2 # Generic algorithms support
8 # async_tx api: hardware offloaded memory transfer/transform support
10 source "crypto/async_tx/Kconfig"
13 # Cryptographic API Configuration
16 tristate "Cryptographic API"
18 This option provides the core Cryptographic API.
22 comment "Crypto core or helper"
25 bool "FIPS 200 compliance"
26 depends on CRYPTO_ANSI_CPRNG
28 This options enables the fips boot option which is
29 required if you want to system to operate in a FIPS 200
30 certification. You should say no unless you know what
31 this is. Note that CRYPTO_ANSI_CPRNG is requred if this
38 This option provides the API for cryptographic algorithms.
52 config CRYPTO_BLKCIPHER
54 select CRYPTO_BLKCIPHER2
57 config CRYPTO_BLKCIPHER2
61 select CRYPTO_WORKQUEUE
86 tristate "Cryptographic algorithm manager"
87 select CRYPTO_MANAGER2
89 Create default cryptographic template instantiations such as
92 config CRYPTO_MANAGER2
93 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
96 select CRYPTO_BLKCIPHER2
99 config CRYPTO_GF128MUL
100 tristate "GF(2^128) multiplication functions (EXPERIMENTAL)"
101 depends on EXPERIMENTAL
103 Efficient table driven implementation of multiplications in the
104 field GF(2^128). This is needed by some cypher modes. This
105 option will be selected automatically if you select such a
106 cipher mode. Only select this option by hand if you expect to load
107 an external module that requires these functions.
110 tristate "Null algorithms"
112 select CRYPTO_BLKCIPHER
115 These are 'Null' algorithms, used by IPsec, which do nothing.
117 config CRYPTO_WORKQUEUE
121 tristate "Software async crypto daemon"
122 select CRYPTO_BLKCIPHER
124 select CRYPTO_MANAGER
125 select CRYPTO_WORKQUEUE
127 This is a generic software asynchronous crypto daemon that
128 converts an arbitrary synchronous software crypto algorithm
129 into an asynchronous algorithm that executes in a kernel thread.
131 config CRYPTO_AUTHENC
132 tristate "Authenc support"
134 select CRYPTO_BLKCIPHER
135 select CRYPTO_MANAGER
138 Authenc: Combined mode wrapper for IPsec.
139 This is required for IPSec.
142 tristate "Testing module"
144 select CRYPTO_MANAGER
146 Quick & dirty crypto test module.
148 comment "Authenticated Encryption with Associated Data"
151 tristate "CCM support"
155 Support for Counter with CBC MAC. Required for IPsec.
158 tristate "GCM/GMAC support"
163 Support for Galois/Counter Mode (GCM) and Galois Message
164 Authentication Code (GMAC). Required for IPSec.
167 tristate "Sequence Number IV Generator"
169 select CRYPTO_BLKCIPHER
172 This IV generator generates an IV based on a sequence number by
173 xoring it with a salt. This algorithm is mainly useful for CTR
175 comment "Block modes"
178 tristate "CBC support"
179 select CRYPTO_BLKCIPHER
180 select CRYPTO_MANAGER
182 CBC: Cipher Block Chaining mode
183 This block cipher algorithm is required for IPSec.
186 tristate "CTR support"
187 select CRYPTO_BLKCIPHER
189 select CRYPTO_MANAGER
192 This block cipher algorithm is required for IPSec.
195 tristate "CTS support"
196 select CRYPTO_BLKCIPHER
198 CTS: Cipher Text Stealing
199 This is the Cipher Text Stealing mode as described by
200 Section 8 of rfc2040 and referenced by rfc3962.
201 (rfc3962 includes errata information in its Appendix A)
202 This mode is required for Kerberos gss mechanism support
206 tristate "ECB support"
207 select CRYPTO_BLKCIPHER
208 select CRYPTO_MANAGER
210 ECB: Electronic CodeBook mode
211 This is the simplest block cipher algorithm. It simply encrypts
212 the input block by block.
215 tristate "LRW support (EXPERIMENTAL)"
216 depends on EXPERIMENTAL
217 select CRYPTO_BLKCIPHER
218 select CRYPTO_MANAGER
219 select CRYPTO_GF128MUL
221 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
222 narrow block cipher mode for dm-crypt. Use it with cipher
223 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
224 The first 128, 192 or 256 bits in the key are used for AES and the
225 rest is used to tie each cipher block to its logical position.
228 tristate "PCBC support"
229 select CRYPTO_BLKCIPHER
230 select CRYPTO_MANAGER
232 PCBC: Propagating Cipher Block Chaining mode
233 This block cipher algorithm is required for RxRPC.
236 tristate "XTS support (EXPERIMENTAL)"
237 depends on EXPERIMENTAL
238 select CRYPTO_BLKCIPHER
239 select CRYPTO_MANAGER
240 select CRYPTO_GF128MUL
242 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
243 key size 256, 384 or 512 bits. This implementation currently
244 can't handle a sectorsize which is not a multiple of 16 bytes.
248 select CRYPTO_BLKCIPHER
249 select CRYPTO_MANAGER
254 tristate "HMAC support"
256 select CRYPTO_MANAGER
258 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
259 This is required for IPSec.
262 tristate "XCBC support"
263 depends on EXPERIMENTAL
265 select CRYPTO_MANAGER
267 XCBC: Keyed-Hashing with encryption algorithm
268 http://www.ietf.org/rfc/rfc3566.txt
269 http://csrc.nist.gov/encryption/modes/proposedmodes/
270 xcbc-mac/xcbc-mac-spec.pdf
273 tristate "VMAC support"
274 depends on EXPERIMENTAL
276 select CRYPTO_MANAGER
278 VMAC is a message authentication algorithm designed for
279 very high speed on 64-bit architectures.
282 <http://fastcrypto.org/vmac>
287 tristate "CRC32c CRC algorithm"
290 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
291 by iSCSI for header and data digests and by others.
292 See Castagnoli93. Module will be crc32c.
294 config CRYPTO_CRC32C_INTEL
295 tristate "CRC32c INTEL hardware acceleration"
299 In Intel processor with SSE4.2 supported, the processor will
300 support CRC32C implementation using hardware accelerated CRC32
301 instruction. This option will create 'crc32c-intel' module,
302 which will enable any routine to use the CRC32 instruction to
303 gain performance compared with software implementation.
304 Module will be crc32c-intel.
307 tristate "GHASH digest algorithm"
309 select CRYPTO_GF128MUL
311 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
314 tristate "MD4 digest algorithm"
317 MD4 message digest algorithm (RFC1320).
320 tristate "MD5 digest algorithm"
323 MD5 message digest algorithm (RFC1321).
325 config CRYPTO_MICHAEL_MIC
326 tristate "Michael MIC keyed digest algorithm"
329 Michael MIC is used for message integrity protection in TKIP
330 (IEEE 802.11i). This algorithm is required for TKIP, but it
331 should not be used for other purposes because of the weakness
335 tristate "RIPEMD-128 digest algorithm"
338 RIPEMD-128 (ISO/IEC 10118-3:2004).
340 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
341 to be used as a secure replacement for RIPEMD. For other use cases
342 RIPEMD-160 should be used.
344 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
345 See <http://home.esat.kuleuven.be/~bosselae/ripemd160.html>
348 tristate "RIPEMD-160 digest algorithm"
351 RIPEMD-160 (ISO/IEC 10118-3:2004).
353 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
354 to be used as a secure replacement for the 128-bit hash functions
355 MD4, MD5 and it's predecessor RIPEMD
356 (not to be confused with RIPEMD-128).
358 It's speed is comparable to SHA1 and there are no known attacks
361 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
362 See <http://home.esat.kuleuven.be/~bosselae/ripemd160.html>
365 tristate "RIPEMD-256 digest algorithm"
368 RIPEMD-256 is an optional extension of RIPEMD-128 with a
369 256 bit hash. It is intended for applications that require
370 longer hash-results, without needing a larger security level
373 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
374 See <http://home.esat.kuleuven.be/~bosselae/ripemd160.html>
377 tristate "RIPEMD-320 digest algorithm"
380 RIPEMD-320 is an optional extension of RIPEMD-160 with a
381 320 bit hash. It is intended for applications that require
382 longer hash-results, without needing a larger security level
385 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
386 See <http://home.esat.kuleuven.be/~bosselae/ripemd160.html>
389 tristate "SHA1 digest algorithm"
392 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
395 tristate "SHA224 and SHA256 digest algorithm"
398 SHA256 secure hash standard (DFIPS 180-2).
400 This version of SHA implements a 256 bit hash with 128 bits of
401 security against collision attacks.
403 This code also includes SHA-224, a 224 bit hash with 112 bits
404 of security against collision attacks.
407 tristate "SHA384 and SHA512 digest algorithms"
410 SHA512 secure hash standard (DFIPS 180-2).
412 This version of SHA implements a 512 bit hash with 256 bits of
413 security against collision attacks.
415 This code also includes SHA-384, a 384 bit hash with 192 bits
416 of security against collision attacks.
419 tristate "Tiger digest algorithms"
422 Tiger hash algorithm 192, 160 and 128-bit hashes
424 Tiger is a hash function optimized for 64-bit processors while
425 still having decent performance on 32-bit processors.
426 Tiger was developed by Ross Anderson and Eli Biham.
429 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
432 tristate "Whirlpool digest algorithms"
435 Whirlpool hash algorithm 512, 384 and 256-bit hashes
437 Whirlpool-512 is part of the NESSIE cryptographic primitives.
438 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
441 <http://planeta.terra.com.br/informatica/paulobarreto/WhirlpoolPage.html>
443 config CRYPTO_GHASH_CLMUL_NI_INTEL
444 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
448 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
449 The implementation is accelerated by CLMUL-NI of Intel.
454 tristate "AES cipher algorithms"
457 AES cipher algorithms (FIPS-197). AES uses the Rijndael
460 Rijndael appears to be consistently a very good performer in
461 both hardware and software across a wide range of computing
462 environments regardless of its use in feedback or non-feedback
463 modes. Its key setup time is excellent, and its key agility is
464 good. Rijndael's very low memory requirements make it very well
465 suited for restricted-space environments, in which it also
466 demonstrates excellent performance. Rijndael's operations are
467 among the easiest to defend against power and timing attacks.
469 The AES specifies three key sizes: 128, 192 and 256 bits
471 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
473 config CRYPTO_AES_586
474 tristate "AES cipher algorithms (i586)"
475 depends on (X86 || UML_X86) && !64BIT
479 AES cipher algorithms (FIPS-197). AES uses the Rijndael
482 Rijndael appears to be consistently a very good performer in
483 both hardware and software across a wide range of computing
484 environments regardless of its use in feedback or non-feedback
485 modes. Its key setup time is excellent, and its key agility is
486 good. Rijndael's very low memory requirements make it very well
487 suited for restricted-space environments, in which it also
488 demonstrates excellent performance. Rijndael's operations are
489 among the easiest to defend against power and timing attacks.
491 The AES specifies three key sizes: 128, 192 and 256 bits
493 See <http://csrc.nist.gov/encryption/aes/> for more information.
495 config CRYPTO_AES_X86_64
496 tristate "AES cipher algorithms (x86_64)"
497 depends on (X86 || UML_X86) && 64BIT
501 AES cipher algorithms (FIPS-197). AES uses the Rijndael
504 Rijndael appears to be consistently a very good performer in
505 both hardware and software across a wide range of computing
506 environments regardless of its use in feedback or non-feedback
507 modes. Its key setup time is excellent, and its key agility is
508 good. Rijndael's very low memory requirements make it very well
509 suited for restricted-space environments, in which it also
510 demonstrates excellent performance. Rijndael's operations are
511 among the easiest to defend against power and timing attacks.
513 The AES specifies three key sizes: 128, 192 and 256 bits
515 See <http://csrc.nist.gov/encryption/aes/> for more information.
517 config CRYPTO_AES_NI_INTEL
518 tristate "AES cipher algorithms (AES-NI)"
519 depends on (X86 || UML_X86) && 64BIT
520 select CRYPTO_AES_X86_64
525 Use Intel AES-NI instructions for AES algorithm.
527 AES cipher algorithms (FIPS-197). AES uses the Rijndael
530 Rijndael appears to be consistently a very good performer in
531 both hardware and software across a wide range of computing
532 environments regardless of its use in feedback or non-feedback
533 modes. Its key setup time is excellent, and its key agility is
534 good. Rijndael's very low memory requirements make it very well
535 suited for restricted-space environments, in which it also
536 demonstrates excellent performance. Rijndael's operations are
537 among the easiest to defend against power and timing attacks.
539 The AES specifies three key sizes: 128, 192 and 256 bits
541 See <http://csrc.nist.gov/encryption/aes/> for more information.
543 In addition to AES cipher algorithm support, the
544 acceleration for some popular block cipher mode is supported
545 too, including ECB, CBC, CTR, LRW, PCBC, XTS.
548 tristate "Anubis cipher algorithm"
551 Anubis cipher algorithm.
553 Anubis is a variable key length cipher which can use keys from
554 128 bits to 320 bits in length. It was evaluated as a entrant
555 in the NESSIE competition.
558 <https://www.cosic.esat.kuleuven.ac.be/nessie/reports/>
559 <http://planeta.terra.com.br/informatica/paulobarreto/AnubisPage.html>
562 tristate "ARC4 cipher algorithm"
565 ARC4 cipher algorithm.
567 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
568 bits in length. This algorithm is required for driver-based
569 WEP, but it should not be for other purposes because of the
570 weakness of the algorithm.
572 config CRYPTO_BLOWFISH
573 tristate "Blowfish cipher algorithm"
576 Blowfish cipher algorithm, by Bruce Schneier.
578 This is a variable key length cipher which can use keys from 32
579 bits to 448 bits in length. It's fast, simple and specifically
580 designed for use on "large microprocessors".
583 <http://www.schneier.com/blowfish.html>
585 config CRYPTO_CAMELLIA
586 tristate "Camellia cipher algorithms"
590 Camellia cipher algorithms module.
592 Camellia is a symmetric key block cipher developed jointly
593 at NTT and Mitsubishi Electric Corporation.
595 The Camellia specifies three key sizes: 128, 192 and 256 bits.
598 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
601 tristate "CAST5 (CAST-128) cipher algorithm"
604 The CAST5 encryption algorithm (synonymous with CAST-128) is
605 described in RFC2144.
608 tristate "CAST6 (CAST-256) cipher algorithm"
611 The CAST6 encryption algorithm (synonymous with CAST-256) is
612 described in RFC2612.
615 tristate "DES and Triple DES EDE cipher algorithms"
618 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
621 tristate "FCrypt cipher algorithm"
623 select CRYPTO_BLKCIPHER
625 FCrypt algorithm used by RxRPC.
628 tristate "Khazad cipher algorithm"
631 Khazad cipher algorithm.
633 Khazad was a finalist in the initial NESSIE competition. It is
634 an algorithm optimized for 64-bit processors with good performance
635 on 32-bit processors. Khazad uses an 128 bit key size.
638 <http://planeta.terra.com.br/informatica/paulobarreto/KhazadPage.html>
640 config CRYPTO_SALSA20
641 tristate "Salsa20 stream cipher algorithm (EXPERIMENTAL)"
642 depends on EXPERIMENTAL
643 select CRYPTO_BLKCIPHER
645 Salsa20 stream cipher algorithm.
647 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
648 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
650 The Salsa20 stream cipher algorithm is designed by Daniel J.
651 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
653 config CRYPTO_SALSA20_586
654 tristate "Salsa20 stream cipher algorithm (i586) (EXPERIMENTAL)"
655 depends on (X86 || UML_X86) && !64BIT
656 depends on EXPERIMENTAL
657 select CRYPTO_BLKCIPHER
659 Salsa20 stream cipher algorithm.
661 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
662 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
664 The Salsa20 stream cipher algorithm is designed by Daniel J.
665 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
667 config CRYPTO_SALSA20_X86_64
668 tristate "Salsa20 stream cipher algorithm (x86_64) (EXPERIMENTAL)"
669 depends on (X86 || UML_X86) && 64BIT
670 depends on EXPERIMENTAL
671 select CRYPTO_BLKCIPHER
673 Salsa20 stream cipher algorithm.
675 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
676 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
678 The Salsa20 stream cipher algorithm is designed by Daniel J.
679 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
682 tristate "SEED cipher algorithm"
685 SEED cipher algorithm (RFC4269).
687 SEED is a 128-bit symmetric key block cipher that has been
688 developed by KISA (Korea Information Security Agency) as a
689 national standard encryption algorithm of the Republic of Korea.
690 It is a 16 round block cipher with the key size of 128 bit.
693 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
695 config CRYPTO_SERPENT
696 tristate "Serpent cipher algorithm"
699 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
701 Keys are allowed to be from 0 to 256 bits in length, in steps
702 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
703 variant of Serpent for compatibility with old kerneli.org code.
706 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
709 tristate "TEA, XTEA and XETA cipher algorithms"
712 TEA cipher algorithm.
714 Tiny Encryption Algorithm is a simple cipher that uses
715 many rounds for security. It is very fast and uses
718 Xtendend Tiny Encryption Algorithm is a modification to
719 the TEA algorithm to address a potential key weakness
720 in the TEA algorithm.
722 Xtendend Encryption Tiny Algorithm is a mis-implementation
723 of the XTEA algorithm for compatibility purposes.
725 config CRYPTO_TWOFISH
726 tristate "Twofish cipher algorithm"
728 select CRYPTO_TWOFISH_COMMON
730 Twofish cipher algorithm.
732 Twofish was submitted as an AES (Advanced Encryption Standard)
733 candidate cipher by researchers at CounterPane Systems. It is a
734 16 round block cipher supporting key sizes of 128, 192, and 256
738 <http://www.schneier.com/twofish.html>
740 config CRYPTO_TWOFISH_COMMON
743 Common parts of the Twofish cipher algorithm shared by the
744 generic c and the assembler implementations.
746 config CRYPTO_TWOFISH_586
747 tristate "Twofish cipher algorithms (i586)"
748 depends on (X86 || UML_X86) && !64BIT
750 select CRYPTO_TWOFISH_COMMON
752 Twofish cipher algorithm.
754 Twofish was submitted as an AES (Advanced Encryption Standard)
755 candidate cipher by researchers at CounterPane Systems. It is a
756 16 round block cipher supporting key sizes of 128, 192, and 256
760 <http://www.schneier.com/twofish.html>
762 config CRYPTO_TWOFISH_X86_64
763 tristate "Twofish cipher algorithm (x86_64)"
764 depends on (X86 || UML_X86) && 64BIT
766 select CRYPTO_TWOFISH_COMMON
768 Twofish cipher algorithm (x86_64).
770 Twofish was submitted as an AES (Advanced Encryption Standard)
771 candidate cipher by researchers at CounterPane Systems. It is a
772 16 round block cipher supporting key sizes of 128, 192, and 256
776 <http://www.schneier.com/twofish.html>
778 comment "Compression"
780 config CRYPTO_DEFLATE
781 tristate "Deflate compression algorithm"
786 This is the Deflate algorithm (RFC1951), specified for use in
787 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
789 You will most probably want this if using IPSec.
792 tristate "Zlib compression algorithm"
798 This is the zlib algorithm.
801 tristate "LZO compression algorithm"
804 select LZO_DECOMPRESS
806 This is the LZO algorithm.
808 comment "Random Number Generation"
810 config CRYPTO_ANSI_CPRNG
811 tristate "Pseudo Random Number Generation for Cryptographic modules"
816 This option enables the generic pseudo random number generator
817 for cryptographic modules. Uses the Algorithm specified in
818 ANSI X9.31 A.2.4. Not this option must be enabled if CRYPTO_FIPS
821 source "drivers/crypto/Kconfig"