1# SPDX-License-Identifier: GPL-2.0
2#
3# Generic algorithms support
4#
5config XOR_BLOCKS
6	tristate
7
8#
9# async_tx api: hardware offloaded memory transfer/transform support
10#
11source "crypto/async_tx/Kconfig"
12
13#
14# Cryptographic API Configuration
15#
16menuconfig CRYPTO
17	tristate "Cryptographic API"
18	select CRYPTO_LIB_UTILS
19	help
20	  This option provides the core Cryptographic API.
21
22if CRYPTO
23
24menu "Crypto core or helper"
25
26config CRYPTO_FIPS
27	bool "FIPS 200 compliance"
28	depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29	depends on (MODULE_SIG || !MODULES)
30	help
31	  This option enables the fips boot option which is
32	  required if you want the system to operate in a FIPS 200
33	  certification.  You should say no unless you know what
34	  this is.
35
36config CRYPTO_FIPS_NAME
37	string "FIPS Module Name"
38	default "Linux Kernel Cryptographic API"
39	depends on CRYPTO_FIPS
40	help
41	  This option sets the FIPS Module name reported by the Crypto API via
42	  the /proc/sys/crypto/fips_name file.
43
44config CRYPTO_FIPS_CUSTOM_VERSION
45	bool "Use Custom FIPS Module Version"
46	depends on CRYPTO_FIPS
47	default n
48
49config CRYPTO_FIPS_VERSION
50	string "FIPS Module Version"
51	default "(none)"
52	depends on CRYPTO_FIPS_CUSTOM_VERSION
53	help
54	  This option provides the ability to override the FIPS Module Version.
55	  By default the KERNELRELEASE value is used.
56
57config CRYPTO_ALGAPI
58	tristate
59	select CRYPTO_ALGAPI2
60	help
61	  This option provides the API for cryptographic algorithms.
62
63config CRYPTO_ALGAPI2
64	tristate
65
66config CRYPTO_AEAD
67	tristate
68	select CRYPTO_AEAD2
69	select CRYPTO_ALGAPI
70
71config CRYPTO_AEAD2
72	tristate
73	select CRYPTO_ALGAPI2
74	select CRYPTO_NULL2
75	select CRYPTO_RNG2
76
77config CRYPTO_SKCIPHER
78	tristate
79	select CRYPTO_SKCIPHER2
80	select CRYPTO_ALGAPI
81
82config CRYPTO_SKCIPHER2
83	tristate
84	select CRYPTO_ALGAPI2
85	select CRYPTO_RNG2
86
87config CRYPTO_HASH
88	tristate
89	select CRYPTO_HASH2
90	select CRYPTO_ALGAPI
91
92config CRYPTO_HASH2
93	tristate
94	select CRYPTO_ALGAPI2
95
96config CRYPTO_RNG
97	tristate
98	select CRYPTO_RNG2
99	select CRYPTO_ALGAPI
100
101config CRYPTO_RNG2
102	tristate
103	select CRYPTO_ALGAPI2
104
105config CRYPTO_RNG_DEFAULT
106	tristate
107	select CRYPTO_DRBG_MENU
108
109config CRYPTO_AKCIPHER2
110	tristate
111	select CRYPTO_ALGAPI2
112
113config CRYPTO_AKCIPHER
114	tristate
115	select CRYPTO_AKCIPHER2
116	select CRYPTO_ALGAPI
117
118config CRYPTO_KPP2
119	tristate
120	select CRYPTO_ALGAPI2
121
122config CRYPTO_KPP
123	tristate
124	select CRYPTO_ALGAPI
125	select CRYPTO_KPP2
126
127config CRYPTO_ACOMP2
128	tristate
129	select CRYPTO_ALGAPI2
130	select SGL_ALLOC
131
132config CRYPTO_ACOMP
133	tristate
134	select CRYPTO_ALGAPI
135	select CRYPTO_ACOMP2
136
137config CRYPTO_MANAGER
138	tristate "Cryptographic algorithm manager"
139	select CRYPTO_MANAGER2
140	help
141	  Create default cryptographic template instantiations such as
142	  cbc(aes).
143
144config CRYPTO_MANAGER2
145	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
146	select CRYPTO_AEAD2
147	select CRYPTO_HASH2
148	select CRYPTO_SKCIPHER2
149	select CRYPTO_AKCIPHER2
150	select CRYPTO_KPP2
151	select CRYPTO_ACOMP2
152
153config CRYPTO_USER
154	tristate "Userspace cryptographic algorithm configuration"
155	depends on NET
156	select CRYPTO_MANAGER
157	help
158	  Userspace configuration for cryptographic instantiations such as
159	  cbc(aes).
160
161config CRYPTO_MANAGER_DISABLE_TESTS
162	bool "Disable run-time self tests"
163	default y
164	help
165	  Disable run-time self tests that normally take place at
166	  algorithm registration.
167
168config CRYPTO_MANAGER_EXTRA_TESTS
169	bool "Enable extra run-time crypto self tests"
170	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
171	help
172	  Enable extra run-time self tests of registered crypto algorithms,
173	  including randomized fuzz tests.
174
175	  This is intended for developer use only, as these tests take much
176	  longer to run than the normal self tests.
177
178config CRYPTO_NULL
179	tristate "Null algorithms"
180	select CRYPTO_NULL2
181	help
182	  These are 'Null' algorithms, used by IPsec, which do nothing.
183
184config CRYPTO_NULL2
185	tristate
186	select CRYPTO_ALGAPI2
187	select CRYPTO_SKCIPHER2
188	select CRYPTO_HASH2
189
190config CRYPTO_PCRYPT
191	tristate "Parallel crypto engine"
192	depends on SMP
193	select PADATA
194	select CRYPTO_MANAGER
195	select CRYPTO_AEAD
196	help
197	  This converts an arbitrary crypto algorithm into a parallel
198	  algorithm that executes in kernel threads.
199
200config CRYPTO_CRYPTD
201	tristate "Software async crypto daemon"
202	select CRYPTO_SKCIPHER
203	select CRYPTO_HASH
204	select CRYPTO_MANAGER
205	help
206	  This is a generic software asynchronous crypto daemon that
207	  converts an arbitrary synchronous software crypto algorithm
208	  into an asynchronous algorithm that executes in a kernel thread.
209
210config CRYPTO_AUTHENC
211	tristate "Authenc support"
212	select CRYPTO_AEAD
213	select CRYPTO_SKCIPHER
214	select CRYPTO_MANAGER
215	select CRYPTO_HASH
216	select CRYPTO_NULL
217	help
218	  Authenc: Combined mode wrapper for IPsec.
219
220	  This is required for IPSec ESP (XFRM_ESP).
221
222config CRYPTO_TEST
223	tristate "Testing module"
224	depends on m || EXPERT
225	select CRYPTO_MANAGER
226	help
227	  Quick & dirty crypto test module.
228
229config CRYPTO_SIMD
230	tristate
231	select CRYPTO_CRYPTD
232
233config CRYPTO_ENGINE
234	tristate
235
236endmenu
237
238menu "Public-key cryptography"
239
240config CRYPTO_RSA
241	tristate "RSA (Rivest-Shamir-Adleman)"
242	select CRYPTO_AKCIPHER
243	select CRYPTO_MANAGER
244	select MPILIB
245	select ASN1
246	help
247	  RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
248
249config CRYPTO_DH
250	tristate "DH (Diffie-Hellman)"
251	select CRYPTO_KPP
252	select MPILIB
253	help
254	  DH (Diffie-Hellman) key exchange algorithm
255
256config CRYPTO_DH_RFC7919_GROUPS
257	bool "RFC 7919 FFDHE groups"
258	depends on CRYPTO_DH
259	select CRYPTO_RNG_DEFAULT
260	help
261	  FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
262	  defined in RFC7919.
263
264	  Support these finite-field groups in DH key exchanges:
265	  - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
266
267	  If unsure, say N.
268
269config CRYPTO_ECC
270	tristate
271	select CRYPTO_RNG_DEFAULT
272
273config CRYPTO_ECDH
274	tristate "ECDH (Elliptic Curve Diffie-Hellman)"
275	select CRYPTO_ECC
276	select CRYPTO_KPP
277	help
278	  ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
279	  using curves P-192, P-256, and P-384 (FIPS 186)
280
281config CRYPTO_ECDSA
282	tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
283	select CRYPTO_ECC
284	select CRYPTO_AKCIPHER
285	select ASN1
286	help
287	  ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
288	  ISO/IEC 14888-3)
289	  using curves P-192, P-256, and P-384
290
291	  Only signature verification is implemented.
292
293config CRYPTO_ECRDSA
294	tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
295	select CRYPTO_ECC
296	select CRYPTO_AKCIPHER
297	select CRYPTO_STREEBOG
298	select OID_REGISTRY
299	select ASN1
300	help
301	  Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
302	  RFC 7091, ISO/IEC 14888-3)
303
304	  One of the Russian cryptographic standard algorithms (called GOST
305	  algorithms). Only signature verification is implemented.
306
307config CRYPTO_SM2
308	tristate "SM2 (ShangMi 2)"
309	select CRYPTO_SM3
310	select CRYPTO_AKCIPHER
311	select CRYPTO_MANAGER
312	select MPILIB
313	select ASN1
314	help
315	  SM2 (ShangMi 2) public key algorithm
316
317	  Published by State Encryption Management Bureau, China,
318	  as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
319
320	  References:
321	  https://datatracker.ietf.org/doc/draft-shen-sm2-ecdsa/
322	  http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
323	  http://www.gmbz.org.cn/main/bzlb.html
324
325config CRYPTO_CURVE25519
326	tristate "Curve25519"
327	select CRYPTO_KPP
328	select CRYPTO_LIB_CURVE25519_GENERIC
329	help
330	  Curve25519 elliptic curve (RFC7748)
331
332endmenu
333
334menu "Block ciphers"
335
336config CRYPTO_AES
337	tristate "AES (Advanced Encryption Standard)"
338	select CRYPTO_ALGAPI
339	select CRYPTO_LIB_AES
340	help
341	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
342
343	  Rijndael appears to be consistently a very good performer in
344	  both hardware and software across a wide range of computing
345	  environments regardless of its use in feedback or non-feedback
346	  modes. Its key setup time is excellent, and its key agility is
347	  good. Rijndael's very low memory requirements make it very well
348	  suited for restricted-space environments, in which it also
349	  demonstrates excellent performance. Rijndael's operations are
350	  among the easiest to defend against power and timing attacks.
351
352	  The AES specifies three key sizes: 128, 192 and 256 bits
353
354config CRYPTO_AES_TI
355	tristate "AES (Advanced Encryption Standard) (fixed time)"
356	select CRYPTO_ALGAPI
357	select CRYPTO_LIB_AES
358	help
359	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
360
361	  This is a generic implementation of AES that attempts to eliminate
362	  data dependent latencies as much as possible without affecting
363	  performance too much. It is intended for use by the generic CCM
364	  and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
365	  solely on encryption (although decryption is supported as well, but
366	  with a more dramatic performance hit)
367
368	  Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
369	  8 for decryption), this implementation only uses just two S-boxes of
370	  256 bytes each, and attempts to eliminate data dependent latencies by
371	  prefetching the entire table into the cache at the start of each
372	  block. Interrupts are also disabled to avoid races where cachelines
373	  are evicted when the CPU is interrupted to do something else.
374
375config CRYPTO_ANUBIS
376	tristate "Anubis"
377	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
378	select CRYPTO_ALGAPI
379	help
380	  Anubis cipher algorithm
381
382	  Anubis is a variable key length cipher which can use keys from
383	  128 bits to 320 bits in length.  It was evaluated as a entrant
384	  in the NESSIE competition.
385
386	  See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
387	  for further information.
388
389config CRYPTO_ARIA
390	tristate "ARIA"
391	select CRYPTO_ALGAPI
392	help
393	  ARIA cipher algorithm (RFC5794)
394
395	  ARIA is a standard encryption algorithm of the Republic of Korea.
396	  The ARIA specifies three key sizes and rounds.
397	  128-bit: 12 rounds.
398	  192-bit: 14 rounds.
399	  256-bit: 16 rounds.
400
401	  See:
402	  https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
403
404config CRYPTO_BLOWFISH
405	tristate "Blowfish"
406	select CRYPTO_ALGAPI
407	select CRYPTO_BLOWFISH_COMMON
408	help
409	  Blowfish cipher algorithm, by Bruce Schneier
410
411	  This is a variable key length cipher which can use keys from 32
412	  bits to 448 bits in length.  It's fast, simple and specifically
413	  designed for use on "large microprocessors".
414
415	  See https://www.schneier.com/blowfish.html for further information.
416
417config CRYPTO_BLOWFISH_COMMON
418	tristate
419	help
420	  Common parts of the Blowfish cipher algorithm shared by the
421	  generic c and the assembler implementations.
422
423config CRYPTO_CAMELLIA
424	tristate "Camellia"
425	select CRYPTO_ALGAPI
426	help
427	  Camellia cipher algorithms (ISO/IEC 18033-3)
428
429	  Camellia is a symmetric key block cipher developed jointly
430	  at NTT and Mitsubishi Electric Corporation.
431
432	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
433
434	  See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
435
436config CRYPTO_CAST_COMMON
437	tristate
438	help
439	  Common parts of the CAST cipher algorithms shared by the
440	  generic c and the assembler implementations.
441
442config CRYPTO_CAST5
443	tristate "CAST5 (CAST-128)"
444	select CRYPTO_ALGAPI
445	select CRYPTO_CAST_COMMON
446	help
447	  CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
448
449config CRYPTO_CAST6
450	tristate "CAST6 (CAST-256)"
451	select CRYPTO_ALGAPI
452	select CRYPTO_CAST_COMMON
453	help
454	  CAST6 (CAST-256) encryption algorithm (RFC2612)
455
456config CRYPTO_DES
457	tristate "DES and Triple DES EDE"
458	select CRYPTO_ALGAPI
459	select CRYPTO_LIB_DES
460	help
461	  DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
462	  Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
463	  cipher algorithms
464
465config CRYPTO_FCRYPT
466	tristate "FCrypt"
467	select CRYPTO_ALGAPI
468	select CRYPTO_SKCIPHER
469	help
470	  FCrypt algorithm used by RxRPC
471
472	  See https://ota.polyonymo.us/fcrypt-paper.txt
473
474config CRYPTO_KHAZAD
475	tristate "Khazad"
476	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
477	select CRYPTO_ALGAPI
478	help
479	  Khazad cipher algorithm
480
481	  Khazad was a finalist in the initial NESSIE competition.  It is
482	  an algorithm optimized for 64-bit processors with good performance
483	  on 32-bit processors.  Khazad uses an 128 bit key size.
484
485	  See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
486	  for further information.
487
488config CRYPTO_SEED
489	tristate "SEED"
490	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
491	select CRYPTO_ALGAPI
492	help
493	  SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
494
495	  SEED is a 128-bit symmetric key block cipher that has been
496	  developed by KISA (Korea Information Security Agency) as a
497	  national standard encryption algorithm of the Republic of Korea.
498	  It is a 16 round block cipher with the key size of 128 bit.
499
500	  See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
501	  for further information.
502
503config CRYPTO_SERPENT
504	tristate "Serpent"
505	select CRYPTO_ALGAPI
506	help
507	  Serpent cipher algorithm, by Anderson, Biham & Knudsen
508
509	  Keys are allowed to be from 0 to 256 bits in length, in steps
510	  of 8 bits.
511
512	  See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
513
514config CRYPTO_SM4
515	tristate
516
517config CRYPTO_SM4_GENERIC
518	tristate "SM4 (ShangMi 4)"
519	select CRYPTO_ALGAPI
520	select CRYPTO_SM4
521	help
522	  SM4 cipher algorithms (OSCCA GB/T 32907-2016,
523	  ISO/IEC 18033-3:2010/Amd 1:2021)
524
525	  SM4 (GBT.32907-2016) is a cryptographic standard issued by the
526	  Organization of State Commercial Administration of China (OSCCA)
527	  as an authorized cryptographic algorithms for the use within China.
528
529	  SMS4 was originally created for use in protecting wireless
530	  networks, and is mandated in the Chinese National Standard for
531	  Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
532	  (GB.15629.11-2003).
533
534	  The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
535	  standardized through TC 260 of the Standardization Administration
536	  of the People's Republic of China (SAC).
537
538	  The input, output, and key of SMS4 are each 128 bits.
539
540	  See https://eprint.iacr.org/2008/329.pdf for further information.
541
542	  If unsure, say N.
543
544config CRYPTO_TEA
545	tristate "TEA, XTEA and XETA"
546	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
547	select CRYPTO_ALGAPI
548	help
549	  TEA (Tiny Encryption Algorithm) cipher algorithms
550
551	  Tiny Encryption Algorithm is a simple cipher that uses
552	  many rounds for security.  It is very fast and uses
553	  little memory.
554
555	  Xtendend Tiny Encryption Algorithm is a modification to
556	  the TEA algorithm to address a potential key weakness
557	  in the TEA algorithm.
558
559	  Xtendend Encryption Tiny Algorithm is a mis-implementation
560	  of the XTEA algorithm for compatibility purposes.
561
562config CRYPTO_TWOFISH
563	tristate "Twofish"
564	select CRYPTO_ALGAPI
565	select CRYPTO_TWOFISH_COMMON
566	help
567	  Twofish cipher algorithm
568
569	  Twofish was submitted as an AES (Advanced Encryption Standard)
570	  candidate cipher by researchers at CounterPane Systems.  It is a
571	  16 round block cipher supporting key sizes of 128, 192, and 256
572	  bits.
573
574	  See https://www.schneier.com/twofish.html for further information.
575
576config CRYPTO_TWOFISH_COMMON
577	tristate
578	help
579	  Common parts of the Twofish cipher algorithm shared by the
580	  generic c and the assembler implementations.
581
582endmenu
583
584menu "Length-preserving ciphers and modes"
585
586config CRYPTO_ADIANTUM
587	tristate "Adiantum"
588	select CRYPTO_CHACHA20
589	select CRYPTO_LIB_POLY1305_GENERIC
590	select CRYPTO_NHPOLY1305
591	select CRYPTO_MANAGER
592	help
593	  Adiantum tweakable, length-preserving encryption mode
594
595	  Designed for fast and secure disk encryption, especially on
596	  CPUs without dedicated crypto instructions.  It encrypts
597	  each sector using the XChaCha12 stream cipher, two passes of
598	  an ε-almost-∆-universal hash function, and an invocation of
599	  the AES-256 block cipher on a single 16-byte block.  On CPUs
600	  without AES instructions, Adiantum is much faster than
601	  AES-XTS.
602
603	  Adiantum's security is provably reducible to that of its
604	  underlying stream and block ciphers, subject to a security
605	  bound.  Unlike XTS, Adiantum is a true wide-block encryption
606	  mode, so it actually provides an even stronger notion of
607	  security than XTS, subject to the security bound.
608
609	  If unsure, say N.
610
611config CRYPTO_ARC4
612	tristate "ARC4 (Alleged Rivest Cipher 4)"
613	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
614	select CRYPTO_SKCIPHER
615	select CRYPTO_LIB_ARC4
616	help
617	  ARC4 cipher algorithm
618
619	  ARC4 is a stream cipher using keys ranging from 8 bits to 2048
620	  bits in length.  This algorithm is required for driver-based
621	  WEP, but it should not be for other purposes because of the
622	  weakness of the algorithm.
623
624config CRYPTO_CHACHA20
625	tristate "ChaCha"
626	select CRYPTO_LIB_CHACHA_GENERIC
627	select CRYPTO_SKCIPHER
628	help
629	  The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
630
631	  ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
632	  Bernstein and further specified in RFC7539 for use in IETF protocols.
633	  This is the portable C implementation of ChaCha20.  See
634	  https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
635
636	  XChaCha20 is the application of the XSalsa20 construction to ChaCha20
637	  rather than to Salsa20.  XChaCha20 extends ChaCha20's nonce length
638	  from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
639	  while provably retaining ChaCha20's security.  See
640	  https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
641
642	  XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
643	  reduced security margin but increased performance.  It can be needed
644	  in some performance-sensitive scenarios.
645
646config CRYPTO_CBC
647	tristate "CBC (Cipher Block Chaining)"
648	select CRYPTO_SKCIPHER
649	select CRYPTO_MANAGER
650	help
651	  CBC (Cipher Block Chaining) mode (NIST SP800-38A)
652
653	  This block cipher mode is required for IPSec ESP (XFRM_ESP).
654
655config CRYPTO_CFB
656	tristate "CFB (Cipher Feedback)"
657	select CRYPTO_SKCIPHER
658	select CRYPTO_MANAGER
659	help
660	  CFB (Cipher Feedback) mode (NIST SP800-38A)
661
662	  This block cipher mode is required for TPM2 Cryptography.
663
664config CRYPTO_CTR
665	tristate "CTR (Counter)"
666	select CRYPTO_SKCIPHER
667	select CRYPTO_MANAGER
668	help
669	  CTR (Counter) mode (NIST SP800-38A)
670
671config CRYPTO_CTS
672	tristate "CTS (Cipher Text Stealing)"
673	select CRYPTO_SKCIPHER
674	select CRYPTO_MANAGER
675	help
676	  CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
677	  Addendum to SP800-38A (October 2010))
678
679	  This mode is required for Kerberos gss mechanism support
680	  for AES encryption.
681
682config CRYPTO_ECB
683	tristate "ECB (Electronic Codebook)"
684	select CRYPTO_SKCIPHER
685	select CRYPTO_MANAGER
686	help
687	  ECB (Electronic Codebook) mode (NIST SP800-38A)
688
689config CRYPTO_HCTR2
690	tristate "HCTR2"
691	select CRYPTO_XCTR
692	select CRYPTO_POLYVAL
693	select CRYPTO_MANAGER
694	help
695	  HCTR2 length-preserving encryption mode
696
697	  A mode for storage encryption that is efficient on processors with
698	  instructions to accelerate AES and carryless multiplication, e.g.
699	  x86 processors with AES-NI and CLMUL, and ARM processors with the
700	  ARMv8 crypto extensions.
701
702	  See https://eprint.iacr.org/2021/1441
703
704config CRYPTO_KEYWRAP
705	tristate "KW (AES Key Wrap)"
706	select CRYPTO_SKCIPHER
707	select CRYPTO_MANAGER
708	help
709	  KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
710	  and RFC3394) without padding.
711
712config CRYPTO_LRW
713	tristate "LRW (Liskov Rivest Wagner)"
714	select CRYPTO_LIB_GF128MUL
715	select CRYPTO_SKCIPHER
716	select CRYPTO_MANAGER
717	select CRYPTO_ECB
718	help
719	  LRW (Liskov Rivest Wagner) mode
720
721	  A tweakable, non malleable, non movable
722	  narrow block cipher mode for dm-crypt.  Use it with cipher
723	  specification string aes-lrw-benbi, the key must be 256, 320 or 384.
724	  The first 128, 192 or 256 bits in the key are used for AES and the
725	  rest is used to tie each cipher block to its logical position.
726
727	  See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
728
729config CRYPTO_OFB
730	tristate "OFB (Output Feedback)"
731	select CRYPTO_SKCIPHER
732	select CRYPTO_MANAGER
733	help
734	  OFB (Output Feedback) mode (NIST SP800-38A)
735
736	  This mode makes a block cipher into a synchronous
737	  stream cipher. It generates keystream blocks, which are then XORed
738	  with the plaintext blocks to get the ciphertext. Flipping a bit in the
739	  ciphertext produces a flipped bit in the plaintext at the same
740	  location. This property allows many error correcting codes to function
741	  normally even when applied before encryption.
742
743config CRYPTO_PCBC
744	tristate "PCBC (Propagating Cipher Block Chaining)"
745	select CRYPTO_SKCIPHER
746	select CRYPTO_MANAGER
747	help
748	  PCBC (Propagating Cipher Block Chaining) mode
749
750	  This block cipher mode is required for RxRPC.
751
752config CRYPTO_XCTR
753	tristate
754	select CRYPTO_SKCIPHER
755	select CRYPTO_MANAGER
756	help
757	  XCTR (XOR Counter) mode for HCTR2
758
759	  This blockcipher mode is a variant of CTR mode using XORs and little-endian
760	  addition rather than big-endian arithmetic.
761
762	  XCTR mode is used to implement HCTR2.
763
764config CRYPTO_XTS
765	tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
766	select CRYPTO_SKCIPHER
767	select CRYPTO_MANAGER
768	select CRYPTO_ECB
769	help
770	  XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
771	  and IEEE 1619)
772
773	  Use with aes-xts-plain, key size 256, 384 or 512 bits. This
774	  implementation currently can't handle a sectorsize which is not a
775	  multiple of 16 bytes.
776
777config CRYPTO_NHPOLY1305
778	tristate
779	select CRYPTO_HASH
780	select CRYPTO_LIB_POLY1305_GENERIC
781
782endmenu
783
784menu "AEAD (authenticated encryption with associated data) ciphers"
785
786config CRYPTO_AEGIS128
787	tristate "AEGIS-128"
788	select CRYPTO_AEAD
789	select CRYPTO_AES  # for AES S-box tables
790	help
791	  AEGIS-128 AEAD algorithm
792
793config CRYPTO_AEGIS128_SIMD
794	bool "AEGIS-128 (arm NEON, arm64 NEON)"
795	depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
796	default y
797	help
798	  AEGIS-128 AEAD algorithm
799
800	  Architecture: arm or arm64 using:
801	  - NEON (Advanced SIMD) extension
802
803config CRYPTO_CHACHA20POLY1305
804	tristate "ChaCha20-Poly1305"
805	select CRYPTO_CHACHA20
806	select CRYPTO_POLY1305
807	select CRYPTO_AEAD
808	select CRYPTO_MANAGER
809	help
810	  ChaCha20 stream cipher and Poly1305 authenticator combined
811	  mode (RFC8439)
812
813config CRYPTO_CCM
814	tristate "CCM (Counter with Cipher Block Chaining-MAC)"
815	select CRYPTO_CTR
816	select CRYPTO_HASH
817	select CRYPTO_AEAD
818	select CRYPTO_MANAGER
819	help
820	  CCM (Counter with Cipher Block Chaining-Message Authentication Code)
821	  authenticated encryption mode (NIST SP800-38C)
822
823config CRYPTO_GCM
824	tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
825	select CRYPTO_CTR
826	select CRYPTO_AEAD
827	select CRYPTO_GHASH
828	select CRYPTO_NULL
829	select CRYPTO_MANAGER
830	help
831	  GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
832	  (GCM Message Authentication Code) (NIST SP800-38D)
833
834	  This is required for IPSec ESP (XFRM_ESP).
835
836config CRYPTO_SEQIV
837	tristate "Sequence Number IV Generator"
838	select CRYPTO_AEAD
839	select CRYPTO_SKCIPHER
840	select CRYPTO_NULL
841	select CRYPTO_RNG_DEFAULT
842	select CRYPTO_MANAGER
843	help
844	  Sequence Number IV generator
845
846	  This IV generator generates an IV based on a sequence number by
847	  xoring it with a salt.  This algorithm is mainly useful for CTR.
848
849	  This is required for IPsec ESP (XFRM_ESP).
850
851config CRYPTO_ECHAINIV
852	tristate "Encrypted Chain IV Generator"
853	select CRYPTO_AEAD
854	select CRYPTO_NULL
855	select CRYPTO_RNG_DEFAULT
856	select CRYPTO_MANAGER
857	help
858	  Encrypted Chain IV generator
859
860	  This IV generator generates an IV based on the encryption of
861	  a sequence number xored with a salt.  This is the default
862	  algorithm for CBC.
863
864config CRYPTO_ESSIV
865	tristate "Encrypted Salt-Sector IV Generator"
866	select CRYPTO_AUTHENC
867	help
868	  Encrypted Salt-Sector IV generator
869
870	  This IV generator is used in some cases by fscrypt and/or
871	  dm-crypt. It uses the hash of the block encryption key as the
872	  symmetric key for a block encryption pass applied to the input
873	  IV, making low entropy IV sources more suitable for block
874	  encryption.
875
876	  This driver implements a crypto API template that can be
877	  instantiated either as an skcipher or as an AEAD (depending on the
878	  type of the first template argument), and which defers encryption
879	  and decryption requests to the encapsulated cipher after applying
880	  ESSIV to the input IV. Note that in the AEAD case, it is assumed
881	  that the keys are presented in the same format used by the authenc
882	  template, and that the IV appears at the end of the authenticated
883	  associated data (AAD) region (which is how dm-crypt uses it.)
884
885	  Note that the use of ESSIV is not recommended for new deployments,
886	  and so this only needs to be enabled when interoperability with
887	  existing encrypted volumes of filesystems is required, or when
888	  building for a particular system that requires it (e.g., when
889	  the SoC in question has accelerated CBC but not XTS, making CBC
890	  combined with ESSIV the only feasible mode for h/w accelerated
891	  block encryption)
892
893endmenu
894
895menu "Hashes, digests, and MACs"
896
897config CRYPTO_BLAKE2B
898	tristate "BLAKE2b"
899	select CRYPTO_HASH
900	help
901	  BLAKE2b cryptographic hash function (RFC 7693)
902
903	  BLAKE2b is optimized for 64-bit platforms and can produce digests
904	  of any size between 1 and 64 bytes. The keyed hash is also implemented.
905
906	  This module provides the following algorithms:
907	  - blake2b-160
908	  - blake2b-256
909	  - blake2b-384
910	  - blake2b-512
911
912	  Used by the btrfs filesystem.
913
914	  See https://blake2.net for further information.
915
916config CRYPTO_CMAC
917	tristate "CMAC (Cipher-based MAC)"
918	select CRYPTO_HASH
919	select CRYPTO_MANAGER
920	help
921	  CMAC (Cipher-based Message Authentication Code) authentication
922	  mode (NIST SP800-38B and IETF RFC4493)
923
924config CRYPTO_GHASH
925	tristate "GHASH"
926	select CRYPTO_HASH
927	select CRYPTO_LIB_GF128MUL
928	help
929	  GCM GHASH function (NIST SP800-38D)
930
931config CRYPTO_HMAC
932	tristate "HMAC (Keyed-Hash MAC)"
933	select CRYPTO_HASH
934	select CRYPTO_MANAGER
935	help
936	  HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
937	  RFC2104)
938
939	  This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
940
941config CRYPTO_MD4
942	tristate "MD4"
943	select CRYPTO_HASH
944	help
945	  MD4 message digest algorithm (RFC1320)
946
947config CRYPTO_MD5
948	tristate "MD5"
949	select CRYPTO_HASH
950	help
951	  MD5 message digest algorithm (RFC1321)
952
953config CRYPTO_MICHAEL_MIC
954	tristate "Michael MIC"
955	select CRYPTO_HASH
956	help
957	  Michael MIC (Message Integrity Code) (IEEE 802.11i)
958
959	  Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
960	  known as WPA (Wif-Fi Protected Access).
961
962	  This algorithm is required for TKIP, but it should not be used for
963	  other purposes because of the weakness of the algorithm.
964
965config CRYPTO_POLYVAL
966	tristate
967	select CRYPTO_HASH
968	select CRYPTO_LIB_GF128MUL
969	help
970	  POLYVAL hash function for HCTR2
971
972	  This is used in HCTR2.  It is not a general-purpose
973	  cryptographic hash function.
974
975config CRYPTO_POLY1305
976	tristate "Poly1305"
977	select CRYPTO_HASH
978	select CRYPTO_LIB_POLY1305_GENERIC
979	help
980	  Poly1305 authenticator algorithm (RFC7539)
981
982	  Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
983	  It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
984	  in IETF protocols. This is the portable C implementation of Poly1305.
985
986config CRYPTO_RMD160
987	tristate "RIPEMD-160"
988	select CRYPTO_HASH
989	help
990	  RIPEMD-160 hash function (ISO/IEC 10118-3)
991
992	  RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
993	  to be used as a secure replacement for the 128-bit hash functions
994	  MD4, MD5 and its predecessor RIPEMD
995	  (not to be confused with RIPEMD-128).
996
997	  Its speed is comparable to SHA-1 and there are no known attacks
998	  against RIPEMD-160.
999
1000	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
1001	  See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
1002	  for further information.
1003
1004config CRYPTO_SHA1
1005	tristate "SHA-1"
1006	select CRYPTO_HASH
1007	select CRYPTO_LIB_SHA1
1008	help
1009	  SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
1010
1011config CRYPTO_SHA256
1012	tristate "SHA-224 and SHA-256"
1013	select CRYPTO_HASH
1014	select CRYPTO_LIB_SHA256
1015	help
1016	  SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1017
1018	  This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
1019	  Used by the btrfs filesystem, Ceph, NFS, and SMB.
1020
1021config CRYPTO_SHA512
1022	tristate "SHA-384 and SHA-512"
1023	select CRYPTO_HASH
1024	help
1025	  SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1026
1027config CRYPTO_SHA3
1028	tristate "SHA-3"
1029	select CRYPTO_HASH
1030	help
1031	  SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1032
1033config CRYPTO_SM3
1034	tristate
1035
1036config CRYPTO_SM3_GENERIC
1037	tristate "SM3 (ShangMi 3)"
1038	select CRYPTO_HASH
1039	select CRYPTO_SM3
1040	help
1041	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1042
1043	  This is part of the Chinese Commercial Cryptography suite.
1044
1045	  References:
1046	  http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1047	  https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1048
1049config CRYPTO_STREEBOG
1050	tristate "Streebog"
1051	select CRYPTO_HASH
1052	help
1053	  Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1054
1055	  This is one of the Russian cryptographic standard algorithms (called
1056	  GOST algorithms). This setting enables two hash algorithms with
1057	  256 and 512 bits output.
1058
1059	  References:
1060	  https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1061	  https://tools.ietf.org/html/rfc6986
1062
1063config CRYPTO_VMAC
1064	tristate "VMAC"
1065	select CRYPTO_HASH
1066	select CRYPTO_MANAGER
1067	help
1068	  VMAC is a message authentication algorithm designed for
1069	  very high speed on 64-bit architectures.
1070
1071	  See https://fastcrypto.org/vmac for further information.
1072
1073config CRYPTO_WP512
1074	tristate "Whirlpool"
1075	select CRYPTO_HASH
1076	help
1077	  Whirlpool hash function (ISO/IEC 10118-3)
1078
1079	  512, 384 and 256-bit hashes.
1080
1081	  Whirlpool-512 is part of the NESSIE cryptographic primitives.
1082
1083	  See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
1084	  for further information.
1085
1086config CRYPTO_XCBC
1087	tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1088	select CRYPTO_HASH
1089	select CRYPTO_MANAGER
1090	help
1091	  XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1092	  Code) (RFC3566)
1093
1094config CRYPTO_XXHASH
1095	tristate "xxHash"
1096	select CRYPTO_HASH
1097	select XXHASH
1098	help
1099	  xxHash non-cryptographic hash algorithm
1100
1101	  Extremely fast, working at speeds close to RAM limits.
1102
1103	  Used by the btrfs filesystem.
1104
1105endmenu
1106
1107menu "CRCs (cyclic redundancy checks)"
1108
1109config CRYPTO_CRC32C
1110	tristate "CRC32c"
1111	select CRYPTO_HASH
1112	select CRC32
1113	help
1114	  CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1115
1116	  A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1117	  by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1118	  Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1119	  on Communications, Vol. 41, No. 6, June 1993, selected for use with
1120	  iSCSI.
1121
1122	  Used by btrfs, ext4, jbd2, NVMeoF/TCP, and iSCSI.
1123
1124config CRYPTO_CRC32
1125	tristate "CRC32"
1126	select CRYPTO_HASH
1127	select CRC32
1128	help
1129	  CRC32 CRC algorithm (IEEE 802.3)
1130
1131	  Used by RoCEv2 and f2fs.
1132
1133config CRYPTO_CRCT10DIF
1134	tristate "CRCT10DIF"
1135	select CRYPTO_HASH
1136	help
1137	  CRC16 CRC algorithm used for the T10 (SCSI) Data Integrity Field (DIF)
1138
1139	  CRC algorithm used by the SCSI Block Commands standard.
1140
1141config CRYPTO_CRC64_ROCKSOFT
1142	tristate "CRC64 based on Rocksoft Model algorithm"
1143	depends on CRC64
1144	select CRYPTO_HASH
1145	help
1146	  CRC64 CRC algorithm based on the Rocksoft Model CRC Algorithm
1147
1148	  Used by the NVMe implementation of T10 DIF (BLK_DEV_INTEGRITY)
1149
1150	  See https://zlib.net/crc_v3.txt
1151
1152endmenu
1153
1154menu "Compression"
1155
1156config CRYPTO_DEFLATE
1157	tristate "Deflate"
1158	select CRYPTO_ALGAPI
1159	select CRYPTO_ACOMP2
1160	select ZLIB_INFLATE
1161	select ZLIB_DEFLATE
1162	help
1163	  Deflate compression algorithm (RFC1951)
1164
1165	  Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1166
1167config CRYPTO_LZO
1168	tristate "LZO"
1169	select CRYPTO_ALGAPI
1170	select CRYPTO_ACOMP2
1171	select LZO_COMPRESS
1172	select LZO_DECOMPRESS
1173	help
1174	  LZO compression algorithm
1175
1176	  See https://www.oberhumer.com/opensource/lzo/ for further information.
1177
1178config CRYPTO_842
1179	tristate "842"
1180	select CRYPTO_ALGAPI
1181	select CRYPTO_ACOMP2
1182	select 842_COMPRESS
1183	select 842_DECOMPRESS
1184	help
1185	  842 compression algorithm by IBM
1186
1187	  See https://github.com/plauth/lib842 for further information.
1188
1189config CRYPTO_LZ4
1190	tristate "LZ4"
1191	select CRYPTO_ALGAPI
1192	select CRYPTO_ACOMP2
1193	select LZ4_COMPRESS
1194	select LZ4_DECOMPRESS
1195	help
1196	  LZ4 compression algorithm
1197
1198	  See https://github.com/lz4/lz4 for further information.
1199
1200config CRYPTO_LZ4HC
1201	tristate "LZ4HC"
1202	select CRYPTO_ALGAPI
1203	select CRYPTO_ACOMP2
1204	select LZ4HC_COMPRESS
1205	select LZ4_DECOMPRESS
1206	help
1207	  LZ4 high compression mode algorithm
1208
1209	  See https://github.com/lz4/lz4 for further information.
1210
1211config CRYPTO_ZSTD
1212	tristate "Zstd"
1213	select CRYPTO_ALGAPI
1214	select CRYPTO_ACOMP2
1215	select ZSTD_COMPRESS
1216	select ZSTD_DECOMPRESS
1217	help
1218	  zstd compression algorithm
1219
1220	  See https://github.com/facebook/zstd for further information.
1221
1222endmenu
1223
1224menu "Random number generation"
1225
1226config CRYPTO_ANSI_CPRNG
1227	tristate "ANSI PRNG (Pseudo Random Number Generator)"
1228	select CRYPTO_AES
1229	select CRYPTO_RNG
1230	help
1231	  Pseudo RNG (random number generator) (ANSI X9.31 Appendix A.2.4)
1232
1233	  This uses the AES cipher algorithm.
1234
1235	  Note that this option must be enabled if CRYPTO_FIPS is selected
1236
1237menuconfig CRYPTO_DRBG_MENU
1238	tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1239	help
1240	  DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1241
1242	  In the following submenu, one or more of the DRBG types must be selected.
1243
1244if CRYPTO_DRBG_MENU
1245
1246config CRYPTO_DRBG_HMAC
1247	bool
1248	default y
1249	select CRYPTO_HMAC
1250	select CRYPTO_SHA512
1251
1252config CRYPTO_DRBG_HASH
1253	bool "Hash_DRBG"
1254	select CRYPTO_SHA256
1255	help
1256	  Hash_DRBG variant as defined in NIST SP800-90A.
1257
1258	  This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1259
1260config CRYPTO_DRBG_CTR
1261	bool "CTR_DRBG"
1262	select CRYPTO_AES
1263	select CRYPTO_CTR
1264	help
1265	  CTR_DRBG variant as defined in NIST SP800-90A.
1266
1267	  This uses the AES cipher algorithm with the counter block mode.
1268
1269config CRYPTO_DRBG
1270	tristate
1271	default CRYPTO_DRBG_MENU
1272	select CRYPTO_RNG
1273	select CRYPTO_JITTERENTROPY
1274
1275endif	# if CRYPTO_DRBG_MENU
1276
1277config CRYPTO_JITTERENTROPY
1278	tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1279	select CRYPTO_RNG
1280	help
1281	  CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1282
1283	  A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1284	  compliant with NIST SP800-90B) intended to provide a seed to a
1285	  deterministic RNG (e.g.  per NIST SP800-90C).
1286	  This RNG does not perform any cryptographic whitening of the generated
1287
1288	  See https://www.chronox.de/jent.html
1289
1290config CRYPTO_KDF800108_CTR
1291	tristate
1292	select CRYPTO_HMAC
1293	select CRYPTO_SHA256
1294
1295endmenu
1296menu "Userspace interface"
1297
1298config CRYPTO_USER_API
1299	tristate
1300
1301config CRYPTO_USER_API_HASH
1302	tristate "Hash algorithms"
1303	depends on NET
1304	select CRYPTO_HASH
1305	select CRYPTO_USER_API
1306	help
1307	  Enable the userspace interface for hash algorithms.
1308
1309	  See Documentation/crypto/userspace-if.rst and
1310	  https://www.chronox.de/libkcapi/html/index.html
1311
1312config CRYPTO_USER_API_SKCIPHER
1313	tristate "Symmetric key cipher algorithms"
1314	depends on NET
1315	select CRYPTO_SKCIPHER
1316	select CRYPTO_USER_API
1317	help
1318	  Enable the userspace interface for symmetric key cipher algorithms.
1319
1320	  See Documentation/crypto/userspace-if.rst and
1321	  https://www.chronox.de/libkcapi/html/index.html
1322
1323config CRYPTO_USER_API_RNG
1324	tristate "RNG (random number generator) algorithms"
1325	depends on NET
1326	select CRYPTO_RNG
1327	select CRYPTO_USER_API
1328	help
1329	  Enable the userspace interface for RNG (random number generator)
1330	  algorithms.
1331
1332	  See Documentation/crypto/userspace-if.rst and
1333	  https://www.chronox.de/libkcapi/html/index.html
1334
1335config CRYPTO_USER_API_RNG_CAVP
1336	bool "Enable CAVP testing of DRBG"
1337	depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1338	help
1339	  Enable extra APIs in the userspace interface for NIST CAVP
1340	  (Cryptographic Algorithm Validation Program) testing:
1341	  - resetting DRBG entropy
1342	  - providing Additional Data
1343
1344	  This should only be enabled for CAVP testing. You should say
1345	  no unless you know what this is.
1346
1347config CRYPTO_USER_API_AEAD
1348	tristate "AEAD cipher algorithms"
1349	depends on NET
1350	select CRYPTO_AEAD
1351	select CRYPTO_SKCIPHER
1352	select CRYPTO_NULL
1353	select CRYPTO_USER_API
1354	help
1355	  Enable the userspace interface for AEAD cipher algorithms.
1356
1357	  See Documentation/crypto/userspace-if.rst and
1358	  https://www.chronox.de/libkcapi/html/index.html
1359
1360config CRYPTO_USER_API_ENABLE_OBSOLETE
1361	bool "Obsolete cryptographic algorithms"
1362	depends on CRYPTO_USER_API
1363	default y
1364	help
1365	  Allow obsolete cryptographic algorithms to be selected that have
1366	  already been phased out from internal use by the kernel, and are
1367	  only useful for userspace clients that still rely on them.
1368
1369config CRYPTO_STATS
1370	bool "Crypto usage statistics"
1371	depends on CRYPTO_USER
1372	help
1373	  Enable the gathering of crypto stats.
1374
1375	  This collects data sizes, numbers of requests, and numbers
1376	  of errors processed by:
1377	  - AEAD ciphers (encrypt, decrypt)
1378	  - asymmetric key ciphers (encrypt, decrypt, verify, sign)
1379	  - symmetric key ciphers (encrypt, decrypt)
1380	  - compression algorithms (compress, decompress)
1381	  - hash algorithms (hash)
1382	  - key-agreement protocol primitives (setsecret, generate
1383	    public key, compute shared secret)
1384	  - RNG (generate, seed)
1385
1386endmenu
1387
1388config CRYPTO_HASH_INFO
1389	bool
1390
1391if !KMSAN # avoid false positives from assembly
1392if ARM
1393source "arch/arm/crypto/Kconfig"
1394endif
1395if ARM64
1396source "arch/arm64/crypto/Kconfig"
1397endif
1398if MIPS
1399source "arch/mips/crypto/Kconfig"
1400endif
1401if PPC
1402source "arch/powerpc/crypto/Kconfig"
1403endif
1404if S390
1405source "arch/s390/crypto/Kconfig"
1406endif
1407if SPARC
1408source "arch/sparc/crypto/Kconfig"
1409endif
1410if X86
1411source "arch/x86/crypto/Kconfig"
1412endif
1413endif
1414
1415source "drivers/crypto/Kconfig"
1416source "crypto/asymmetric_keys/Kconfig"
1417source "certs/Kconfig"
1418
1419endif	# if CRYPTO
1420