0001 # SPDX-License-Identifier: GPL-2.0
0002 menuconfig ASYMMETRIC_KEY_TYPE
0003 bool "Asymmetric (public-key cryptographic) key type"
0004 depends on KEYS
0005 help
0006 This option provides support for a key type that holds the data for
0007 the asymmetric keys used for public key cryptographic operations such
0008 as encryption, decryption, signature generation and signature
0009 verification.
0010
0011 if ASYMMETRIC_KEY_TYPE
0012
0013 config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
0014 tristate "Asymmetric public-key crypto algorithm subtype"
0015 select MPILIB
0016 select CRYPTO_HASH_INFO
0017 select CRYPTO_AKCIPHER
0018 select CRYPTO_HASH
0019 help
0020 This option provides support for asymmetric public key type handling.
0021 If signature generation and/or verification are to be used,
0022 appropriate hash algorithms (such as SHA-1) must be available.
0023 ENOPKG will be reported if the requisite algorithm is unavailable.
0024
0025 config X509_CERTIFICATE_PARSER
0026 tristate "X.509 certificate parser"
0027 depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
0028 select ASN1
0029 select OID_REGISTRY
0030 help
0031 This option provides support for parsing X.509 format blobs for key
0032 data and provides the ability to instantiate a crypto key from a
0033 public key packet found inside the certificate.
0034
0035 config PKCS8_PRIVATE_KEY_PARSER
0036 tristate "PKCS#8 private key parser"
0037 depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
0038 select ASN1
0039 select OID_REGISTRY
0040 help
0041 This option provides support for parsing PKCS#8 format blobs for
0042 private key data and provides the ability to instantiate a crypto key
0043 from that data.
0044
0045 config PKCS7_MESSAGE_PARSER
0046 tristate "PKCS#7 message parser"
0047 depends on X509_CERTIFICATE_PARSER
0048 select CRYPTO_HASH
0049 select ASN1
0050 select OID_REGISTRY
0051 help
0052 This option provides support for parsing PKCS#7 format messages for
0053 signature data and provides the ability to verify the signature.
0054
0055 config PKCS7_TEST_KEY
0056 tristate "PKCS#7 testing key type"
0057 depends on SYSTEM_DATA_VERIFICATION
0058 help
0059 This option provides a type of key that can be loaded up from a
0060 PKCS#7 message - provided the message is signed by a trusted key. If
0061 it is, the PKCS#7 wrapper is discarded and reading the key returns
0062 just the payload. If it isn't, adding the key will fail with an
0063 error.
0064
0065 This is intended for testing the PKCS#7 parser.
0066
0067 config SIGNED_PE_FILE_VERIFICATION
0068 bool "Support for PE file signature verification"
0069 depends on PKCS7_MESSAGE_PARSER=y
0070 depends on SYSTEM_DATA_VERIFICATION
0071 select CRYPTO_HASH
0072 select ASN1
0073 select OID_REGISTRY
0074 help
0075 This option provides support for verifying the signature(s) on a
0076 signed PE binary.
0077
0078 config FIPS_SIGNATURE_SELFTEST
0079 bool "Run FIPS selftests on the X.509+PKCS7 signature verification"
0080 help
0081 This option causes some selftests to be run on the signature
0082 verification code, using some built in data. This is required
0083 for FIPS.
0084 depends on KEYS
0085 depends on ASYMMETRIC_KEY_TYPE
0086 depends on PKCS7_MESSAGE_PARSER
0087
0088 endif # ASYMMETRIC_KEY_TYPE
