# SPDX-License-Identifier: GPL-2.0-only
|
config FS_ENCRYPTION
|
bool "FS Encryption (Per-file encryption)"
|
select CRYPTO
|
select CRYPTO_HASH
|
select CRYPTO_SKCIPHER
|
select CRYPTO_LIB_SHA256
|
select KEYS
|
help
|
Enable encryption of files and directories. This
|
feature is similar to ecryptfs, but it is more memory
|
efficient since it avoids caching the encrypted and
|
decrypted pages in the page cache. Currently Ext4,
|
F2FS and UBIFS make use of this feature.
|
|
# Filesystems supporting encryption must select this if FS_ENCRYPTION. This
|
# allows the algorithms to be built as modules when all the filesystems are,
|
# whereas selecting them from FS_ENCRYPTION would force them to be built-in.
|
#
|
# Note: this option only pulls in the algorithms that filesystem encryption
|
# needs "by default". If userspace will use "non-default" encryption modes such
|
# as Adiantum encryption, then those other modes need to be explicitly enabled
|
# in the crypto API; see Documentation/filesystems/fscrypt.rst for details.
|
#
|
# Also note that this option only pulls in the generic implementations of the
|
# algorithms, not any per-architecture optimized implementations. It is
|
# strongly recommended to enable optimized implementations too. It is safe to
|
# disable these generic implementations if corresponding optimized
|
# implementations will always be available too; for this reason, these are soft
|
# dependencies ('imply' rather than 'select'). Only disable these generic
|
# implementations if you're sure they will never be needed, though.
|
config FS_ENCRYPTION_ALGS
|
tristate
|
imply CRYPTO_AES
|
imply CRYPTO_CBC
|
imply CRYPTO_CTS
|
imply CRYPTO_ECB
|
imply CRYPTO_HMAC
|
imply CRYPTO_SHA512
|
imply CRYPTO_XTS
|
|
config FS_ENCRYPTION_INLINE_CRYPT
|
bool "Enable fscrypt to use inline crypto"
|
depends on FS_ENCRYPTION && BLK_INLINE_ENCRYPTION
|
help
|
Enable fscrypt to use inline encryption hardware if available.
|
