David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 1 | # |
| 2 | # Key management configuration |
| 3 | # |
| 4 | |
| 5 | config KEYS |
| 6 | bool "Enable access key retention support" |
David Howells | b2a4df2 | 2013-09-24 10:35:18 +0100 | [diff] [blame] | 7 | select ASSOCIATIVE_ARRAY |
David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 8 | help |
| 9 | This option provides support for retaining authentication tokens and |
| 10 | access keys in the kernel. |
| 11 | |
| 12 | It also includes provision of methods by which such keys might be |
| 13 | associated with a process so that network filesystems, encryption |
| 14 | support and the like can find them. |
| 15 | |
| 16 | Furthermore, a special type of key is available that acts as keyring: |
| 17 | a searchable sequence of keys. Each process is equipped with access |
| 18 | to five standard keyrings: UID-specific, GID-specific, session, |
| 19 | process and thread. |
| 20 | |
| 21 | If you are unsure as to whether this is required, answer N. |
| 22 | |
Bilal Amarni | 47b2c3f | 2017-06-08 14:47:26 +0100 | [diff] [blame] | 23 | config KEYS_COMPAT |
| 24 | def_bool y |
| 25 | depends on COMPAT && KEYS |
| 26 | |
David Howells | f36f8c7 | 2013-09-24 10:35:19 +0100 | [diff] [blame] | 27 | config PERSISTENT_KEYRINGS |
| 28 | bool "Enable register of persistent per-UID keyrings" |
| 29 | depends on KEYS |
| 30 | help |
| 31 | This option provides a register of persistent per-UID keyrings, |
| 32 | primarily aimed at Kerberos key storage. The keyrings are persistent |
| 33 | in the sense that they stay around after all processes of that UID |
| 34 | have exited, not that they survive the machine being rebooted. |
| 35 | |
| 36 | A particular keyring may be accessed by either the user whose keyring |
| 37 | it is or by a process with administrative privileges. The active |
| 38 | LSMs gets to rule on which admin-level processes get to access the |
| 39 | cache. |
| 40 | |
| 41 | Keyrings are created and added into the register upon demand and get |
| 42 | removed if they expire (a default timeout is set upon creation). |
| 43 | |
David Howells | ab3c358 | 2013-09-24 10:35:18 +0100 | [diff] [blame] | 44 | config BIG_KEYS |
Josh Boyer | 2eaf6b5 | 2013-10-30 11:15:23 +0000 | [diff] [blame] | 45 | bool "Large payload keys" |
David Howells | ab3c358 | 2013-09-24 10:35:18 +0100 | [diff] [blame] | 46 | depends on KEYS |
| 47 | depends on TMPFS |
Kirill Marinushkin | 13100a7 | 2016-04-12 19:54:58 +0100 | [diff] [blame] | 48 | select CRYPTO_AES |
Jason A. Donenfeld | 428490e | 2017-09-20 16:58:39 +0200 | [diff] [blame^] | 49 | select CRYPTO_GCM |
David Howells | ab3c358 | 2013-09-24 10:35:18 +0100 | [diff] [blame] | 50 | help |
| 51 | This option provides support for holding large keys within the kernel |
| 52 | (for example Kerberos ticket caches). The data may be stored out to |
| 53 | swapspace by tmpfs. |
| 54 | |
| 55 | If you are unsure as to whether this is required, answer N. |
| 56 | |
David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 57 | config TRUSTED_KEYS |
| 58 | tristate "TRUSTED KEYS" |
| 59 | depends on KEYS && TCG_TPM |
| 60 | select CRYPTO |
| 61 | select CRYPTO_HMAC |
| 62 | select CRYPTO_SHA1 |
Jarkko Sakkinen | 5ca4c20 | 2015-11-05 21:43:06 +0200 | [diff] [blame] | 63 | select CRYPTO_HASH_INFO |
David Howells | f089494 | 2012-05-11 10:56:56 +0100 | [diff] [blame] | 64 | help |
| 65 | This option provides support for creating, sealing, and unsealing |
| 66 | keys in the kernel. Trusted keys are random number symmetric keys, |
| 67 | generated and RSA-sealed by the TPM. The TPM only unseals the keys, |
| 68 | if the boot PCRs and other criteria match. Userspace will only ever |
| 69 | see encrypted blobs. |
| 70 | |
| 71 | If you are unsure as to whether this is required, answer N. |
| 72 | |
| 73 | config ENCRYPTED_KEYS |
| 74 | tristate "ENCRYPTED KEYS" |
| 75 | depends on KEYS |
| 76 | select CRYPTO |
| 77 | select CRYPTO_HMAC |
| 78 | select CRYPTO_AES |
| 79 | select CRYPTO_CBC |
| 80 | select CRYPTO_SHA256 |
| 81 | select CRYPTO_RNG |
| 82 | help |
| 83 | This option provides support for create/encrypting/decrypting keys |
| 84 | in the kernel. Encrypted keys are kernel generated random numbers, |
| 85 | which are encrypted/decrypted with a 'master' symmetric key. The |
| 86 | 'master' key can be either a trusted-key or user-key type. |
| 87 | Userspace only ever sees/stores encrypted blobs. |
| 88 | |
| 89 | If you are unsure as to whether this is required, answer N. |
Mat Martineau | ddbb411 | 2016-04-12 19:54:58 +0100 | [diff] [blame] | 90 | |
| 91 | config KEY_DH_OPERATIONS |
| 92 | bool "Diffie-Hellman operations on retained keys" |
| 93 | depends on KEYS |
Stephan Müller | 4cd4ca7 | 2017-04-11 13:07:07 +0200 | [diff] [blame] | 94 | select CRYPTO |
Stephan Mueller | f1c316a | 2016-08-19 20:39:09 +0200 | [diff] [blame] | 95 | select CRYPTO_HASH |
Mat Martineau | 7cbe093 | 2017-06-08 14:50:11 +0100 | [diff] [blame] | 96 | select CRYPTO_DH |
Mat Martineau | ddbb411 | 2016-04-12 19:54:58 +0100 | [diff] [blame] | 97 | help |
| 98 | This option provides support for calculating Diffie-Hellman |
| 99 | public keys and shared secrets using values stored as keys |
| 100 | in the kernel. |
| 101 | |
| 102 | If you are unsure as to whether this is required, answer N. |