1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
19 This option provides the core Cryptographic API.
23 comment "Crypto core or helper"
26 bool "FIPS 200 compliance"
27 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
28 depends on (MODULE_SIG || !MODULES)
30 This option enables the fips boot option which is
31 required if you want the system to operate in a FIPS 200
32 certification. You should say no unless you know what
39 This option provides the API for cryptographic algorithms.
55 config CRYPTO_SKCIPHER
57 select CRYPTO_SKCIPHER2
60 config CRYPTO_SKCIPHER2
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
87 config CRYPTO_AKCIPHER2
91 config CRYPTO_AKCIPHER
93 select CRYPTO_AKCIPHER2
107 select CRYPTO_ALGAPI2
115 config CRYPTO_MANAGER
116 tristate "Cryptographic algorithm manager"
117 select CRYPTO_MANAGER2
119 Create default cryptographic template instantiations such as
122 config CRYPTO_MANAGER2
123 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
126 select CRYPTO_SKCIPHER2
127 select CRYPTO_AKCIPHER2
132 tristate "Userspace cryptographic algorithm configuration"
134 select CRYPTO_MANAGER
136 Userspace configuration for cryptographic instantiations such as
139 config CRYPTO_MANAGER_DISABLE_TESTS
140 bool "Disable run-time self tests"
143 Disable run-time self tests that normally take place at
144 algorithm registration.
146 config CRYPTO_MANAGER_EXTRA_TESTS
147 bool "Enable extra run-time crypto self tests"
148 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
150 Enable extra run-time self tests of registered crypto algorithms,
151 including randomized fuzz tests.
153 This is intended for developer use only, as these tests take much
154 longer to run than the normal self tests.
156 config CRYPTO_GF128MUL
160 tristate "Null algorithms"
163 These are 'Null' algorithms, used by IPsec, which do nothing.
167 select CRYPTO_ALGAPI2
168 select CRYPTO_SKCIPHER2
172 tristate "Parallel crypto engine"
175 select CRYPTO_MANAGER
178 This converts an arbitrary crypto algorithm into a parallel
179 algorithm that executes in kernel threads.
182 tristate "Software async crypto daemon"
183 select CRYPTO_SKCIPHER
185 select CRYPTO_MANAGER
187 This is a generic software asynchronous crypto daemon that
188 converts an arbitrary synchronous software crypto algorithm
189 into an asynchronous algorithm that executes in a kernel thread.
191 config CRYPTO_AUTHENC
192 tristate "Authenc support"
194 select CRYPTO_SKCIPHER
195 select CRYPTO_MANAGER
199 Authenc: Combined mode wrapper for IPsec.
200 This is required for IPSec.
203 tristate "Testing module"
204 depends on m || EXPERT
205 select CRYPTO_MANAGER
207 Quick & dirty crypto test module.
216 comment "Public-key cryptography"
219 tristate "RSA algorithm"
220 select CRYPTO_AKCIPHER
221 select CRYPTO_MANAGER
225 Generic implementation of the RSA public key algorithm.
228 tristate "Diffie-Hellman algorithm"
232 Generic implementation of the Diffie-Hellman algorithm.
238 tristate "ECDH algorithm"
241 select CRYPTO_RNG_DEFAULT
243 Generic implementation of the ECDH algorithm
246 tristate "ECDSA (NIST P192, P256 etc.) algorithm"
248 select CRYPTO_AKCIPHER
251 Elliptic Curve Digital Signature Algorithm (NIST P192, P256 etc.)
252 is A NIST cryptographic standard algorithm. Only signature verification
256 tristate "EC-RDSA (GOST 34.10) algorithm"
258 select CRYPTO_AKCIPHER
259 select CRYPTO_STREEBOG
263 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
264 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
265 standard algorithms (called GOST algorithms). Only signature verification
269 tristate "SM2 algorithm"
271 select CRYPTO_AKCIPHER
272 select CRYPTO_MANAGER
276 Generic implementation of the SM2 public key algorithm. It was
277 published by State Encryption Management Bureau, China.
278 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
281 https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
282 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
283 http://www.gmbz.org.cn/main/bzlb.html
285 config CRYPTO_CURVE25519
286 tristate "Curve25519 algorithm"
288 select CRYPTO_LIB_CURVE25519_GENERIC
290 config CRYPTO_CURVE25519_X86
291 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
292 depends on X86 && 64BIT
293 select CRYPTO_LIB_CURVE25519_GENERIC
294 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
296 comment "Authenticated Encryption with Associated Data"
299 tristate "CCM support"
303 select CRYPTO_MANAGER
305 Support for Counter with CBC MAC. Required for IPsec.
308 tristate "GCM/GMAC support"
313 select CRYPTO_MANAGER
315 Support for Galois/Counter Mode (GCM) and Galois Message
316 Authentication Code (GMAC). Required for IPSec.
318 config CRYPTO_CHACHA20POLY1305
319 tristate "ChaCha20-Poly1305 AEAD support"
320 select CRYPTO_CHACHA20
321 select CRYPTO_POLY1305
323 select CRYPTO_MANAGER
325 ChaCha20-Poly1305 AEAD support, RFC7539.
327 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
328 with the Poly1305 authenticator. It is defined in RFC7539 for use in
331 config CRYPTO_AEGIS128
332 tristate "AEGIS-128 AEAD algorithm"
334 select CRYPTO_AES # for AES S-box tables
336 Support for the AEGIS-128 dedicated AEAD algorithm.
338 config CRYPTO_AEGIS128_SIMD
339 bool "Support SIMD acceleration for AEGIS-128"
340 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
343 config CRYPTO_AEGIS128_AESNI_SSE2
344 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
345 depends on X86 && 64BIT
349 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
352 tristate "Sequence Number IV Generator"
354 select CRYPTO_SKCIPHER
356 select CRYPTO_RNG_DEFAULT
357 select CRYPTO_MANAGER
359 This IV generator generates an IV based on a sequence number by
360 xoring it with a salt. This algorithm is mainly useful for CTR
362 config CRYPTO_ECHAINIV
363 tristate "Encrypted Chain IV Generator"
366 select CRYPTO_RNG_DEFAULT
367 select CRYPTO_MANAGER
369 This IV generator generates an IV based on the encryption of
370 a sequence number xored with a salt. This is the default
373 comment "Block modes"
376 tristate "CBC support"
377 select CRYPTO_SKCIPHER
378 select CRYPTO_MANAGER
380 CBC: Cipher Block Chaining mode
381 This block cipher algorithm is required for IPSec.
384 tristate "CFB support"
385 select CRYPTO_SKCIPHER
386 select CRYPTO_MANAGER
388 CFB: Cipher FeedBack mode
389 This block cipher algorithm is required for TPM2 Cryptography.
392 tristate "CTR support"
393 select CRYPTO_SKCIPHER
394 select CRYPTO_MANAGER
397 This block cipher algorithm is required for IPSec.
400 tristate "CTS support"
401 select CRYPTO_SKCIPHER
402 select CRYPTO_MANAGER
404 CTS: Cipher Text Stealing
405 This is the Cipher Text Stealing mode as described by
406 Section 8 of rfc2040 and referenced by rfc3962
407 (rfc3962 includes errata information in its Appendix A) or
408 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
409 This mode is required for Kerberos gss mechanism support
412 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
415 tristate "ECB support"
416 select CRYPTO_SKCIPHER
417 select CRYPTO_MANAGER
419 ECB: Electronic CodeBook mode
420 This is the simplest block cipher algorithm. It simply encrypts
421 the input block by block.
424 tristate "LRW support"
425 select CRYPTO_SKCIPHER
426 select CRYPTO_MANAGER
427 select CRYPTO_GF128MUL
429 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
430 narrow block cipher mode for dm-crypt. Use it with cipher
431 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
432 The first 128, 192 or 256 bits in the key are used for AES and the
433 rest is used to tie each cipher block to its logical position.
436 tristate "OFB support"
437 select CRYPTO_SKCIPHER
438 select CRYPTO_MANAGER
440 OFB: the Output Feedback mode makes a block cipher into a synchronous
441 stream cipher. It generates keystream blocks, which are then XORed
442 with the plaintext blocks to get the ciphertext. Flipping a bit in the
443 ciphertext produces a flipped bit in the plaintext at the same
444 location. This property allows many error correcting codes to function
445 normally even when applied before encryption.
448 tristate "PCBC support"
449 select CRYPTO_SKCIPHER
450 select CRYPTO_MANAGER
452 PCBC: Propagating Cipher Block Chaining mode
453 This block cipher algorithm is required for RxRPC.
456 tristate "XTS support"
457 select CRYPTO_SKCIPHER
458 select CRYPTO_MANAGER
461 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
462 key size 256, 384 or 512 bits. This implementation currently
463 can't handle a sectorsize which is not a multiple of 16 bytes.
465 config CRYPTO_KEYWRAP
466 tristate "Key wrapping support"
467 select CRYPTO_SKCIPHER
468 select CRYPTO_MANAGER
470 Support for key wrapping (NIST SP800-38F / RFC3394) without
473 config CRYPTO_NHPOLY1305
476 select CRYPTO_LIB_POLY1305_GENERIC
478 config CRYPTO_NHPOLY1305_SSE2
479 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
480 depends on X86 && 64BIT
481 select CRYPTO_NHPOLY1305
483 SSE2 optimized implementation of the hash function used by the
484 Adiantum encryption mode.
486 config CRYPTO_NHPOLY1305_AVX2
487 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
488 depends on X86 && 64BIT
489 select CRYPTO_NHPOLY1305
491 AVX2 optimized implementation of the hash function used by the
492 Adiantum encryption mode.
494 config CRYPTO_ADIANTUM
495 tristate "Adiantum support"
496 select CRYPTO_CHACHA20
497 select CRYPTO_LIB_POLY1305_GENERIC
498 select CRYPTO_NHPOLY1305
499 select CRYPTO_MANAGER
501 Adiantum is a tweakable, length-preserving encryption mode
502 designed for fast and secure disk encryption, especially on
503 CPUs without dedicated crypto instructions. It encrypts
504 each sector using the XChaCha12 stream cipher, two passes of
505 an ε-almost-∆-universal hash function, and an invocation of
506 the AES-256 block cipher on a single 16-byte block. On CPUs
507 without AES instructions, Adiantum is much faster than
510 Adiantum's security is provably reducible to that of its
511 underlying stream and block ciphers, subject to a security
512 bound. Unlike XTS, Adiantum is a true wide-block encryption
513 mode, so it actually provides an even stronger notion of
514 security than XTS, subject to the security bound.
519 tristate "ESSIV support for block encryption"
520 select CRYPTO_AUTHENC
522 Encrypted salt-sector initialization vector (ESSIV) is an IV
523 generation method that is used in some cases by fscrypt and/or
524 dm-crypt. It uses the hash of the block encryption key as the
525 symmetric key for a block encryption pass applied to the input
526 IV, making low entropy IV sources more suitable for block
529 This driver implements a crypto API template that can be
530 instantiated either as an skcipher or as an AEAD (depending on the
531 type of the first template argument), and which defers encryption
532 and decryption requests to the encapsulated cipher after applying
533 ESSIV to the input IV. Note that in the AEAD case, it is assumed
534 that the keys are presented in the same format used by the authenc
535 template, and that the IV appears at the end of the authenticated
536 associated data (AAD) region (which is how dm-crypt uses it.)
538 Note that the use of ESSIV is not recommended for new deployments,
539 and so this only needs to be enabled when interoperability with
540 existing encrypted volumes of filesystems is required, or when
541 building for a particular system that requires it (e.g., when
542 the SoC in question has accelerated CBC but not XTS, making CBC
543 combined with ESSIV the only feasible mode for h/w accelerated
549 tristate "CMAC support"
551 select CRYPTO_MANAGER
553 Cipher-based Message Authentication Code (CMAC) specified by
554 The National Institute of Standards and Technology (NIST).
556 https://tools.ietf.org/html/rfc4493
557 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
560 tristate "HMAC support"
562 select CRYPTO_MANAGER
564 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
565 This is required for IPSec.
568 tristate "XCBC support"
570 select CRYPTO_MANAGER
572 XCBC: Keyed-Hashing with encryption algorithm
573 https://www.ietf.org/rfc/rfc3566.txt
574 http://csrc.nist.gov/encryption/modes/proposedmodes/
575 xcbc-mac/xcbc-mac-spec.pdf
578 tristate "VMAC support"
580 select CRYPTO_MANAGER
582 VMAC is a message authentication algorithm designed for
583 very high speed on 64-bit architectures.
586 <https://fastcrypto.org/vmac>
591 tristate "CRC32c CRC algorithm"
595 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
596 by iSCSI for header and data digests and by others.
597 See Castagnoli93. Module will be crc32c.
599 config CRYPTO_CRC32C_INTEL
600 tristate "CRC32c INTEL hardware acceleration"
604 In Intel processor with SSE4.2 supported, the processor will
605 support CRC32C implementation using hardware accelerated CRC32
606 instruction. This option will create 'crc32c-intel' module,
607 which will enable any routine to use the CRC32 instruction to
608 gain performance compared with software implementation.
609 Module will be crc32c-intel.
611 config CRYPTO_CRC32C_VPMSUM
612 tristate "CRC32c CRC algorithm (powerpc64)"
613 depends on PPC64 && ALTIVEC
617 CRC32c algorithm implemented using vector polynomial multiply-sum
618 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
619 and newer processors for improved performance.
622 config CRYPTO_CRC32C_SPARC64
623 tristate "CRC32c CRC algorithm (SPARC64)"
628 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
632 tristate "CRC32 CRC algorithm"
636 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
637 Shash crypto api wrappers to crc32_le function.
639 config CRYPTO_CRC32_PCLMUL
640 tristate "CRC32 PCLMULQDQ hardware acceleration"
645 From Intel Westmere and AMD Bulldozer processor with SSE4.2
646 and PCLMULQDQ supported, the processor will support
647 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
648 instruction. This option will create 'crc32-pclmul' module,
649 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
650 and gain better performance as compared with the table implementation.
652 config CRYPTO_CRC32_MIPS
653 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
654 depends on MIPS_CRC_SUPPORT
657 CRC32c and CRC32 CRC algorithms implemented using mips crypto
658 instructions, when available.
662 tristate "xxHash hash algorithm"
666 xxHash non-cryptographic hash algorithm. Extremely fast, working at
667 speeds close to RAM limits.
669 config CRYPTO_BLAKE2B
670 tristate "BLAKE2b digest algorithm"
673 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
674 optimized for 64bit platforms and can produce digests of any size
675 between 1 to 64. The keyed hash is also implemented.
677 This module provides the following algorithms:
684 See https://blake2.net for further information.
686 config CRYPTO_BLAKE2S
687 tristate "BLAKE2s digest algorithm"
688 select CRYPTO_LIB_BLAKE2S_GENERIC
691 Implementation of cryptographic hash function BLAKE2s
692 optimized for 8-32bit platforms and can produce digests of any size
693 between 1 to 32. The keyed hash is also implemented.
695 This module provides the following algorithms:
702 See https://blake2.net for further information.
704 config CRYPTO_BLAKE2S_X86
705 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
706 depends on X86 && 64BIT
707 select CRYPTO_LIB_BLAKE2S_GENERIC
708 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
710 config CRYPTO_CRCT10DIF
711 tristate "CRCT10DIF algorithm"
714 CRC T10 Data Integrity Field computation is being cast as
715 a crypto transform. This allows for faster crc t10 diff
716 transforms to be used if they are available.
718 config CRYPTO_CRCT10DIF_PCLMUL
719 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
720 depends on X86 && 64BIT && CRC_T10DIF
723 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
724 CRC T10 DIF PCLMULQDQ computation can be hardware
725 accelerated PCLMULQDQ instruction. This option will create
726 'crct10dif-pclmul' module, which is faster when computing the
727 crct10dif checksum as compared with the generic table implementation.
729 config CRYPTO_CRCT10DIF_VPMSUM
730 tristate "CRC32T10DIF powerpc64 hardware acceleration"
731 depends on PPC64 && ALTIVEC && CRC_T10DIF
734 CRC10T10DIF algorithm implemented using vector polynomial
735 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
736 POWER8 and newer processors for improved performance.
738 config CRYPTO_VPMSUM_TESTER
739 tristate "Powerpc64 vpmsum hardware acceleration tester"
740 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
742 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
743 POWER8 vpmsum instructions.
744 Unless you are testing these algorithms, you don't need this.
747 tristate "GHASH hash function"
748 select CRYPTO_GF128MUL
751 GHASH is the hash function used in GCM (Galois/Counter Mode).
752 It is not a general-purpose cryptographic hash function.
754 config CRYPTO_POLY1305
755 tristate "Poly1305 authenticator algorithm"
757 select CRYPTO_LIB_POLY1305_GENERIC
759 Poly1305 authenticator algorithm, RFC7539.
761 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
762 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
763 in IETF protocols. This is the portable C implementation of Poly1305.
765 config CRYPTO_POLY1305_X86_64
766 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
767 depends on X86 && 64BIT
768 select CRYPTO_LIB_POLY1305_GENERIC
769 select CRYPTO_ARCH_HAVE_LIB_POLY1305
771 Poly1305 authenticator algorithm, RFC7539.
773 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
774 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
775 in IETF protocols. This is the x86_64 assembler implementation using SIMD
778 config CRYPTO_POLY1305_MIPS
779 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
780 depends on CPU_MIPS32 || (CPU_MIPS64 && 64BIT)
781 select CRYPTO_ARCH_HAVE_LIB_POLY1305
784 tristate "MD4 digest algorithm"
787 MD4 message digest algorithm (RFC1320).
790 tristate "MD5 digest algorithm"
793 MD5 message digest algorithm (RFC1321).
795 config CRYPTO_MD5_OCTEON
796 tristate "MD5 digest algorithm (OCTEON)"
797 depends on CPU_CAVIUM_OCTEON
801 MD5 message digest algorithm (RFC1321) implemented
802 using OCTEON crypto instructions, when available.
804 config CRYPTO_MD5_PPC
805 tristate "MD5 digest algorithm (PPC)"
809 MD5 message digest algorithm (RFC1321) implemented
812 config CRYPTO_MD5_SPARC64
813 tristate "MD5 digest algorithm (SPARC64)"
818 MD5 message digest algorithm (RFC1321) implemented
819 using sparc64 crypto instructions, when available.
821 config CRYPTO_MICHAEL_MIC
822 tristate "Michael MIC keyed digest algorithm"
825 Michael MIC is used for message integrity protection in TKIP
826 (IEEE 802.11i). This algorithm is required for TKIP, but it
827 should not be used for other purposes because of the weakness
831 tristate "RIPEMD-160 digest algorithm"
834 RIPEMD-160 (ISO/IEC 10118-3:2004).
836 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
837 to be used as a secure replacement for the 128-bit hash functions
838 MD4, MD5 and it's predecessor RIPEMD
839 (not to be confused with RIPEMD-128).
841 It's speed is comparable to SHA1 and there are no known attacks
844 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
845 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
848 tristate "SHA1 digest algorithm"
851 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
853 config CRYPTO_SHA1_SSSE3
854 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
855 depends on X86 && 64BIT
859 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
860 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
861 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
864 config CRYPTO_SHA256_SSSE3
865 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
866 depends on X86 && 64BIT
870 SHA-256 secure hash standard (DFIPS 180-2) implemented
871 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
872 Extensions version 1 (AVX1), or Advanced Vector Extensions
873 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
874 Instructions) when available.
876 config CRYPTO_SHA512_SSSE3
877 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
878 depends on X86 && 64BIT
882 SHA-512 secure hash standard (DFIPS 180-2) implemented
883 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
884 Extensions version 1 (AVX1), or Advanced Vector Extensions
885 version 2 (AVX2) instructions, when available.
887 config CRYPTO_SHA1_OCTEON
888 tristate "SHA1 digest algorithm (OCTEON)"
889 depends on CPU_CAVIUM_OCTEON
893 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
894 using OCTEON crypto instructions, when available.
896 config CRYPTO_SHA1_SPARC64
897 tristate "SHA1 digest algorithm (SPARC64)"
902 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
903 using sparc64 crypto instructions, when available.
905 config CRYPTO_SHA1_PPC
906 tristate "SHA1 digest algorithm (powerpc)"
909 This is the powerpc hardware accelerated implementation of the
910 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
912 config CRYPTO_SHA1_PPC_SPE
913 tristate "SHA1 digest algorithm (PPC SPE)"
914 depends on PPC && SPE
916 SHA-1 secure hash standard (DFIPS 180-4) implemented
917 using powerpc SPE SIMD instruction set.
920 tristate "SHA224 and SHA256 digest algorithm"
922 select CRYPTO_LIB_SHA256
924 SHA256 secure hash standard (DFIPS 180-2).
926 This version of SHA implements a 256 bit hash with 128 bits of
927 security against collision attacks.
929 This code also includes SHA-224, a 224 bit hash with 112 bits
930 of security against collision attacks.
932 config CRYPTO_SHA256_PPC_SPE
933 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
934 depends on PPC && SPE
938 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
939 implemented using powerpc SPE SIMD instruction set.
941 config CRYPTO_SHA256_OCTEON
942 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
943 depends on CPU_CAVIUM_OCTEON
947 SHA-256 secure hash standard (DFIPS 180-2) implemented
948 using OCTEON crypto instructions, when available.
950 config CRYPTO_SHA256_SPARC64
951 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
956 SHA-256 secure hash standard (DFIPS 180-2) implemented
957 using sparc64 crypto instructions, when available.
960 tristate "SHA384 and SHA512 digest algorithms"
963 SHA512 secure hash standard (DFIPS 180-2).
965 This version of SHA implements a 512 bit hash with 256 bits of
966 security against collision attacks.
968 This code also includes SHA-384, a 384 bit hash with 192 bits
969 of security against collision attacks.
971 config CRYPTO_SHA512_OCTEON
972 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
973 depends on CPU_CAVIUM_OCTEON
977 SHA-512 secure hash standard (DFIPS 180-2) implemented
978 using OCTEON crypto instructions, when available.
980 config CRYPTO_SHA512_SPARC64
981 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
986 SHA-512 secure hash standard (DFIPS 180-2) implemented
987 using sparc64 crypto instructions, when available.
990 tristate "SHA3 digest algorithm"
993 SHA-3 secure hash standard (DFIPS 202). It's based on
994 cryptographic sponge function family called Keccak.
997 http://keccak.noekeon.org/
1000 tristate "SM3 digest algorithm"
1003 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1004 It is part of the Chinese Commercial Cryptography suite.
1007 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1008 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1010 config CRYPTO_STREEBOG
1011 tristate "Streebog Hash Function"
1014 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1015 cryptographic standard algorithms (called GOST algorithms).
1016 This setting enables two hash algorithms with 256 and 512 bits output.
1019 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1020 https://tools.ietf.org/html/rfc6986
1023 tristate "Whirlpool digest algorithms"
1026 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1028 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1029 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1032 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1034 config CRYPTO_GHASH_CLMUL_NI_INTEL
1035 tristate "GHASH hash function (CLMUL-NI accelerated)"
1036 depends on X86 && 64BIT
1037 select CRYPTO_CRYPTD
1039 This is the x86_64 CLMUL-NI accelerated implementation of
1040 GHASH, the hash function used in GCM (Galois/Counter mode).
1045 tristate "AES cipher algorithms"
1046 select CRYPTO_ALGAPI
1047 select CRYPTO_LIB_AES
1049 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1052 Rijndael appears to be consistently a very good performer in
1053 both hardware and software across a wide range of computing
1054 environments regardless of its use in feedback or non-feedback
1055 modes. Its key setup time is excellent, and its key agility is
1056 good. Rijndael's very low memory requirements make it very well
1057 suited for restricted-space environments, in which it also
1058 demonstrates excellent performance. Rijndael's operations are
1059 among the easiest to defend against power and timing attacks.
1061 The AES specifies three key sizes: 128, 192 and 256 bits
1063 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1065 config CRYPTO_AES_TI
1066 tristate "Fixed time AES cipher"
1067 select CRYPTO_ALGAPI
1068 select CRYPTO_LIB_AES
1070 This is a generic implementation of AES that attempts to eliminate
1071 data dependent latencies as much as possible without affecting
1072 performance too much. It is intended for use by the generic CCM
1073 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1074 solely on encryption (although decryption is supported as well, but
1075 with a more dramatic performance hit)
1077 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1078 8 for decryption), this implementation only uses just two S-boxes of
1079 256 bytes each, and attempts to eliminate data dependent latencies by
1080 prefetching the entire table into the cache at the start of each
1081 block. Interrupts are also disabled to avoid races where cachelines
1082 are evicted when the CPU is interrupted to do something else.
1084 config CRYPTO_AES_NI_INTEL
1085 tristate "AES cipher algorithms (AES-NI)"
1088 select CRYPTO_LIB_AES
1089 select CRYPTO_ALGAPI
1090 select CRYPTO_SKCIPHER
1093 Use Intel AES-NI instructions for AES algorithm.
1095 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1098 Rijndael appears to be consistently a very good performer in
1099 both hardware and software across a wide range of computing
1100 environments regardless of its use in feedback or non-feedback
1101 modes. Its key setup time is excellent, and its key agility is
1102 good. Rijndael's very low memory requirements make it very well
1103 suited for restricted-space environments, in which it also
1104 demonstrates excellent performance. Rijndael's operations are
1105 among the easiest to defend against power and timing attacks.
1107 The AES specifies three key sizes: 128, 192 and 256 bits
1109 See <http://csrc.nist.gov/encryption/aes/> for more information.
1111 In addition to AES cipher algorithm support, the acceleration
1112 for some popular block cipher mode is supported too, including
1113 ECB, CBC, LRW, XTS. The 64 bit version has additional
1114 acceleration for CTR.
1116 config CRYPTO_AES_SPARC64
1117 tristate "AES cipher algorithms (SPARC64)"
1119 select CRYPTO_SKCIPHER
1121 Use SPARC64 crypto opcodes for AES algorithm.
1123 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1126 Rijndael appears to be consistently a very good performer in
1127 both hardware and software across a wide range of computing
1128 environments regardless of its use in feedback or non-feedback
1129 modes. Its key setup time is excellent, and its key agility is
1130 good. Rijndael's very low memory requirements make it very well
1131 suited for restricted-space environments, in which it also
1132 demonstrates excellent performance. Rijndael's operations are
1133 among the easiest to defend against power and timing attacks.
1135 The AES specifies three key sizes: 128, 192 and 256 bits
1137 See <http://csrc.nist.gov/encryption/aes/> for more information.
1139 In addition to AES cipher algorithm support, the acceleration
1140 for some popular block cipher mode is supported too, including
1143 config CRYPTO_AES_PPC_SPE
1144 tristate "AES cipher algorithms (PPC SPE)"
1145 depends on PPC && SPE
1146 select CRYPTO_SKCIPHER
1148 AES cipher algorithms (FIPS-197). Additionally the acceleration
1149 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1150 This module should only be used for low power (router) devices
1151 without hardware AES acceleration (e.g. caam crypto). It reduces the
1152 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1153 timining attacks. Nevertheless it might be not as secure as other
1154 architecture specific assembler implementations that work on 1KB
1155 tables or 256 bytes S-boxes.
1157 config CRYPTO_ANUBIS
1158 tristate "Anubis cipher algorithm"
1159 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1160 select CRYPTO_ALGAPI
1162 Anubis cipher algorithm.
1164 Anubis is a variable key length cipher which can use keys from
1165 128 bits to 320 bits in length. It was evaluated as a entrant
1166 in the NESSIE competition.
1169 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1170 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1173 tristate "ARC4 cipher algorithm"
1174 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1175 select CRYPTO_SKCIPHER
1176 select CRYPTO_LIB_ARC4
1178 ARC4 cipher algorithm.
1180 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1181 bits in length. This algorithm is required for driver-based
1182 WEP, but it should not be for other purposes because of the
1183 weakness of the algorithm.
1185 config CRYPTO_BLOWFISH
1186 tristate "Blowfish cipher algorithm"
1187 select CRYPTO_ALGAPI
1188 select CRYPTO_BLOWFISH_COMMON
1190 Blowfish cipher algorithm, by Bruce Schneier.
1192 This is a variable key length cipher which can use keys from 32
1193 bits to 448 bits in length. It's fast, simple and specifically
1194 designed for use on "large microprocessors".
1197 <https://www.schneier.com/blowfish.html>
1199 config CRYPTO_BLOWFISH_COMMON
1202 Common parts of the Blowfish cipher algorithm shared by the
1203 generic c and the assembler implementations.
1206 <https://www.schneier.com/blowfish.html>
1208 config CRYPTO_BLOWFISH_X86_64
1209 tristate "Blowfish cipher algorithm (x86_64)"
1210 depends on X86 && 64BIT
1211 select CRYPTO_SKCIPHER
1212 select CRYPTO_BLOWFISH_COMMON
1215 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1217 This is a variable key length cipher which can use keys from 32
1218 bits to 448 bits in length. It's fast, simple and specifically
1219 designed for use on "large microprocessors".
1222 <https://www.schneier.com/blowfish.html>
1224 config CRYPTO_CAMELLIA
1225 tristate "Camellia cipher algorithms"
1227 select CRYPTO_ALGAPI
1229 Camellia cipher algorithms module.
1231 Camellia is a symmetric key block cipher developed jointly
1232 at NTT and Mitsubishi Electric Corporation.
1234 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1237 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1239 config CRYPTO_CAMELLIA_X86_64
1240 tristate "Camellia cipher algorithm (x86_64)"
1241 depends on X86 && 64BIT
1243 select CRYPTO_SKCIPHER
1246 Camellia cipher algorithm module (x86_64).
1248 Camellia is a symmetric key block cipher developed jointly
1249 at NTT and Mitsubishi Electric Corporation.
1251 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1254 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1256 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1257 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1258 depends on X86 && 64BIT
1260 select CRYPTO_SKCIPHER
1261 select CRYPTO_CAMELLIA_X86_64
1265 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1267 Camellia is a symmetric key block cipher developed jointly
1268 at NTT and Mitsubishi Electric Corporation.
1270 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1273 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1275 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1276 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1277 depends on X86 && 64BIT
1279 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1281 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1283 Camellia is a symmetric key block cipher developed jointly
1284 at NTT and Mitsubishi Electric Corporation.
1286 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1289 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1291 config CRYPTO_CAMELLIA_SPARC64
1292 tristate "Camellia cipher algorithm (SPARC64)"
1295 select CRYPTO_ALGAPI
1296 select CRYPTO_SKCIPHER
1298 Camellia cipher algorithm module (SPARC64).
1300 Camellia is a symmetric key block cipher developed jointly
1301 at NTT and Mitsubishi Electric Corporation.
1303 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1306 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1308 config CRYPTO_CAST_COMMON
1311 Common parts of the CAST cipher algorithms shared by the
1312 generic c and the assembler implementations.
1315 tristate "CAST5 (CAST-128) cipher algorithm"
1316 select CRYPTO_ALGAPI
1317 select CRYPTO_CAST_COMMON
1319 The CAST5 encryption algorithm (synonymous with CAST-128) is
1320 described in RFC2144.
1322 config CRYPTO_CAST5_AVX_X86_64
1323 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1324 depends on X86 && 64BIT
1325 select CRYPTO_SKCIPHER
1327 select CRYPTO_CAST_COMMON
1331 The CAST5 encryption algorithm (synonymous with CAST-128) is
1332 described in RFC2144.
1334 This module provides the Cast5 cipher algorithm that processes
1335 sixteen blocks parallel using the AVX instruction set.
1338 tristate "CAST6 (CAST-256) cipher algorithm"
1339 select CRYPTO_ALGAPI
1340 select CRYPTO_CAST_COMMON
1342 The CAST6 encryption algorithm (synonymous with CAST-256) is
1343 described in RFC2612.
1345 config CRYPTO_CAST6_AVX_X86_64
1346 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1347 depends on X86 && 64BIT
1348 select CRYPTO_SKCIPHER
1350 select CRYPTO_CAST_COMMON
1355 The CAST6 encryption algorithm (synonymous with CAST-256) is
1356 described in RFC2612.
1358 This module provides the Cast6 cipher algorithm that processes
1359 eight blocks parallel using the AVX instruction set.
1362 tristate "DES and Triple DES EDE cipher algorithms"
1363 select CRYPTO_ALGAPI
1364 select CRYPTO_LIB_DES
1366 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1368 config CRYPTO_DES_SPARC64
1369 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1371 select CRYPTO_ALGAPI
1372 select CRYPTO_LIB_DES
1373 select CRYPTO_SKCIPHER
1375 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1376 optimized using SPARC64 crypto opcodes.
1378 config CRYPTO_DES3_EDE_X86_64
1379 tristate "Triple DES EDE cipher algorithm (x86-64)"
1380 depends on X86 && 64BIT
1381 select CRYPTO_SKCIPHER
1382 select CRYPTO_LIB_DES
1385 Triple DES EDE (FIPS 46-3) algorithm.
1387 This module provides implementation of the Triple DES EDE cipher
1388 algorithm that is optimized for x86-64 processors. Two versions of
1389 algorithm are provided; regular processing one input block and
1390 one that processes three blocks parallel.
1392 config CRYPTO_FCRYPT
1393 tristate "FCrypt cipher algorithm"
1394 select CRYPTO_ALGAPI
1395 select CRYPTO_SKCIPHER
1397 FCrypt algorithm used by RxRPC.
1399 config CRYPTO_KHAZAD
1400 tristate "Khazad cipher algorithm"
1401 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1402 select CRYPTO_ALGAPI
1404 Khazad cipher algorithm.
1406 Khazad was a finalist in the initial NESSIE competition. It is
1407 an algorithm optimized for 64-bit processors with good performance
1408 on 32-bit processors. Khazad uses an 128 bit key size.
1411 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1413 config CRYPTO_CHACHA20
1414 tristate "ChaCha stream cipher algorithms"
1415 select CRYPTO_LIB_CHACHA_GENERIC
1416 select CRYPTO_SKCIPHER
1418 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1420 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1421 Bernstein and further specified in RFC7539 for use in IETF protocols.
1422 This is the portable C implementation of ChaCha20. See also:
1423 <https://cr.yp.to/chacha/chacha-20080128.pdf>
1425 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1426 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1427 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1428 while provably retaining ChaCha20's security. See also:
1429 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1431 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1432 reduced security margin but increased performance. It can be needed
1433 in some performance-sensitive scenarios.
1435 config CRYPTO_CHACHA20_X86_64
1436 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1437 depends on X86 && 64BIT
1438 select CRYPTO_SKCIPHER
1439 select CRYPTO_LIB_CHACHA_GENERIC
1440 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1442 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1443 XChaCha20, and XChaCha12 stream ciphers.
1445 config CRYPTO_CHACHA_MIPS
1446 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1447 depends on CPU_MIPS32_R2
1448 select CRYPTO_SKCIPHER
1449 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1452 tristate "SEED cipher algorithm"
1453 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1454 select CRYPTO_ALGAPI
1456 SEED cipher algorithm (RFC4269).
1458 SEED is a 128-bit symmetric key block cipher that has been
1459 developed by KISA (Korea Information Security Agency) as a
1460 national standard encryption algorithm of the Republic of Korea.
1461 It is a 16 round block cipher with the key size of 128 bit.
1464 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1466 config CRYPTO_SERPENT
1467 tristate "Serpent cipher algorithm"
1468 select CRYPTO_ALGAPI
1470 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1472 Keys are allowed to be from 0 to 256 bits in length, in steps
1476 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1478 config CRYPTO_SERPENT_SSE2_X86_64
1479 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1480 depends on X86 && 64BIT
1481 select CRYPTO_SKCIPHER
1482 select CRYPTO_SERPENT
1486 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1488 Keys are allowed to be from 0 to 256 bits in length, in steps
1491 This module provides Serpent cipher algorithm that processes eight
1492 blocks parallel using SSE2 instruction set.
1495 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1497 config CRYPTO_SERPENT_SSE2_586
1498 tristate "Serpent cipher algorithm (i586/SSE2)"
1499 depends on X86 && !64BIT
1500 select CRYPTO_SKCIPHER
1501 select CRYPTO_SERPENT
1505 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1507 Keys are allowed to be from 0 to 256 bits in length, in steps
1510 This module provides Serpent cipher algorithm that processes four
1511 blocks parallel using SSE2 instruction set.
1514 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1516 config CRYPTO_SERPENT_AVX_X86_64
1517 tristate "Serpent cipher algorithm (x86_64/AVX)"
1518 depends on X86 && 64BIT
1519 select CRYPTO_SKCIPHER
1520 select CRYPTO_SERPENT
1525 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1527 Keys are allowed to be from 0 to 256 bits in length, in steps
1530 This module provides the Serpent cipher algorithm that processes
1531 eight blocks parallel using the AVX instruction set.
1534 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1536 config CRYPTO_SERPENT_AVX2_X86_64
1537 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1538 depends on X86 && 64BIT
1539 select CRYPTO_SERPENT_AVX_X86_64
1541 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1543 Keys are allowed to be from 0 to 256 bits in length, in steps
1546 This module provides Serpent cipher algorithm that processes 16
1547 blocks parallel using AVX2 instruction set.
1550 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1553 tristate "SM4 cipher algorithm"
1554 select CRYPTO_ALGAPI
1556 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1558 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1559 Organization of State Commercial Administration of China (OSCCA)
1560 as an authorized cryptographic algorithms for the use within China.
1562 SMS4 was originally created for use in protecting wireless
1563 networks, and is mandated in the Chinese National Standard for
1564 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1567 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1568 standardized through TC 260 of the Standardization Administration
1569 of the People's Republic of China (SAC).
1571 The input, output, and key of SMS4 are each 128 bits.
1573 See also: <https://eprint.iacr.org/2008/329.pdf>
1578 tristate "TEA, XTEA and XETA cipher algorithms"
1579 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1580 select CRYPTO_ALGAPI
1582 TEA cipher algorithm.
1584 Tiny Encryption Algorithm is a simple cipher that uses
1585 many rounds for security. It is very fast and uses
1588 Xtendend Tiny Encryption Algorithm is a modification to
1589 the TEA algorithm to address a potential key weakness
1590 in the TEA algorithm.
1592 Xtendend Encryption Tiny Algorithm is a mis-implementation
1593 of the XTEA algorithm for compatibility purposes.
1595 config CRYPTO_TWOFISH
1596 tristate "Twofish cipher algorithm"
1597 select CRYPTO_ALGAPI
1598 select CRYPTO_TWOFISH_COMMON
1600 Twofish cipher algorithm.
1602 Twofish was submitted as an AES (Advanced Encryption Standard)
1603 candidate cipher by researchers at CounterPane Systems. It is a
1604 16 round block cipher supporting key sizes of 128, 192, and 256
1608 <https://www.schneier.com/twofish.html>
1610 config CRYPTO_TWOFISH_COMMON
1613 Common parts of the Twofish cipher algorithm shared by the
1614 generic c and the assembler implementations.
1616 config CRYPTO_TWOFISH_586
1617 tristate "Twofish cipher algorithms (i586)"
1618 depends on (X86 || UML_X86) && !64BIT
1619 select CRYPTO_ALGAPI
1620 select CRYPTO_TWOFISH_COMMON
1623 Twofish cipher algorithm.
1625 Twofish was submitted as an AES (Advanced Encryption Standard)
1626 candidate cipher by researchers at CounterPane Systems. It is a
1627 16 round block cipher supporting key sizes of 128, 192, and 256
1631 <https://www.schneier.com/twofish.html>
1633 config CRYPTO_TWOFISH_X86_64
1634 tristate "Twofish cipher algorithm (x86_64)"
1635 depends on (X86 || UML_X86) && 64BIT
1636 select CRYPTO_ALGAPI
1637 select CRYPTO_TWOFISH_COMMON
1640 Twofish cipher algorithm (x86_64).
1642 Twofish was submitted as an AES (Advanced Encryption Standard)
1643 candidate cipher by researchers at CounterPane Systems. It is a
1644 16 round block cipher supporting key sizes of 128, 192, and 256
1648 <https://www.schneier.com/twofish.html>
1650 config CRYPTO_TWOFISH_X86_64_3WAY
1651 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1652 depends on X86 && 64BIT
1653 select CRYPTO_SKCIPHER
1654 select CRYPTO_TWOFISH_COMMON
1655 select CRYPTO_TWOFISH_X86_64
1657 Twofish cipher algorithm (x86_64, 3-way parallel).
1659 Twofish was submitted as an AES (Advanced Encryption Standard)
1660 candidate cipher by researchers at CounterPane Systems. It is a
1661 16 round block cipher supporting key sizes of 128, 192, and 256
1664 This module provides Twofish cipher algorithm that processes three
1665 blocks parallel, utilizing resources of out-of-order CPUs better.
1668 <https://www.schneier.com/twofish.html>
1670 config CRYPTO_TWOFISH_AVX_X86_64
1671 tristate "Twofish cipher algorithm (x86_64/AVX)"
1672 depends on X86 && 64BIT
1673 select CRYPTO_SKCIPHER
1675 select CRYPTO_TWOFISH_COMMON
1676 select CRYPTO_TWOFISH_X86_64
1677 select CRYPTO_TWOFISH_X86_64_3WAY
1680 Twofish cipher algorithm (x86_64/AVX).
1682 Twofish was submitted as an AES (Advanced Encryption Standard)
1683 candidate cipher by researchers at CounterPane Systems. It is a
1684 16 round block cipher supporting key sizes of 128, 192, and 256
1687 This module provides the Twofish cipher algorithm that processes
1688 eight blocks parallel using the AVX Instruction Set.
1691 <https://www.schneier.com/twofish.html>
1693 comment "Compression"
1695 config CRYPTO_DEFLATE
1696 tristate "Deflate compression algorithm"
1697 select CRYPTO_ALGAPI
1698 select CRYPTO_ACOMP2
1702 This is the Deflate algorithm (RFC1951), specified for use in
1703 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1705 You will most probably want this if using IPSec.
1708 tristate "LZO compression algorithm"
1709 select CRYPTO_ALGAPI
1710 select CRYPTO_ACOMP2
1712 select LZO_DECOMPRESS
1714 This is the LZO algorithm.
1717 tristate "842 compression algorithm"
1718 select CRYPTO_ALGAPI
1719 select CRYPTO_ACOMP2
1721 select 842_DECOMPRESS
1723 This is the 842 algorithm.
1726 tristate "LZ4 compression algorithm"
1727 select CRYPTO_ALGAPI
1728 select CRYPTO_ACOMP2
1730 select LZ4_DECOMPRESS
1732 This is the LZ4 algorithm.
1735 tristate "LZ4HC compression algorithm"
1736 select CRYPTO_ALGAPI
1737 select CRYPTO_ACOMP2
1738 select LZ4HC_COMPRESS
1739 select LZ4_DECOMPRESS
1741 This is the LZ4 high compression mode algorithm.
1744 tristate "Zstd compression algorithm"
1745 select CRYPTO_ALGAPI
1746 select CRYPTO_ACOMP2
1747 select ZSTD_COMPRESS
1748 select ZSTD_DECOMPRESS
1750 This is the zstd algorithm.
1752 comment "Random Number Generation"
1754 config CRYPTO_ANSI_CPRNG
1755 tristate "Pseudo Random Number Generation for Cryptographic modules"
1759 This option enables the generic pseudo random number generator
1760 for cryptographic modules. Uses the Algorithm specified in
1761 ANSI X9.31 A.2.4. Note that this option must be enabled if
1762 CRYPTO_FIPS is selected
1764 menuconfig CRYPTO_DRBG_MENU
1765 tristate "NIST SP800-90A DRBG"
1767 NIST SP800-90A compliant DRBG. In the following submenu, one or
1768 more of the DRBG types must be selected.
1772 config CRYPTO_DRBG_HMAC
1776 select CRYPTO_SHA256
1778 config CRYPTO_DRBG_HASH
1779 bool "Enable Hash DRBG"
1780 select CRYPTO_SHA256
1782 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1784 config CRYPTO_DRBG_CTR
1785 bool "Enable CTR DRBG"
1789 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1793 default CRYPTO_DRBG_MENU
1795 select CRYPTO_JITTERENTROPY
1797 endif # if CRYPTO_DRBG_MENU
1799 config CRYPTO_JITTERENTROPY
1800 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1803 The Jitterentropy RNG is a noise that is intended
1804 to provide seed to another RNG. The RNG does not
1805 perform any cryptographic whitening of the generated
1806 random numbers. This Jitterentropy RNG registers with
1807 the kernel crypto API and can be used by any caller.
1809 config CRYPTO_USER_API
1812 config CRYPTO_USER_API_HASH
1813 tristate "User-space interface for hash algorithms"
1816 select CRYPTO_USER_API
1818 This option enables the user-spaces interface for hash
1821 config CRYPTO_USER_API_SKCIPHER
1822 tristate "User-space interface for symmetric key cipher algorithms"
1824 select CRYPTO_SKCIPHER
1825 select CRYPTO_USER_API
1827 This option enables the user-spaces interface for symmetric
1828 key cipher algorithms.
1830 config CRYPTO_USER_API_RNG
1831 tristate "User-space interface for random number generator algorithms"
1834 select CRYPTO_USER_API
1836 This option enables the user-spaces interface for random
1837 number generator algorithms.
1839 config CRYPTO_USER_API_RNG_CAVP
1840 bool "Enable CAVP testing of DRBG"
1841 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1843 This option enables extra API for CAVP testing via the user-space
1844 interface: resetting of DRBG entropy, and providing Additional Data.
1845 This should only be enabled for CAVP testing. You should say
1846 no unless you know what this is.
1848 config CRYPTO_USER_API_AEAD
1849 tristate "User-space interface for AEAD cipher algorithms"
1852 select CRYPTO_SKCIPHER
1854 select CRYPTO_USER_API
1856 This option enables the user-spaces interface for AEAD
1859 config CRYPTO_USER_API_ENABLE_OBSOLETE
1860 bool "Enable obsolete cryptographic algorithms for userspace"
1861 depends on CRYPTO_USER_API
1864 Allow obsolete cryptographic algorithms to be selected that have
1865 already been phased out from internal use by the kernel, and are
1866 only useful for userspace clients that still rely on them.
1869 bool "Crypto usage statistics for User-space"
1870 depends on CRYPTO_USER
1872 This option enables the gathering of crypto stats.
1874 - encrypt/decrypt size and numbers of symmeric operations
1875 - compress/decompress size and numbers of compress operations
1876 - size and numbers of hash operations
1877 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1878 - generate/seed numbers for rng operations
1880 config CRYPTO_HASH_INFO
1883 source "lib/crypto/Kconfig"
1884 source "drivers/crypto/Kconfig"
1885 source "crypto/asymmetric_keys/Kconfig"
1886 source "certs/Kconfig"