1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
20 This option provides the core Cryptographic API.
24 comment "Crypto core or helper"
27 bool "FIPS 200 compliance"
28 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 depends on (MODULE_SIG || !MODULES)
31 This option enables the fips boot option which is
32 required if you want the system to operate in a FIPS 200
33 certification. You should say no unless you know what
40 This option provides the API for cryptographic algorithms.
56 config CRYPTO_SKCIPHER
58 select CRYPTO_SKCIPHER2
61 config CRYPTO_SKCIPHER2
84 config CRYPTO_RNG_DEFAULT
86 select CRYPTO_DRBG_MENU
88 config CRYPTO_AKCIPHER2
92 config CRYPTO_AKCIPHER
94 select CRYPTO_AKCIPHER2
108 select CRYPTO_ALGAPI2
116 config CRYPTO_MANAGER
117 tristate "Cryptographic algorithm manager"
118 select CRYPTO_MANAGER2
120 Create default cryptographic template instantiations such as
123 config CRYPTO_MANAGER2
124 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
127 select CRYPTO_SKCIPHER2
128 select CRYPTO_AKCIPHER2
133 tristate "Userspace cryptographic algorithm configuration"
135 select CRYPTO_MANAGER
137 Userspace configuration for cryptographic instantiations such as
140 config CRYPTO_MANAGER_DISABLE_TESTS
141 bool "Disable run-time self tests"
144 Disable run-time self tests that normally take place at
145 algorithm registration.
147 config CRYPTO_MANAGER_EXTRA_TESTS
148 bool "Enable extra run-time crypto self tests"
149 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
151 Enable extra run-time self tests of registered crypto algorithms,
152 including randomized fuzz tests.
154 This is intended for developer use only, as these tests take much
155 longer to run than the normal self tests.
157 config CRYPTO_GF128MUL
161 tristate "Null algorithms"
164 These are 'Null' algorithms, used by IPsec, which do nothing.
168 select CRYPTO_ALGAPI2
169 select CRYPTO_SKCIPHER2
173 tristate "Parallel crypto engine"
176 select CRYPTO_MANAGER
179 This converts an arbitrary crypto algorithm into a parallel
180 algorithm that executes in kernel threads.
183 tristate "Software async crypto daemon"
184 select CRYPTO_SKCIPHER
186 select CRYPTO_MANAGER
188 This is a generic software asynchronous crypto daemon that
189 converts an arbitrary synchronous software crypto algorithm
190 into an asynchronous algorithm that executes in a kernel thread.
192 config CRYPTO_AUTHENC
193 tristate "Authenc support"
195 select CRYPTO_SKCIPHER
196 select CRYPTO_MANAGER
200 Authenc: Combined mode wrapper for IPsec.
201 This is required for IPSec.
204 tristate "Testing module"
205 depends on m || EXPERT
206 select CRYPTO_MANAGER
208 Quick & dirty crypto test module.
217 comment "Public-key cryptography"
220 tristate "RSA algorithm"
221 select CRYPTO_AKCIPHER
222 select CRYPTO_MANAGER
226 Generic implementation of the RSA public key algorithm.
229 tristate "Diffie-Hellman algorithm"
233 Generic implementation of the Diffie-Hellman algorithm.
235 config CRYPTO_DH_RFC7919_GROUPS
236 bool "Support for RFC 7919 FFDHE group parameters"
238 select CRYPTO_RNG_DEFAULT
240 Provide support for RFC 7919 FFDHE group parameters. If unsure, say N.
244 select CRYPTO_RNG_DEFAULT
247 tristate "ECDH algorithm"
251 Generic implementation of the ECDH algorithm
254 tristate "ECDSA (NIST P192, P256 etc.) algorithm"
256 select CRYPTO_AKCIPHER
259 Elliptic Curve Digital Signature Algorithm (NIST P192, P256 etc.)
260 is A NIST cryptographic standard algorithm. Only signature verification
264 tristate "EC-RDSA (GOST 34.10) algorithm"
266 select CRYPTO_AKCIPHER
267 select CRYPTO_STREEBOG
271 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
272 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
273 standard algorithms (called GOST algorithms). Only signature verification
277 tristate "SM2 algorithm"
279 select CRYPTO_AKCIPHER
280 select CRYPTO_MANAGER
284 Generic implementation of the SM2 public key algorithm. It was
285 published by State Encryption Management Bureau, China.
286 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
289 https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
290 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
291 http://www.gmbz.org.cn/main/bzlb.html
293 config CRYPTO_CURVE25519
294 tristate "Curve25519 algorithm"
296 select CRYPTO_LIB_CURVE25519_GENERIC
298 config CRYPTO_CURVE25519_X86
299 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
300 depends on X86 && 64BIT
301 select CRYPTO_LIB_CURVE25519_GENERIC
302 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
304 comment "Authenticated Encryption with Associated Data"
307 tristate "CCM support"
311 select CRYPTO_MANAGER
313 Support for Counter with CBC MAC. Required for IPsec.
316 tristate "GCM/GMAC support"
321 select CRYPTO_MANAGER
323 Support for Galois/Counter Mode (GCM) and Galois Message
324 Authentication Code (GMAC). Required for IPSec.
326 config CRYPTO_CHACHA20POLY1305
327 tristate "ChaCha20-Poly1305 AEAD support"
328 select CRYPTO_CHACHA20
329 select CRYPTO_POLY1305
331 select CRYPTO_MANAGER
333 ChaCha20-Poly1305 AEAD support, RFC7539.
335 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
336 with the Poly1305 authenticator. It is defined in RFC7539 for use in
339 config CRYPTO_AEGIS128
340 tristate "AEGIS-128 AEAD algorithm"
342 select CRYPTO_AES # for AES S-box tables
344 Support for the AEGIS-128 dedicated AEAD algorithm.
346 config CRYPTO_AEGIS128_SIMD
347 bool "Support SIMD acceleration for AEGIS-128"
348 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
351 config CRYPTO_AEGIS128_AESNI_SSE2
352 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
353 depends on X86 && 64BIT
357 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
360 tristate "Sequence Number IV Generator"
362 select CRYPTO_SKCIPHER
364 select CRYPTO_RNG_DEFAULT
365 select CRYPTO_MANAGER
367 This IV generator generates an IV based on a sequence number by
368 xoring it with a salt. This algorithm is mainly useful for CTR
370 config CRYPTO_ECHAINIV
371 tristate "Encrypted Chain IV Generator"
374 select CRYPTO_RNG_DEFAULT
375 select CRYPTO_MANAGER
377 This IV generator generates an IV based on the encryption of
378 a sequence number xored with a salt. This is the default
381 comment "Block modes"
384 tristate "CBC support"
385 select CRYPTO_SKCIPHER
386 select CRYPTO_MANAGER
388 CBC: Cipher Block Chaining mode
389 This block cipher algorithm is required for IPSec.
392 tristate "CFB support"
393 select CRYPTO_SKCIPHER
394 select CRYPTO_MANAGER
396 CFB: Cipher FeedBack mode
397 This block cipher algorithm is required for TPM2 Cryptography.
400 tristate "CTR support"
401 select CRYPTO_SKCIPHER
402 select CRYPTO_MANAGER
405 This block cipher algorithm is required for IPSec.
408 tristate "CTS support"
409 select CRYPTO_SKCIPHER
410 select CRYPTO_MANAGER
412 CTS: Cipher Text Stealing
413 This is the Cipher Text Stealing mode as described by
414 Section 8 of rfc2040 and referenced by rfc3962
415 (rfc3962 includes errata information in its Appendix A) or
416 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
417 This mode is required for Kerberos gss mechanism support
420 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
423 tristate "ECB support"
424 select CRYPTO_SKCIPHER
425 select CRYPTO_MANAGER
427 ECB: Electronic CodeBook mode
428 This is the simplest block cipher algorithm. It simply encrypts
429 the input block by block.
432 tristate "LRW support"
433 select CRYPTO_SKCIPHER
434 select CRYPTO_MANAGER
435 select CRYPTO_GF128MUL
438 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
439 narrow block cipher mode for dm-crypt. Use it with cipher
440 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
441 The first 128, 192 or 256 bits in the key are used for AES and the
442 rest is used to tie each cipher block to its logical position.
445 tristate "OFB support"
446 select CRYPTO_SKCIPHER
447 select CRYPTO_MANAGER
449 OFB: the Output Feedback mode makes a block cipher into a synchronous
450 stream cipher. It generates keystream blocks, which are then XORed
451 with the plaintext blocks to get the ciphertext. Flipping a bit in the
452 ciphertext produces a flipped bit in the plaintext at the same
453 location. This property allows many error correcting codes to function
454 normally even when applied before encryption.
457 tristate "PCBC support"
458 select CRYPTO_SKCIPHER
459 select CRYPTO_MANAGER
461 PCBC: Propagating Cipher Block Chaining mode
462 This block cipher algorithm is required for RxRPC.
465 tristate "XTS support"
466 select CRYPTO_SKCIPHER
467 select CRYPTO_MANAGER
470 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
471 key size 256, 384 or 512 bits. This implementation currently
472 can't handle a sectorsize which is not a multiple of 16 bytes.
474 config CRYPTO_KEYWRAP
475 tristate "Key wrapping support"
476 select CRYPTO_SKCIPHER
477 select CRYPTO_MANAGER
479 Support for key wrapping (NIST SP800-38F / RFC3394) without
482 config CRYPTO_NHPOLY1305
485 select CRYPTO_LIB_POLY1305_GENERIC
487 config CRYPTO_NHPOLY1305_SSE2
488 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
489 depends on X86 && 64BIT
490 select CRYPTO_NHPOLY1305
492 SSE2 optimized implementation of the hash function used by the
493 Adiantum encryption mode.
495 config CRYPTO_NHPOLY1305_AVX2
496 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
497 depends on X86 && 64BIT
498 select CRYPTO_NHPOLY1305
500 AVX2 optimized implementation of the hash function used by the
501 Adiantum encryption mode.
503 config CRYPTO_ADIANTUM
504 tristate "Adiantum support"
505 select CRYPTO_CHACHA20
506 select CRYPTO_LIB_POLY1305_GENERIC
507 select CRYPTO_NHPOLY1305
508 select CRYPTO_MANAGER
510 Adiantum is a tweakable, length-preserving encryption mode
511 designed for fast and secure disk encryption, especially on
512 CPUs without dedicated crypto instructions. It encrypts
513 each sector using the XChaCha12 stream cipher, two passes of
514 an ε-almost-∆-universal hash function, and an invocation of
515 the AES-256 block cipher on a single 16-byte block. On CPUs
516 without AES instructions, Adiantum is much faster than
519 Adiantum's security is provably reducible to that of its
520 underlying stream and block ciphers, subject to a security
521 bound. Unlike XTS, Adiantum is a true wide-block encryption
522 mode, so it actually provides an even stronger notion of
523 security than XTS, subject to the security bound.
528 tristate "ESSIV support for block encryption"
529 select CRYPTO_AUTHENC
531 Encrypted salt-sector initialization vector (ESSIV) is an IV
532 generation method that is used in some cases by fscrypt and/or
533 dm-crypt. It uses the hash of the block encryption key as the
534 symmetric key for a block encryption pass applied to the input
535 IV, making low entropy IV sources more suitable for block
538 This driver implements a crypto API template that can be
539 instantiated either as an skcipher or as an AEAD (depending on the
540 type of the first template argument), and which defers encryption
541 and decryption requests to the encapsulated cipher after applying
542 ESSIV to the input IV. Note that in the AEAD case, it is assumed
543 that the keys are presented in the same format used by the authenc
544 template, and that the IV appears at the end of the authenticated
545 associated data (AAD) region (which is how dm-crypt uses it.)
547 Note that the use of ESSIV is not recommended for new deployments,
548 and so this only needs to be enabled when interoperability with
549 existing encrypted volumes of filesystems is required, or when
550 building for a particular system that requires it (e.g., when
551 the SoC in question has accelerated CBC but not XTS, making CBC
552 combined with ESSIV the only feasible mode for h/w accelerated
558 tristate "CMAC support"
560 select CRYPTO_MANAGER
562 Cipher-based Message Authentication Code (CMAC) specified by
563 The National Institute of Standards and Technology (NIST).
565 https://tools.ietf.org/html/rfc4493
566 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
569 tristate "HMAC support"
571 select CRYPTO_MANAGER
573 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
574 This is required for IPSec.
577 tristate "XCBC support"
579 select CRYPTO_MANAGER
581 XCBC: Keyed-Hashing with encryption algorithm
582 https://www.ietf.org/rfc/rfc3566.txt
583 http://csrc.nist.gov/encryption/modes/proposedmodes/
584 xcbc-mac/xcbc-mac-spec.pdf
587 tristate "VMAC support"
589 select CRYPTO_MANAGER
591 VMAC is a message authentication algorithm designed for
592 very high speed on 64-bit architectures.
595 <https://fastcrypto.org/vmac>
600 tristate "CRC32c CRC algorithm"
604 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
605 by iSCSI for header and data digests and by others.
606 See Castagnoli93. Module will be crc32c.
608 config CRYPTO_CRC32C_INTEL
609 tristate "CRC32c INTEL hardware acceleration"
613 In Intel processor with SSE4.2 supported, the processor will
614 support CRC32C implementation using hardware accelerated CRC32
615 instruction. This option will create 'crc32c-intel' module,
616 which will enable any routine to use the CRC32 instruction to
617 gain performance compared with software implementation.
618 Module will be crc32c-intel.
620 config CRYPTO_CRC32C_VPMSUM
621 tristate "CRC32c CRC algorithm (powerpc64)"
622 depends on PPC64 && ALTIVEC
626 CRC32c algorithm implemented using vector polynomial multiply-sum
627 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
628 and newer processors for improved performance.
631 config CRYPTO_CRC32C_SPARC64
632 tristate "CRC32c CRC algorithm (SPARC64)"
637 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
641 tristate "CRC32 CRC algorithm"
645 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
646 Shash crypto api wrappers to crc32_le function.
648 config CRYPTO_CRC32_PCLMUL
649 tristate "CRC32 PCLMULQDQ hardware acceleration"
654 From Intel Westmere and AMD Bulldozer processor with SSE4.2
655 and PCLMULQDQ supported, the processor will support
656 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
657 instruction. This option will create 'crc32-pclmul' module,
658 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
659 and gain better performance as compared with the table implementation.
661 config CRYPTO_CRC32_MIPS
662 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
663 depends on MIPS_CRC_SUPPORT
666 CRC32c and CRC32 CRC algorithms implemented using mips crypto
667 instructions, when available.
671 tristate "xxHash hash algorithm"
675 xxHash non-cryptographic hash algorithm. Extremely fast, working at
676 speeds close to RAM limits.
678 config CRYPTO_BLAKE2B
679 tristate "BLAKE2b digest algorithm"
682 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
683 optimized for 64bit platforms and can produce digests of any size
684 between 1 to 64. The keyed hash is also implemented.
686 This module provides the following algorithms:
693 See https://blake2.net for further information.
695 config CRYPTO_BLAKE2S
696 tristate "BLAKE2s digest algorithm"
697 select CRYPTO_LIB_BLAKE2S_GENERIC
700 Implementation of cryptographic hash function BLAKE2s
701 optimized for 8-32bit platforms and can produce digests of any size
702 between 1 to 32. The keyed hash is also implemented.
704 This module provides the following algorithms:
711 See https://blake2.net for further information.
713 config CRYPTO_BLAKE2S_X86
714 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
715 depends on X86 && 64BIT
716 select CRYPTO_LIB_BLAKE2S_GENERIC
717 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
719 config CRYPTO_CRCT10DIF
720 tristate "CRCT10DIF algorithm"
723 CRC T10 Data Integrity Field computation is being cast as
724 a crypto transform. This allows for faster crc t10 diff
725 transforms to be used if they are available.
727 config CRYPTO_CRCT10DIF_PCLMUL
728 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
729 depends on X86 && 64BIT && CRC_T10DIF
732 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
733 CRC T10 DIF PCLMULQDQ computation can be hardware
734 accelerated PCLMULQDQ instruction. This option will create
735 'crct10dif-pclmul' module, which is faster when computing the
736 crct10dif checksum as compared with the generic table implementation.
738 config CRYPTO_CRCT10DIF_VPMSUM
739 tristate "CRC32T10DIF powerpc64 hardware acceleration"
740 depends on PPC64 && ALTIVEC && CRC_T10DIF
743 CRC10T10DIF algorithm implemented using vector polynomial
744 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
745 POWER8 and newer processors for improved performance.
747 config CRYPTO_CRC64_ROCKSOFT
748 tristate "Rocksoft Model CRC64 algorithm"
752 config CRYPTO_VPMSUM_TESTER
753 tristate "Powerpc64 vpmsum hardware acceleration tester"
754 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
756 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
757 POWER8 vpmsum instructions.
758 Unless you are testing these algorithms, you don't need this.
761 tristate "GHASH hash function"
762 select CRYPTO_GF128MUL
765 GHASH is the hash function used in GCM (Galois/Counter Mode).
766 It is not a general-purpose cryptographic hash function.
768 config CRYPTO_POLY1305
769 tristate "Poly1305 authenticator algorithm"
771 select CRYPTO_LIB_POLY1305_GENERIC
773 Poly1305 authenticator algorithm, RFC7539.
775 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
776 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
777 in IETF protocols. This is the portable C implementation of Poly1305.
779 config CRYPTO_POLY1305_X86_64
780 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
781 depends on X86 && 64BIT
782 select CRYPTO_LIB_POLY1305_GENERIC
783 select CRYPTO_ARCH_HAVE_LIB_POLY1305
785 Poly1305 authenticator algorithm, RFC7539.
787 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
788 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
789 in IETF protocols. This is the x86_64 assembler implementation using SIMD
792 config CRYPTO_POLY1305_MIPS
793 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
795 select CRYPTO_ARCH_HAVE_LIB_POLY1305
798 tristate "MD4 digest algorithm"
801 MD4 message digest algorithm (RFC1320).
804 tristate "MD5 digest algorithm"
807 MD5 message digest algorithm (RFC1321).
809 config CRYPTO_MD5_OCTEON
810 tristate "MD5 digest algorithm (OCTEON)"
811 depends on CPU_CAVIUM_OCTEON
815 MD5 message digest algorithm (RFC1321) implemented
816 using OCTEON crypto instructions, when available.
818 config CRYPTO_MD5_PPC
819 tristate "MD5 digest algorithm (PPC)"
823 MD5 message digest algorithm (RFC1321) implemented
826 config CRYPTO_MD5_SPARC64
827 tristate "MD5 digest algorithm (SPARC64)"
832 MD5 message digest algorithm (RFC1321) implemented
833 using sparc64 crypto instructions, when available.
835 config CRYPTO_MICHAEL_MIC
836 tristate "Michael MIC keyed digest algorithm"
839 Michael MIC is used for message integrity protection in TKIP
840 (IEEE 802.11i). This algorithm is required for TKIP, but it
841 should not be used for other purposes because of the weakness
845 tristate "RIPEMD-160 digest algorithm"
848 RIPEMD-160 (ISO/IEC 10118-3:2004).
850 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
851 to be used as a secure replacement for the 128-bit hash functions
852 MD4, MD5 and it's predecessor RIPEMD
853 (not to be confused with RIPEMD-128).
855 It's speed is comparable to SHA1 and there are no known attacks
858 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
859 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
862 tristate "SHA1 digest algorithm"
865 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
867 config CRYPTO_SHA1_SSSE3
868 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
869 depends on X86 && 64BIT
873 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
874 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
875 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
878 config CRYPTO_SHA256_SSSE3
879 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
880 depends on X86 && 64BIT
884 SHA-256 secure hash standard (DFIPS 180-2) implemented
885 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
886 Extensions version 1 (AVX1), or Advanced Vector Extensions
887 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
888 Instructions) when available.
890 config CRYPTO_SHA512_SSSE3
891 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
892 depends on X86 && 64BIT
896 SHA-512 secure hash standard (DFIPS 180-2) implemented
897 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
898 Extensions version 1 (AVX1), or Advanced Vector Extensions
899 version 2 (AVX2) instructions, when available.
901 config CRYPTO_SHA1_OCTEON
902 tristate "SHA1 digest algorithm (OCTEON)"
903 depends on CPU_CAVIUM_OCTEON
907 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
908 using OCTEON crypto instructions, when available.
910 config CRYPTO_SHA1_SPARC64
911 tristate "SHA1 digest algorithm (SPARC64)"
916 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
917 using sparc64 crypto instructions, when available.
919 config CRYPTO_SHA1_PPC
920 tristate "SHA1 digest algorithm (powerpc)"
923 This is the powerpc hardware accelerated implementation of the
924 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
926 config CRYPTO_SHA1_PPC_SPE
927 tristate "SHA1 digest algorithm (PPC SPE)"
928 depends on PPC && SPE
930 SHA-1 secure hash standard (DFIPS 180-4) implemented
931 using powerpc SPE SIMD instruction set.
934 tristate "SHA224 and SHA256 digest algorithm"
936 select CRYPTO_LIB_SHA256
938 SHA256 secure hash standard (DFIPS 180-2).
940 This version of SHA implements a 256 bit hash with 128 bits of
941 security against collision attacks.
943 This code also includes SHA-224, a 224 bit hash with 112 bits
944 of security against collision attacks.
946 config CRYPTO_SHA256_PPC_SPE
947 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
948 depends on PPC && SPE
952 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
953 implemented using powerpc SPE SIMD instruction set.
955 config CRYPTO_SHA256_OCTEON
956 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
957 depends on CPU_CAVIUM_OCTEON
961 SHA-256 secure hash standard (DFIPS 180-2) implemented
962 using OCTEON crypto instructions, when available.
964 config CRYPTO_SHA256_SPARC64
965 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
970 SHA-256 secure hash standard (DFIPS 180-2) implemented
971 using sparc64 crypto instructions, when available.
974 tristate "SHA384 and SHA512 digest algorithms"
977 SHA512 secure hash standard (DFIPS 180-2).
979 This version of SHA implements a 512 bit hash with 256 bits of
980 security against collision attacks.
982 This code also includes SHA-384, a 384 bit hash with 192 bits
983 of security against collision attacks.
985 config CRYPTO_SHA512_OCTEON
986 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
987 depends on CPU_CAVIUM_OCTEON
991 SHA-512 secure hash standard (DFIPS 180-2) implemented
992 using OCTEON crypto instructions, when available.
994 config CRYPTO_SHA512_SPARC64
995 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
1000 SHA-512 secure hash standard (DFIPS 180-2) implemented
1001 using sparc64 crypto instructions, when available.
1004 tristate "SHA3 digest algorithm"
1007 SHA-3 secure hash standard (DFIPS 202). It's based on
1008 cryptographic sponge function family called Keccak.
1011 http://keccak.noekeon.org/
1016 config CRYPTO_SM3_GENERIC
1017 tristate "SM3 digest algorithm"
1021 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1022 It is part of the Chinese Commercial Cryptography suite.
1025 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1026 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1028 config CRYPTO_SM3_AVX_X86_64
1029 tristate "SM3 digest algorithm (x86_64/AVX)"
1030 depends on X86 && 64BIT
1034 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1035 It is part of the Chinese Commercial Cryptography suite. This is
1036 SM3 optimized implementation using Advanced Vector Extensions (AVX)
1041 config CRYPTO_STREEBOG
1042 tristate "Streebog Hash Function"
1045 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1046 cryptographic standard algorithms (called GOST algorithms).
1047 This setting enables two hash algorithms with 256 and 512 bits output.
1050 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1051 https://tools.ietf.org/html/rfc6986
1054 tristate "Whirlpool digest algorithms"
1057 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1059 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1060 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1063 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1065 config CRYPTO_GHASH_CLMUL_NI_INTEL
1066 tristate "GHASH hash function (CLMUL-NI accelerated)"
1067 depends on X86 && 64BIT
1068 select CRYPTO_CRYPTD
1070 This is the x86_64 CLMUL-NI accelerated implementation of
1071 GHASH, the hash function used in GCM (Galois/Counter mode).
1076 tristate "AES cipher algorithms"
1077 select CRYPTO_ALGAPI
1078 select CRYPTO_LIB_AES
1080 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1083 Rijndael appears to be consistently a very good performer in
1084 both hardware and software across a wide range of computing
1085 environments regardless of its use in feedback or non-feedback
1086 modes. Its key setup time is excellent, and its key agility is
1087 good. Rijndael's very low memory requirements make it very well
1088 suited for restricted-space environments, in which it also
1089 demonstrates excellent performance. Rijndael's operations are
1090 among the easiest to defend against power and timing attacks.
1092 The AES specifies three key sizes: 128, 192 and 256 bits
1094 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1096 config CRYPTO_AES_TI
1097 tristate "Fixed time AES cipher"
1098 select CRYPTO_ALGAPI
1099 select CRYPTO_LIB_AES
1101 This is a generic implementation of AES that attempts to eliminate
1102 data dependent latencies as much as possible without affecting
1103 performance too much. It is intended for use by the generic CCM
1104 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1105 solely on encryption (although decryption is supported as well, but
1106 with a more dramatic performance hit)
1108 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1109 8 for decryption), this implementation only uses just two S-boxes of
1110 256 bytes each, and attempts to eliminate data dependent latencies by
1111 prefetching the entire table into the cache at the start of each
1112 block. Interrupts are also disabled to avoid races where cachelines
1113 are evicted when the CPU is interrupted to do something else.
1115 config CRYPTO_AES_NI_INTEL
1116 tristate "AES cipher algorithms (AES-NI)"
1119 select CRYPTO_LIB_AES
1120 select CRYPTO_ALGAPI
1121 select CRYPTO_SKCIPHER
1124 Use Intel AES-NI instructions for AES algorithm.
1126 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1129 Rijndael appears to be consistently a very good performer in
1130 both hardware and software across a wide range of computing
1131 environments regardless of its use in feedback or non-feedback
1132 modes. Its key setup time is excellent, and its key agility is
1133 good. Rijndael's very low memory requirements make it very well
1134 suited for restricted-space environments, in which it also
1135 demonstrates excellent performance. Rijndael's operations are
1136 among the easiest to defend against power and timing attacks.
1138 The AES specifies three key sizes: 128, 192 and 256 bits
1140 See <http://csrc.nist.gov/encryption/aes/> for more information.
1142 In addition to AES cipher algorithm support, the acceleration
1143 for some popular block cipher mode is supported too, including
1144 ECB, CBC, LRW, XTS. The 64 bit version has additional
1145 acceleration for CTR.
1147 config CRYPTO_AES_SPARC64
1148 tristate "AES cipher algorithms (SPARC64)"
1150 select CRYPTO_SKCIPHER
1152 Use SPARC64 crypto opcodes for AES algorithm.
1154 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1157 Rijndael appears to be consistently a very good performer in
1158 both hardware and software across a wide range of computing
1159 environments regardless of its use in feedback or non-feedback
1160 modes. Its key setup time is excellent, and its key agility is
1161 good. Rijndael's very low memory requirements make it very well
1162 suited for restricted-space environments, in which it also
1163 demonstrates excellent performance. Rijndael's operations are
1164 among the easiest to defend against power and timing attacks.
1166 The AES specifies three key sizes: 128, 192 and 256 bits
1168 See <http://csrc.nist.gov/encryption/aes/> for more information.
1170 In addition to AES cipher algorithm support, the acceleration
1171 for some popular block cipher mode is supported too, including
1174 config CRYPTO_AES_PPC_SPE
1175 tristate "AES cipher algorithms (PPC SPE)"
1176 depends on PPC && SPE
1177 select CRYPTO_SKCIPHER
1179 AES cipher algorithms (FIPS-197). Additionally the acceleration
1180 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1181 This module should only be used for low power (router) devices
1182 without hardware AES acceleration (e.g. caam crypto). It reduces the
1183 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1184 timining attacks. Nevertheless it might be not as secure as other
1185 architecture specific assembler implementations that work on 1KB
1186 tables or 256 bytes S-boxes.
1188 config CRYPTO_ANUBIS
1189 tristate "Anubis cipher algorithm"
1190 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1191 select CRYPTO_ALGAPI
1193 Anubis cipher algorithm.
1195 Anubis is a variable key length cipher which can use keys from
1196 128 bits to 320 bits in length. It was evaluated as a entrant
1197 in the NESSIE competition.
1200 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1201 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1204 tristate "ARC4 cipher algorithm"
1205 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1206 select CRYPTO_SKCIPHER
1207 select CRYPTO_LIB_ARC4
1209 ARC4 cipher algorithm.
1211 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1212 bits in length. This algorithm is required for driver-based
1213 WEP, but it should not be for other purposes because of the
1214 weakness of the algorithm.
1216 config CRYPTO_BLOWFISH
1217 tristate "Blowfish cipher algorithm"
1218 select CRYPTO_ALGAPI
1219 select CRYPTO_BLOWFISH_COMMON
1221 Blowfish cipher algorithm, by Bruce Schneier.
1223 This is a variable key length cipher which can use keys from 32
1224 bits to 448 bits in length. It's fast, simple and specifically
1225 designed for use on "large microprocessors".
1228 <https://www.schneier.com/blowfish.html>
1230 config CRYPTO_BLOWFISH_COMMON
1233 Common parts of the Blowfish cipher algorithm shared by the
1234 generic c and the assembler implementations.
1237 <https://www.schneier.com/blowfish.html>
1239 config CRYPTO_BLOWFISH_X86_64
1240 tristate "Blowfish cipher algorithm (x86_64)"
1241 depends on X86 && 64BIT
1242 select CRYPTO_SKCIPHER
1243 select CRYPTO_BLOWFISH_COMMON
1246 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1248 This is a variable key length cipher which can use keys from 32
1249 bits to 448 bits in length. It's fast, simple and specifically
1250 designed for use on "large microprocessors".
1253 <https://www.schneier.com/blowfish.html>
1255 config CRYPTO_CAMELLIA
1256 tristate "Camellia cipher algorithms"
1257 select CRYPTO_ALGAPI
1259 Camellia cipher algorithms module.
1261 Camellia is a symmetric key block cipher developed jointly
1262 at NTT and Mitsubishi Electric Corporation.
1264 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1267 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1269 config CRYPTO_CAMELLIA_X86_64
1270 tristate "Camellia cipher algorithm (x86_64)"
1271 depends on X86 && 64BIT
1272 select CRYPTO_SKCIPHER
1275 Camellia cipher algorithm module (x86_64).
1277 Camellia is a symmetric key block cipher developed jointly
1278 at NTT and Mitsubishi Electric Corporation.
1280 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1283 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1285 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1286 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1287 depends on X86 && 64BIT
1288 select CRYPTO_SKCIPHER
1289 select CRYPTO_CAMELLIA_X86_64
1293 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1295 Camellia is a symmetric key block cipher developed jointly
1296 at NTT and Mitsubishi Electric Corporation.
1298 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1301 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1303 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1304 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1305 depends on X86 && 64BIT
1306 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1308 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1310 Camellia is a symmetric key block cipher developed jointly
1311 at NTT and Mitsubishi Electric Corporation.
1313 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1316 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1318 config CRYPTO_CAMELLIA_SPARC64
1319 tristate "Camellia cipher algorithm (SPARC64)"
1321 select CRYPTO_ALGAPI
1322 select CRYPTO_SKCIPHER
1324 Camellia cipher algorithm module (SPARC64).
1326 Camellia is a symmetric key block cipher developed jointly
1327 at NTT and Mitsubishi Electric Corporation.
1329 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1332 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1334 config CRYPTO_CAST_COMMON
1337 Common parts of the CAST cipher algorithms shared by the
1338 generic c and the assembler implementations.
1341 tristate "CAST5 (CAST-128) cipher algorithm"
1342 select CRYPTO_ALGAPI
1343 select CRYPTO_CAST_COMMON
1345 The CAST5 encryption algorithm (synonymous with CAST-128) is
1346 described in RFC2144.
1348 config CRYPTO_CAST5_AVX_X86_64
1349 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1350 depends on X86 && 64BIT
1351 select CRYPTO_SKCIPHER
1353 select CRYPTO_CAST_COMMON
1357 The CAST5 encryption algorithm (synonymous with CAST-128) is
1358 described in RFC2144.
1360 This module provides the Cast5 cipher algorithm that processes
1361 sixteen blocks parallel using the AVX instruction set.
1364 tristate "CAST6 (CAST-256) cipher algorithm"
1365 select CRYPTO_ALGAPI
1366 select CRYPTO_CAST_COMMON
1368 The CAST6 encryption algorithm (synonymous with CAST-256) is
1369 described in RFC2612.
1371 config CRYPTO_CAST6_AVX_X86_64
1372 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1373 depends on X86 && 64BIT
1374 select CRYPTO_SKCIPHER
1376 select CRYPTO_CAST_COMMON
1381 The CAST6 encryption algorithm (synonymous with CAST-256) is
1382 described in RFC2612.
1384 This module provides the Cast6 cipher algorithm that processes
1385 eight blocks parallel using the AVX instruction set.
1388 tristate "DES and Triple DES EDE cipher algorithms"
1389 select CRYPTO_ALGAPI
1390 select CRYPTO_LIB_DES
1392 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1394 config CRYPTO_DES_SPARC64
1395 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1397 select CRYPTO_ALGAPI
1398 select CRYPTO_LIB_DES
1399 select CRYPTO_SKCIPHER
1401 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1402 optimized using SPARC64 crypto opcodes.
1404 config CRYPTO_DES3_EDE_X86_64
1405 tristate "Triple DES EDE cipher algorithm (x86-64)"
1406 depends on X86 && 64BIT
1407 select CRYPTO_SKCIPHER
1408 select CRYPTO_LIB_DES
1411 Triple DES EDE (FIPS 46-3) algorithm.
1413 This module provides implementation of the Triple DES EDE cipher
1414 algorithm that is optimized for x86-64 processors. Two versions of
1415 algorithm are provided; regular processing one input block and
1416 one that processes three blocks parallel.
1418 config CRYPTO_FCRYPT
1419 tristate "FCrypt cipher algorithm"
1420 select CRYPTO_ALGAPI
1421 select CRYPTO_SKCIPHER
1423 FCrypt algorithm used by RxRPC.
1425 config CRYPTO_KHAZAD
1426 tristate "Khazad cipher algorithm"
1427 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1428 select CRYPTO_ALGAPI
1430 Khazad cipher algorithm.
1432 Khazad was a finalist in the initial NESSIE competition. It is
1433 an algorithm optimized for 64-bit processors with good performance
1434 on 32-bit processors. Khazad uses an 128 bit key size.
1437 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1439 config CRYPTO_CHACHA20
1440 tristate "ChaCha stream cipher algorithms"
1441 select CRYPTO_LIB_CHACHA_GENERIC
1442 select CRYPTO_SKCIPHER
1444 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1446 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1447 Bernstein and further specified in RFC7539 for use in IETF protocols.
1448 This is the portable C implementation of ChaCha20. See also:
1449 <https://cr.yp.to/chacha/chacha-20080128.pdf>
1451 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1452 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1453 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1454 while provably retaining ChaCha20's security. See also:
1455 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1457 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1458 reduced security margin but increased performance. It can be needed
1459 in some performance-sensitive scenarios.
1461 config CRYPTO_CHACHA20_X86_64
1462 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1463 depends on X86 && 64BIT
1464 select CRYPTO_SKCIPHER
1465 select CRYPTO_LIB_CHACHA_GENERIC
1466 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1468 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1469 XChaCha20, and XChaCha12 stream ciphers.
1471 config CRYPTO_CHACHA_MIPS
1472 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1473 depends on CPU_MIPS32_R2
1474 select CRYPTO_SKCIPHER
1475 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1478 tristate "SEED cipher algorithm"
1479 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1480 select CRYPTO_ALGAPI
1482 SEED cipher algorithm (RFC4269).
1484 SEED is a 128-bit symmetric key block cipher that has been
1485 developed by KISA (Korea Information Security Agency) as a
1486 national standard encryption algorithm of the Republic of Korea.
1487 It is a 16 round block cipher with the key size of 128 bit.
1490 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1492 config CRYPTO_SERPENT
1493 tristate "Serpent cipher algorithm"
1494 select CRYPTO_ALGAPI
1496 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1498 Keys are allowed to be from 0 to 256 bits in length, in steps
1502 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1504 config CRYPTO_SERPENT_SSE2_X86_64
1505 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1506 depends on X86 && 64BIT
1507 select CRYPTO_SKCIPHER
1508 select CRYPTO_SERPENT
1512 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1514 Keys are allowed to be from 0 to 256 bits in length, in steps
1517 This module provides Serpent cipher algorithm that processes eight
1518 blocks parallel using SSE2 instruction set.
1521 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1523 config CRYPTO_SERPENT_SSE2_586
1524 tristate "Serpent cipher algorithm (i586/SSE2)"
1525 depends on X86 && !64BIT
1526 select CRYPTO_SKCIPHER
1527 select CRYPTO_SERPENT
1531 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1533 Keys are allowed to be from 0 to 256 bits in length, in steps
1536 This module provides Serpent cipher algorithm that processes four
1537 blocks parallel using SSE2 instruction set.
1540 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1542 config CRYPTO_SERPENT_AVX_X86_64
1543 tristate "Serpent cipher algorithm (x86_64/AVX)"
1544 depends on X86 && 64BIT
1545 select CRYPTO_SKCIPHER
1546 select CRYPTO_SERPENT
1551 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1553 Keys are allowed to be from 0 to 256 bits in length, in steps
1556 This module provides the Serpent cipher algorithm that processes
1557 eight blocks parallel using the AVX instruction set.
1560 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1562 config CRYPTO_SERPENT_AVX2_X86_64
1563 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1564 depends on X86 && 64BIT
1565 select CRYPTO_SERPENT_AVX_X86_64
1567 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1569 Keys are allowed to be from 0 to 256 bits in length, in steps
1572 This module provides Serpent cipher algorithm that processes 16
1573 blocks parallel using AVX2 instruction set.
1576 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1581 config CRYPTO_SM4_GENERIC
1582 tristate "SM4 cipher algorithm"
1583 select CRYPTO_ALGAPI
1586 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1588 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1589 Organization of State Commercial Administration of China (OSCCA)
1590 as an authorized cryptographic algorithms for the use within China.
1592 SMS4 was originally created for use in protecting wireless
1593 networks, and is mandated in the Chinese National Standard for
1594 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1597 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1598 standardized through TC 260 of the Standardization Administration
1599 of the People's Republic of China (SAC).
1601 The input, output, and key of SMS4 are each 128 bits.
1603 See also: <https://eprint.iacr.org/2008/329.pdf>
1607 config CRYPTO_SM4_AESNI_AVX_X86_64
1608 tristate "SM4 cipher algorithm (x86_64/AES-NI/AVX)"
1609 depends on X86 && 64BIT
1610 select CRYPTO_SKCIPHER
1612 select CRYPTO_ALGAPI
1615 SM4 cipher algorithms (OSCCA GB/T 32907-2016) (x86_64/AES-NI/AVX).
1617 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1618 Organization of State Commercial Administration of China (OSCCA)
1619 as an authorized cryptographic algorithms for the use within China.
1621 This is SM4 optimized implementation using AES-NI/AVX/x86_64
1622 instruction set for block cipher. Through two affine transforms,
1623 we can use the AES S-Box to simulate the SM4 S-Box to achieve the
1624 effect of instruction acceleration.
1628 config CRYPTO_SM4_AESNI_AVX2_X86_64
1629 tristate "SM4 cipher algorithm (x86_64/AES-NI/AVX2)"
1630 depends on X86 && 64BIT
1631 select CRYPTO_SKCIPHER
1633 select CRYPTO_ALGAPI
1635 select CRYPTO_SM4_AESNI_AVX_X86_64
1637 SM4 cipher algorithms (OSCCA GB/T 32907-2016) (x86_64/AES-NI/AVX2).
1639 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1640 Organization of State Commercial Administration of China (OSCCA)
1641 as an authorized cryptographic algorithms for the use within China.
1643 This is SM4 optimized implementation using AES-NI/AVX2/x86_64
1644 instruction set for block cipher. Through two affine transforms,
1645 we can use the AES S-Box to simulate the SM4 S-Box to achieve the
1646 effect of instruction acceleration.
1651 tristate "TEA, XTEA and XETA cipher algorithms"
1652 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1653 select CRYPTO_ALGAPI
1655 TEA cipher algorithm.
1657 Tiny Encryption Algorithm is a simple cipher that uses
1658 many rounds for security. It is very fast and uses
1661 Xtendend Tiny Encryption Algorithm is a modification to
1662 the TEA algorithm to address a potential key weakness
1663 in the TEA algorithm.
1665 Xtendend Encryption Tiny Algorithm is a mis-implementation
1666 of the XTEA algorithm for compatibility purposes.
1668 config CRYPTO_TWOFISH
1669 tristate "Twofish cipher algorithm"
1670 select CRYPTO_ALGAPI
1671 select CRYPTO_TWOFISH_COMMON
1673 Twofish cipher algorithm.
1675 Twofish was submitted as an AES (Advanced Encryption Standard)
1676 candidate cipher by researchers at CounterPane Systems. It is a
1677 16 round block cipher supporting key sizes of 128, 192, and 256
1681 <https://www.schneier.com/twofish.html>
1683 config CRYPTO_TWOFISH_COMMON
1686 Common parts of the Twofish cipher algorithm shared by the
1687 generic c and the assembler implementations.
1689 config CRYPTO_TWOFISH_586
1690 tristate "Twofish cipher algorithms (i586)"
1691 depends on (X86 || UML_X86) && !64BIT
1692 select CRYPTO_ALGAPI
1693 select CRYPTO_TWOFISH_COMMON
1696 Twofish cipher algorithm.
1698 Twofish was submitted as an AES (Advanced Encryption Standard)
1699 candidate cipher by researchers at CounterPane Systems. It is a
1700 16 round block cipher supporting key sizes of 128, 192, and 256
1704 <https://www.schneier.com/twofish.html>
1706 config CRYPTO_TWOFISH_X86_64
1707 tristate "Twofish cipher algorithm (x86_64)"
1708 depends on (X86 || UML_X86) && 64BIT
1709 select CRYPTO_ALGAPI
1710 select CRYPTO_TWOFISH_COMMON
1713 Twofish cipher algorithm (x86_64).
1715 Twofish was submitted as an AES (Advanced Encryption Standard)
1716 candidate cipher by researchers at CounterPane Systems. It is a
1717 16 round block cipher supporting key sizes of 128, 192, and 256
1721 <https://www.schneier.com/twofish.html>
1723 config CRYPTO_TWOFISH_X86_64_3WAY
1724 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1725 depends on X86 && 64BIT
1726 select CRYPTO_SKCIPHER
1727 select CRYPTO_TWOFISH_COMMON
1728 select CRYPTO_TWOFISH_X86_64
1730 Twofish cipher algorithm (x86_64, 3-way parallel).
1732 Twofish was submitted as an AES (Advanced Encryption Standard)
1733 candidate cipher by researchers at CounterPane Systems. It is a
1734 16 round block cipher supporting key sizes of 128, 192, and 256
1737 This module provides Twofish cipher algorithm that processes three
1738 blocks parallel, utilizing resources of out-of-order CPUs better.
1741 <https://www.schneier.com/twofish.html>
1743 config CRYPTO_TWOFISH_AVX_X86_64
1744 tristate "Twofish cipher algorithm (x86_64/AVX)"
1745 depends on X86 && 64BIT
1746 select CRYPTO_SKCIPHER
1748 select CRYPTO_TWOFISH_COMMON
1749 select CRYPTO_TWOFISH_X86_64
1750 select CRYPTO_TWOFISH_X86_64_3WAY
1753 Twofish cipher algorithm (x86_64/AVX).
1755 Twofish was submitted as an AES (Advanced Encryption Standard)
1756 candidate cipher by researchers at CounterPane Systems. It is a
1757 16 round block cipher supporting key sizes of 128, 192, and 256
1760 This module provides the Twofish cipher algorithm that processes
1761 eight blocks parallel using the AVX Instruction Set.
1764 <https://www.schneier.com/twofish.html>
1766 comment "Compression"
1768 config CRYPTO_DEFLATE
1769 tristate "Deflate compression algorithm"
1770 select CRYPTO_ALGAPI
1771 select CRYPTO_ACOMP2
1775 This is the Deflate algorithm (RFC1951), specified for use in
1776 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1778 You will most probably want this if using IPSec.
1781 tristate "LZO compression algorithm"
1782 select CRYPTO_ALGAPI
1783 select CRYPTO_ACOMP2
1785 select LZO_DECOMPRESS
1787 This is the LZO algorithm.
1790 tristate "842 compression algorithm"
1791 select CRYPTO_ALGAPI
1792 select CRYPTO_ACOMP2
1794 select 842_DECOMPRESS
1796 This is the 842 algorithm.
1799 tristate "LZ4 compression algorithm"
1800 select CRYPTO_ALGAPI
1801 select CRYPTO_ACOMP2
1803 select LZ4_DECOMPRESS
1805 This is the LZ4 algorithm.
1808 tristate "LZ4HC compression algorithm"
1809 select CRYPTO_ALGAPI
1810 select CRYPTO_ACOMP2
1811 select LZ4HC_COMPRESS
1812 select LZ4_DECOMPRESS
1814 This is the LZ4 high compression mode algorithm.
1817 tristate "Zstd compression algorithm"
1818 select CRYPTO_ALGAPI
1819 select CRYPTO_ACOMP2
1820 select ZSTD_COMPRESS
1821 select ZSTD_DECOMPRESS
1823 This is the zstd algorithm.
1825 comment "Random Number Generation"
1827 config CRYPTO_ANSI_CPRNG
1828 tristate "Pseudo Random Number Generation for Cryptographic modules"
1832 This option enables the generic pseudo random number generator
1833 for cryptographic modules. Uses the Algorithm specified in
1834 ANSI X9.31 A.2.4. Note that this option must be enabled if
1835 CRYPTO_FIPS is selected
1837 menuconfig CRYPTO_DRBG_MENU
1838 tristate "NIST SP800-90A DRBG"
1840 NIST SP800-90A compliant DRBG. In the following submenu, one or
1841 more of the DRBG types must be selected.
1845 config CRYPTO_DRBG_HMAC
1849 select CRYPTO_SHA512
1851 config CRYPTO_DRBG_HASH
1852 bool "Enable Hash DRBG"
1853 select CRYPTO_SHA256
1855 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1857 config CRYPTO_DRBG_CTR
1858 bool "Enable CTR DRBG"
1862 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1866 default CRYPTO_DRBG_MENU
1868 select CRYPTO_JITTERENTROPY
1870 endif # if CRYPTO_DRBG_MENU
1872 config CRYPTO_JITTERENTROPY
1873 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1876 The Jitterentropy RNG is a noise that is intended
1877 to provide seed to another RNG. The RNG does not
1878 perform any cryptographic whitening of the generated
1879 random numbers. This Jitterentropy RNG registers with
1880 the kernel crypto API and can be used by any caller.
1882 config CRYPTO_KDF800108_CTR
1885 select CRYPTO_SHA256
1887 config CRYPTO_USER_API
1890 config CRYPTO_USER_API_HASH
1891 tristate "User-space interface for hash algorithms"
1894 select CRYPTO_USER_API
1896 This option enables the user-spaces interface for hash
1899 config CRYPTO_USER_API_SKCIPHER
1900 tristate "User-space interface for symmetric key cipher algorithms"
1902 select CRYPTO_SKCIPHER
1903 select CRYPTO_USER_API
1905 This option enables the user-spaces interface for symmetric
1906 key cipher algorithms.
1908 config CRYPTO_USER_API_RNG
1909 tristate "User-space interface for random number generator algorithms"
1912 select CRYPTO_USER_API
1914 This option enables the user-spaces interface for random
1915 number generator algorithms.
1917 config CRYPTO_USER_API_RNG_CAVP
1918 bool "Enable CAVP testing of DRBG"
1919 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1921 This option enables extra API for CAVP testing via the user-space
1922 interface: resetting of DRBG entropy, and providing Additional Data.
1923 This should only be enabled for CAVP testing. You should say
1924 no unless you know what this is.
1926 config CRYPTO_USER_API_AEAD
1927 tristate "User-space interface for AEAD cipher algorithms"
1930 select CRYPTO_SKCIPHER
1932 select CRYPTO_USER_API
1934 This option enables the user-spaces interface for AEAD
1937 config CRYPTO_USER_API_ENABLE_OBSOLETE
1938 bool "Enable obsolete cryptographic algorithms for userspace"
1939 depends on CRYPTO_USER_API
1942 Allow obsolete cryptographic algorithms to be selected that have
1943 already been phased out from internal use by the kernel, and are
1944 only useful for userspace clients that still rely on them.
1947 bool "Crypto usage statistics for User-space"
1948 depends on CRYPTO_USER
1950 This option enables the gathering of crypto stats.
1952 - encrypt/decrypt size and numbers of symmeric operations
1953 - compress/decompress size and numbers of compress operations
1954 - size and numbers of hash operations
1955 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1956 - generate/seed numbers for rng operations
1958 config CRYPTO_HASH_INFO
1961 source "drivers/crypto/Kconfig"
1962 source "crypto/asymmetric_keys/Kconfig"
1963 source "certs/Kconfig"