2 # Generic algorithms support
8 # async_tx api: hardware offloaded memory transfer/transform support
10 source "crypto/async_tx/Kconfig"
13 # Cryptographic API Configuration
16 tristate "Cryptographic API"
18 This option provides the core Cryptographic API.
22 comment "Crypto core or helper"
25 bool "FIPS 200 compliance"
26 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 This options enables the fips boot option which is
30 required if you want to system to operate in a FIPS 200
31 certification. You should say no unless you know what
38 This option provides the API for cryptographic algorithms.
52 config CRYPTO_BLKCIPHER
54 select CRYPTO_BLKCIPHER2
57 config CRYPTO_BLKCIPHER2
61 select CRYPTO_WORKQUEUE
81 config CRYPTO_RNG_DEFAULT
83 select CRYPTO_DRBG_MENU
94 config CRYPTO_AKCIPHER2
98 config CRYPTO_AKCIPHER
100 select CRYPTO_AKCIPHER2
104 tristate "RSA algorithm"
105 select CRYPTO_AKCIPHER
109 Generic implementation of the RSA public key algorithm.
111 config CRYPTO_MANAGER
112 tristate "Cryptographic algorithm manager"
113 select CRYPTO_MANAGER2
115 Create default cryptographic template instantiations such as
118 config CRYPTO_MANAGER2
119 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
122 select CRYPTO_BLKCIPHER2
124 select CRYPTO_AKCIPHER2
127 tristate "Userspace cryptographic algorithm configuration"
129 select CRYPTO_MANAGER
131 Userspace configuration for cryptographic instantiations such as
134 config CRYPTO_MANAGER_DISABLE_TESTS
135 bool "Disable run-time self tests"
137 depends on CRYPTO_MANAGER2
139 Disable run-time self tests that normally take place at
140 algorithm registration.
142 config CRYPTO_GF128MUL
143 tristate "GF(2^128) multiplication functions"
145 Efficient table driven implementation of multiplications in the
146 field GF(2^128). This is needed by some cypher modes. This
147 option will be selected automatically if you select such a
148 cipher mode. Only select this option by hand if you expect to load
149 an external module that requires these functions.
152 tristate "Null algorithms"
154 select CRYPTO_BLKCIPHER
157 These are 'Null' algorithms, used by IPsec, which do nothing.
160 tristate "Parallel crypto engine"
163 select CRYPTO_MANAGER
166 This converts an arbitrary crypto algorithm into a parallel
167 algorithm that executes in kernel threads.
169 config CRYPTO_WORKQUEUE
173 tristate "Software async crypto daemon"
174 select CRYPTO_BLKCIPHER
176 select CRYPTO_MANAGER
177 select CRYPTO_WORKQUEUE
179 This is a generic software asynchronous crypto daemon that
180 converts an arbitrary synchronous software crypto algorithm
181 into an asynchronous algorithm that executes in a kernel thread.
183 config CRYPTO_MCRYPTD
184 tristate "Software async multi-buffer crypto daemon"
185 select CRYPTO_BLKCIPHER
187 select CRYPTO_MANAGER
188 select CRYPTO_WORKQUEUE
190 This is a generic software asynchronous crypto daemon that
191 provides the kernel thread to assist multi-buffer crypto
192 algorithms for submitting jobs and flushing jobs in multi-buffer
193 crypto algorithms. Multi-buffer crypto algorithms are executed
194 in the context of this kernel thread and drivers can post
195 their crypto request asynchronously to be processed by this daemon.
197 config CRYPTO_AUTHENC
198 tristate "Authenc support"
200 select CRYPTO_BLKCIPHER
201 select CRYPTO_MANAGER
205 Authenc: Combined mode wrapper for IPsec.
206 This is required for IPSec.
209 tristate "Testing module"
211 select CRYPTO_MANAGER
213 Quick & dirty crypto test module.
215 config CRYPTO_ABLK_HELPER
219 config CRYPTO_GLUE_HELPER_X86
224 comment "Authenticated Encryption with Associated Data"
227 tristate "CCM support"
231 Support for Counter with CBC MAC. Required for IPsec.
234 tristate "GCM/GMAC support"
240 Support for Galois/Counter Mode (GCM) and Galois Message
241 Authentication Code (GMAC). Required for IPSec.
243 config CRYPTO_CHACHA20POLY1305
244 tristate "ChaCha20-Poly1305 AEAD support"
245 select CRYPTO_CHACHA20
246 select CRYPTO_POLY1305
249 ChaCha20-Poly1305 AEAD support, RFC7539.
251 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
252 with the Poly1305 authenticator. It is defined in RFC7539 for use in
256 tristate "Sequence Number IV Generator"
258 select CRYPTO_BLKCIPHER
260 select CRYPTO_RNG_DEFAULT
262 This IV generator generates an IV based on a sequence number by
263 xoring it with a salt. This algorithm is mainly useful for CTR
265 config CRYPTO_ECHAINIV
266 tristate "Encrypted Chain IV Generator"
269 select CRYPTO_RNG_DEFAULT
272 This IV generator generates an IV based on the encryption of
273 a sequence number xored with a salt. This is the default
276 comment "Block modes"
279 tristate "CBC support"
280 select CRYPTO_BLKCIPHER
281 select CRYPTO_MANAGER
283 CBC: Cipher Block Chaining mode
284 This block cipher algorithm is required for IPSec.
287 tristate "CTR support"
288 select CRYPTO_BLKCIPHER
290 select CRYPTO_MANAGER
293 This block cipher algorithm is required for IPSec.
296 tristate "CTS support"
297 select CRYPTO_BLKCIPHER
299 CTS: Cipher Text Stealing
300 This is the Cipher Text Stealing mode as described by
301 Section 8 of rfc2040 and referenced by rfc3962.
302 (rfc3962 includes errata information in its Appendix A)
303 This mode is required for Kerberos gss mechanism support
307 tristate "ECB support"
308 select CRYPTO_BLKCIPHER
309 select CRYPTO_MANAGER
311 ECB: Electronic CodeBook mode
312 This is the simplest block cipher algorithm. It simply encrypts
313 the input block by block.
316 tristate "LRW support"
317 select CRYPTO_BLKCIPHER
318 select CRYPTO_MANAGER
319 select CRYPTO_GF128MUL
321 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
322 narrow block cipher mode for dm-crypt. Use it with cipher
323 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
324 The first 128, 192 or 256 bits in the key are used for AES and the
325 rest is used to tie each cipher block to its logical position.
328 tristate "PCBC support"
329 select CRYPTO_BLKCIPHER
330 select CRYPTO_MANAGER
332 PCBC: Propagating Cipher Block Chaining mode
333 This block cipher algorithm is required for RxRPC.
336 tristate "XTS support"
337 select CRYPTO_BLKCIPHER
338 select CRYPTO_MANAGER
339 select CRYPTO_GF128MUL
341 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
342 key size 256, 384 or 512 bits. This implementation currently
343 can't handle a sectorsize which is not a multiple of 16 bytes.
348 tristate "CMAC support"
350 select CRYPTO_MANAGER
352 Cipher-based Message Authentication Code (CMAC) specified by
353 The National Institute of Standards and Technology (NIST).
355 https://tools.ietf.org/html/rfc4493
356 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
359 tristate "HMAC support"
361 select CRYPTO_MANAGER
363 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
364 This is required for IPSec.
367 tristate "XCBC support"
369 select CRYPTO_MANAGER
371 XCBC: Keyed-Hashing with encryption algorithm
372 http://www.ietf.org/rfc/rfc3566.txt
373 http://csrc.nist.gov/encryption/modes/proposedmodes/
374 xcbc-mac/xcbc-mac-spec.pdf
377 tristate "VMAC support"
379 select CRYPTO_MANAGER
381 VMAC is a message authentication algorithm designed for
382 very high speed on 64-bit architectures.
385 <http://fastcrypto.org/vmac>
390 tristate "CRC32c CRC algorithm"
394 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
395 by iSCSI for header and data digests and by others.
396 See Castagnoli93. Module will be crc32c.
398 config CRYPTO_CRC32C_INTEL
399 tristate "CRC32c INTEL hardware acceleration"
403 In Intel processor with SSE4.2 supported, the processor will
404 support CRC32C implementation using hardware accelerated CRC32
405 instruction. This option will create 'crc32c-intel' module,
406 which will enable any routine to use the CRC32 instruction to
407 gain performance compared with software implementation.
408 Module will be crc32c-intel.
410 config CRYPTO_CRC32C_SPARC64
411 tristate "CRC32c CRC algorithm (SPARC64)"
416 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
420 tristate "CRC32 CRC algorithm"
424 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
425 Shash crypto api wrappers to crc32_le function.
427 config CRYPTO_CRC32_PCLMUL
428 tristate "CRC32 PCLMULQDQ hardware acceleration"
433 From Intel Westmere and AMD Bulldozer processor with SSE4.2
434 and PCLMULQDQ supported, the processor will support
435 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
436 instruction. This option will create 'crc32-plcmul' module,
437 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
438 and gain better performance as compared with the table implementation.
440 config CRYPTO_CRCT10DIF
441 tristate "CRCT10DIF algorithm"
444 CRC T10 Data Integrity Field computation is being cast as
445 a crypto transform. This allows for faster crc t10 diff
446 transforms to be used if they are available.
448 config CRYPTO_CRCT10DIF_PCLMUL
449 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
450 depends on X86 && 64BIT && CRC_T10DIF
453 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
454 CRC T10 DIF PCLMULQDQ computation can be hardware
455 accelerated PCLMULQDQ instruction. This option will create
456 'crct10dif-plcmul' module, which is faster when computing the
457 crct10dif checksum as compared with the generic table implementation.
460 tristate "GHASH digest algorithm"
461 select CRYPTO_GF128MUL
463 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
465 config CRYPTO_POLY1305
466 tristate "Poly1305 authenticator algorithm"
468 Poly1305 authenticator algorithm, RFC7539.
470 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
471 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
472 in IETF protocols. This is the portable C implementation of Poly1305.
474 config CRYPTO_POLY1305_X86_64
475 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
476 depends on X86 && 64BIT
477 select CRYPTO_POLY1305
479 Poly1305 authenticator algorithm, RFC7539.
481 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
482 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
483 in IETF protocols. This is the x86_64 assembler implementation using SIMD
487 tristate "MD4 digest algorithm"
490 MD4 message digest algorithm (RFC1320).
493 tristate "MD5 digest algorithm"
496 MD5 message digest algorithm (RFC1321).
498 config CRYPTO_MD5_OCTEON
499 tristate "MD5 digest algorithm (OCTEON)"
500 depends on CPU_CAVIUM_OCTEON
504 MD5 message digest algorithm (RFC1321) implemented
505 using OCTEON crypto instructions, when available.
507 config CRYPTO_MD5_PPC
508 tristate "MD5 digest algorithm (PPC)"
512 MD5 message digest algorithm (RFC1321) implemented
515 config CRYPTO_MD5_SPARC64
516 tristate "MD5 digest algorithm (SPARC64)"
521 MD5 message digest algorithm (RFC1321) implemented
522 using sparc64 crypto instructions, when available.
524 config CRYPTO_MICHAEL_MIC
525 tristate "Michael MIC keyed digest algorithm"
528 Michael MIC is used for message integrity protection in TKIP
529 (IEEE 802.11i). This algorithm is required for TKIP, but it
530 should not be used for other purposes because of the weakness
534 tristate "RIPEMD-128 digest algorithm"
537 RIPEMD-128 (ISO/IEC 10118-3:2004).
539 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
540 be used as a secure replacement for RIPEMD. For other use cases,
541 RIPEMD-160 should be used.
543 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
544 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
547 tristate "RIPEMD-160 digest algorithm"
550 RIPEMD-160 (ISO/IEC 10118-3:2004).
552 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
553 to be used as a secure replacement for the 128-bit hash functions
554 MD4, MD5 and it's predecessor RIPEMD
555 (not to be confused with RIPEMD-128).
557 It's speed is comparable to SHA1 and there are no known attacks
560 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
561 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
564 tristate "RIPEMD-256 digest algorithm"
567 RIPEMD-256 is an optional extension of RIPEMD-128 with a
568 256 bit hash. It is intended for applications that require
569 longer hash-results, without needing a larger security level
572 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
573 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
576 tristate "RIPEMD-320 digest algorithm"
579 RIPEMD-320 is an optional extension of RIPEMD-160 with a
580 320 bit hash. It is intended for applications that require
581 longer hash-results, without needing a larger security level
584 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
585 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
588 tristate "SHA1 digest algorithm"
591 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
593 config CRYPTO_SHA1_SSSE3
594 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2)"
595 depends on X86 && 64BIT
599 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
600 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
601 Extensions (AVX/AVX2), when available.
603 config CRYPTO_SHA256_SSSE3
604 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2)"
605 depends on X86 && 64BIT
609 SHA-256 secure hash standard (DFIPS 180-2) implemented
610 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
611 Extensions version 1 (AVX1), or Advanced Vector Extensions
612 version 2 (AVX2) instructions, when available.
614 config CRYPTO_SHA512_SSSE3
615 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
616 depends on X86 && 64BIT
620 SHA-512 secure hash standard (DFIPS 180-2) implemented
621 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
622 Extensions version 1 (AVX1), or Advanced Vector Extensions
623 version 2 (AVX2) instructions, when available.
625 config CRYPTO_SHA1_OCTEON
626 tristate "SHA1 digest algorithm (OCTEON)"
627 depends on CPU_CAVIUM_OCTEON
631 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
632 using OCTEON crypto instructions, when available.
634 config CRYPTO_SHA1_SPARC64
635 tristate "SHA1 digest algorithm (SPARC64)"
640 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
641 using sparc64 crypto instructions, when available.
643 config CRYPTO_SHA1_PPC
644 tristate "SHA1 digest algorithm (powerpc)"
647 This is the powerpc hardware accelerated implementation of the
648 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
650 config CRYPTO_SHA1_PPC_SPE
651 tristate "SHA1 digest algorithm (PPC SPE)"
652 depends on PPC && SPE
654 SHA-1 secure hash standard (DFIPS 180-4) implemented
655 using powerpc SPE SIMD instruction set.
657 config CRYPTO_SHA1_MB
658 tristate "SHA1 digest algorithm (x86_64 Multi-Buffer, Experimental)"
659 depends on X86 && 64BIT
662 select CRYPTO_MCRYPTD
664 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
665 using multi-buffer technique. This algorithm computes on
666 multiple data lanes concurrently with SIMD instructions for
667 better throughput. It should not be enabled by default but
668 used when there is significant amount of work to keep the keep
669 the data lanes filled to get performance benefit. If the data
670 lanes remain unfilled, a flush operation will be initiated to
671 process the crypto jobs, adding a slight latency.
674 tristate "SHA224 and SHA256 digest algorithm"
677 SHA256 secure hash standard (DFIPS 180-2).
679 This version of SHA implements a 256 bit hash with 128 bits of
680 security against collision attacks.
682 This code also includes SHA-224, a 224 bit hash with 112 bits
683 of security against collision attacks.
685 config CRYPTO_SHA256_PPC_SPE
686 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
687 depends on PPC && SPE
691 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
692 implemented using powerpc SPE SIMD instruction set.
694 config CRYPTO_SHA256_OCTEON
695 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
696 depends on CPU_CAVIUM_OCTEON
700 SHA-256 secure hash standard (DFIPS 180-2) implemented
701 using OCTEON crypto instructions, when available.
703 config CRYPTO_SHA256_SPARC64
704 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
709 SHA-256 secure hash standard (DFIPS 180-2) implemented
710 using sparc64 crypto instructions, when available.
713 tristate "SHA384 and SHA512 digest algorithms"
716 SHA512 secure hash standard (DFIPS 180-2).
718 This version of SHA implements a 512 bit hash with 256 bits of
719 security against collision attacks.
721 This code also includes SHA-384, a 384 bit hash with 192 bits
722 of security against collision attacks.
724 config CRYPTO_SHA512_OCTEON
725 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
726 depends on CPU_CAVIUM_OCTEON
730 SHA-512 secure hash standard (DFIPS 180-2) implemented
731 using OCTEON crypto instructions, when available.
733 config CRYPTO_SHA512_SPARC64
734 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
739 SHA-512 secure hash standard (DFIPS 180-2) implemented
740 using sparc64 crypto instructions, when available.
743 tristate "Tiger digest algorithms"
746 Tiger hash algorithm 192, 160 and 128-bit hashes
748 Tiger is a hash function optimized for 64-bit processors while
749 still having decent performance on 32-bit processors.
750 Tiger was developed by Ross Anderson and Eli Biham.
753 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
756 tristate "Whirlpool digest algorithms"
759 Whirlpool hash algorithm 512, 384 and 256-bit hashes
761 Whirlpool-512 is part of the NESSIE cryptographic primitives.
762 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
765 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
767 config CRYPTO_GHASH_CLMUL_NI_INTEL
768 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
769 depends on X86 && 64BIT
772 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
773 The implementation is accelerated by CLMUL-NI of Intel.
778 tristate "AES cipher algorithms"
781 AES cipher algorithms (FIPS-197). AES uses the Rijndael
784 Rijndael appears to be consistently a very good performer in
785 both hardware and software across a wide range of computing
786 environments regardless of its use in feedback or non-feedback
787 modes. Its key setup time is excellent, and its key agility is
788 good. Rijndael's very low memory requirements make it very well
789 suited for restricted-space environments, in which it also
790 demonstrates excellent performance. Rijndael's operations are
791 among the easiest to defend against power and timing attacks.
793 The AES specifies three key sizes: 128, 192 and 256 bits
795 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
797 config CRYPTO_AES_586
798 tristate "AES cipher algorithms (i586)"
799 depends on (X86 || UML_X86) && !64BIT
803 AES cipher algorithms (FIPS-197). AES uses the Rijndael
806 Rijndael appears to be consistently a very good performer in
807 both hardware and software across a wide range of computing
808 environments regardless of its use in feedback or non-feedback
809 modes. Its key setup time is excellent, and its key agility is
810 good. Rijndael's very low memory requirements make it very well
811 suited for restricted-space environments, in which it also
812 demonstrates excellent performance. Rijndael's operations are
813 among the easiest to defend against power and timing attacks.
815 The AES specifies three key sizes: 128, 192 and 256 bits
817 See <http://csrc.nist.gov/encryption/aes/> for more information.
819 config CRYPTO_AES_X86_64
820 tristate "AES cipher algorithms (x86_64)"
821 depends on (X86 || UML_X86) && 64BIT
825 AES cipher algorithms (FIPS-197). AES uses the Rijndael
828 Rijndael appears to be consistently a very good performer in
829 both hardware and software across a wide range of computing
830 environments regardless of its use in feedback or non-feedback
831 modes. Its key setup time is excellent, and its key agility is
832 good. Rijndael's very low memory requirements make it very well
833 suited for restricted-space environments, in which it also
834 demonstrates excellent performance. Rijndael's operations are
835 among the easiest to defend against power and timing attacks.
837 The AES specifies three key sizes: 128, 192 and 256 bits
839 See <http://csrc.nist.gov/encryption/aes/> for more information.
841 config CRYPTO_AES_NI_INTEL
842 tristate "AES cipher algorithms (AES-NI)"
844 select CRYPTO_AES_X86_64 if 64BIT
845 select CRYPTO_AES_586 if !64BIT
847 select CRYPTO_ABLK_HELPER
849 select CRYPTO_GLUE_HELPER_X86 if 64BIT
853 Use Intel AES-NI instructions for AES algorithm.
855 AES cipher algorithms (FIPS-197). AES uses the Rijndael
858 Rijndael appears to be consistently a very good performer in
859 both hardware and software across a wide range of computing
860 environments regardless of its use in feedback or non-feedback
861 modes. Its key setup time is excellent, and its key agility is
862 good. Rijndael's very low memory requirements make it very well
863 suited for restricted-space environments, in which it also
864 demonstrates excellent performance. Rijndael's operations are
865 among the easiest to defend against power and timing attacks.
867 The AES specifies three key sizes: 128, 192 and 256 bits
869 See <http://csrc.nist.gov/encryption/aes/> for more information.
871 In addition to AES cipher algorithm support, the acceleration
872 for some popular block cipher mode is supported too, including
873 ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
874 acceleration for CTR.
876 config CRYPTO_AES_SPARC64
877 tristate "AES cipher algorithms (SPARC64)"
882 Use SPARC64 crypto opcodes for AES algorithm.
884 AES cipher algorithms (FIPS-197). AES uses the Rijndael
887 Rijndael appears to be consistently a very good performer in
888 both hardware and software across a wide range of computing
889 environments regardless of its use in feedback or non-feedback
890 modes. Its key setup time is excellent, and its key agility is
891 good. Rijndael's very low memory requirements make it very well
892 suited for restricted-space environments, in which it also
893 demonstrates excellent performance. Rijndael's operations are
894 among the easiest to defend against power and timing attacks.
896 The AES specifies three key sizes: 128, 192 and 256 bits
898 See <http://csrc.nist.gov/encryption/aes/> for more information.
900 In addition to AES cipher algorithm support, the acceleration
901 for some popular block cipher mode is supported too, including
904 config CRYPTO_AES_PPC_SPE
905 tristate "AES cipher algorithms (PPC SPE)"
906 depends on PPC && SPE
908 AES cipher algorithms (FIPS-197). Additionally the acceleration
909 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
910 This module should only be used for low power (router) devices
911 without hardware AES acceleration (e.g. caam crypto). It reduces the
912 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
913 timining attacks. Nevertheless it might be not as secure as other
914 architecture specific assembler implementations that work on 1KB
915 tables or 256 bytes S-boxes.
918 tristate "Anubis cipher algorithm"
921 Anubis cipher algorithm.
923 Anubis is a variable key length cipher which can use keys from
924 128 bits to 320 bits in length. It was evaluated as a entrant
925 in the NESSIE competition.
928 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
929 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
932 tristate "ARC4 cipher algorithm"
933 select CRYPTO_BLKCIPHER
935 ARC4 cipher algorithm.
937 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
938 bits in length. This algorithm is required for driver-based
939 WEP, but it should not be for other purposes because of the
940 weakness of the algorithm.
942 config CRYPTO_BLOWFISH
943 tristate "Blowfish cipher algorithm"
945 select CRYPTO_BLOWFISH_COMMON
947 Blowfish cipher algorithm, by Bruce Schneier.
949 This is a variable key length cipher which can use keys from 32
950 bits to 448 bits in length. It's fast, simple and specifically
951 designed for use on "large microprocessors".
954 <http://www.schneier.com/blowfish.html>
956 config CRYPTO_BLOWFISH_COMMON
959 Common parts of the Blowfish cipher algorithm shared by the
960 generic c and the assembler implementations.
963 <http://www.schneier.com/blowfish.html>
965 config CRYPTO_BLOWFISH_X86_64
966 tristate "Blowfish cipher algorithm (x86_64)"
967 depends on X86 && 64BIT
969 select CRYPTO_BLOWFISH_COMMON
971 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
973 This is a variable key length cipher which can use keys from 32
974 bits to 448 bits in length. It's fast, simple and specifically
975 designed for use on "large microprocessors".
978 <http://www.schneier.com/blowfish.html>
980 config CRYPTO_CAMELLIA
981 tristate "Camellia cipher algorithms"
985 Camellia cipher algorithms module.
987 Camellia is a symmetric key block cipher developed jointly
988 at NTT and Mitsubishi Electric Corporation.
990 The Camellia specifies three key sizes: 128, 192 and 256 bits.
993 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
995 config CRYPTO_CAMELLIA_X86_64
996 tristate "Camellia cipher algorithm (x86_64)"
997 depends on X86 && 64BIT
1000 select CRYPTO_GLUE_HELPER_X86
1004 Camellia cipher algorithm module (x86_64).
1006 Camellia is a symmetric key block cipher developed jointly
1007 at NTT and Mitsubishi Electric Corporation.
1009 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1012 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1014 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1015 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1016 depends on X86 && 64BIT
1018 select CRYPTO_ALGAPI
1019 select CRYPTO_CRYPTD
1020 select CRYPTO_ABLK_HELPER
1021 select CRYPTO_GLUE_HELPER_X86
1022 select CRYPTO_CAMELLIA_X86_64
1026 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1028 Camellia is a symmetric key block cipher developed jointly
1029 at NTT and Mitsubishi Electric Corporation.
1031 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1034 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1036 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1037 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1038 depends on X86 && 64BIT
1040 select CRYPTO_ALGAPI
1041 select CRYPTO_CRYPTD
1042 select CRYPTO_ABLK_HELPER
1043 select CRYPTO_GLUE_HELPER_X86
1044 select CRYPTO_CAMELLIA_X86_64
1045 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1049 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1051 Camellia is a symmetric key block cipher developed jointly
1052 at NTT and Mitsubishi Electric Corporation.
1054 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1057 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1059 config CRYPTO_CAMELLIA_SPARC64
1060 tristate "Camellia cipher algorithm (SPARC64)"
1063 select CRYPTO_ALGAPI
1065 Camellia cipher algorithm module (SPARC64).
1067 Camellia is a symmetric key block cipher developed jointly
1068 at NTT and Mitsubishi Electric Corporation.
1070 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1073 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1075 config CRYPTO_CAST_COMMON
1078 Common parts of the CAST cipher algorithms shared by the
1079 generic c and the assembler implementations.
1082 tristate "CAST5 (CAST-128) cipher algorithm"
1083 select CRYPTO_ALGAPI
1084 select CRYPTO_CAST_COMMON
1086 The CAST5 encryption algorithm (synonymous with CAST-128) is
1087 described in RFC2144.
1089 config CRYPTO_CAST5_AVX_X86_64
1090 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1091 depends on X86 && 64BIT
1092 select CRYPTO_ALGAPI
1093 select CRYPTO_CRYPTD
1094 select CRYPTO_ABLK_HELPER
1095 select CRYPTO_CAST_COMMON
1098 The CAST5 encryption algorithm (synonymous with CAST-128) is
1099 described in RFC2144.
1101 This module provides the Cast5 cipher algorithm that processes
1102 sixteen blocks parallel using the AVX instruction set.
1105 tristate "CAST6 (CAST-256) cipher algorithm"
1106 select CRYPTO_ALGAPI
1107 select CRYPTO_CAST_COMMON
1109 The CAST6 encryption algorithm (synonymous with CAST-256) is
1110 described in RFC2612.
1112 config CRYPTO_CAST6_AVX_X86_64
1113 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1114 depends on X86 && 64BIT
1115 select CRYPTO_ALGAPI
1116 select CRYPTO_CRYPTD
1117 select CRYPTO_ABLK_HELPER
1118 select CRYPTO_GLUE_HELPER_X86
1119 select CRYPTO_CAST_COMMON
1124 The CAST6 encryption algorithm (synonymous with CAST-256) is
1125 described in RFC2612.
1127 This module provides the Cast6 cipher algorithm that processes
1128 eight blocks parallel using the AVX instruction set.
1131 tristate "DES and Triple DES EDE cipher algorithms"
1132 select CRYPTO_ALGAPI
1134 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1136 config CRYPTO_DES_SPARC64
1137 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1139 select CRYPTO_ALGAPI
1142 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1143 optimized using SPARC64 crypto opcodes.
1145 config CRYPTO_DES3_EDE_X86_64
1146 tristate "Triple DES EDE cipher algorithm (x86-64)"
1147 depends on X86 && 64BIT
1148 select CRYPTO_ALGAPI
1151 Triple DES EDE (FIPS 46-3) algorithm.
1153 This module provides implementation of the Triple DES EDE cipher
1154 algorithm that is optimized for x86-64 processors. Two versions of
1155 algorithm are provided; regular processing one input block and
1156 one that processes three blocks parallel.
1158 config CRYPTO_FCRYPT
1159 tristate "FCrypt cipher algorithm"
1160 select CRYPTO_ALGAPI
1161 select CRYPTO_BLKCIPHER
1163 FCrypt algorithm used by RxRPC.
1165 config CRYPTO_KHAZAD
1166 tristate "Khazad cipher algorithm"
1167 select CRYPTO_ALGAPI
1169 Khazad cipher algorithm.
1171 Khazad was a finalist in the initial NESSIE competition. It is
1172 an algorithm optimized for 64-bit processors with good performance
1173 on 32-bit processors. Khazad uses an 128 bit key size.
1176 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1178 config CRYPTO_SALSA20
1179 tristate "Salsa20 stream cipher algorithm"
1180 select CRYPTO_BLKCIPHER
1182 Salsa20 stream cipher algorithm.
1184 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1185 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1187 The Salsa20 stream cipher algorithm is designed by Daniel J.
1188 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1190 config CRYPTO_SALSA20_586
1191 tristate "Salsa20 stream cipher algorithm (i586)"
1192 depends on (X86 || UML_X86) && !64BIT
1193 select CRYPTO_BLKCIPHER
1195 Salsa20 stream cipher algorithm.
1197 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1198 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1200 The Salsa20 stream cipher algorithm is designed by Daniel J.
1201 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1203 config CRYPTO_SALSA20_X86_64
1204 tristate "Salsa20 stream cipher algorithm (x86_64)"
1205 depends on (X86 || UML_X86) && 64BIT
1206 select CRYPTO_BLKCIPHER
1208 Salsa20 stream cipher algorithm.
1210 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1211 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1213 The Salsa20 stream cipher algorithm is designed by Daniel J.
1214 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1216 config CRYPTO_CHACHA20
1217 tristate "ChaCha20 cipher algorithm"
1218 select CRYPTO_BLKCIPHER
1220 ChaCha20 cipher algorithm, RFC7539.
1222 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1223 Bernstein and further specified in RFC7539 for use in IETF protocols.
1224 This is the portable C implementation of ChaCha20.
1227 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1229 config CRYPTO_CHACHA20_X86_64
1230 tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
1231 depends on X86 && 64BIT
1232 select CRYPTO_BLKCIPHER
1233 select CRYPTO_CHACHA20
1235 ChaCha20 cipher algorithm, RFC7539.
1237 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1238 Bernstein and further specified in RFC7539 for use in IETF protocols.
1239 This is the x86_64 assembler implementation using SIMD instructions.
1242 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1245 tristate "SEED cipher algorithm"
1246 select CRYPTO_ALGAPI
1248 SEED cipher algorithm (RFC4269).
1250 SEED is a 128-bit symmetric key block cipher that has been
1251 developed by KISA (Korea Information Security Agency) as a
1252 national standard encryption algorithm of the Republic of Korea.
1253 It is a 16 round block cipher with the key size of 128 bit.
1256 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1258 config CRYPTO_SERPENT
1259 tristate "Serpent cipher algorithm"
1260 select CRYPTO_ALGAPI
1262 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1264 Keys are allowed to be from 0 to 256 bits in length, in steps
1265 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1266 variant of Serpent for compatibility with old kerneli.org code.
1269 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1271 config CRYPTO_SERPENT_SSE2_X86_64
1272 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1273 depends on X86 && 64BIT
1274 select CRYPTO_ALGAPI
1275 select CRYPTO_CRYPTD
1276 select CRYPTO_ABLK_HELPER
1277 select CRYPTO_GLUE_HELPER_X86
1278 select CRYPTO_SERPENT
1282 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1284 Keys are allowed to be from 0 to 256 bits in length, in steps
1287 This module provides Serpent cipher algorithm that processes eight
1288 blocks parallel using SSE2 instruction set.
1291 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1293 config CRYPTO_SERPENT_SSE2_586
1294 tristate "Serpent cipher algorithm (i586/SSE2)"
1295 depends on X86 && !64BIT
1296 select CRYPTO_ALGAPI
1297 select CRYPTO_CRYPTD
1298 select CRYPTO_ABLK_HELPER
1299 select CRYPTO_GLUE_HELPER_X86
1300 select CRYPTO_SERPENT
1304 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1306 Keys are allowed to be from 0 to 256 bits in length, in steps
1309 This module provides Serpent cipher algorithm that processes four
1310 blocks parallel using SSE2 instruction set.
1313 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1315 config CRYPTO_SERPENT_AVX_X86_64
1316 tristate "Serpent cipher algorithm (x86_64/AVX)"
1317 depends on X86 && 64BIT
1318 select CRYPTO_ALGAPI
1319 select CRYPTO_CRYPTD
1320 select CRYPTO_ABLK_HELPER
1321 select CRYPTO_GLUE_HELPER_X86
1322 select CRYPTO_SERPENT
1326 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1328 Keys are allowed to be from 0 to 256 bits in length, in steps
1331 This module provides the Serpent cipher algorithm that processes
1332 eight blocks parallel using the AVX instruction set.
1335 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1337 config CRYPTO_SERPENT_AVX2_X86_64
1338 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1339 depends on X86 && 64BIT
1340 select CRYPTO_ALGAPI
1341 select CRYPTO_CRYPTD
1342 select CRYPTO_ABLK_HELPER
1343 select CRYPTO_GLUE_HELPER_X86
1344 select CRYPTO_SERPENT
1345 select CRYPTO_SERPENT_AVX_X86_64
1349 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1351 Keys are allowed to be from 0 to 256 bits in length, in steps
1354 This module provides Serpent cipher algorithm that processes 16
1355 blocks parallel using AVX2 instruction set.
1358 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1361 tristate "TEA, XTEA and XETA cipher algorithms"
1362 select CRYPTO_ALGAPI
1364 TEA cipher algorithm.
1366 Tiny Encryption Algorithm is a simple cipher that uses
1367 many rounds for security. It is very fast and uses
1370 Xtendend Tiny Encryption Algorithm is a modification to
1371 the TEA algorithm to address a potential key weakness
1372 in the TEA algorithm.
1374 Xtendend Encryption Tiny Algorithm is a mis-implementation
1375 of the XTEA algorithm for compatibility purposes.
1377 config CRYPTO_TWOFISH
1378 tristate "Twofish cipher algorithm"
1379 select CRYPTO_ALGAPI
1380 select CRYPTO_TWOFISH_COMMON
1382 Twofish cipher algorithm.
1384 Twofish was submitted as an AES (Advanced Encryption Standard)
1385 candidate cipher by researchers at CounterPane Systems. It is a
1386 16 round block cipher supporting key sizes of 128, 192, and 256
1390 <http://www.schneier.com/twofish.html>
1392 config CRYPTO_TWOFISH_COMMON
1395 Common parts of the Twofish cipher algorithm shared by the
1396 generic c and the assembler implementations.
1398 config CRYPTO_TWOFISH_586
1399 tristate "Twofish cipher algorithms (i586)"
1400 depends on (X86 || UML_X86) && !64BIT
1401 select CRYPTO_ALGAPI
1402 select CRYPTO_TWOFISH_COMMON
1404 Twofish cipher algorithm.
1406 Twofish was submitted as an AES (Advanced Encryption Standard)
1407 candidate cipher by researchers at CounterPane Systems. It is a
1408 16 round block cipher supporting key sizes of 128, 192, and 256
1412 <http://www.schneier.com/twofish.html>
1414 config CRYPTO_TWOFISH_X86_64
1415 tristate "Twofish cipher algorithm (x86_64)"
1416 depends on (X86 || UML_X86) && 64BIT
1417 select CRYPTO_ALGAPI
1418 select CRYPTO_TWOFISH_COMMON
1420 Twofish cipher algorithm (x86_64).
1422 Twofish was submitted as an AES (Advanced Encryption Standard)
1423 candidate cipher by researchers at CounterPane Systems. It is a
1424 16 round block cipher supporting key sizes of 128, 192, and 256
1428 <http://www.schneier.com/twofish.html>
1430 config CRYPTO_TWOFISH_X86_64_3WAY
1431 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1432 depends on X86 && 64BIT
1433 select CRYPTO_ALGAPI
1434 select CRYPTO_TWOFISH_COMMON
1435 select CRYPTO_TWOFISH_X86_64
1436 select CRYPTO_GLUE_HELPER_X86
1440 Twofish cipher algorithm (x86_64, 3-way parallel).
1442 Twofish was submitted as an AES (Advanced Encryption Standard)
1443 candidate cipher by researchers at CounterPane Systems. It is a
1444 16 round block cipher supporting key sizes of 128, 192, and 256
1447 This module provides Twofish cipher algorithm that processes three
1448 blocks parallel, utilizing resources of out-of-order CPUs better.
1451 <http://www.schneier.com/twofish.html>
1453 config CRYPTO_TWOFISH_AVX_X86_64
1454 tristate "Twofish cipher algorithm (x86_64/AVX)"
1455 depends on X86 && 64BIT
1456 select CRYPTO_ALGAPI
1457 select CRYPTO_CRYPTD
1458 select CRYPTO_ABLK_HELPER
1459 select CRYPTO_GLUE_HELPER_X86
1460 select CRYPTO_TWOFISH_COMMON
1461 select CRYPTO_TWOFISH_X86_64
1462 select CRYPTO_TWOFISH_X86_64_3WAY
1466 Twofish cipher algorithm (x86_64/AVX).
1468 Twofish was submitted as an AES (Advanced Encryption Standard)
1469 candidate cipher by researchers at CounterPane Systems. It is a
1470 16 round block cipher supporting key sizes of 128, 192, and 256
1473 This module provides the Twofish cipher algorithm that processes
1474 eight blocks parallel using the AVX Instruction Set.
1477 <http://www.schneier.com/twofish.html>
1479 comment "Compression"
1481 config CRYPTO_DEFLATE
1482 tristate "Deflate compression algorithm"
1483 select CRYPTO_ALGAPI
1487 This is the Deflate algorithm (RFC1951), specified for use in
1488 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1490 You will most probably want this if using IPSec.
1493 tristate "Zlib compression algorithm"
1499 This is the zlib algorithm.
1502 tristate "LZO compression algorithm"
1503 select CRYPTO_ALGAPI
1505 select LZO_DECOMPRESS
1507 This is the LZO algorithm.
1510 tristate "842 compression algorithm"
1511 select CRYPTO_ALGAPI
1513 select 842_DECOMPRESS
1515 This is the 842 algorithm.
1518 tristate "LZ4 compression algorithm"
1519 select CRYPTO_ALGAPI
1521 select LZ4_DECOMPRESS
1523 This is the LZ4 algorithm.
1526 tristate "LZ4HC compression algorithm"
1527 select CRYPTO_ALGAPI
1528 select LZ4HC_COMPRESS
1529 select LZ4_DECOMPRESS
1531 This is the LZ4 high compression mode algorithm.
1533 comment "Random Number Generation"
1535 config CRYPTO_ANSI_CPRNG
1536 tristate "Pseudo Random Number Generation for Cryptographic modules"
1540 This option enables the generic pseudo random number generator
1541 for cryptographic modules. Uses the Algorithm specified in
1542 ANSI X9.31 A.2.4. Note that this option must be enabled if
1543 CRYPTO_FIPS is selected
1545 menuconfig CRYPTO_DRBG_MENU
1546 tristate "NIST SP800-90A DRBG"
1548 NIST SP800-90A compliant DRBG. In the following submenu, one or
1549 more of the DRBG types must be selected.
1553 config CRYPTO_DRBG_HMAC
1557 select CRYPTO_SHA256
1559 config CRYPTO_DRBG_HASH
1560 bool "Enable Hash DRBG"
1561 select CRYPTO_SHA256
1563 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1565 config CRYPTO_DRBG_CTR
1566 bool "Enable CTR DRBG"
1569 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1573 default CRYPTO_DRBG_MENU
1575 select CRYPTO_JITTERENTROPY
1577 endif # if CRYPTO_DRBG_MENU
1579 config CRYPTO_JITTERENTROPY
1580 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1582 The Jitterentropy RNG is a noise that is intended
1583 to provide seed to another RNG. The RNG does not
1584 perform any cryptographic whitening of the generated
1585 random numbers. This Jitterentropy RNG registers with
1586 the kernel crypto API and can be used by any caller.
1588 config CRYPTO_USER_API
1591 config CRYPTO_USER_API_HASH
1592 tristate "User-space interface for hash algorithms"
1595 select CRYPTO_USER_API
1597 This option enables the user-spaces interface for hash
1600 config CRYPTO_USER_API_SKCIPHER
1601 tristate "User-space interface for symmetric key cipher algorithms"
1603 select CRYPTO_BLKCIPHER
1604 select CRYPTO_USER_API
1606 This option enables the user-spaces interface for symmetric
1607 key cipher algorithms.
1609 config CRYPTO_USER_API_RNG
1610 tristate "User-space interface for random number generator algorithms"
1613 select CRYPTO_USER_API
1615 This option enables the user-spaces interface for random
1616 number generator algorithms.
1618 config CRYPTO_USER_API_AEAD
1619 tristate "User-space interface for AEAD cipher algorithms"
1622 select CRYPTO_USER_API
1624 This option enables the user-spaces interface for AEAD
1627 config CRYPTO_HASH_INFO
1630 source "drivers/crypto/Kconfig"
1631 source crypto/asymmetric_keys/Kconfig