How To Wiki
Don't have an account?
Register
Advertisement
Register
in: Linux

How to configure the Linux kernel/crypto

< How to configure the Linux kernel
Sign in to edit

Howto configure the Linux kernel / crypto

Cryptographic API Configuration

Cryptographic options[]

  • Option: CRYPTO
    • Kernel Versions: 2.6.15.6 ...
    • (on/off) Cryptographic API
      This option provides the core Cryptographic API.


  • Option: CRYPTO_HMAC
    • Kernel Versions: 2.6.15.6 ...
    • (on/off) HMAC support
    • depends on CRYPTO
      HMAC: Keyed-Hashing for Message Authentication (RFC2104). This is required for IPSec.


  • Option: CRYPTO_NULL
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Null algorithms
    • depends on CRYPTO
      These are 'Null' algorithms, used by IPsec, which do nothing.


  • Option: CRYPTO_MD4
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) MD4 digest algorithm
    • depends on CRYPTO
      MD4 message digest algorithm (RFC1320).


  • Option: CRYPTO_MD5
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) MD5 digest algorithm
    • depends on CRYPTO
      MD5 message digest algorithm (RFC1321).


  • Option: CRYPTO_SHA1
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) SHA1 digest algorithm
    • depends on CRYPTO
      SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).


  • Option: CRYPTO_SHA1_Z990
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) SHA1 digest algorithm for IBM zSeries z990
    • depends on CRYPTO && ARCH_S390
      SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).


  • Option: CRYPTO_SHA256
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) SHA256 digest algorithm
    • depends on CRYPTO
      SHA256 secure hash standard (DFIPS 180-2). This version of SHA implements a 256 bit hash with 128 bits of security against collision attacks.


  • Option: CRYPTO_SHA512
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) SHA384 and SHA512 digest algorithms
    • depends on CRYPTO
      SHA512 secure hash standard (DFIPS 180-2). This version of SHA implements a 512 bit hash with 256 bits of security against collision attacks.
      This code also includes SHA-384, a 384 bit hash with 192 bits of security against collision attacks.


  • Option: CRYPTO_WP512


  • Option: CRYPTO_TGR192
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Tiger digest algorithms
    • depends on CRYPTO
      Tiger hash algorithm 192, 160 and 128-bit hashes
      Tiger is a hash function optimized for 64-bit processors while still having decent performance on 32-bit processors. Tiger was developed by Ross Anderson and Eli Biham.
      See also: <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.


  • Option: CRYPTO_DES
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) DES and Triple DES EDE cipher algorithms
    • depends on CRYPTO
      DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).


  • Option: CRYPTO_DES_Z990
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) DES and Triple DES cipher algorithms for IBM zSeries z990
    • depends on CRYPTO && ARCH_S390
      DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).


  • Option: CRYPTO_BLOWFISH
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Blowfish cipher algorithm
    • depends on CRYPTO
      Blowfish cipher algorithm, by Bruce Schneier. This is a variable key length cipher which can use keys from 32 bits to 448 bits in length. It's fast, simple and specifically designed for use on "large microprocessors". See also: <http://www.schneier.com/blowfish.html>


  • Option: CRYPTO_TWOFISH
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Twofish cipher algorithm
    • depends on CRYPTO
      Twofish cipher algorithm. Twofish was submitted as an AES (Advanced Encryption Standard) candidate cipher by researchers at CounterPane Systems. It is a 16 round block cipher supporting key sizes of 128, 192, and 256 bits. See also: <http://www.schneier.com/twofish.html>


  • Option: CRYPTO_SERPENT
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Serpent cipher algorithm
    • depends on CRYPTO
      Serpent cipher algorithm, by Anderson, Biham & Knudsen.
      Keys are allowed to be from 0 to 256 bits in length, in steps of 8 bits. Also includes the 'Tnepres' algorithm, a reversed variant of Serpent for compatibility with old kerneli code.
      See also: <http://www.cl.cam.ac.uk/~rja14/serpent.html>


  • Option: CRYPTO_AES
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) AES cipher algorithms
    • depends on CRYPTO && !(X86 || UML_X86)
      AES cipher algorithms (FIPS-197). AES uses the Rijndael algorithm.
      Rijndael appears to be consistently a very good performer in both hardware and software across a wide range of computing environments regardless of its use in feedback or non-feedback modes. Its key setup time is excellent, and its key agility is good. Rijndael's very low memory requirements make it very well suited for restricted-space environments, in which it also demonstrates excellent performance. Rijndael's operations are among the easiest to defend against power and timing attacks.
      The AES specifies three key sizes: 128, 192 and 256 bits
      See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.


  • Option: CRYPTO_AES_586
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) AES cipher algorithms (i586)
    • depends on CRYPTO && ((X86 || UML_X86) && !64BIT)
      AES cipher algorithms (FIPS-197). AES uses the Rijndael algorithm.
      Rijndael appears to be consistently a very good performer in both hardware and software across a wide range of computing environments regardless of its use in feedback or non-feedback modes. Its key setup time is excellent, and its key agility is good. Rijndael's very low memory requirements make it very well suited for restricted-space environments, in which it also demonstrates excellent performance. Rijndael's operations are among the easiest to defend against power and timing attacks.
      The AES specifies three key sizes: 128, 192 and 256 bits
      See <http://csrc.nist.gov/encryption/aes/> for more information.


  • Option: CRYPTO_AES_X86_64
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) AES cipher algorithms (x86_64)
    • depends on CRYPTO && ((X86 || UML_X86) && 64BIT)
      AES cipher algorithms (FIPS-197). AES uses the Rijndael algorithm.
      Rijndael appears to be consistently a very good performer in both hardware and software across a wide range of computing environments regardless of its use in feedback or non-feedback modes. Its key setup time is excellent, and its key agility is good. Rijndael's very low memory requirements make it very well suited for restricted-space environments, in which it also demonstrates excellent performance. Rijndael's operations are among the easiest to defend against power and timing attacks.
      The AES specifies three key sizes: 128, 192 and 256 bits
      See <http://csrc.nist.gov/encryption/aes/> for more information.


  • Option: CRYPTO_CAST5
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) CAST5 (CAST-128) cipher algorithm
    • depends on CRYPTO
      The CAST5 encryption algorithm (synonymous with CAST-128) is described in RFC2144.


  • Option: CRYPTO_CAST6
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) CAST6 (CAST-256) cipher algorithm
    • depends on CRYPTO
      The CAST6 encryption algorithm (synonymous with CAST-256) is described in RFC2612.


  • Option: CRYPTO_TEA
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) TEA, XTEA and XETA cipher algorithms
    • depends on CRYPTO
      TEA cipher algorithm.
      Tiny Encryption Algorithm is a simple cipher that uses many rounds for security. It is very fast and uses little memory.
      Xtendend Tiny Encryption Algorithm is a modification to the TEA algorithm to address a potential key weakness in the TEA algorithm.
      Xtendend Encryption Tiny Algorithm is a mis-implementation of the XTEA algorithm for compatibility purposes.


  • Option: CRYPTO_ARC4
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ARC4 cipher algorithm
    • depends on CRYPTO
      ARC4 cipher algorithm.
      ARC4 is a stream cipher using keys ranging from 8 bits to 2048 bits in length. This algorithm is required for driver-based WEP, but it should not be for other purposes because of the weakness of the algorithm.


  • Option: CRYPTO_KHAZAD
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Khazad cipher algorithm
    • depends on CRYPTO
      Khazad cipher algorithm.
      Khazad was a finalist in the initial NESSIE competition. It is an algorithm optimized for 64-bit processors with good performance on 32-bit processors. Khazad uses an 128 bit key size.
      See also: <http://planeta.terra.com.br/informatica/paulobarreto/KhazadPage.html>




  • Option: CRYPTO_DEFLATE
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Deflate compression algorithm
    • depends on CRYPTO
    • select ZLIB_INFLATE
    • select ZLIB_DEFLATE
      This is the Deflate algorithm (RFC1951), specified for use in IPSec with the IPCOMP protocol (RFC3173, RFC2394). You will most probably want this if using IPSec.


  • Option: CRYPTO_MICHAEL_MIC
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Michael MIC keyed digest algorithm
    • depends on CRYPTO
      Michael MIC is used for message integrity protection in TKIP (IEEE 802.11i). This algorithm is required for TKIP, but it should not be used for other purposes because of the weakness of the algorithm.


  • Option: CRYPTO_CRC32C
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) CRC32c CRC algorithm
    • depends on CRYPTO
    • select LIBCRC32C
      Castagnoli, et al. Cyclic Redundancy-Check Algorithm. Used by iSCSI for header and data digests and by others. See Castagnoli93. This implementation uses lib/libcrc32c. Module will be crc32c.


  • Option: CRYPTO_TEST
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Testing module
    • depends on CRYPTO
      Quick & dirty crypto test module.




Linux Kernel Configuration

Community content is available under CC-BY-SA unless otherwise noted.
Advertisement

Fan Feed

More How To Wiki