linux-6.12.1/crypto/Kconfig

1 # SPDX-License-Identifier: GPL-2.0
171 	bool "Disable run-time self tests"
174 	  Disable run-time self tests that normally take place at
178 	bool "Enable extra run-time crypto self tests"
181 	  Enable extra run-time self tests of registered crypto algorithms,
247 menu "Public-key cryptography"
250 	tristate "RSA (Rivest-Shamir-Adleman)"
256 	  RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
259 	tristate "DH (Diffie-Hellman)"
263 	  DH (Diffie-Hellman) key exchange algorithm
270 	  FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
273 	  Support these finite-field groups in DH key exchanges:
274 	  - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
283 	tristate "ECDH (Elliptic Curve Diffie-Hellman)"
287 	  ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
288 	  using curves P-192, P-256, and P-384 (FIPS 186)
297 	  ISO/IEC 14888-3)
298 	  using curves P-192, P-256, and P-384
303 	tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
310 	  Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
311 	  RFC 7091, ISO/IEC 14888-3)
332 	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
336 	  environments regardless of its use in feedback or non-feedback
337 	  modes. Its key setup time is excellent, and its key agility is
339 	  suited for restricted-space environments, in which it also
343 	  The AES specifies three key sizes: 128, 192 and 256 bits
350 	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
360 	  8 for decryption), this implementation only uses just two S-boxes of
373 	  Anubis is a variable key length cipher which can use keys from
387 	  The ARIA specifies three key sizes and rounds.
388 	  128-bit: 12 rounds.
389 	  192-bit: 14 rounds.
390 	  256-bit: 16 rounds.
402 	  This is a variable key length cipher which can use keys from 32
418 	  Camellia cipher algorithms (ISO/IEC 18033-3)
420 	  Camellia is a symmetric key block cipher developed jointly
423 	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
434 	tristate "CAST5 (CAST-128)"
438 	  CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
441 	tristate "CAST6 (CAST-256)"
445 	  CAST6 (CAST-256) encryption algorithm (RFC2612)
452 	  DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
453 	  Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
463 	  See https://ota.polyonymo.us/fcrypt-paper.txt
473 	  an algorithm optimized for 64-bit processors with good performance
474 	  on 32-bit processors.  Khazad uses an 128 bit key size.
484 	  SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
486 	  SEED is a 128-bit symmetric key block cipher that has been
489 	  It is a 16 round block cipher with the key size of 128 bit.
513 	  SM4 cipher algorithms (OSCCA GB/T 32907-2016,
514 	  ISO/IEC 18033-3:2010/Amd 1:2021)
516 	  SM4 (GBT.32907-2016) is a cryptographic standard issued by the
523 	  (GB.15629.11-2003).
525 	  The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
529 	  The input, output, and key of SMS4 are each 128 bits.
547 	  the TEA algorithm to address a potential key weakness
550 	  Xtendend Encryption Tiny Algorithm is a mis-implementation
562 	  16 round block cipher supporting key sizes of 128, 192, and 256
575 menu "Length-preserving ciphers and modes"
584 	  Adiantum tweakable, length-preserving encryption mode
589 	  an ε-almost-∆-universal hash function, and an invocation of
590 	  the AES-256 block cipher on a single 16-byte block.  On CPUs
592 	  AES-XTS.
596 	  bound.  Unlike XTS, Adiantum is a true wide-block encryption
611 	  bits in length.  This algorithm is required for driver-based
622 	  ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
625 	  https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
631 	  https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
635 	  in some performance-sensitive scenarios.
642 	  CBC (Cipher Block Chaining) mode (NIST SP800-38A)
651 	  CTR (Counter) mode (NIST SP800-38A)
658 	  CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
659 	  Addendum to SP800-38A (October 2010))
669 	  ECB (Electronic Codebook) mode (NIST SP800-38A)
677 	  HCTR2 length-preserving encryption mode
681 	  x86 processors with AES-NI and CLMUL, and ARM processors with the
687 	tristate "KW (AES Key Wrap)"
691 	  KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
704 	  narrow block cipher mode for dm-crypt.  Use it with cipher
705 	  specification string aes-lrw-benbi, the key must be 256, 320 or 384.
706 	  The first 128, 192 or 256 bits in the key are used for AES and the
727 	  This blockcipher mode is a variant of CTR mode using XORs and little-endian
728 	  addition rather than big-endian arithmetic.
738 	  XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
741 	  Use with aes-xts-plain, key size 256, 384 or 512 bits. This
755 	tristate "AEGIS-128"
757 	select CRYPTO_AES  # for AES S-box tables
759 	  AEGIS-128 AEAD algorithm
762 	bool "AEGIS-128 (arm NEON, arm64 NEON)"
766 	  AEGIS-128 AEAD algorithm
769 	  - NEON (Advanced SIMD) extension
772 	tristate "ChaCha20-Poly1305"
782 	tristate "CCM (Counter with Cipher Block Chaining-MAC)"
788 	  CCM (Counter with Cipher Block Chaining-Message Authentication Code)
789 	  authenticated encryption mode (NIST SP800-38C)
800 	  (GCM Message Authentication Code) (NIST SP800-38D)
833 	tristate "Encrypted Salt-Sector IV Generator"
836 	  Encrypted Salt-Sector IV generator
839 	  dm-crypt. It uses the hash of the block encryption key as the
840 	  symmetric key for a block encryption pass applied to the input
851 	  associated data (AAD) region (which is how dm-crypt uses it.)
871 	  BLAKE2b is optimized for 64-bit platforms and can produce digests
875 	  - blake2b-160
876 	  - blake2b-256
877 	  - blake2b-384
878 	  - blake2b-512
885 	tristate "CMAC (Cipher-based MAC)"
889 	  CMAC (Cipher-based Message Authentication Code) authentication
890 	  mode (NIST SP800-38B and IETF RFC4493)
897 	  GCM GHASH function (NIST SP800-38D)
900 	tristate "HMAC (Keyed-Hash MAC)"
904 	  HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
927 	  Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
928 	  known as WPA (Wif-Fi Protected Access).
940 	  This is used in HCTR2.  It is not a general-purpose
951 	  It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
955 	tristate "RIPEMD-160"
958 	  RIPEMD-160 hash function (ISO/IEC 10118-3)
960 	  RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
961 	  to be used as a secure replacement for the 128-bit hash functions
963 	  (not to be confused with RIPEMD-128).
965 	  Its speed is comparable to SHA-1 and there are no known attacks
966 	  against RIPEMD-160.
973 	tristate "SHA-1"
977 	  SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
980 	tristate "SHA-224 and SHA-256"
984 	  SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
990 	tristate "SHA-384 and SHA-512"
993 	  SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
996 	tristate "SHA-3"
999 	  SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1009 	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1015 	  https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1021 	  Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1037 	  very high speed on 64-bit architectures.
1045 	  Whirlpool hash function (ISO/IEC 10118-3)
1047 	  512, 384 and 256-bit hashes.
1049 	  Whirlpool-512 is part of the NESSIE cryptographic primitives.
1055 	tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1059 	  XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1067 	  xxHash non-cryptographic hash algorithm
1084 	  A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1086 	  Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1206 	tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1208 	  DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1224 	  Hash_DRBG variant as defined in NIST SP800-90A.
1226 	  This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1233 	  CTR_DRBG variant as defined in NIST SP800-90A.
1246 	tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1252 	  A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1253 	  compliant with NIST SP800-90B) intended to provide a seed to a
1254 	  deterministic RNG (e.g., per NIST SP800-90C).
1318 	  trade-off, however, is that the Jitter RNG now requires more time
1379 	  Enable the userspace interface for hash algorithms.
1381 	  See Documentation/crypto/userspace-if.rst and
1385 	tristate "Symmetric key cipher algorithms"
1390 	  Enable the userspace interface for symmetric key cipher algorithms.
1392 	  See Documentation/crypto/userspace-if.rst and
1401 	  Enable the userspace interface for RNG (random number generator)
1404 	  See Documentation/crypto/userspace-if.rst and
1408 	bool "Enable CAVP testing of DRBG"
1411 	  Enable extra APIs in the userspace interface for NIST CAVP
1413 	  - resetting DRBG entropy
1414 	  - providing Additional Data
1427 	  Enable the userspace interface for AEAD cipher algorithms.
1429 	  See Documentation/crypto/userspace-if.rst and