]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
crypto: fips - Depend on CRYPTO_DRBG=y
authorEric Biggers <ebiggers@kernel.org>
Thu, 26 Mar 2026 00:15:06 +0000 (17:15 -0700)
committerHerbert Xu <herbert@gondor.apana.org.au>
Fri, 3 Apr 2026 00:56:12 +0000 (08:56 +0800)
commit7339b0e0b75eb56c3b9402bc831799138d219144
tree81ef0288f24afc2a95cf9e1e60ed63be5f9f4fdf
parent65b3c2f6278516397bebcdbf4698bd3102120ca5
crypto: fips - Depend on CRYPTO_DRBG=y

Currently, the callers of crypto_stdrng_get_bytes() do 'select
CRYPTO_RNG_DEFAULT', which does 'select CRYPTO_DRBG_MENU'.

However, due to the change in how crypto_stdrng_get_bytes() is
implemented, CRYPTO_DRBG_MENU is now needed only when CRYPTO_FIPS.

But, 'select CRYPTO_DRBG_MENU if CRYPTO_FIPS' would cause a recursive
dependency, since CRYPTO_FIPS 'depends on CRYPTO_DRBG'.

Solve this by just making CRYPTO_FIPS depend on CRYPTO_DRBG=y (rather
than CRYPTO_DRBG i.e. CRYPTO_DRBG=y || CRYPTO_DRBG=m).  The distros that
use CRYPTO_FIPS=y already set CRYPTO_DRBG=y anyway, which makes sense.

This makes the CRYPTO_RNG_DEFAULT symbol (and its corresponding
selection of CRYPTO_DRBG_MENU) unnecessary.  A later commit removes it.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
crypto/Kconfig