| 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | config FS_ENCRYPTION |
| 3 | bool "FS Encryption (Per-file encryption)" |
| 4 | select BLK_INLINE_ENCRYPTION if BLOCK |
| 5 | select BLK_INLINE_ENCRYPTION_FALLBACK if BLOCK |
| 6 | select CRYPTO |
| 7 | select CRYPTO_SKCIPHER |
| 8 | select CRYPTO_LIB_AES_ECB # for deprecated v1 key derivation function |
| 9 | select CRYPTO_LIB_SHA256 |
| 10 | select CRYPTO_LIB_SHA512 |
| 11 | select KEYS |
| 12 | help |
| 13 | Enable encryption of files and directories. This |
| 14 | feature is similar to ecryptfs, but it is more memory |
| 15 | efficient since it avoids caching the encrypted and |
| 16 | decrypted pages in the page cache. Currently Ext4, |
| 17 | F2FS, UBIFS, and CephFS make use of this feature. |
| 18 | |
| 19 | # Filesystems supporting encryption must select this if FS_ENCRYPTION. This |
| 20 | # allows the algorithms to be built as modules when all the filesystems are, |
| 21 | # whereas selecting them from FS_ENCRYPTION would force them to be built-in. |
| 22 | # |
| 23 | # Note: this option only pulls in the algorithms that filesystem encryption |
| 24 | # needs "by default". If userspace will use "non-default" encryption modes such |
| 25 | # as Adiantum encryption, then those other modes need to be explicitly enabled |
| 26 | # in the crypto API; see Documentation/filesystems/fscrypt.rst for details. |
| 27 | # |
| 28 | # Also note that this option only pulls in the generic implementations of the |
| 29 | # algorithms, not any per-architecture optimized implementations. It is |
| 30 | # strongly recommended to enable optimized implementations too. |
| 31 | config FS_ENCRYPTION_ALGS |
| 32 | tristate |
| 33 | select CRYPTO_AES |
| 34 | select CRYPTO_CBC |
| 35 | select CRYPTO_CTS |
| 36 | select CRYPTO_XTS |
| 37 | |
| 38 | config FS_ENCRYPTION_INLINE_CRYPT |
| 39 | bool |
| 40 | default y if FS_ENCRYPTION && BLOCK |