2 # Generic algorithms support
8 # async_tx api: hardware offloaded memory transfer/transform support
10 source "crypto/async_tx/Kconfig"
13 # Cryptographic API Configuration
16 tristate "Cryptographic API"
18 This option provides the core Cryptographic API.
22 comment "Crypto core or helper"
25 bool "FIPS 200 compliance"
26 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 This options enables the fips boot option which is
30 required if you want to system to operate in a FIPS 200
31 certification. You should say no unless you know what
38 This option provides the API for cryptographic algorithms.
54 config CRYPTO_BLKCIPHER
56 select CRYPTO_BLKCIPHER2
59 config CRYPTO_BLKCIPHER2
63 select CRYPTO_WORKQUEUE
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
96 config CRYPTO_AKCIPHER2
100 config CRYPTO_AKCIPHER
102 select CRYPTO_AKCIPHER2
106 tristate "RSA algorithm"
107 select CRYPTO_AKCIPHER
111 Generic implementation of the RSA public key algorithm.
113 config CRYPTO_MANAGER
114 tristate "Cryptographic algorithm manager"
115 select CRYPTO_MANAGER2
117 Create default cryptographic template instantiations such as
120 config CRYPTO_MANAGER2
121 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
124 select CRYPTO_BLKCIPHER2
126 select CRYPTO_AKCIPHER2
129 tristate "Userspace cryptographic algorithm configuration"
131 select CRYPTO_MANAGER
133 Userspace configuration for cryptographic instantiations such as
136 config CRYPTO_MANAGER_DISABLE_TESTS
137 bool "Disable run-time self tests"
139 depends on CRYPTO_MANAGER2
141 Disable run-time self tests that normally take place at
142 algorithm registration.
144 config CRYPTO_GF128MUL
145 tristate "GF(2^128) multiplication functions"
147 Efficient table driven implementation of multiplications in the
148 field GF(2^128). This is needed by some cypher modes. This
149 option will be selected automatically if you select such a
150 cipher mode. Only select this option by hand if you expect to load
151 an external module that requires these functions.
154 tristate "Null algorithms"
157 These are 'Null' algorithms, used by IPsec, which do nothing.
160 select CRYPTO_ALGAPI2
161 select CRYPTO_BLKCIPHER2
165 tristate "Parallel crypto engine"
168 select CRYPTO_MANAGER
171 This converts an arbitrary crypto algorithm into a parallel
172 algorithm that executes in kernel threads.
174 config CRYPTO_WORKQUEUE
178 tristate "Software async crypto daemon"
179 select CRYPTO_BLKCIPHER
181 select CRYPTO_MANAGER
182 select CRYPTO_WORKQUEUE
184 This is a generic software asynchronous crypto daemon that
185 converts an arbitrary synchronous software crypto algorithm
186 into an asynchronous algorithm that executes in a kernel thread.
188 config CRYPTO_MCRYPTD
189 tristate "Software async multi-buffer crypto daemon"
190 select CRYPTO_BLKCIPHER
192 select CRYPTO_MANAGER
193 select CRYPTO_WORKQUEUE
195 This is a generic software asynchronous crypto daemon that
196 provides the kernel thread to assist multi-buffer crypto
197 algorithms for submitting jobs and flushing jobs in multi-buffer
198 crypto algorithms. Multi-buffer crypto algorithms are executed
199 in the context of this kernel thread and drivers can post
200 their crypto request asynchronously to be processed by this daemon.
202 config CRYPTO_AUTHENC
203 tristate "Authenc support"
205 select CRYPTO_BLKCIPHER
206 select CRYPTO_MANAGER
210 Authenc: Combined mode wrapper for IPsec.
211 This is required for IPSec.
214 tristate "Testing module"
216 select CRYPTO_MANAGER
218 Quick & dirty crypto test module.
220 config CRYPTO_ABLK_HELPER
224 config CRYPTO_GLUE_HELPER_X86
229 comment "Authenticated Encryption with Associated Data"
232 tristate "CCM support"
236 Support for Counter with CBC MAC. Required for IPsec.
239 tristate "GCM/GMAC support"
245 Support for Galois/Counter Mode (GCM) and Galois Message
246 Authentication Code (GMAC). Required for IPSec.
248 config CRYPTO_CHACHA20POLY1305
249 tristate "ChaCha20-Poly1305 AEAD support"
250 select CRYPTO_CHACHA20
251 select CRYPTO_POLY1305
254 ChaCha20-Poly1305 AEAD support, RFC7539.
256 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
257 with the Poly1305 authenticator. It is defined in RFC7539 for use in
261 tristate "Sequence Number IV Generator"
263 select CRYPTO_BLKCIPHER
265 select CRYPTO_RNG_DEFAULT
267 This IV generator generates an IV based on a sequence number by
268 xoring it with a salt. This algorithm is mainly useful for CTR
270 config CRYPTO_ECHAINIV
271 tristate "Encrypted Chain IV Generator"
274 select CRYPTO_RNG_DEFAULT
277 This IV generator generates an IV based on the encryption of
278 a sequence number xored with a salt. This is the default
281 comment "Block modes"
284 tristate "CBC support"
285 select CRYPTO_BLKCIPHER
286 select CRYPTO_MANAGER
288 CBC: Cipher Block Chaining mode
289 This block cipher algorithm is required for IPSec.
292 tristate "CTR support"
293 select CRYPTO_BLKCIPHER
295 select CRYPTO_MANAGER
298 This block cipher algorithm is required for IPSec.
301 tristate "CTS support"
302 select CRYPTO_BLKCIPHER
304 CTS: Cipher Text Stealing
305 This is the Cipher Text Stealing mode as described by
306 Section 8 of rfc2040 and referenced by rfc3962.
307 (rfc3962 includes errata information in its Appendix A)
308 This mode is required for Kerberos gss mechanism support
312 tristate "ECB support"
313 select CRYPTO_BLKCIPHER
314 select CRYPTO_MANAGER
316 ECB: Electronic CodeBook mode
317 This is the simplest block cipher algorithm. It simply encrypts
318 the input block by block.
321 tristate "LRW support"
322 select CRYPTO_BLKCIPHER
323 select CRYPTO_MANAGER
324 select CRYPTO_GF128MUL
326 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
327 narrow block cipher mode for dm-crypt. Use it with cipher
328 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
329 The first 128, 192 or 256 bits in the key are used for AES and the
330 rest is used to tie each cipher block to its logical position.
333 tristate "PCBC support"
334 select CRYPTO_BLKCIPHER
335 select CRYPTO_MANAGER
337 PCBC: Propagating Cipher Block Chaining mode
338 This block cipher algorithm is required for RxRPC.
341 tristate "XTS support"
342 select CRYPTO_BLKCIPHER
343 select CRYPTO_MANAGER
344 select CRYPTO_GF128MUL
346 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
347 key size 256, 384 or 512 bits. This implementation currently
348 can't handle a sectorsize which is not a multiple of 16 bytes.
353 tristate "CMAC support"
355 select CRYPTO_MANAGER
357 Cipher-based Message Authentication Code (CMAC) specified by
358 The National Institute of Standards and Technology (NIST).
360 https://tools.ietf.org/html/rfc4493
361 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
364 tristate "HMAC support"
366 select CRYPTO_MANAGER
368 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
369 This is required for IPSec.
372 tristate "XCBC support"
374 select CRYPTO_MANAGER
376 XCBC: Keyed-Hashing with encryption algorithm
377 http://www.ietf.org/rfc/rfc3566.txt
378 http://csrc.nist.gov/encryption/modes/proposedmodes/
379 xcbc-mac/xcbc-mac-spec.pdf
382 tristate "VMAC support"
384 select CRYPTO_MANAGER
386 VMAC is a message authentication algorithm designed for
387 very high speed on 64-bit architectures.
390 <http://fastcrypto.org/vmac>
395 tristate "CRC32c CRC algorithm"
399 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
400 by iSCSI for header and data digests and by others.
401 See Castagnoli93. Module will be crc32c.
403 config CRYPTO_CRC32C_INTEL
404 tristate "CRC32c INTEL hardware acceleration"
408 In Intel processor with SSE4.2 supported, the processor will
409 support CRC32C implementation using hardware accelerated CRC32
410 instruction. This option will create 'crc32c-intel' module,
411 which will enable any routine to use the CRC32 instruction to
412 gain performance compared with software implementation.
413 Module will be crc32c-intel.
415 config CRYPTO_CRC32C_SPARC64
416 tristate "CRC32c CRC algorithm (SPARC64)"
421 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
425 tristate "CRC32 CRC algorithm"
429 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
430 Shash crypto api wrappers to crc32_le function.
432 config CRYPTO_CRC32_PCLMUL
433 tristate "CRC32 PCLMULQDQ hardware acceleration"
438 From Intel Westmere and AMD Bulldozer processor with SSE4.2
439 and PCLMULQDQ supported, the processor will support
440 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
441 instruction. This option will create 'crc32-plcmul' module,
442 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
443 and gain better performance as compared with the table implementation.
445 config CRYPTO_CRCT10DIF
446 tristate "CRCT10DIF algorithm"
449 CRC T10 Data Integrity Field computation is being cast as
450 a crypto transform. This allows for faster crc t10 diff
451 transforms to be used if they are available.
453 config CRYPTO_CRCT10DIF_PCLMUL
454 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
455 depends on X86 && 64BIT && CRC_T10DIF
458 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
459 CRC T10 DIF PCLMULQDQ computation can be hardware
460 accelerated PCLMULQDQ instruction. This option will create
461 'crct10dif-plcmul' module, which is faster when computing the
462 crct10dif checksum as compared with the generic table implementation.
465 tristate "GHASH digest algorithm"
466 select CRYPTO_GF128MUL
468 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
470 config CRYPTO_POLY1305
471 tristate "Poly1305 authenticator algorithm"
473 Poly1305 authenticator algorithm, RFC7539.
475 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
476 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
477 in IETF protocols. This is the portable C implementation of Poly1305.
479 config CRYPTO_POLY1305_X86_64
480 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
481 depends on X86 && 64BIT
482 select CRYPTO_POLY1305
484 Poly1305 authenticator algorithm, RFC7539.
486 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
487 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
488 in IETF protocols. This is the x86_64 assembler implementation using SIMD
492 tristate "MD4 digest algorithm"
495 MD4 message digest algorithm (RFC1320).
498 tristate "MD5 digest algorithm"
501 MD5 message digest algorithm (RFC1321).
503 config CRYPTO_MD5_OCTEON
504 tristate "MD5 digest algorithm (OCTEON)"
505 depends on CPU_CAVIUM_OCTEON
509 MD5 message digest algorithm (RFC1321) implemented
510 using OCTEON crypto instructions, when available.
512 config CRYPTO_MD5_PPC
513 tristate "MD5 digest algorithm (PPC)"
517 MD5 message digest algorithm (RFC1321) implemented
520 config CRYPTO_MD5_SPARC64
521 tristate "MD5 digest algorithm (SPARC64)"
526 MD5 message digest algorithm (RFC1321) implemented
527 using sparc64 crypto instructions, when available.
529 config CRYPTO_MICHAEL_MIC
530 tristate "Michael MIC keyed digest algorithm"
533 Michael MIC is used for message integrity protection in TKIP
534 (IEEE 802.11i). This algorithm is required for TKIP, but it
535 should not be used for other purposes because of the weakness
539 tristate "RIPEMD-128 digest algorithm"
542 RIPEMD-128 (ISO/IEC 10118-3:2004).
544 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
545 be used as a secure replacement for RIPEMD. For other use cases,
546 RIPEMD-160 should be used.
548 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
549 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
552 tristate "RIPEMD-160 digest algorithm"
555 RIPEMD-160 (ISO/IEC 10118-3:2004).
557 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
558 to be used as a secure replacement for the 128-bit hash functions
559 MD4, MD5 and it's predecessor RIPEMD
560 (not to be confused with RIPEMD-128).
562 It's speed is comparable to SHA1 and there are no known attacks
565 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
566 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
569 tristate "RIPEMD-256 digest algorithm"
572 RIPEMD-256 is an optional extension of RIPEMD-128 with a
573 256 bit hash. It is intended for applications that require
574 longer hash-results, without needing a larger security level
577 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
578 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
581 tristate "RIPEMD-320 digest algorithm"
584 RIPEMD-320 is an optional extension of RIPEMD-160 with a
585 320 bit hash. It is intended for applications that require
586 longer hash-results, without needing a larger security level
589 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
590 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
593 tristate "SHA1 digest algorithm"
596 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
598 config CRYPTO_SHA1_SSSE3
599 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2)"
600 depends on X86 && 64BIT
604 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
605 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
606 Extensions (AVX/AVX2), when available.
608 config CRYPTO_SHA256_SSSE3
609 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2)"
610 depends on X86 && 64BIT
614 SHA-256 secure hash standard (DFIPS 180-2) implemented
615 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
616 Extensions version 1 (AVX1), or Advanced Vector Extensions
617 version 2 (AVX2) instructions, when available.
619 config CRYPTO_SHA512_SSSE3
620 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
621 depends on X86 && 64BIT
625 SHA-512 secure hash standard (DFIPS 180-2) implemented
626 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
627 Extensions version 1 (AVX1), or Advanced Vector Extensions
628 version 2 (AVX2) instructions, when available.
630 config CRYPTO_SHA1_OCTEON
631 tristate "SHA1 digest algorithm (OCTEON)"
632 depends on CPU_CAVIUM_OCTEON
636 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
637 using OCTEON crypto instructions, when available.
639 config CRYPTO_SHA1_SPARC64
640 tristate "SHA1 digest algorithm (SPARC64)"
645 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
646 using sparc64 crypto instructions, when available.
648 config CRYPTO_SHA1_PPC
649 tristate "SHA1 digest algorithm (powerpc)"
652 This is the powerpc hardware accelerated implementation of the
653 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
655 config CRYPTO_SHA1_PPC_SPE
656 tristate "SHA1 digest algorithm (PPC SPE)"
657 depends on PPC && SPE
659 SHA-1 secure hash standard (DFIPS 180-4) implemented
660 using powerpc SPE SIMD instruction set.
662 config CRYPTO_SHA1_MB
663 tristate "SHA1 digest algorithm (x86_64 Multi-Buffer, Experimental)"
664 depends on X86 && 64BIT
667 select CRYPTO_MCRYPTD
669 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
670 using multi-buffer technique. This algorithm computes on
671 multiple data lanes concurrently with SIMD instructions for
672 better throughput. It should not be enabled by default but
673 used when there is significant amount of work to keep the keep
674 the data lanes filled to get performance benefit. If the data
675 lanes remain unfilled, a flush operation will be initiated to
676 process the crypto jobs, adding a slight latency.
679 tristate "SHA224 and SHA256 digest algorithm"
682 SHA256 secure hash standard (DFIPS 180-2).
684 This version of SHA implements a 256 bit hash with 128 bits of
685 security against collision attacks.
687 This code also includes SHA-224, a 224 bit hash with 112 bits
688 of security against collision attacks.
690 config CRYPTO_SHA256_PPC_SPE
691 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
692 depends on PPC && SPE
696 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
697 implemented using powerpc SPE SIMD instruction set.
699 config CRYPTO_SHA256_OCTEON
700 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
701 depends on CPU_CAVIUM_OCTEON
705 SHA-256 secure hash standard (DFIPS 180-2) implemented
706 using OCTEON crypto instructions, when available.
708 config CRYPTO_SHA256_SPARC64
709 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
714 SHA-256 secure hash standard (DFIPS 180-2) implemented
715 using sparc64 crypto instructions, when available.
718 tristate "SHA384 and SHA512 digest algorithms"
721 SHA512 secure hash standard (DFIPS 180-2).
723 This version of SHA implements a 512 bit hash with 256 bits of
724 security against collision attacks.
726 This code also includes SHA-384, a 384 bit hash with 192 bits
727 of security against collision attacks.
729 config CRYPTO_SHA512_OCTEON
730 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
731 depends on CPU_CAVIUM_OCTEON
735 SHA-512 secure hash standard (DFIPS 180-2) implemented
736 using OCTEON crypto instructions, when available.
738 config CRYPTO_SHA512_SPARC64
739 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
744 SHA-512 secure hash standard (DFIPS 180-2) implemented
745 using sparc64 crypto instructions, when available.
748 tristate "Tiger digest algorithms"
751 Tiger hash algorithm 192, 160 and 128-bit hashes
753 Tiger is a hash function optimized for 64-bit processors while
754 still having decent performance on 32-bit processors.
755 Tiger was developed by Ross Anderson and Eli Biham.
758 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
761 tristate "Whirlpool digest algorithms"
764 Whirlpool hash algorithm 512, 384 and 256-bit hashes
766 Whirlpool-512 is part of the NESSIE cryptographic primitives.
767 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
770 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
772 config CRYPTO_GHASH_CLMUL_NI_INTEL
773 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
774 depends on X86 && 64BIT
777 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
778 The implementation is accelerated by CLMUL-NI of Intel.
783 tristate "AES cipher algorithms"
786 AES cipher algorithms (FIPS-197). AES uses the Rijndael
789 Rijndael appears to be consistently a very good performer in
790 both hardware and software across a wide range of computing
791 environments regardless of its use in feedback or non-feedback
792 modes. Its key setup time is excellent, and its key agility is
793 good. Rijndael's very low memory requirements make it very well
794 suited for restricted-space environments, in which it also
795 demonstrates excellent performance. Rijndael's operations are
796 among the easiest to defend against power and timing attacks.
798 The AES specifies three key sizes: 128, 192 and 256 bits
800 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
802 config CRYPTO_AES_586
803 tristate "AES cipher algorithms (i586)"
804 depends on (X86 || UML_X86) && !64BIT
808 AES cipher algorithms (FIPS-197). AES uses the Rijndael
811 Rijndael appears to be consistently a very good performer in
812 both hardware and software across a wide range of computing
813 environments regardless of its use in feedback or non-feedback
814 modes. Its key setup time is excellent, and its key agility is
815 good. Rijndael's very low memory requirements make it very well
816 suited for restricted-space environments, in which it also
817 demonstrates excellent performance. Rijndael's operations are
818 among the easiest to defend against power and timing attacks.
820 The AES specifies three key sizes: 128, 192 and 256 bits
822 See <http://csrc.nist.gov/encryption/aes/> for more information.
824 config CRYPTO_AES_X86_64
825 tristate "AES cipher algorithms (x86_64)"
826 depends on (X86 || UML_X86) && 64BIT
830 AES cipher algorithms (FIPS-197). AES uses the Rijndael
833 Rijndael appears to be consistently a very good performer in
834 both hardware and software across a wide range of computing
835 environments regardless of its use in feedback or non-feedback
836 modes. Its key setup time is excellent, and its key agility is
837 good. Rijndael's very low memory requirements make it very well
838 suited for restricted-space environments, in which it also
839 demonstrates excellent performance. Rijndael's operations are
840 among the easiest to defend against power and timing attacks.
842 The AES specifies three key sizes: 128, 192 and 256 bits
844 See <http://csrc.nist.gov/encryption/aes/> for more information.
846 config CRYPTO_AES_NI_INTEL
847 tristate "AES cipher algorithms (AES-NI)"
849 select CRYPTO_AES_X86_64 if 64BIT
850 select CRYPTO_AES_586 if !64BIT
852 select CRYPTO_ABLK_HELPER
854 select CRYPTO_GLUE_HELPER_X86 if 64BIT
858 Use Intel AES-NI instructions for AES algorithm.
860 AES cipher algorithms (FIPS-197). AES uses the Rijndael
863 Rijndael appears to be consistently a very good performer in
864 both hardware and software across a wide range of computing
865 environments regardless of its use in feedback or non-feedback
866 modes. Its key setup time is excellent, and its key agility is
867 good. Rijndael's very low memory requirements make it very well
868 suited for restricted-space environments, in which it also
869 demonstrates excellent performance. Rijndael's operations are
870 among the easiest to defend against power and timing attacks.
872 The AES specifies three key sizes: 128, 192 and 256 bits
874 See <http://csrc.nist.gov/encryption/aes/> for more information.
876 In addition to AES cipher algorithm support, the acceleration
877 for some popular block cipher mode is supported too, including
878 ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
879 acceleration for CTR.
881 config CRYPTO_AES_SPARC64
882 tristate "AES cipher algorithms (SPARC64)"
887 Use SPARC64 crypto opcodes for AES algorithm.
889 AES cipher algorithms (FIPS-197). AES uses the Rijndael
892 Rijndael appears to be consistently a very good performer in
893 both hardware and software across a wide range of computing
894 environments regardless of its use in feedback or non-feedback
895 modes. Its key setup time is excellent, and its key agility is
896 good. Rijndael's very low memory requirements make it very well
897 suited for restricted-space environments, in which it also
898 demonstrates excellent performance. Rijndael's operations are
899 among the easiest to defend against power and timing attacks.
901 The AES specifies three key sizes: 128, 192 and 256 bits
903 See <http://csrc.nist.gov/encryption/aes/> for more information.
905 In addition to AES cipher algorithm support, the acceleration
906 for some popular block cipher mode is supported too, including
909 config CRYPTO_AES_PPC_SPE
910 tristate "AES cipher algorithms (PPC SPE)"
911 depends on PPC && SPE
913 AES cipher algorithms (FIPS-197). Additionally the acceleration
914 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
915 This module should only be used for low power (router) devices
916 without hardware AES acceleration (e.g. caam crypto). It reduces the
917 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
918 timining attacks. Nevertheless it might be not as secure as other
919 architecture specific assembler implementations that work on 1KB
920 tables or 256 bytes S-boxes.
923 tristate "Anubis cipher algorithm"
926 Anubis cipher algorithm.
928 Anubis is a variable key length cipher which can use keys from
929 128 bits to 320 bits in length. It was evaluated as a entrant
930 in the NESSIE competition.
933 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
934 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
937 tristate "ARC4 cipher algorithm"
938 select CRYPTO_BLKCIPHER
940 ARC4 cipher algorithm.
942 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
943 bits in length. This algorithm is required for driver-based
944 WEP, but it should not be for other purposes because of the
945 weakness of the algorithm.
947 config CRYPTO_BLOWFISH
948 tristate "Blowfish cipher algorithm"
950 select CRYPTO_BLOWFISH_COMMON
952 Blowfish cipher algorithm, by Bruce Schneier.
954 This is a variable key length cipher which can use keys from 32
955 bits to 448 bits in length. It's fast, simple and specifically
956 designed for use on "large microprocessors".
959 <http://www.schneier.com/blowfish.html>
961 config CRYPTO_BLOWFISH_COMMON
964 Common parts of the Blowfish cipher algorithm shared by the
965 generic c and the assembler implementations.
968 <http://www.schneier.com/blowfish.html>
970 config CRYPTO_BLOWFISH_X86_64
971 tristate "Blowfish cipher algorithm (x86_64)"
972 depends on X86 && 64BIT
974 select CRYPTO_BLOWFISH_COMMON
976 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
978 This is a variable key length cipher which can use keys from 32
979 bits to 448 bits in length. It's fast, simple and specifically
980 designed for use on "large microprocessors".
983 <http://www.schneier.com/blowfish.html>
985 config CRYPTO_CAMELLIA
986 tristate "Camellia cipher algorithms"
990 Camellia cipher algorithms module.
992 Camellia is a symmetric key block cipher developed jointly
993 at NTT and Mitsubishi Electric Corporation.
995 The Camellia specifies three key sizes: 128, 192 and 256 bits.
998 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1000 config CRYPTO_CAMELLIA_X86_64
1001 tristate "Camellia cipher algorithm (x86_64)"
1002 depends on X86 && 64BIT
1004 select CRYPTO_ALGAPI
1005 select CRYPTO_GLUE_HELPER_X86
1009 Camellia cipher algorithm module (x86_64).
1011 Camellia is a symmetric key block cipher developed jointly
1012 at NTT and Mitsubishi Electric Corporation.
1014 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1017 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1019 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1020 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1021 depends on X86 && 64BIT
1023 select CRYPTO_ALGAPI
1024 select CRYPTO_CRYPTD
1025 select CRYPTO_ABLK_HELPER
1026 select CRYPTO_GLUE_HELPER_X86
1027 select CRYPTO_CAMELLIA_X86_64
1031 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1033 Camellia is a symmetric key block cipher developed jointly
1034 at NTT and Mitsubishi Electric Corporation.
1036 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1039 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1041 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1042 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1043 depends on X86 && 64BIT
1045 select CRYPTO_ALGAPI
1046 select CRYPTO_CRYPTD
1047 select CRYPTO_ABLK_HELPER
1048 select CRYPTO_GLUE_HELPER_X86
1049 select CRYPTO_CAMELLIA_X86_64
1050 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1054 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1056 Camellia is a symmetric key block cipher developed jointly
1057 at NTT and Mitsubishi Electric Corporation.
1059 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1062 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1064 config CRYPTO_CAMELLIA_SPARC64
1065 tristate "Camellia cipher algorithm (SPARC64)"
1068 select CRYPTO_ALGAPI
1070 Camellia cipher algorithm module (SPARC64).
1072 Camellia is a symmetric key block cipher developed jointly
1073 at NTT and Mitsubishi Electric Corporation.
1075 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1078 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1080 config CRYPTO_CAST_COMMON
1083 Common parts of the CAST cipher algorithms shared by the
1084 generic c and the assembler implementations.
1087 tristate "CAST5 (CAST-128) cipher algorithm"
1088 select CRYPTO_ALGAPI
1089 select CRYPTO_CAST_COMMON
1091 The CAST5 encryption algorithm (synonymous with CAST-128) is
1092 described in RFC2144.
1094 config CRYPTO_CAST5_AVX_X86_64
1095 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1096 depends on X86 && 64BIT
1097 select CRYPTO_ALGAPI
1098 select CRYPTO_CRYPTD
1099 select CRYPTO_ABLK_HELPER
1100 select CRYPTO_CAST_COMMON
1103 The CAST5 encryption algorithm (synonymous with CAST-128) is
1104 described in RFC2144.
1106 This module provides the Cast5 cipher algorithm that processes
1107 sixteen blocks parallel using the AVX instruction set.
1110 tristate "CAST6 (CAST-256) cipher algorithm"
1111 select CRYPTO_ALGAPI
1112 select CRYPTO_CAST_COMMON
1114 The CAST6 encryption algorithm (synonymous with CAST-256) is
1115 described in RFC2612.
1117 config CRYPTO_CAST6_AVX_X86_64
1118 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1119 depends on X86 && 64BIT
1120 select CRYPTO_ALGAPI
1121 select CRYPTO_CRYPTD
1122 select CRYPTO_ABLK_HELPER
1123 select CRYPTO_GLUE_HELPER_X86
1124 select CRYPTO_CAST_COMMON
1129 The CAST6 encryption algorithm (synonymous with CAST-256) is
1130 described in RFC2612.
1132 This module provides the Cast6 cipher algorithm that processes
1133 eight blocks parallel using the AVX instruction set.
1136 tristate "DES and Triple DES EDE cipher algorithms"
1137 select CRYPTO_ALGAPI
1139 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1141 config CRYPTO_DES_SPARC64
1142 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1144 select CRYPTO_ALGAPI
1147 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1148 optimized using SPARC64 crypto opcodes.
1150 config CRYPTO_DES3_EDE_X86_64
1151 tristate "Triple DES EDE cipher algorithm (x86-64)"
1152 depends on X86 && 64BIT
1153 select CRYPTO_ALGAPI
1156 Triple DES EDE (FIPS 46-3) algorithm.
1158 This module provides implementation of the Triple DES EDE cipher
1159 algorithm that is optimized for x86-64 processors. Two versions of
1160 algorithm are provided; regular processing one input block and
1161 one that processes three blocks parallel.
1163 config CRYPTO_FCRYPT
1164 tristate "FCrypt cipher algorithm"
1165 select CRYPTO_ALGAPI
1166 select CRYPTO_BLKCIPHER
1168 FCrypt algorithm used by RxRPC.
1170 config CRYPTO_KHAZAD
1171 tristate "Khazad cipher algorithm"
1172 select CRYPTO_ALGAPI
1174 Khazad cipher algorithm.
1176 Khazad was a finalist in the initial NESSIE competition. It is
1177 an algorithm optimized for 64-bit processors with good performance
1178 on 32-bit processors. Khazad uses an 128 bit key size.
1181 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1183 config CRYPTO_SALSA20
1184 tristate "Salsa20 stream cipher algorithm"
1185 select CRYPTO_BLKCIPHER
1187 Salsa20 stream cipher algorithm.
1189 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1190 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1192 The Salsa20 stream cipher algorithm is designed by Daniel J.
1193 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1195 config CRYPTO_SALSA20_586
1196 tristate "Salsa20 stream cipher algorithm (i586)"
1197 depends on (X86 || UML_X86) && !64BIT
1198 select CRYPTO_BLKCIPHER
1200 Salsa20 stream cipher algorithm.
1202 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1203 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1205 The Salsa20 stream cipher algorithm is designed by Daniel J.
1206 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1208 config CRYPTO_SALSA20_X86_64
1209 tristate "Salsa20 stream cipher algorithm (x86_64)"
1210 depends on (X86 || UML_X86) && 64BIT
1211 select CRYPTO_BLKCIPHER
1213 Salsa20 stream cipher algorithm.
1215 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1216 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1218 The Salsa20 stream cipher algorithm is designed by Daniel J.
1219 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1221 config CRYPTO_CHACHA20
1222 tristate "ChaCha20 cipher algorithm"
1223 select CRYPTO_BLKCIPHER
1225 ChaCha20 cipher algorithm, RFC7539.
1227 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1228 Bernstein and further specified in RFC7539 for use in IETF protocols.
1229 This is the portable C implementation of ChaCha20.
1232 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1234 config CRYPTO_CHACHA20_X86_64
1235 tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
1236 depends on X86 && 64BIT
1237 select CRYPTO_BLKCIPHER
1238 select CRYPTO_CHACHA20
1240 ChaCha20 cipher algorithm, RFC7539.
1242 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1243 Bernstein and further specified in RFC7539 for use in IETF protocols.
1244 This is the x86_64 assembler implementation using SIMD instructions.
1247 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1250 tristate "SEED cipher algorithm"
1251 select CRYPTO_ALGAPI
1253 SEED cipher algorithm (RFC4269).
1255 SEED is a 128-bit symmetric key block cipher that has been
1256 developed by KISA (Korea Information Security Agency) as a
1257 national standard encryption algorithm of the Republic of Korea.
1258 It is a 16 round block cipher with the key size of 128 bit.
1261 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1263 config CRYPTO_SERPENT
1264 tristate "Serpent cipher algorithm"
1265 select CRYPTO_ALGAPI
1267 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1269 Keys are allowed to be from 0 to 256 bits in length, in steps
1270 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1271 variant of Serpent for compatibility with old kerneli.org code.
1274 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1276 config CRYPTO_SERPENT_SSE2_X86_64
1277 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1278 depends on X86 && 64BIT
1279 select CRYPTO_ALGAPI
1280 select CRYPTO_CRYPTD
1281 select CRYPTO_ABLK_HELPER
1282 select CRYPTO_GLUE_HELPER_X86
1283 select CRYPTO_SERPENT
1287 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1289 Keys are allowed to be from 0 to 256 bits in length, in steps
1292 This module provides Serpent cipher algorithm that processes eight
1293 blocks parallel using SSE2 instruction set.
1296 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1298 config CRYPTO_SERPENT_SSE2_586
1299 tristate "Serpent cipher algorithm (i586/SSE2)"
1300 depends on X86 && !64BIT
1301 select CRYPTO_ALGAPI
1302 select CRYPTO_CRYPTD
1303 select CRYPTO_ABLK_HELPER
1304 select CRYPTO_GLUE_HELPER_X86
1305 select CRYPTO_SERPENT
1309 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1311 Keys are allowed to be from 0 to 256 bits in length, in steps
1314 This module provides Serpent cipher algorithm that processes four
1315 blocks parallel using SSE2 instruction set.
1318 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1320 config CRYPTO_SERPENT_AVX_X86_64
1321 tristate "Serpent cipher algorithm (x86_64/AVX)"
1322 depends on X86 && 64BIT
1323 select CRYPTO_ALGAPI
1324 select CRYPTO_CRYPTD
1325 select CRYPTO_ABLK_HELPER
1326 select CRYPTO_GLUE_HELPER_X86
1327 select CRYPTO_SERPENT
1331 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1333 Keys are allowed to be from 0 to 256 bits in length, in steps
1336 This module provides the Serpent cipher algorithm that processes
1337 eight blocks parallel using the AVX instruction set.
1340 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1342 config CRYPTO_SERPENT_AVX2_X86_64
1343 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1344 depends on X86 && 64BIT
1345 select CRYPTO_ALGAPI
1346 select CRYPTO_CRYPTD
1347 select CRYPTO_ABLK_HELPER
1348 select CRYPTO_GLUE_HELPER_X86
1349 select CRYPTO_SERPENT
1350 select CRYPTO_SERPENT_AVX_X86_64
1354 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1356 Keys are allowed to be from 0 to 256 bits in length, in steps
1359 This module provides Serpent cipher algorithm that processes 16
1360 blocks parallel using AVX2 instruction set.
1363 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1366 tristate "TEA, XTEA and XETA cipher algorithms"
1367 select CRYPTO_ALGAPI
1369 TEA cipher algorithm.
1371 Tiny Encryption Algorithm is a simple cipher that uses
1372 many rounds for security. It is very fast and uses
1375 Xtendend Tiny Encryption Algorithm is a modification to
1376 the TEA algorithm to address a potential key weakness
1377 in the TEA algorithm.
1379 Xtendend Encryption Tiny Algorithm is a mis-implementation
1380 of the XTEA algorithm for compatibility purposes.
1382 config CRYPTO_TWOFISH
1383 tristate "Twofish cipher algorithm"
1384 select CRYPTO_ALGAPI
1385 select CRYPTO_TWOFISH_COMMON
1387 Twofish cipher algorithm.
1389 Twofish was submitted as an AES (Advanced Encryption Standard)
1390 candidate cipher by researchers at CounterPane Systems. It is a
1391 16 round block cipher supporting key sizes of 128, 192, and 256
1395 <http://www.schneier.com/twofish.html>
1397 config CRYPTO_TWOFISH_COMMON
1400 Common parts of the Twofish cipher algorithm shared by the
1401 generic c and the assembler implementations.
1403 config CRYPTO_TWOFISH_586
1404 tristate "Twofish cipher algorithms (i586)"
1405 depends on (X86 || UML_X86) && !64BIT
1406 select CRYPTO_ALGAPI
1407 select CRYPTO_TWOFISH_COMMON
1409 Twofish cipher algorithm.
1411 Twofish was submitted as an AES (Advanced Encryption Standard)
1412 candidate cipher by researchers at CounterPane Systems. It is a
1413 16 round block cipher supporting key sizes of 128, 192, and 256
1417 <http://www.schneier.com/twofish.html>
1419 config CRYPTO_TWOFISH_X86_64
1420 tristate "Twofish cipher algorithm (x86_64)"
1421 depends on (X86 || UML_X86) && 64BIT
1422 select CRYPTO_ALGAPI
1423 select CRYPTO_TWOFISH_COMMON
1425 Twofish cipher algorithm (x86_64).
1427 Twofish was submitted as an AES (Advanced Encryption Standard)
1428 candidate cipher by researchers at CounterPane Systems. It is a
1429 16 round block cipher supporting key sizes of 128, 192, and 256
1433 <http://www.schneier.com/twofish.html>
1435 config CRYPTO_TWOFISH_X86_64_3WAY
1436 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1437 depends on X86 && 64BIT
1438 select CRYPTO_ALGAPI
1439 select CRYPTO_TWOFISH_COMMON
1440 select CRYPTO_TWOFISH_X86_64
1441 select CRYPTO_GLUE_HELPER_X86
1445 Twofish cipher algorithm (x86_64, 3-way parallel).
1447 Twofish was submitted as an AES (Advanced Encryption Standard)
1448 candidate cipher by researchers at CounterPane Systems. It is a
1449 16 round block cipher supporting key sizes of 128, 192, and 256
1452 This module provides Twofish cipher algorithm that processes three
1453 blocks parallel, utilizing resources of out-of-order CPUs better.
1456 <http://www.schneier.com/twofish.html>
1458 config CRYPTO_TWOFISH_AVX_X86_64
1459 tristate "Twofish cipher algorithm (x86_64/AVX)"
1460 depends on X86 && 64BIT
1461 select CRYPTO_ALGAPI
1462 select CRYPTO_CRYPTD
1463 select CRYPTO_ABLK_HELPER
1464 select CRYPTO_GLUE_HELPER_X86
1465 select CRYPTO_TWOFISH_COMMON
1466 select CRYPTO_TWOFISH_X86_64
1467 select CRYPTO_TWOFISH_X86_64_3WAY
1471 Twofish cipher algorithm (x86_64/AVX).
1473 Twofish was submitted as an AES (Advanced Encryption Standard)
1474 candidate cipher by researchers at CounterPane Systems. It is a
1475 16 round block cipher supporting key sizes of 128, 192, and 256
1478 This module provides the Twofish cipher algorithm that processes
1479 eight blocks parallel using the AVX Instruction Set.
1482 <http://www.schneier.com/twofish.html>
1484 comment "Compression"
1486 config CRYPTO_DEFLATE
1487 tristate "Deflate compression algorithm"
1488 select CRYPTO_ALGAPI
1492 This is the Deflate algorithm (RFC1951), specified for use in
1493 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1495 You will most probably want this if using IPSec.
1498 tristate "Zlib compression algorithm"
1504 This is the zlib algorithm.
1507 tristate "LZO compression algorithm"
1508 select CRYPTO_ALGAPI
1510 select LZO_DECOMPRESS
1512 This is the LZO algorithm.
1515 tristate "842 compression algorithm"
1516 select CRYPTO_ALGAPI
1518 select 842_DECOMPRESS
1520 This is the 842 algorithm.
1523 tristate "LZ4 compression algorithm"
1524 select CRYPTO_ALGAPI
1526 select LZ4_DECOMPRESS
1528 This is the LZ4 algorithm.
1531 tristate "LZ4HC compression algorithm"
1532 select CRYPTO_ALGAPI
1533 select LZ4HC_COMPRESS
1534 select LZ4_DECOMPRESS
1536 This is the LZ4 high compression mode algorithm.
1538 comment "Random Number Generation"
1540 config CRYPTO_ANSI_CPRNG
1541 tristate "Pseudo Random Number Generation for Cryptographic modules"
1545 This option enables the generic pseudo random number generator
1546 for cryptographic modules. Uses the Algorithm specified in
1547 ANSI X9.31 A.2.4. Note that this option must be enabled if
1548 CRYPTO_FIPS is selected
1550 menuconfig CRYPTO_DRBG_MENU
1551 tristate "NIST SP800-90A DRBG"
1553 NIST SP800-90A compliant DRBG. In the following submenu, one or
1554 more of the DRBG types must be selected.
1558 config CRYPTO_DRBG_HMAC
1562 select CRYPTO_SHA256
1564 config CRYPTO_DRBG_HASH
1565 bool "Enable Hash DRBG"
1566 select CRYPTO_SHA256
1568 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1570 config CRYPTO_DRBG_CTR
1571 bool "Enable CTR DRBG"
1574 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1578 default CRYPTO_DRBG_MENU
1580 select CRYPTO_JITTERENTROPY
1582 endif # if CRYPTO_DRBG_MENU
1584 config CRYPTO_JITTERENTROPY
1585 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1587 The Jitterentropy RNG is a noise that is intended
1588 to provide seed to another RNG. The RNG does not
1589 perform any cryptographic whitening of the generated
1590 random numbers. This Jitterentropy RNG registers with
1591 the kernel crypto API and can be used by any caller.
1593 config CRYPTO_USER_API
1596 config CRYPTO_USER_API_HASH
1597 tristate "User-space interface for hash algorithms"
1600 select CRYPTO_USER_API
1602 This option enables the user-spaces interface for hash
1605 config CRYPTO_USER_API_SKCIPHER
1606 tristate "User-space interface for symmetric key cipher algorithms"
1608 select CRYPTO_BLKCIPHER
1609 select CRYPTO_USER_API
1611 This option enables the user-spaces interface for symmetric
1612 key cipher algorithms.
1614 config CRYPTO_USER_API_RNG
1615 tristate "User-space interface for random number generator algorithms"
1618 select CRYPTO_USER_API
1620 This option enables the user-spaces interface for random
1621 number generator algorithms.
1623 config CRYPTO_USER_API_AEAD
1624 tristate "User-space interface for AEAD cipher algorithms"
1627 select CRYPTO_USER_API
1629 This option enables the user-spaces interface for AEAD
1632 config CRYPTO_HASH_INFO
1635 source "drivers/crypto/Kconfig"
1636 source crypto/asymmetric_keys/Kconfig