2 # Generic algorithms support
8 # async_tx api: hardware offloaded memory transfer/transform support
10 source "crypto/async_tx/Kconfig"
13 # Cryptographic API Configuration
16 tristate "Cryptographic API"
18 This option provides the core Cryptographic API.
22 comment "Crypto core or helper"
25 bool "FIPS 200 compliance"
26 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 This options enables the fips boot option which is
30 required if you want to system to operate in a FIPS 200
31 certification. You should say no unless you know what
38 This option provides the API for cryptographic algorithms.
52 config CRYPTO_BLKCIPHER
54 select CRYPTO_BLKCIPHER2
57 config CRYPTO_BLKCIPHER2
61 select CRYPTO_WORKQUEUE
81 config CRYPTO_RNG_DEFAULT
83 select CRYPTO_DRBG_MENU
94 config CRYPTO_AKCIPHER2
98 config CRYPTO_AKCIPHER
100 select CRYPTO_AKCIPHER2
104 tristate "RSA algorithm"
105 select CRYPTO_AKCIPHER
109 Generic implementation of the RSA public key algorithm.
111 config CRYPTO_MANAGER
112 tristate "Cryptographic algorithm manager"
113 select CRYPTO_MANAGER2
115 Create default cryptographic template instantiations such as
118 config CRYPTO_MANAGER2
119 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
122 select CRYPTO_BLKCIPHER2
124 select CRYPTO_AKCIPHER2
127 tristate "Userspace cryptographic algorithm configuration"
129 select CRYPTO_MANAGER
131 Userspace configuration for cryptographic instantiations such as
134 config CRYPTO_MANAGER_DISABLE_TESTS
135 bool "Disable run-time self tests"
137 depends on CRYPTO_MANAGER2
139 Disable run-time self tests that normally take place at
140 algorithm registration.
142 config CRYPTO_GF128MUL
143 tristate "GF(2^128) multiplication functions"
145 Efficient table driven implementation of multiplications in the
146 field GF(2^128). This is needed by some cypher modes. This
147 option will be selected automatically if you select such a
148 cipher mode. Only select this option by hand if you expect to load
149 an external module that requires these functions.
152 tristate "Null algorithms"
154 select CRYPTO_BLKCIPHER
157 These are 'Null' algorithms, used by IPsec, which do nothing.
160 tristate "Parallel crypto engine"
163 select CRYPTO_MANAGER
166 This converts an arbitrary crypto algorithm into a parallel
167 algorithm that executes in kernel threads.
169 config CRYPTO_WORKQUEUE
173 tristate "Software async crypto daemon"
174 select CRYPTO_BLKCIPHER
176 select CRYPTO_MANAGER
177 select CRYPTO_WORKQUEUE
179 This is a generic software asynchronous crypto daemon that
180 converts an arbitrary synchronous software crypto algorithm
181 into an asynchronous algorithm that executes in a kernel thread.
183 config CRYPTO_MCRYPTD
184 tristate "Software async multi-buffer crypto daemon"
185 select CRYPTO_BLKCIPHER
187 select CRYPTO_MANAGER
188 select CRYPTO_WORKQUEUE
190 This is a generic software asynchronous crypto daemon that
191 provides the kernel thread to assist multi-buffer crypto
192 algorithms for submitting jobs and flushing jobs in multi-buffer
193 crypto algorithms. Multi-buffer crypto algorithms are executed
194 in the context of this kernel thread and drivers can post
195 their crypto request asynchronously to be processed by this daemon.
197 config CRYPTO_AUTHENC
198 tristate "Authenc support"
200 select CRYPTO_BLKCIPHER
201 select CRYPTO_MANAGER
204 Authenc: Combined mode wrapper for IPsec.
205 This is required for IPSec.
208 tristate "Testing module"
210 select CRYPTO_MANAGER
212 Quick & dirty crypto test module.
214 config CRYPTO_ABLK_HELPER
218 config CRYPTO_GLUE_HELPER_X86
223 comment "Authenticated Encryption with Associated Data"
226 tristate "CCM support"
230 Support for Counter with CBC MAC. Required for IPsec.
233 tristate "GCM/GMAC support"
239 Support for Galois/Counter Mode (GCM) and Galois Message
240 Authentication Code (GMAC). Required for IPSec.
242 config CRYPTO_CHACHA20POLY1305
243 tristate "ChaCha20-Poly1305 AEAD support"
244 select CRYPTO_CHACHA20
245 select CRYPTO_POLY1305
248 ChaCha20-Poly1305 AEAD support, RFC7539.
250 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
251 with the Poly1305 authenticator. It is defined in RFC7539 for use in
255 tristate "Sequence Number IV Generator"
257 select CRYPTO_BLKCIPHER
259 select CRYPTO_RNG_DEFAULT
261 This IV generator generates an IV based on a sequence number by
262 xoring it with a salt. This algorithm is mainly useful for CTR
264 config CRYPTO_ECHAINIV
265 tristate "Encrypted Chain IV Generator"
268 select CRYPTO_RNG_DEFAULT
271 This IV generator generates an IV based on the encryption of
272 a sequence number xored with a salt. This is the default
275 comment "Block modes"
278 tristate "CBC support"
279 select CRYPTO_BLKCIPHER
280 select CRYPTO_MANAGER
282 CBC: Cipher Block Chaining mode
283 This block cipher algorithm is required for IPSec.
286 tristate "CTR support"
287 select CRYPTO_BLKCIPHER
289 select CRYPTO_MANAGER
292 This block cipher algorithm is required for IPSec.
295 tristate "CTS support"
296 select CRYPTO_BLKCIPHER
298 CTS: Cipher Text Stealing
299 This is the Cipher Text Stealing mode as described by
300 Section 8 of rfc2040 and referenced by rfc3962.
301 (rfc3962 includes errata information in its Appendix A)
302 This mode is required for Kerberos gss mechanism support
306 tristate "ECB support"
307 select CRYPTO_BLKCIPHER
308 select CRYPTO_MANAGER
310 ECB: Electronic CodeBook mode
311 This is the simplest block cipher algorithm. It simply encrypts
312 the input block by block.
315 tristate "LRW support"
316 select CRYPTO_BLKCIPHER
317 select CRYPTO_MANAGER
318 select CRYPTO_GF128MUL
320 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
321 narrow block cipher mode for dm-crypt. Use it with cipher
322 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
323 The first 128, 192 or 256 bits in the key are used for AES and the
324 rest is used to tie each cipher block to its logical position.
327 tristate "PCBC support"
328 select CRYPTO_BLKCIPHER
329 select CRYPTO_MANAGER
331 PCBC: Propagating Cipher Block Chaining mode
332 This block cipher algorithm is required for RxRPC.
335 tristate "XTS support"
336 select CRYPTO_BLKCIPHER
337 select CRYPTO_MANAGER
338 select CRYPTO_GF128MUL
340 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
341 key size 256, 384 or 512 bits. This implementation currently
342 can't handle a sectorsize which is not a multiple of 16 bytes.
347 tristate "CMAC support"
349 select CRYPTO_MANAGER
351 Cipher-based Message Authentication Code (CMAC) specified by
352 The National Institute of Standards and Technology (NIST).
354 https://tools.ietf.org/html/rfc4493
355 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
358 tristate "HMAC support"
360 select CRYPTO_MANAGER
362 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
363 This is required for IPSec.
366 tristate "XCBC support"
368 select CRYPTO_MANAGER
370 XCBC: Keyed-Hashing with encryption algorithm
371 http://www.ietf.org/rfc/rfc3566.txt
372 http://csrc.nist.gov/encryption/modes/proposedmodes/
373 xcbc-mac/xcbc-mac-spec.pdf
376 tristate "VMAC support"
378 select CRYPTO_MANAGER
380 VMAC is a message authentication algorithm designed for
381 very high speed on 64-bit architectures.
384 <http://fastcrypto.org/vmac>
389 tristate "CRC32c CRC algorithm"
393 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
394 by iSCSI for header and data digests and by others.
395 See Castagnoli93. Module will be crc32c.
397 config CRYPTO_CRC32C_INTEL
398 tristate "CRC32c INTEL hardware acceleration"
402 In Intel processor with SSE4.2 supported, the processor will
403 support CRC32C implementation using hardware accelerated CRC32
404 instruction. This option will create 'crc32c-intel' module,
405 which will enable any routine to use the CRC32 instruction to
406 gain performance compared with software implementation.
407 Module will be crc32c-intel.
409 config CRYPTO_CRC32C_SPARC64
410 tristate "CRC32c CRC algorithm (SPARC64)"
415 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
419 tristate "CRC32 CRC algorithm"
423 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
424 Shash crypto api wrappers to crc32_le function.
426 config CRYPTO_CRC32_PCLMUL
427 tristate "CRC32 PCLMULQDQ hardware acceleration"
432 From Intel Westmere and AMD Bulldozer processor with SSE4.2
433 and PCLMULQDQ supported, the processor will support
434 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
435 instruction. This option will create 'crc32-plcmul' module,
436 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
437 and gain better performance as compared with the table implementation.
439 config CRYPTO_CRCT10DIF
440 tristate "CRCT10DIF algorithm"
443 CRC T10 Data Integrity Field computation is being cast as
444 a crypto transform. This allows for faster crc t10 diff
445 transforms to be used if they are available.
447 config CRYPTO_CRCT10DIF_PCLMUL
448 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
449 depends on X86 && 64BIT && CRC_T10DIF
452 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
453 CRC T10 DIF PCLMULQDQ computation can be hardware
454 accelerated PCLMULQDQ instruction. This option will create
455 'crct10dif-plcmul' module, which is faster when computing the
456 crct10dif checksum as compared with the generic table implementation.
459 tristate "GHASH digest algorithm"
460 select CRYPTO_GF128MUL
462 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
464 config CRYPTO_POLY1305
465 tristate "Poly1305 authenticator algorithm"
467 Poly1305 authenticator algorithm, RFC7539.
469 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
470 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
471 in IETF protocols. This is the portable C implementation of Poly1305.
473 config CRYPTO_POLY1305_X86_64
474 tristate "Poly1305 authenticator algorithm (x86_64/SSE2)"
475 depends on X86 && 64BIT
476 select CRYPTO_POLY1305
478 Poly1305 authenticator algorithm, RFC7539.
480 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
481 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
482 in IETF protocols. This is the x86_64 assembler implementation using SIMD
486 tristate "MD4 digest algorithm"
489 MD4 message digest algorithm (RFC1320).
492 tristate "MD5 digest algorithm"
495 MD5 message digest algorithm (RFC1321).
497 config CRYPTO_MD5_OCTEON
498 tristate "MD5 digest algorithm (OCTEON)"
499 depends on CPU_CAVIUM_OCTEON
503 MD5 message digest algorithm (RFC1321) implemented
504 using OCTEON crypto instructions, when available.
506 config CRYPTO_MD5_PPC
507 tristate "MD5 digest algorithm (PPC)"
511 MD5 message digest algorithm (RFC1321) implemented
514 config CRYPTO_MD5_SPARC64
515 tristate "MD5 digest algorithm (SPARC64)"
520 MD5 message digest algorithm (RFC1321) implemented
521 using sparc64 crypto instructions, when available.
523 config CRYPTO_MICHAEL_MIC
524 tristate "Michael MIC keyed digest algorithm"
527 Michael MIC is used for message integrity protection in TKIP
528 (IEEE 802.11i). This algorithm is required for TKIP, but it
529 should not be used for other purposes because of the weakness
533 tristate "RIPEMD-128 digest algorithm"
536 RIPEMD-128 (ISO/IEC 10118-3:2004).
538 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
539 be used as a secure replacement for RIPEMD. For other use cases,
540 RIPEMD-160 should be used.
542 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
543 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
546 tristate "RIPEMD-160 digest algorithm"
549 RIPEMD-160 (ISO/IEC 10118-3:2004).
551 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
552 to be used as a secure replacement for the 128-bit hash functions
553 MD4, MD5 and it's predecessor RIPEMD
554 (not to be confused with RIPEMD-128).
556 It's speed is comparable to SHA1 and there are no known attacks
559 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
560 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
563 tristate "RIPEMD-256 digest algorithm"
566 RIPEMD-256 is an optional extension of RIPEMD-128 with a
567 256 bit hash. It is intended for applications that require
568 longer hash-results, without needing a larger security level
571 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
572 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
575 tristate "RIPEMD-320 digest algorithm"
578 RIPEMD-320 is an optional extension of RIPEMD-160 with a
579 320 bit hash. It is intended for applications that require
580 longer hash-results, without needing a larger security level
583 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
584 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
587 tristate "SHA1 digest algorithm"
590 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
592 config CRYPTO_SHA1_SSSE3
593 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2)"
594 depends on X86 && 64BIT
598 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
599 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
600 Extensions (AVX/AVX2), when available.
602 config CRYPTO_SHA256_SSSE3
603 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2)"
604 depends on X86 && 64BIT
608 SHA-256 secure hash standard (DFIPS 180-2) implemented
609 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
610 Extensions version 1 (AVX1), or Advanced Vector Extensions
611 version 2 (AVX2) instructions, when available.
613 config CRYPTO_SHA512_SSSE3
614 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
615 depends on X86 && 64BIT
619 SHA-512 secure hash standard (DFIPS 180-2) implemented
620 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
621 Extensions version 1 (AVX1), or Advanced Vector Extensions
622 version 2 (AVX2) instructions, when available.
624 config CRYPTO_SHA1_OCTEON
625 tristate "SHA1 digest algorithm (OCTEON)"
626 depends on CPU_CAVIUM_OCTEON
630 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
631 using OCTEON crypto instructions, when available.
633 config CRYPTO_SHA1_SPARC64
634 tristate "SHA1 digest algorithm (SPARC64)"
639 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
640 using sparc64 crypto instructions, when available.
642 config CRYPTO_SHA1_PPC
643 tristate "SHA1 digest algorithm (powerpc)"
646 This is the powerpc hardware accelerated implementation of the
647 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
649 config CRYPTO_SHA1_PPC_SPE
650 tristate "SHA1 digest algorithm (PPC SPE)"
651 depends on PPC && SPE
653 SHA-1 secure hash standard (DFIPS 180-4) implemented
654 using powerpc SPE SIMD instruction set.
656 config CRYPTO_SHA1_MB
657 tristate "SHA1 digest algorithm (x86_64 Multi-Buffer, Experimental)"
658 depends on X86 && 64BIT
661 select CRYPTO_MCRYPTD
663 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
664 using multi-buffer technique. This algorithm computes on
665 multiple data lanes concurrently with SIMD instructions for
666 better throughput. It should not be enabled by default but
667 used when there is significant amount of work to keep the keep
668 the data lanes filled to get performance benefit. If the data
669 lanes remain unfilled, a flush operation will be initiated to
670 process the crypto jobs, adding a slight latency.
673 tristate "SHA224 and SHA256 digest algorithm"
676 SHA256 secure hash standard (DFIPS 180-2).
678 This version of SHA implements a 256 bit hash with 128 bits of
679 security against collision attacks.
681 This code also includes SHA-224, a 224 bit hash with 112 bits
682 of security against collision attacks.
684 config CRYPTO_SHA256_PPC_SPE
685 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
686 depends on PPC && SPE
690 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
691 implemented using powerpc SPE SIMD instruction set.
693 config CRYPTO_SHA256_OCTEON
694 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
695 depends on CPU_CAVIUM_OCTEON
699 SHA-256 secure hash standard (DFIPS 180-2) implemented
700 using OCTEON crypto instructions, when available.
702 config CRYPTO_SHA256_SPARC64
703 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
708 SHA-256 secure hash standard (DFIPS 180-2) implemented
709 using sparc64 crypto instructions, when available.
712 tristate "SHA384 and SHA512 digest algorithms"
715 SHA512 secure hash standard (DFIPS 180-2).
717 This version of SHA implements a 512 bit hash with 256 bits of
718 security against collision attacks.
720 This code also includes SHA-384, a 384 bit hash with 192 bits
721 of security against collision attacks.
723 config CRYPTO_SHA512_OCTEON
724 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
725 depends on CPU_CAVIUM_OCTEON
729 SHA-512 secure hash standard (DFIPS 180-2) implemented
730 using OCTEON crypto instructions, when available.
732 config CRYPTO_SHA512_SPARC64
733 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
738 SHA-512 secure hash standard (DFIPS 180-2) implemented
739 using sparc64 crypto instructions, when available.
742 tristate "Tiger digest algorithms"
745 Tiger hash algorithm 192, 160 and 128-bit hashes
747 Tiger is a hash function optimized for 64-bit processors while
748 still having decent performance on 32-bit processors.
749 Tiger was developed by Ross Anderson and Eli Biham.
752 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
755 tristate "Whirlpool digest algorithms"
758 Whirlpool hash algorithm 512, 384 and 256-bit hashes
760 Whirlpool-512 is part of the NESSIE cryptographic primitives.
761 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
764 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
766 config CRYPTO_GHASH_CLMUL_NI_INTEL
767 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
768 depends on X86 && 64BIT
771 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
772 The implementation is accelerated by CLMUL-NI of Intel.
777 tristate "AES cipher algorithms"
780 AES cipher algorithms (FIPS-197). AES uses the Rijndael
783 Rijndael appears to be consistently a very good performer in
784 both hardware and software across a wide range of computing
785 environments regardless of its use in feedback or non-feedback
786 modes. Its key setup time is excellent, and its key agility is
787 good. Rijndael's very low memory requirements make it very well
788 suited for restricted-space environments, in which it also
789 demonstrates excellent performance. Rijndael's operations are
790 among the easiest to defend against power and timing attacks.
792 The AES specifies three key sizes: 128, 192 and 256 bits
794 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
796 config CRYPTO_AES_586
797 tristate "AES cipher algorithms (i586)"
798 depends on (X86 || UML_X86) && !64BIT
802 AES cipher algorithms (FIPS-197). AES uses the Rijndael
805 Rijndael appears to be consistently a very good performer in
806 both hardware and software across a wide range of computing
807 environments regardless of its use in feedback or non-feedback
808 modes. Its key setup time is excellent, and its key agility is
809 good. Rijndael's very low memory requirements make it very well
810 suited for restricted-space environments, in which it also
811 demonstrates excellent performance. Rijndael's operations are
812 among the easiest to defend against power and timing attacks.
814 The AES specifies three key sizes: 128, 192 and 256 bits
816 See <http://csrc.nist.gov/encryption/aes/> for more information.
818 config CRYPTO_AES_X86_64
819 tristate "AES cipher algorithms (x86_64)"
820 depends on (X86 || UML_X86) && 64BIT
824 AES cipher algorithms (FIPS-197). AES uses the Rijndael
827 Rijndael appears to be consistently a very good performer in
828 both hardware and software across a wide range of computing
829 environments regardless of its use in feedback or non-feedback
830 modes. Its key setup time is excellent, and its key agility is
831 good. Rijndael's very low memory requirements make it very well
832 suited for restricted-space environments, in which it also
833 demonstrates excellent performance. Rijndael's operations are
834 among the easiest to defend against power and timing attacks.
836 The AES specifies three key sizes: 128, 192 and 256 bits
838 See <http://csrc.nist.gov/encryption/aes/> for more information.
840 config CRYPTO_AES_NI_INTEL
841 tristate "AES cipher algorithms (AES-NI)"
843 select CRYPTO_AES_X86_64 if 64BIT
844 select CRYPTO_AES_586 if !64BIT
846 select CRYPTO_ABLK_HELPER
848 select CRYPTO_GLUE_HELPER_X86 if 64BIT
852 Use Intel AES-NI instructions for AES algorithm.
854 AES cipher algorithms (FIPS-197). AES uses the Rijndael
857 Rijndael appears to be consistently a very good performer in
858 both hardware and software across a wide range of computing
859 environments regardless of its use in feedback or non-feedback
860 modes. Its key setup time is excellent, and its key agility is
861 good. Rijndael's very low memory requirements make it very well
862 suited for restricted-space environments, in which it also
863 demonstrates excellent performance. Rijndael's operations are
864 among the easiest to defend against power and timing attacks.
866 The AES specifies three key sizes: 128, 192 and 256 bits
868 See <http://csrc.nist.gov/encryption/aes/> for more information.
870 In addition to AES cipher algorithm support, the acceleration
871 for some popular block cipher mode is supported too, including
872 ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
873 acceleration for CTR.
875 config CRYPTO_AES_SPARC64
876 tristate "AES cipher algorithms (SPARC64)"
881 Use SPARC64 crypto opcodes for AES algorithm.
883 AES cipher algorithms (FIPS-197). AES uses the Rijndael
886 Rijndael appears to be consistently a very good performer in
887 both hardware and software across a wide range of computing
888 environments regardless of its use in feedback or non-feedback
889 modes. Its key setup time is excellent, and its key agility is
890 good. Rijndael's very low memory requirements make it very well
891 suited for restricted-space environments, in which it also
892 demonstrates excellent performance. Rijndael's operations are
893 among the easiest to defend against power and timing attacks.
895 The AES specifies three key sizes: 128, 192 and 256 bits
897 See <http://csrc.nist.gov/encryption/aes/> for more information.
899 In addition to AES cipher algorithm support, the acceleration
900 for some popular block cipher mode is supported too, including
903 config CRYPTO_AES_PPC_SPE
904 tristate "AES cipher algorithms (PPC SPE)"
905 depends on PPC && SPE
907 AES cipher algorithms (FIPS-197). Additionally the acceleration
908 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
909 This module should only be used for low power (router) devices
910 without hardware AES acceleration (e.g. caam crypto). It reduces the
911 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
912 timining attacks. Nevertheless it might be not as secure as other
913 architecture specific assembler implementations that work on 1KB
914 tables or 256 bytes S-boxes.
917 tristate "Anubis cipher algorithm"
920 Anubis cipher algorithm.
922 Anubis is a variable key length cipher which can use keys from
923 128 bits to 320 bits in length. It was evaluated as a entrant
924 in the NESSIE competition.
927 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
928 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
931 tristate "ARC4 cipher algorithm"
932 select CRYPTO_BLKCIPHER
934 ARC4 cipher algorithm.
936 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
937 bits in length. This algorithm is required for driver-based
938 WEP, but it should not be for other purposes because of the
939 weakness of the algorithm.
941 config CRYPTO_BLOWFISH
942 tristate "Blowfish cipher algorithm"
944 select CRYPTO_BLOWFISH_COMMON
946 Blowfish cipher algorithm, by Bruce Schneier.
948 This is a variable key length cipher which can use keys from 32
949 bits to 448 bits in length. It's fast, simple and specifically
950 designed for use on "large microprocessors".
953 <http://www.schneier.com/blowfish.html>
955 config CRYPTO_BLOWFISH_COMMON
958 Common parts of the Blowfish cipher algorithm shared by the
959 generic c and the assembler implementations.
962 <http://www.schneier.com/blowfish.html>
964 config CRYPTO_BLOWFISH_X86_64
965 tristate "Blowfish cipher algorithm (x86_64)"
966 depends on X86 && 64BIT
968 select CRYPTO_BLOWFISH_COMMON
970 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
972 This is a variable key length cipher which can use keys from 32
973 bits to 448 bits in length. It's fast, simple and specifically
974 designed for use on "large microprocessors".
977 <http://www.schneier.com/blowfish.html>
979 config CRYPTO_CAMELLIA
980 tristate "Camellia cipher algorithms"
984 Camellia cipher algorithms module.
986 Camellia is a symmetric key block cipher developed jointly
987 at NTT and Mitsubishi Electric Corporation.
989 The Camellia specifies three key sizes: 128, 192 and 256 bits.
992 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
994 config CRYPTO_CAMELLIA_X86_64
995 tristate "Camellia cipher algorithm (x86_64)"
996 depends on X86 && 64BIT
999 select CRYPTO_GLUE_HELPER_X86
1003 Camellia cipher algorithm module (x86_64).
1005 Camellia is a symmetric key block cipher developed jointly
1006 at NTT and Mitsubishi Electric Corporation.
1008 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1011 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1013 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1014 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1015 depends on X86 && 64BIT
1017 select CRYPTO_ALGAPI
1018 select CRYPTO_CRYPTD
1019 select CRYPTO_ABLK_HELPER
1020 select CRYPTO_GLUE_HELPER_X86
1021 select CRYPTO_CAMELLIA_X86_64
1025 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1027 Camellia is a symmetric key block cipher developed jointly
1028 at NTT and Mitsubishi Electric Corporation.
1030 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1033 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1035 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1036 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1037 depends on X86 && 64BIT
1039 select CRYPTO_ALGAPI
1040 select CRYPTO_CRYPTD
1041 select CRYPTO_ABLK_HELPER
1042 select CRYPTO_GLUE_HELPER_X86
1043 select CRYPTO_CAMELLIA_X86_64
1044 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1048 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1050 Camellia is a symmetric key block cipher developed jointly
1051 at NTT and Mitsubishi Electric Corporation.
1053 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1056 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1058 config CRYPTO_CAMELLIA_SPARC64
1059 tristate "Camellia cipher algorithm (SPARC64)"
1062 select CRYPTO_ALGAPI
1064 Camellia cipher algorithm module (SPARC64).
1066 Camellia is a symmetric key block cipher developed jointly
1067 at NTT and Mitsubishi Electric Corporation.
1069 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1072 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1074 config CRYPTO_CAST_COMMON
1077 Common parts of the CAST cipher algorithms shared by the
1078 generic c and the assembler implementations.
1081 tristate "CAST5 (CAST-128) cipher algorithm"
1082 select CRYPTO_ALGAPI
1083 select CRYPTO_CAST_COMMON
1085 The CAST5 encryption algorithm (synonymous with CAST-128) is
1086 described in RFC2144.
1088 config CRYPTO_CAST5_AVX_X86_64
1089 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1090 depends on X86 && 64BIT
1091 select CRYPTO_ALGAPI
1092 select CRYPTO_CRYPTD
1093 select CRYPTO_ABLK_HELPER
1094 select CRYPTO_CAST_COMMON
1097 The CAST5 encryption algorithm (synonymous with CAST-128) is
1098 described in RFC2144.
1100 This module provides the Cast5 cipher algorithm that processes
1101 sixteen blocks parallel using the AVX instruction set.
1104 tristate "CAST6 (CAST-256) cipher algorithm"
1105 select CRYPTO_ALGAPI
1106 select CRYPTO_CAST_COMMON
1108 The CAST6 encryption algorithm (synonymous with CAST-256) is
1109 described in RFC2612.
1111 config CRYPTO_CAST6_AVX_X86_64
1112 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1113 depends on X86 && 64BIT
1114 select CRYPTO_ALGAPI
1115 select CRYPTO_CRYPTD
1116 select CRYPTO_ABLK_HELPER
1117 select CRYPTO_GLUE_HELPER_X86
1118 select CRYPTO_CAST_COMMON
1123 The CAST6 encryption algorithm (synonymous with CAST-256) is
1124 described in RFC2612.
1126 This module provides the Cast6 cipher algorithm that processes
1127 eight blocks parallel using the AVX instruction set.
1130 tristate "DES and Triple DES EDE cipher algorithms"
1131 select CRYPTO_ALGAPI
1133 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1135 config CRYPTO_DES_SPARC64
1136 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1138 select CRYPTO_ALGAPI
1141 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1142 optimized using SPARC64 crypto opcodes.
1144 config CRYPTO_DES3_EDE_X86_64
1145 tristate "Triple DES EDE cipher algorithm (x86-64)"
1146 depends on X86 && 64BIT
1147 select CRYPTO_ALGAPI
1150 Triple DES EDE (FIPS 46-3) algorithm.
1152 This module provides implementation of the Triple DES EDE cipher
1153 algorithm that is optimized for x86-64 processors. Two versions of
1154 algorithm are provided; regular processing one input block and
1155 one that processes three blocks parallel.
1157 config CRYPTO_FCRYPT
1158 tristate "FCrypt cipher algorithm"
1159 select CRYPTO_ALGAPI
1160 select CRYPTO_BLKCIPHER
1162 FCrypt algorithm used by RxRPC.
1164 config CRYPTO_KHAZAD
1165 tristate "Khazad cipher algorithm"
1166 select CRYPTO_ALGAPI
1168 Khazad cipher algorithm.
1170 Khazad was a finalist in the initial NESSIE competition. It is
1171 an algorithm optimized for 64-bit processors with good performance
1172 on 32-bit processors. Khazad uses an 128 bit key size.
1175 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1177 config CRYPTO_SALSA20
1178 tristate "Salsa20 stream cipher algorithm"
1179 select CRYPTO_BLKCIPHER
1181 Salsa20 stream cipher algorithm.
1183 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1184 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1186 The Salsa20 stream cipher algorithm is designed by Daniel J.
1187 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1189 config CRYPTO_SALSA20_586
1190 tristate "Salsa20 stream cipher algorithm (i586)"
1191 depends on (X86 || UML_X86) && !64BIT
1192 select CRYPTO_BLKCIPHER
1194 Salsa20 stream cipher algorithm.
1196 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1197 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1199 The Salsa20 stream cipher algorithm is designed by Daniel J.
1200 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1202 config CRYPTO_SALSA20_X86_64
1203 tristate "Salsa20 stream cipher algorithm (x86_64)"
1204 depends on (X86 || UML_X86) && 64BIT
1205 select CRYPTO_BLKCIPHER
1207 Salsa20 stream cipher algorithm.
1209 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1210 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1212 The Salsa20 stream cipher algorithm is designed by Daniel J.
1213 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1215 config CRYPTO_CHACHA20
1216 tristate "ChaCha20 cipher algorithm"
1217 select CRYPTO_BLKCIPHER
1219 ChaCha20 cipher algorithm, RFC7539.
1221 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1222 Bernstein and further specified in RFC7539 for use in IETF protocols.
1223 This is the portable C implementation of ChaCha20.
1226 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1228 config CRYPTO_CHACHA20_X86_64
1229 tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
1230 depends on X86 && 64BIT
1231 select CRYPTO_BLKCIPHER
1232 select CRYPTO_CHACHA20
1234 ChaCha20 cipher algorithm, RFC7539.
1236 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1237 Bernstein and further specified in RFC7539 for use in IETF protocols.
1238 This is the x86_64 assembler implementation using SIMD instructions.
1241 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1244 tristate "SEED cipher algorithm"
1245 select CRYPTO_ALGAPI
1247 SEED cipher algorithm (RFC4269).
1249 SEED is a 128-bit symmetric key block cipher that has been
1250 developed by KISA (Korea Information Security Agency) as a
1251 national standard encryption algorithm of the Republic of Korea.
1252 It is a 16 round block cipher with the key size of 128 bit.
1255 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1257 config CRYPTO_SERPENT
1258 tristate "Serpent cipher algorithm"
1259 select CRYPTO_ALGAPI
1261 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1263 Keys are allowed to be from 0 to 256 bits in length, in steps
1264 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1265 variant of Serpent for compatibility with old kerneli.org code.
1268 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1270 config CRYPTO_SERPENT_SSE2_X86_64
1271 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1272 depends on X86 && 64BIT
1273 select CRYPTO_ALGAPI
1274 select CRYPTO_CRYPTD
1275 select CRYPTO_ABLK_HELPER
1276 select CRYPTO_GLUE_HELPER_X86
1277 select CRYPTO_SERPENT
1281 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1283 Keys are allowed to be from 0 to 256 bits in length, in steps
1286 This module provides Serpent cipher algorithm that processes eight
1287 blocks parallel using SSE2 instruction set.
1290 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1292 config CRYPTO_SERPENT_SSE2_586
1293 tristate "Serpent cipher algorithm (i586/SSE2)"
1294 depends on X86 && !64BIT
1295 select CRYPTO_ALGAPI
1296 select CRYPTO_CRYPTD
1297 select CRYPTO_ABLK_HELPER
1298 select CRYPTO_GLUE_HELPER_X86
1299 select CRYPTO_SERPENT
1303 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1305 Keys are allowed to be from 0 to 256 bits in length, in steps
1308 This module provides Serpent cipher algorithm that processes four
1309 blocks parallel using SSE2 instruction set.
1312 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1314 config CRYPTO_SERPENT_AVX_X86_64
1315 tristate "Serpent cipher algorithm (x86_64/AVX)"
1316 depends on X86 && 64BIT
1317 select CRYPTO_ALGAPI
1318 select CRYPTO_CRYPTD
1319 select CRYPTO_ABLK_HELPER
1320 select CRYPTO_GLUE_HELPER_X86
1321 select CRYPTO_SERPENT
1325 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1327 Keys are allowed to be from 0 to 256 bits in length, in steps
1330 This module provides the Serpent cipher algorithm that processes
1331 eight blocks parallel using the AVX instruction set.
1334 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1336 config CRYPTO_SERPENT_AVX2_X86_64
1337 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1338 depends on X86 && 64BIT
1339 select CRYPTO_ALGAPI
1340 select CRYPTO_CRYPTD
1341 select CRYPTO_ABLK_HELPER
1342 select CRYPTO_GLUE_HELPER_X86
1343 select CRYPTO_SERPENT
1344 select CRYPTO_SERPENT_AVX_X86_64
1348 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1350 Keys are allowed to be from 0 to 256 bits in length, in steps
1353 This module provides Serpent cipher algorithm that processes 16
1354 blocks parallel using AVX2 instruction set.
1357 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1360 tristate "TEA, XTEA and XETA cipher algorithms"
1361 select CRYPTO_ALGAPI
1363 TEA cipher algorithm.
1365 Tiny Encryption Algorithm is a simple cipher that uses
1366 many rounds for security. It is very fast and uses
1369 Xtendend Tiny Encryption Algorithm is a modification to
1370 the TEA algorithm to address a potential key weakness
1371 in the TEA algorithm.
1373 Xtendend Encryption Tiny Algorithm is a mis-implementation
1374 of the XTEA algorithm for compatibility purposes.
1376 config CRYPTO_TWOFISH
1377 tristate "Twofish cipher algorithm"
1378 select CRYPTO_ALGAPI
1379 select CRYPTO_TWOFISH_COMMON
1381 Twofish cipher algorithm.
1383 Twofish was submitted as an AES (Advanced Encryption Standard)
1384 candidate cipher by researchers at CounterPane Systems. It is a
1385 16 round block cipher supporting key sizes of 128, 192, and 256
1389 <http://www.schneier.com/twofish.html>
1391 config CRYPTO_TWOFISH_COMMON
1394 Common parts of the Twofish cipher algorithm shared by the
1395 generic c and the assembler implementations.
1397 config CRYPTO_TWOFISH_586
1398 tristate "Twofish cipher algorithms (i586)"
1399 depends on (X86 || UML_X86) && !64BIT
1400 select CRYPTO_ALGAPI
1401 select CRYPTO_TWOFISH_COMMON
1403 Twofish cipher algorithm.
1405 Twofish was submitted as an AES (Advanced Encryption Standard)
1406 candidate cipher by researchers at CounterPane Systems. It is a
1407 16 round block cipher supporting key sizes of 128, 192, and 256
1411 <http://www.schneier.com/twofish.html>
1413 config CRYPTO_TWOFISH_X86_64
1414 tristate "Twofish cipher algorithm (x86_64)"
1415 depends on (X86 || UML_X86) && 64BIT
1416 select CRYPTO_ALGAPI
1417 select CRYPTO_TWOFISH_COMMON
1419 Twofish cipher algorithm (x86_64).
1421 Twofish was submitted as an AES (Advanced Encryption Standard)
1422 candidate cipher by researchers at CounterPane Systems. It is a
1423 16 round block cipher supporting key sizes of 128, 192, and 256
1427 <http://www.schneier.com/twofish.html>
1429 config CRYPTO_TWOFISH_X86_64_3WAY
1430 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1431 depends on X86 && 64BIT
1432 select CRYPTO_ALGAPI
1433 select CRYPTO_TWOFISH_COMMON
1434 select CRYPTO_TWOFISH_X86_64
1435 select CRYPTO_GLUE_HELPER_X86
1439 Twofish cipher algorithm (x86_64, 3-way parallel).
1441 Twofish was submitted as an AES (Advanced Encryption Standard)
1442 candidate cipher by researchers at CounterPane Systems. It is a
1443 16 round block cipher supporting key sizes of 128, 192, and 256
1446 This module provides Twofish cipher algorithm that processes three
1447 blocks parallel, utilizing resources of out-of-order CPUs better.
1450 <http://www.schneier.com/twofish.html>
1452 config CRYPTO_TWOFISH_AVX_X86_64
1453 tristate "Twofish cipher algorithm (x86_64/AVX)"
1454 depends on X86 && 64BIT
1455 select CRYPTO_ALGAPI
1456 select CRYPTO_CRYPTD
1457 select CRYPTO_ABLK_HELPER
1458 select CRYPTO_GLUE_HELPER_X86
1459 select CRYPTO_TWOFISH_COMMON
1460 select CRYPTO_TWOFISH_X86_64
1461 select CRYPTO_TWOFISH_X86_64_3WAY
1465 Twofish cipher algorithm (x86_64/AVX).
1467 Twofish was submitted as an AES (Advanced Encryption Standard)
1468 candidate cipher by researchers at CounterPane Systems. It is a
1469 16 round block cipher supporting key sizes of 128, 192, and 256
1472 This module provides the Twofish cipher algorithm that processes
1473 eight blocks parallel using the AVX Instruction Set.
1476 <http://www.schneier.com/twofish.html>
1478 comment "Compression"
1480 config CRYPTO_DEFLATE
1481 tristate "Deflate compression algorithm"
1482 select CRYPTO_ALGAPI
1486 This is the Deflate algorithm (RFC1951), specified for use in
1487 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1489 You will most probably want this if using IPSec.
1492 tristate "Zlib compression algorithm"
1498 This is the zlib algorithm.
1501 tristate "LZO compression algorithm"
1502 select CRYPTO_ALGAPI
1504 select LZO_DECOMPRESS
1506 This is the LZO algorithm.
1509 tristate "842 compression algorithm"
1510 select CRYPTO_ALGAPI
1512 select 842_DECOMPRESS
1514 This is the 842 algorithm.
1517 tristate "LZ4 compression algorithm"
1518 select CRYPTO_ALGAPI
1520 select LZ4_DECOMPRESS
1522 This is the LZ4 algorithm.
1525 tristate "LZ4HC compression algorithm"
1526 select CRYPTO_ALGAPI
1527 select LZ4HC_COMPRESS
1528 select LZ4_DECOMPRESS
1530 This is the LZ4 high compression mode algorithm.
1532 comment "Random Number Generation"
1534 config CRYPTO_ANSI_CPRNG
1535 tristate "Pseudo Random Number Generation for Cryptographic modules"
1539 This option enables the generic pseudo random number generator
1540 for cryptographic modules. Uses the Algorithm specified in
1541 ANSI X9.31 A.2.4. Note that this option must be enabled if
1542 CRYPTO_FIPS is selected
1544 menuconfig CRYPTO_DRBG_MENU
1545 tristate "NIST SP800-90A DRBG"
1547 NIST SP800-90A compliant DRBG. In the following submenu, one or
1548 more of the DRBG types must be selected.
1552 config CRYPTO_DRBG_HMAC
1556 select CRYPTO_SHA256
1558 config CRYPTO_DRBG_HASH
1559 bool "Enable Hash DRBG"
1560 select CRYPTO_SHA256
1562 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1564 config CRYPTO_DRBG_CTR
1565 bool "Enable CTR DRBG"
1568 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1572 default CRYPTO_DRBG_MENU
1574 select CRYPTO_JITTERENTROPY
1576 endif # if CRYPTO_DRBG_MENU
1578 config CRYPTO_JITTERENTROPY
1579 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1581 The Jitterentropy RNG is a noise that is intended
1582 to provide seed to another RNG. The RNG does not
1583 perform any cryptographic whitening of the generated
1584 random numbers. This Jitterentropy RNG registers with
1585 the kernel crypto API and can be used by any caller.
1587 config CRYPTO_USER_API
1590 config CRYPTO_USER_API_HASH
1591 tristate "User-space interface for hash algorithms"
1594 select CRYPTO_USER_API
1596 This option enables the user-spaces interface for hash
1599 config CRYPTO_USER_API_SKCIPHER
1600 tristate "User-space interface for symmetric key cipher algorithms"
1602 select CRYPTO_BLKCIPHER
1603 select CRYPTO_USER_API
1605 This option enables the user-spaces interface for symmetric
1606 key cipher algorithms.
1608 config CRYPTO_USER_API_RNG
1609 tristate "User-space interface for random number generator algorithms"
1612 select CRYPTO_USER_API
1614 This option enables the user-spaces interface for random
1615 number generator algorithms.
1617 config CRYPTO_USER_API_AEAD
1618 tristate "User-space interface for AEAD cipher algorithms"
1621 select CRYPTO_USER_API
1623 This option enables the user-spaces interface for AEAD
1626 config CRYPTO_HASH_INFO
1629 source "drivers/crypto/Kconfig"
1630 source crypto/asymmetric_keys/Kconfig