projects/linux·blob master · refs

1379 lines · 38.3 KiB

1# SPDX-License-Identifier: GPL-2.0
2#
3# Generic algorithms support
4#
5
6#
7# async_tx api: hardware offloaded memory transfer/transform support
8#
9source "crypto/async_tx/Kconfig"
10
11#
12# Cryptographic API Configuration
13#
14menuconfig CRYPTO
15 tristate "Cryptographic API"
16 select CRYPTO_LIB_UTILS
17 help
18 This option provides the core Cryptographic API.
19
20if CRYPTO
21
22menu "Crypto core or helper"
23
24config CRYPTO_FIPS
25 bool "FIPS 200 compliance"
26 depends on CRYPTO_DRBG=y && CRYPTO_SELFTESTS
27 depends on (MODULE_SIG || !MODULES)
28 help
29 This option enables the fips boot option which is
30 required if you want the system to operate in a FIPS 200
31 certification. You should say no unless you know what
32 this is.
33
34config CRYPTO_FIPS_NAME
35 string "FIPS Module Name"
36 default "Linux Kernel Cryptographic API"
37 depends on CRYPTO_FIPS
38 help
39 This option sets the FIPS Module name reported by the Crypto API via
40 the /proc/sys/crypto/fips_name file.
41
42config CRYPTO_FIPS_CUSTOM_VERSION
43 bool "Use Custom FIPS Module Version"
44 depends on CRYPTO_FIPS
45 default n
46
47config CRYPTO_FIPS_VERSION
48 string "FIPS Module Version"
49 default "(none)"
50 depends on CRYPTO_FIPS_CUSTOM_VERSION
51 help
52 This option provides the ability to override the FIPS Module Version.
53 By default the KERNELRELEASE value is used.
54
55config CRYPTO_ALGAPI
56 tristate
57 select CRYPTO_ALGAPI2
58 help
59 This option provides the API for cryptographic algorithms.
60
61config CRYPTO_ALGAPI2
62 tristate
63
64config CRYPTO_AEAD
65 tristate
66 select CRYPTO_AEAD2
67 select CRYPTO_ALGAPI
68
69config CRYPTO_AEAD2
70 tristate
71 select CRYPTO_ALGAPI2
72
73config CRYPTO_SIG
74 tristate
75 select CRYPTO_SIG2
76 select CRYPTO_ALGAPI
77
78config CRYPTO_SIG2
79 tristate
80 select CRYPTO_ALGAPI2
81
82config CRYPTO_SKCIPHER
83 tristate
84 select CRYPTO_SKCIPHER2
85 select CRYPTO_ALGAPI
86 select CRYPTO_ECB
87
88config CRYPTO_SKCIPHER2
89 tristate
90 select CRYPTO_ALGAPI2
91
92config CRYPTO_HASH
93 tristate
94 select CRYPTO_HASH2
95 select CRYPTO_ALGAPI
96
97config CRYPTO_HASH2
98 tristate
99 select CRYPTO_ALGAPI2
100
101config CRYPTO_RNG
102 tristate
103 select CRYPTO_RNG2
104 select CRYPTO_ALGAPI
105
106config CRYPTO_RNG2
107 tristate
108 select CRYPTO_ALGAPI2
109
110config CRYPTO_AKCIPHER2
111 tristate
112 select CRYPTO_ALGAPI2
113
114config CRYPTO_AKCIPHER
115 tristate
116 select CRYPTO_AKCIPHER2
117 select CRYPTO_ALGAPI
118
119config CRYPTO_KPP2
120 tristate
121 select CRYPTO_ALGAPI2
122
123config CRYPTO_KPP
124 tristate
125 select CRYPTO_ALGAPI
126 select CRYPTO_KPP2
127
128config CRYPTO_ACOMP2
129 tristate
130 select CRYPTO_ALGAPI2
131 select SGL_ALLOC
132
133config CRYPTO_ACOMP
134 tristate
135 select CRYPTO_ALGAPI
136 select CRYPTO_ACOMP2
137
138config CRYPTO_MANAGER
139 tristate
140 default CRYPTO_ALGAPI if CRYPTO_SELFTESTS
141 select CRYPTO_MANAGER2
142 help
143 This provides the support for instantiating templates such as
144 cbc(aes), and the support for the crypto self-tests.
145
146config CRYPTO_MANAGER2
147 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
148 select CRYPTO_ACOMP2 if CRYPTO_SELFTESTS
149 select CRYPTO_AEAD2 if CRYPTO_SELFTESTS
150 select CRYPTO_AKCIPHER2 if CRYPTO_SELFTESTS
151 select CRYPTO_SIG2 if CRYPTO_SELFTESTS
152 select CRYPTO_HASH2 if CRYPTO_SELFTESTS
153 select CRYPTO_KPP2 if CRYPTO_SELFTESTS
154 select CRYPTO_RNG2 if CRYPTO_SELFTESTS
155 select CRYPTO_SKCIPHER2 if CRYPTO_SELFTESTS
156
157config CRYPTO_USER
158 tristate "Userspace cryptographic algorithm configuration"
159 depends on NET
160 select CRYPTO_MANAGER
161 select CRYPTO_RNG
162 help
163 Userspace configuration for cryptographic instantiations such as
164 cbc(aes).
165
166config CRYPTO_SELFTESTS
167 bool "Enable cryptographic self-tests"
168 depends on EXPERT
169 help
170 Enable the cryptographic self-tests.
171
172 The cryptographic self-tests run at boot time, or at algorithm
173 registration time if algorithms are dynamically loaded later.
174
175 There are two main use cases for these tests:
176
177 - Development and pre-release testing. In this case, also enable
178 CRYPTO_SELFTESTS_FULL to get the full set of tests. All crypto code
179 in the kernel is expected to pass the full set of tests.
180
181 - Production kernels, to help prevent buggy drivers from being used
182 and/or meet FIPS 140-3 pre-operational testing requirements. In
183 this case, enable CRYPTO_SELFTESTS but not CRYPTO_SELFTESTS_FULL.
184
185config CRYPTO_SELFTESTS_FULL
186 bool "Enable the full set of cryptographic self-tests"
187 depends on CRYPTO_SELFTESTS
188 help
189 Enable the full set of cryptographic self-tests for each algorithm.
190
191 The full set of tests should be enabled for development and
192 pre-release testing, but not in production kernels.
193
194 All crypto code in the kernel is expected to pass the full tests.
195
196config CRYPTO_NULL
197 tristate "Null algorithms"
198 select CRYPTO_ALGAPI
199 select CRYPTO_SKCIPHER
200 select CRYPTO_HASH
201 help
202 These are 'Null' algorithms, used by IPsec, which do nothing.
203
204config CRYPTO_PCRYPT
205 tristate "Parallel crypto engine"
206 depends on SMP
207 select PADATA
208 select CRYPTO_MANAGER
209 select CRYPTO_AEAD
210 help
211 This converts an arbitrary crypto algorithm into a parallel
212 algorithm that executes in kernel threads.
213
214config CRYPTO_CRYPTD
215 tristate "Software async crypto daemon"
216 select CRYPTO_AEAD
217 select CRYPTO_SKCIPHER
218 select CRYPTO_HASH
219 select CRYPTO_MANAGER
220 help
221 This is a generic software asynchronous crypto daemon that
222 converts an arbitrary synchronous software crypto algorithm
223 into an asynchronous algorithm that executes in a kernel thread.
224
225config CRYPTO_AUTHENC
226 tristate "Authenc support"
227 select CRYPTO_AEAD
228 select CRYPTO_SKCIPHER
229 select CRYPTO_MANAGER
230 select CRYPTO_HASH
231 help
232 Authenc: Combined mode wrapper for IPsec.
233
234 This is required for IPSec ESP (XFRM_ESP).
235
236config CRYPTO_KRB5ENC
237 tristate "Kerberos 5 combined hash+cipher support"
238 select CRYPTO_AEAD
239 select CRYPTO_SKCIPHER
240 select CRYPTO_MANAGER
241 select CRYPTO_HASH
242 help
243 Combined hash and cipher support for Kerberos 5 RFC3961 simplified
244 profile. This is required for Kerberos 5-style encryption, used by
245 sunrpc/NFS and rxrpc/AFS.
246
247config CRYPTO_BENCHMARK
248 tristate "Crypto benchmarking module"
249 depends on m || EXPERT
250 select CRYPTO_AEAD
251 select CRYPTO_HASH
252 select CRYPTO_MANAGER
253 select CRYPTO_SKCIPHER
254 help
255 Quick & dirty crypto benchmarking module.
256
257 This is mainly intended for use by people developing cryptographic
258 algorithms in the kernel. It should not be enabled in production
259 kernels.
260
261config CRYPTO_SIMD
262 tristate
263 select CRYPTO_AEAD
264 select CRYPTO_CRYPTD
265
266config CRYPTO_ENGINE
267 tristate
268 select CRYPTO_AEAD
269 select CRYPTO_AKCIPHER
270 select CRYPTO_HASH
271 select CRYPTO_KPP
272 select CRYPTO_SKCIPHER
273
274endmenu
275
276menu "Public-key cryptography"
277
278config CRYPTO_RSA
279 tristate "RSA (Rivest-Shamir-Adleman)"
280 select CRYPTO_AKCIPHER
281 select CRYPTO_MANAGER
282 select CRYPTO_SIG
283 select MPILIB
284 select ASN1
285 help
286 RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
287
288config CRYPTO_DH
289 tristate "DH (Diffie-Hellman)"
290 select CRYPTO_KPP
291 select MPILIB
292 help
293 DH (Diffie-Hellman) key exchange algorithm
294
295config CRYPTO_DH_RFC7919_GROUPS
296 bool "RFC 7919 FFDHE groups"
297 depends on CRYPTO_DH
298 help
299 FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
300 defined in RFC7919.
301
302 Support these finite-field groups in DH key exchanges:
303 - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
304
305 If unsure, say N.
306
307config CRYPTO_ECC
308 tristate
309
310config CRYPTO_ECDH
311 tristate "ECDH (Elliptic Curve Diffie-Hellman)"
312 select CRYPTO_ECC
313 select CRYPTO_KPP
314 help
315 ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
316 using curves P-192, P-256, and P-384 (FIPS 186)
317
318config CRYPTO_ECDSA
319 tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
320 select CRYPTO_ECC
321 select CRYPTO_SIG
322 select ASN1
323 help
324 ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
325 ISO/IEC 14888-3)
326 using curves P-192, P-256, P-384 and P-521
327
328 Only signature verification is implemented.
329
330config CRYPTO_ECRDSA
331 tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
332 select CRYPTO_ECC
333 select CRYPTO_SIG
334 select CRYPTO_STREEBOG
335 select OID_REGISTRY
336 select ASN1
337 help
338 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
339 RFC 7091, ISO/IEC 14888-3)
340
341 One of the Russian cryptographic standard algorithms (called GOST
342 algorithms). Only signature verification is implemented.
343
344config CRYPTO_MLDSA
345 tristate "ML-DSA (Module-Lattice-Based Digital Signature Algorithm)"
346 select CRYPTO_SIG
347 select CRYPTO_LIB_MLDSA
348 help
349 ML-DSA (Module-Lattice-Based Digital Signature Algorithm) (FIPS-204).
350
351 Only signature verification is implemented.
352
353endmenu
354
355menu "Block ciphers"
356
357config CRYPTO_AES
358 tristate "AES (Advanced Encryption Standard)"
359 select CRYPTO_ALGAPI
360 select CRYPTO_LIB_AES
361 select CRYPTO_LIB_AES_CBC if CRYPTO_CBC != n || CRYPTO_CTS != n
362 select CRYPTO_LIB_AES_CBC_MACS if CRYPTO_CMAC != n || CRYPTO_XCBC != n || CRYPTO_CCM != n
363 select CRYPTO_LIB_AES_CCM if CRYPTO_CCM != n
364 select CRYPTO_LIB_AES_CTR if CRYPTO_CTR != n || CRYPTO_XCTR != n
365 select CRYPTO_LIB_AES_ECB if CRYPTO_ECB != n
366 select CRYPTO_LIB_AES_GCM if CRYPTO_GCM != n
367 select CRYPTO_LIB_AES_XTS if CRYPTO_XTS != n
368 select CRYPTO_AEAD if CRYPTO_GCM != n || CRYPTO_CCM != n
369 select CRYPTO_HASH if CRYPTO_CMAC != n || CRYPTO_XCBC != n || CRYPTO_CCM != n
370 # CRYPTO_SKCIPHER should be selected only if a mode that needs it is
371 # enabled, but that doesn't work due to a recursive dependency caused by
372 # CRYPTO_SKCIPHER selecting CRYPTO_ECB. So just always select it.
373 select CRYPTO_SKCIPHER
374 help
375 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
376
377 Rijndael appears to be consistently a very good performer in
378 both hardware and software across a wide range of computing
379 environments regardless of its use in feedback or non-feedback
380 modes. Its key setup time is excellent, and its key agility is
381 good. Rijndael's very low memory requirements make it very well
382 suited for restricted-space environments, in which it also
383 demonstrates excellent performance. Rijndael's operations are
384 among the easiest to defend against power and timing attacks.
385
386 The AES specifies three key sizes: 128, 192 and 256 bits
387
388config CRYPTO_ANUBIS
389 tristate "Anubis"
390 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
391 select CRYPTO_ALGAPI
392 help
393 Anubis cipher algorithm
394
395 Anubis is a variable key length cipher which can use keys from
396 128 bits to 320 bits in length. It was evaluated as a entrant
397 in the NESSIE competition.
398
399 See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
400 for further information.
401
402config CRYPTO_ARIA
403 tristate "ARIA"
404 select CRYPTO_ALGAPI
405 help
406 ARIA cipher algorithm (RFC5794)
407
408 ARIA is a standard encryption algorithm of the Republic of Korea.
409 The ARIA specifies three key sizes and rounds.
410 128-bit: 12 rounds.
411 192-bit: 14 rounds.
412 256-bit: 16 rounds.
413
414 See:
415 https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
416
417config CRYPTO_BLOWFISH
418 tristate "Blowfish"
419 select CRYPTO_ALGAPI
420 select CRYPTO_BLOWFISH_COMMON
421 help
422 Blowfish cipher algorithm, by Bruce Schneier
423
424 This is a variable key length cipher which can use keys from 32
425 bits to 448 bits in length. It's fast, simple and specifically
426 designed for use on "large microprocessors".
427
428 See https://www.schneier.com/blowfish.html for further information.
429
430config CRYPTO_BLOWFISH_COMMON
431 tristate
432 help
433 Common parts of the Blowfish cipher algorithm shared by the
434 generic c and the assembler implementations.
435
436config CRYPTO_CAMELLIA
437 tristate "Camellia"
438 select CRYPTO_ALGAPI
439 help
440 Camellia cipher algorithms (ISO/IEC 18033-3)
441
442 Camellia is a symmetric key block cipher developed jointly
443 at NTT and Mitsubishi Electric Corporation.
444
445 The Camellia specifies three key sizes: 128, 192 and 256 bits.
446
447 See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
448
449config CRYPTO_CAST_COMMON
450 tristate
451 help
452 Common parts of the CAST cipher algorithms shared by the
453 generic c and the assembler implementations.
454
455config CRYPTO_CAST5
456 tristate "CAST5 (CAST-128)"
457 select CRYPTO_ALGAPI
458 select CRYPTO_CAST_COMMON
459 help
460 CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
461
462config CRYPTO_CAST6
463 tristate "CAST6 (CAST-256)"
464 select CRYPTO_ALGAPI
465 select CRYPTO_CAST_COMMON
466 help
467 CAST6 (CAST-256) encryption algorithm (RFC2612)
468
469config CRYPTO_DES
470 tristate "DES and Triple DES EDE"
471 select CRYPTO_ALGAPI
472 select CRYPTO_LIB_DES
473 help
474 DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
475 Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
476 cipher algorithms
477
478config CRYPTO_KHAZAD
479 tristate "Khazad"
480 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
481 select CRYPTO_ALGAPI
482 help
483 Khazad cipher algorithm
484
485 Khazad was a finalist in the initial NESSIE competition. It is
486 an algorithm optimized for 64-bit processors with good performance
487 on 32-bit processors. Khazad uses an 128 bit key size.
488
489 See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
490 for further information.
491
492config CRYPTO_SEED
493 tristate "SEED"
494 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
495 select CRYPTO_ALGAPI
496 help
497 SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
498
499 SEED is a 128-bit symmetric key block cipher that has been
500 developed by KISA (Korea Information Security Agency) as a
501 national standard encryption algorithm of the Republic of Korea.
502 It is a 16 round block cipher with the key size of 128 bit.
503
504 See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
505 for further information.
506
507config CRYPTO_SERPENT
508 tristate "Serpent"
509 select CRYPTO_ALGAPI
510 help
511 Serpent cipher algorithm, by Anderson, Biham & Knudsen
512
513 Keys are allowed to be from 0 to 256 bits in length, in steps
514 of 8 bits.
515
516 See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
517
518config CRYPTO_SM4
519 tristate
520
521config CRYPTO_SM4_GENERIC
522 tristate "SM4 (ShangMi 4)"
523 select CRYPTO_ALGAPI
524 select CRYPTO_SM4
525 help
526 SM4 cipher algorithms (OSCCA GB/T 32907-2016,
527 ISO/IEC 18033-3:2010/Amd 1:2021)
528
529 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
530 Organization of State Commercial Administration of China (OSCCA)
531 as an authorized cryptographic algorithms for the use within China.
532
533 SMS4 was originally created for use in protecting wireless
534 networks, and is mandated in the Chinese National Standard for
535 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
536 (GB.15629.11-2003).
537
538 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
539 standardized through TC 260 of the Standardization Administration
540 of the People's Republic of China (SAC).
541
542 The input, output, and key of SMS4 are each 128 bits.
543
544 See https://eprint.iacr.org/2008/329.pdf for further information.
545
546 If unsure, say N.
547
548config CRYPTO_TEA
549 tristate "TEA, XTEA and XETA"
550 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
551 select CRYPTO_ALGAPI
552 help
553 TEA (Tiny Encryption Algorithm) cipher algorithms
554
555 Tiny Encryption Algorithm is a simple cipher that uses
556 many rounds for security. It is very fast and uses
557 little memory.
558
559 Xtendend Tiny Encryption Algorithm is a modification to
560 the TEA algorithm to address a potential key weakness
561 in the TEA algorithm.
562
563 Xtendend Encryption Tiny Algorithm is a mis-implementation
564 of the XTEA algorithm for compatibility purposes.
565
566config CRYPTO_TWOFISH
567 tristate "Twofish"
568 select CRYPTO_ALGAPI
569 select CRYPTO_TWOFISH_COMMON
570 help
571 Twofish cipher algorithm
572
573 Twofish was submitted as an AES (Advanced Encryption Standard)
574 candidate cipher by researchers at CounterPane Systems. It is a
575 16 round block cipher supporting key sizes of 128, 192, and 256
576 bits.
577
578 See https://www.schneier.com/twofish.html for further information.
579
580config CRYPTO_TWOFISH_COMMON
581 tristate
582 help
583 Common parts of the Twofish cipher algorithm shared by the
584 generic c and the assembler implementations.
585
586endmenu
587
588menu "Length-preserving ciphers and modes"
589
590config CRYPTO_ADIANTUM
591 tristate "Adiantum"
592 select CRYPTO_CHACHA20
593 select CRYPTO_LIB_NH
594 select CRYPTO_LIB_POLY1305
595 select CRYPTO_LIB_POLY1305_GENERIC
596 select CRYPTO_MANAGER
597 help
598 Adiantum tweakable, length-preserving encryption mode
599
600 Designed for fast and secure disk encryption, especially on
601 CPUs without dedicated crypto instructions. It encrypts
602 each sector using the XChaCha12 stream cipher, two passes of
603 an ε-almost-∆-universal hash function, and an invocation of
604 the AES-256 block cipher on a single 16-byte block. On CPUs
605 without AES instructions, Adiantum is much faster than
606 AES-XTS.
607
608 Adiantum's security is provably reducible to that of its
609 underlying stream and block ciphers, subject to a security
610 bound. Unlike XTS, Adiantum is a true wide-block encryption
611 mode, so it actually provides an even stronger notion of
612 security than XTS, subject to the security bound.
613
614 If unsure, say N.
615
616config CRYPTO_ARC4
617 tristate "ARC4 (Alleged Rivest Cipher 4)"
618 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
619 select CRYPTO_SKCIPHER
620 select CRYPTO_LIB_ARC4
621 help
622 ARC4 cipher algorithm
623
624 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
625 bits in length. This algorithm is required for driver-based
626 WEP, but it should not be for other purposes because of the
627 weakness of the algorithm.
628
629config CRYPTO_CHACHA20
630 tristate "ChaCha"
631 select CRYPTO_LIB_CHACHA
632 select CRYPTO_SKCIPHER
633 help
634 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
635
636 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
637 Bernstein and further specified in RFC7539 for use in IETF protocols.
638 This is the portable C implementation of ChaCha20. See
639 https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
640
641 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
642 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
643 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
644 while provably retaining ChaCha20's security. See
645 https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
646
647 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
648 reduced security margin but increased performance. It can be needed
649 in some performance-sensitive scenarios.
650
651config CRYPTO_CBC
652 tristate "CBC (Cipher Block Chaining)"
653 select CRYPTO_SKCIPHER
654 select CRYPTO_MANAGER
655 help
656 CBC (Cipher Block Chaining) mode (NIST SP800-38A)
657
658 This block cipher mode is required for IPSec ESP (XFRM_ESP).
659
660config CRYPTO_CTR
661 tristate "CTR (Counter)"
662 select CRYPTO_SKCIPHER
663 select CRYPTO_MANAGER
664 help
665 CTR (Counter) mode (NIST SP800-38A)
666
667config CRYPTO_CTS
668 tristate "CTS (Cipher Text Stealing)"
669 select CRYPTO_SKCIPHER
670 select CRYPTO_MANAGER
671 help
672 CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
673 Addendum to SP800-38A (October 2010))
674
675 This mode is required for Kerberos gss mechanism support
676 for AES encryption.
677
678config CRYPTO_ECB
679 tristate "ECB (Electronic Codebook)"
680 select CRYPTO_SKCIPHER2
681 select CRYPTO_MANAGER
682 help
683 ECB (Electronic Codebook) mode (NIST SP800-38A)
684
685config CRYPTO_HCTR2
686 tristate "HCTR2"
687 select CRYPTO_XCTR
688 select CRYPTO_LIB_GF128HASH
689 select CRYPTO_MANAGER
690 help
691 HCTR2 length-preserving encryption mode
692
693 A mode for storage encryption that is efficient on processors with
694 instructions to accelerate AES and carryless multiplication, e.g.
695 x86 processors with AES-NI and CLMUL, and ARM processors with the
696 ARMv8 crypto extensions.
697
698 See https://eprint.iacr.org/2021/1441
699
700config CRYPTO_LRW
701 tristate "LRW (Liskov Rivest Wagner)"
702 select CRYPTO_LIB_GF128MUL
703 select CRYPTO_SKCIPHER
704 select CRYPTO_MANAGER
705 select CRYPTO_ECB
706 help
707 LRW (Liskov Rivest Wagner) mode
708
709 A tweakable, non malleable, non movable
710 narrow block cipher mode for dm-crypt. Use it with cipher
711 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
712 The first 128, 192 or 256 bits in the key are used for AES and the
713 rest is used to tie each cipher block to its logical position.
714
715 See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
716
717config CRYPTO_XCTR
718 tristate
719 select CRYPTO_SKCIPHER
720 select CRYPTO_MANAGER
721 help
722 XCTR (XOR Counter) mode for HCTR2
723
724 This blockcipher mode is a variant of CTR mode using XORs and little-endian
725 addition rather than big-endian arithmetic.
726
727 XCTR mode is used to implement HCTR2.
728
729config CRYPTO_XTS
730 tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
731 select CRYPTO_SKCIPHER
732 select CRYPTO_MANAGER
733 select CRYPTO_ECB
734 help
735 XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
736 and IEEE 1619)
737
738 Use with aes-xts-plain, key size 256, 384 or 512 bits. This
739 implementation currently can't handle a sectorsize which is not a
740 multiple of 16 bytes.
741
742endmenu
743
744menu "AEAD (authenticated encryption with associated data) ciphers"
745
746config CRYPTO_AEGIS128
747 tristate "AEGIS-128"
748 select CRYPTO_AEAD
749 select CRYPTO_LIB_AES # for AES S-box tables
750 help
751 AEGIS-128 AEAD algorithm
752
753config CRYPTO_AEGIS128_SIMD
754 bool "AEGIS-128 (arm NEON, arm64 NEON)"
755 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
756 default y
757 help
758 AEGIS-128 AEAD algorithm
759
760 Architecture: arm or arm64 using:
761 - NEON (Advanced SIMD) extension
762
763config CRYPTO_CHACHA20POLY1305
764 tristate "ChaCha20-Poly1305"
765 select CRYPTO_CHACHA20
766 select CRYPTO_AEAD
767 select CRYPTO_LIB_POLY1305
768 select CRYPTO_MANAGER
769 help
770 ChaCha20 stream cipher and Poly1305 authenticator combined
771 mode (RFC8439)
772
773config CRYPTO_CCM
774 tristate "CCM (Counter with Cipher Block Chaining-MAC)"
775 select CRYPTO_CTR
776 select CRYPTO_HASH
777 select CRYPTO_AEAD
778 select CRYPTO_MANAGER
779 help
780 CCM (Counter with Cipher Block Chaining-Message Authentication Code)
781 authenticated encryption mode (NIST SP800-38C)
782
783config CRYPTO_GCM
784 tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
785 select CRYPTO_CTR
786 select CRYPTO_AEAD
787 select CRYPTO_LIB_GF128HASH
788 select CRYPTO_MANAGER
789 help
790 GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
791 (GCM Message Authentication Code) (NIST SP800-38D)
792
793 This is required for IPSec ESP (XFRM_ESP).
794
795config CRYPTO_GENIV
796 tristate
797 select CRYPTO_AEAD
798 select CRYPTO_MANAGER
799
800config CRYPTO_SEQIV
801 tristate "Sequence Number IV Generator"
802 select CRYPTO_GENIV
803 help
804 Sequence Number IV generator
805
806 This IV generator generates an IV based on a sequence number by
807 xoring it with a salt. This algorithm is mainly useful for CTR.
808
809 This is required for IPsec ESP (XFRM_ESP).
810
811config CRYPTO_ECHAINIV
812 tristate "Encrypted Chain IV Generator"
813 select CRYPTO_GENIV
814 help
815 Encrypted Chain IV generator
816
817 This IV generator generates an IV based on the encryption of
818 a sequence number xored with a salt. This is the default
819 algorithm for CBC.
820
821config CRYPTO_ESSIV
822 tristate "Encrypted Salt-Sector IV Generator"
823 select CRYPTO_AUTHENC
824 help
825 Encrypted Salt-Sector IV generator
826
827 This IV generator is used in some cases by fscrypt and/or
828 dm-crypt. It uses the hash of the block encryption key as the
829 symmetric key for a block encryption pass applied to the input
830 IV, making low entropy IV sources more suitable for block
831 encryption.
832
833 This driver implements a crypto API template that can be
834 instantiated either as an skcipher or as an AEAD (depending on the
835 type of the first template argument), and which defers encryption
836 and decryption requests to the encapsulated cipher after applying
837 ESSIV to the input IV. Note that in the AEAD case, it is assumed
838 that the keys are presented in the same format used by the authenc
839 template, and that the IV appears at the end of the authenticated
840 associated data (AAD) region (which is how dm-crypt uses it.)
841
842 Note that the use of ESSIV is not recommended for new deployments,
843 and so this only needs to be enabled when interoperability with
844 existing encrypted volumes of filesystems is required, or when
845 building for a particular system that requires it (e.g., when
846 the SoC in question has accelerated CBC but not XTS, making CBC
847 combined with ESSIV the only feasible mode for h/w accelerated
848 block encryption)
849
850endmenu
851
852menu "Hashes, digests, and MACs"
853
854config CRYPTO_BLAKE2B
855 tristate "BLAKE2b"
856 select CRYPTO_HASH
857 select CRYPTO_LIB_BLAKE2B
858 help
859 BLAKE2b cryptographic hash function (RFC 7693)
860
861 BLAKE2b is optimized for 64-bit platforms and can produce digests
862 of any size between 1 and 64 bytes. The keyed hash is also implemented.
863
864 This module provides the following algorithms:
865 - blake2b-160
866 - blake2b-256
867 - blake2b-384
868 - blake2b-512
869
870 See https://blake2.net for further information.
871
872config CRYPTO_CMAC
873 tristate "CMAC (Cipher-based MAC)"
874 select CRYPTO_HASH
875 select CRYPTO_MANAGER
876 help
877 CMAC (Cipher-based Message Authentication Code) authentication
878 mode (NIST SP800-38B and IETF RFC4493)
879
880config CRYPTO_HMAC
881 tristate "HMAC (Keyed-Hash MAC)"
882 select CRYPTO_HASH
883 select CRYPTO_MANAGER
884 help
885 HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
886 RFC2104)
887
888 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
889
890config CRYPTO_MD4
891 tristate "MD4"
892 select CRYPTO_HASH
893 help
894 MD4 message digest algorithm (RFC1320)
895
896config CRYPTO_MD5
897 tristate "MD5"
898 select CRYPTO_HASH
899 select CRYPTO_LIB_MD5
900 help
901 MD5 message digest algorithm (RFC1321), including HMAC support.
902
903config CRYPTO_RMD160
904 tristate "RIPEMD-160"
905 select CRYPTO_HASH
906 help
907 RIPEMD-160 hash function (ISO/IEC 10118-3)
908
909 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
910 to be used as a secure replacement for the 128-bit hash functions
911 MD4, MD5 and its predecessor RIPEMD
912 (not to be confused with RIPEMD-128).
913
914 Its speed is comparable to SHA-1 and there are no known attacks
915 against RIPEMD-160.
916
917 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
918 See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
919 for further information.
920
921config CRYPTO_SHA1
922 tristate "SHA-1"
923 select CRYPTO_HASH
924 select CRYPTO_LIB_SHA1
925 help
926 SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3), including
927 HMAC support.
928
929config CRYPTO_SHA256
930 tristate "SHA-224 and SHA-256"
931 select CRYPTO_HASH
932 select CRYPTO_LIB_SHA256
933 help
934 SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC
935 10118-3), including HMAC support.
936
937 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
938
939config CRYPTO_SHA512
940 tristate "SHA-384 and SHA-512"
941 select CRYPTO_HASH
942 select CRYPTO_LIB_SHA512
943 help
944 SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC
945 10118-3), including HMAC support.
946
947config CRYPTO_SHA3
948 tristate "SHA-3"
949 select CRYPTO_HASH
950 select CRYPTO_LIB_SHA3
951 help
952 SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
953
954config CRYPTO_SM3
955 tristate "SM3 (ShangMi 3)"
956 select CRYPTO_HASH
957 select CRYPTO_LIB_SM3
958 help
959 SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
960
961 This is part of the Chinese Commercial Cryptography suite.
962
963 References:
964 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
965 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
966
967config CRYPTO_STREEBOG
968 tristate "Streebog"
969 select CRYPTO_HASH
970 help
971 Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
972
973 This is one of the Russian cryptographic standard algorithms (called
974 GOST algorithms). This setting enables two hash algorithms with
975 256 and 512 bits output.
976
977 References:
978 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
979 https://tools.ietf.org/html/rfc6986
980
981config CRYPTO_WP512
982 tristate "Whirlpool"
983 select CRYPTO_HASH
984 help
985 Whirlpool hash function (ISO/IEC 10118-3)
986
987 512, 384 and 256-bit hashes.
988
989 Whirlpool-512 is part of the NESSIE cryptographic primitives.
990
991 See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
992 for further information.
993
994config CRYPTO_XCBC
995 tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
996 select CRYPTO_HASH
997 select CRYPTO_MANAGER
998 help
999 XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1000 Code) (RFC3566)
1001
1002config CRYPTO_XXHASH
1003 tristate "xxHash"
1004 select CRYPTO_HASH
1005 select XXHASH
1006 help
1007 xxHash non-cryptographic hash algorithm
1008
1009 Extremely fast, working at speeds close to RAM limits.
1010
1011endmenu
1012
1013menu "CRCs (cyclic redundancy checks)"
1014
1015config CRYPTO_CRC32C
1016 tristate "CRC32c"
1017 select CRYPTO_HASH
1018 select CRC32
1019 help
1020 CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1021
1022 A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1023 by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1024 Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1025 on Communications, Vol. 41, No. 6, June 1993, selected for use with
1026 iSCSI.
1027
1028config CRYPTO_CRC32
1029 tristate "CRC32"
1030 select CRYPTO_HASH
1031 select CRC32
1032 help
1033 CRC32 CRC algorithm (IEEE 802.3)
1034
1035endmenu
1036
1037menu "Compression"
1038
1039config CRYPTO_DEFLATE
1040 tristate "Deflate"
1041 select CRYPTO_ALGAPI
1042 select CRYPTO_ACOMP2
1043 select ZLIB_INFLATE
1044 select ZLIB_DEFLATE
1045 help
1046 Deflate compression algorithm (RFC1951)
1047
1048 Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1049
1050config CRYPTO_LZO
1051 tristate "LZO"
1052 select CRYPTO_ALGAPI
1053 select CRYPTO_ACOMP2
1054 select LZO_COMPRESS
1055 select LZO_DECOMPRESS
1056 help
1057 LZO compression algorithm
1058
1059 See https://www.oberhumer.com/opensource/lzo/ for further information.
1060
1061config CRYPTO_842
1062 tristate "842"
1063 select CRYPTO_ALGAPI
1064 select CRYPTO_ACOMP2
1065 select 842_COMPRESS
1066 select 842_DECOMPRESS
1067 help
1068 842 compression algorithm by IBM
1069
1070 See https://github.com/plauth/lib842 for further information.
1071
1072config CRYPTO_LZ4
1073 tristate "LZ4"
1074 select CRYPTO_ALGAPI
1075 select CRYPTO_ACOMP2
1076 select LZ4_COMPRESS
1077 select LZ4_DECOMPRESS
1078 help
1079 LZ4 compression algorithm
1080
1081 See https://github.com/lz4/lz4 for further information.
1082
1083config CRYPTO_LZ4HC
1084 tristate "LZ4HC"
1085 select CRYPTO_ALGAPI
1086 select CRYPTO_ACOMP2
1087 select LZ4HC_COMPRESS
1088 select LZ4_DECOMPRESS
1089 help
1090 LZ4 high compression mode algorithm
1091
1092 See https://github.com/lz4/lz4 for further information.
1093
1094config CRYPTO_ZSTD
1095 tristate "Zstd"
1096 select CRYPTO_ALGAPI
1097 select CRYPTO_ACOMP2
1098 select ZSTD_COMPRESS
1099 select ZSTD_DECOMPRESS
1100 help
1101 zstd compression algorithm
1102
1103 See https://github.com/facebook/zstd for further information.
1104
1105endmenu
1106
1107menu "Random number generation"
1108
1109config CRYPTO_DRBG
1110 tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1111 select CRYPTO_JITTERENTROPY
1112 select CRYPTO_LIB_SHA512
1113 select CRYPTO_RNG
1114 help
1115 DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1116
1117 Enable this only if you need it for a FIPS 140 certification.
1118 It's otherwise redundant with the kernel's regular RNG.
1119
1120config CRYPTO_JITTERENTROPY
1121 tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1122 select CRYPTO_LIB_SHA3
1123 select CRYPTO_RNG
1124 help
1125 CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1126
1127 A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1128 compliant with NIST SP800-90B) intended to provide a seed to a
1129 deterministic RNG (e.g., per NIST SP800-90C).
1130 This RNG does not perform any cryptographic whitening of the generated
1131 random numbers.
1132
1133 See https://www.chronox.de/jent/
1134
1135if CRYPTO_JITTERENTROPY
1136if CRYPTO_FIPS && EXPERT
1137
1138choice
1139 prompt "CPU Jitter RNG Memory Size"
1140 default CRYPTO_JITTERENTROPY_MEMSIZE_2
1141 help
1142 The Jitter RNG measures the execution time of memory accesses.
1143 Multiple consecutive memory accesses are performed. If the memory
1144 size fits into a cache (e.g. L1), only the memory access timing
1145 to that cache is measured. The closer the cache is to the CPU
1146 the less variations are measured and thus the less entropy is
1147 obtained. Thus, if the memory size fits into the L1 cache, the
1148 obtained entropy is less than if the memory size fits within
1149 L1 + L2, which in turn is less if the memory fits into
1150 L1 + L2 + L3. Thus, by selecting a different memory size,
1151 the entropy rate produced by the Jitter RNG can be modified.
1152
1153 config CRYPTO_JITTERENTROPY_MEMSIZE_2
1154 bool "2048 Bytes (default)"
1155
1156 config CRYPTO_JITTERENTROPY_MEMSIZE_128
1157 bool "128 kBytes"
1158
1159 config CRYPTO_JITTERENTROPY_MEMSIZE_1024
1160 bool "1024 kBytes"
1161
1162 config CRYPTO_JITTERENTROPY_MEMSIZE_8192
1163 bool "8192 kBytes"
1164endchoice
1165
1166config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1167 int
1168 default 64 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1169 default 512 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1170 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1171 default 4096 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1172
1173config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1174 int
1175 default 32 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1176 default 256 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1177 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1178 default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1179
1180config CRYPTO_JITTERENTROPY_OSR
1181 int "CPU Jitter RNG Oversampling Rate"
1182 range 1 15
1183 default 3
1184 help
1185 The Jitter RNG allows the specification of an oversampling rate (OSR).
1186 The Jitter RNG operation requires a fixed amount of timing
1187 measurements to produce one output block of random numbers. The
1188 OSR value is multiplied with the amount of timing measurements to
1189 generate one output block. Thus, the timing measurement is oversampled
1190 by the OSR factor. The oversampling allows the Jitter RNG to operate
1191 on hardware whose timers deliver limited amount of entropy (e.g.
1192 the timer is coarse) by setting the OSR to a higher value. The
1193 trade-off, however, is that the Jitter RNG now requires more time
1194 to generate random numbers.
1195
1196config CRYPTO_JITTERENTROPY_TESTINTERFACE
1197 bool "CPU Jitter RNG Test Interface"
1198 help
1199 The test interface allows a privileged process to capture
1200 the raw unconditioned high resolution time stamp noise that
1201 is collected by the Jitter RNG for statistical analysis. As
1202 this data is used at the same time to generate random bits,
1203 the Jitter RNG operates in an insecure mode as long as the
1204 recording is enabled. This interface therefore is only
1205 intended for testing purposes and is not suitable for
1206 production systems.
1207
1208 The raw noise data can be obtained using the jent_raw_hires
1209 debugfs file. Using the option
1210 jitterentropy_testing.boot_raw_hires_test=1 the raw noise of
1211 the first 1000 entropy events since boot can be sampled.
1212
1213 If unsure, select N.
1214
1215endif # if CRYPTO_FIPS && EXPERT
1216
1217if !(CRYPTO_FIPS && EXPERT)
1218
1219config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1220 int
1221 default 64
1222
1223config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1224 int
1225 default 32
1226
1227config CRYPTO_JITTERENTROPY_OSR
1228 int
1229 default 1
1230
1231config CRYPTO_JITTERENTROPY_TESTINTERFACE
1232 bool
1233
1234endif # if !(CRYPTO_FIPS && EXPERT)
1235endif # if CRYPTO_JITTERENTROPY
1236
1237config CRYPTO_KDF800108_CTR
1238 tristate
1239 select CRYPTO_HMAC
1240 select CRYPTO_SHA256
1241
1242endmenu
1243menu "Userspace interface (deprecated)"
1244
1245config CRYPTO_USER_API
1246 tristate
1247
1248config CRYPTO_USER_API_HASH
1249 tristate "Hash algorithms (deprecated)"
1250 depends on NET
1251 select CRYPTO_HASH
1252 select CRYPTO_USER_API
1253 help
1254 Enable the AF_ALG userspace interface for hash algorithms. This
1255 provides unprivileged userspace programs access to arbitrary hash
1256 algorithms implemented in the kernel's privileged execution context.
1257
1258 This interface is deprecated and is supported only for backwards
1259 compatibility. It regularly has vulnerabilities, and the capabilities
1260 it provides are redundant with userspace crypto libraries.
1261
1262 Enable this only if needed for support for a program that hasn't yet
1263 been converted to userspace crypto, for example iwd.
1264
1265 See also Documentation/crypto/userspace-if.rst
1266
1267config CRYPTO_USER_API_SKCIPHER
1268 tristate "Symmetric key cipher algorithms (deprecated)"
1269 depends on NET
1270 select CRYPTO_SKCIPHER
1271 select CRYPTO_USER_API
1272 help
1273 Enable the AF_ALG userspace interface for symmetric key algorithms.
1274 This provides unprivileged userspace programs access to arbitrary
1275 symmetric key algorithms implemented in the kernel's privileged
1276 execution context.
1277
1278 This interface is deprecated and is supported only for backwards
1279 compatibility. It regularly has vulnerabilities, and the capabilities
1280 it provides are redundant with userspace crypto libraries.
1281
1282 Enable this only if needed for support for a program that hasn't yet
1283 been converted to userspace crypto, for example iwd, or cryptsetup
1284 with certain algorithms.
1285
1286 See also Documentation/crypto/userspace-if.rst
1287
1288config CRYPTO_USER_API_RNG
1289 tristate "Random number generation algorithms (deprecated)"
1290 depends on NET
1291 select CRYPTO_RNG
1292 select CRYPTO_USER_API
1293 help
1294 Enable the AF_ALG userspace interface for random number generation
1295 (RNG) algorithms. This provides unprivileged userspace programs
1296 access to arbitrary RNG algorithms implemented in the kernel's
1297 privileged execution context.
1298
1299 This interface is deprecated and is supported only for backwards
1300 compatibility. It regularly has vulnerabilities, and the capabilities
1301 it provides are redundant with userspace crypto libraries as well as
1302 the normal kernel RNG (e.g., /dev/urandom and getrandom(2)).
1303
1304 See also Documentation/crypto/userspace-if.rst
1305
1306config CRYPTO_USER_API_RNG_CAVP
1307 bool "Enable CAVP testing of DRBG"
1308 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1309 help
1310 Enable extra APIs in the userspace interface for NIST CAVP
1311 (Cryptographic Algorithm Validation Program) testing:
1312 - resetting DRBG entropy
1313 - providing Additional Data
1314
1315 This should only be enabled for CAVP testing. You should say
1316 no unless you know what this is.
1317
1318config CRYPTO_USER_API_AEAD
1319 tristate "AEAD cipher algorithms (deprecated)"
1320 depends on NET
1321 select CRYPTO_AEAD
1322 select CRYPTO_SKCIPHER
1323 select CRYPTO_USER_API
1324 help
1325 Enable the AF_ALG userspace interface for authenticated encryption
1326 with associated data (AEAD) algorithms. This provides unprivileged
1327 userspace programs access to arbitrary AEAD algorithms implemented in
1328 the kernel's privileged execution context.
1329
1330 This interface is deprecated and is supported only for backwards
1331 compatibility. It regularly has vulnerabilities, and the capabilities
1332 it provides are redundant with userspace crypto libraries.
1333
1334 Enable this only if needed for support for a program that hasn't yet
1335 been converted to userspace crypto, for example iwd.
1336
1337 See also Documentation/crypto/userspace-if.rst
1338
1339config CRYPTO_USER_API_ENABLE_OBSOLETE
1340 bool "Obsolete cryptographic algorithms"
1341 depends on CRYPTO_USER_API
1342 default y
1343 help
1344 Allow obsolete cryptographic algorithms to be selected that have
1345 already been phased out from internal use by the kernel, and are
1346 only useful for userspace clients that still rely on them.
1347
1348endmenu
1349
1350if !KMSAN # avoid false positives from assembly
1351if ARM
1352source "arch/arm/crypto/Kconfig"
1353endif
1354if ARM64
1355source "arch/arm64/crypto/Kconfig"
1356endif
1357if PPC
1358source "arch/powerpc/crypto/Kconfig"
1359endif
1360if RISCV
1361source "arch/riscv/crypto/Kconfig"
1362endif
1363if S390
1364source "arch/s390/crypto/Kconfig"
1365endif
1366if SPARC
1367source "arch/sparc/crypto/Kconfig"
1368endif
1369if X86
1370source "arch/x86/crypto/Kconfig"
1371endif
1372endif
1373
1374source "drivers/crypto/Kconfig"
1375source "crypto/asymmetric_keys/Kconfig"
1376source "certs/Kconfig"
1377source "crypto/krb5/Kconfig"
1378
1379endif # if CRYPTO