]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
crypto: drbg - Remove support for HASH_DRBG
authorEric Biggers <ebiggers@kernel.org>
Mon, 20 Apr 2026 06:33:57 +0000 (23:33 -0700)
committerHerbert Xu <herbert@gondor.apana.org.au>
Thu, 7 May 2026 08:10:00 +0000 (16:10 +0800)
commite227be3ffde0ec8063c9967062a43237a5545581
treeb955905e9face2d1ec2b0dc09f331858b43362e8
parent6f88f41eeb7d4ef34e4ddb133d10779a316da67f
crypto: drbg - Remove support for HASH_DRBG

Remove the support for HASH_DRBG.  It's likely unused code, seeing as
HMAC_DRBG is always enabled and prioritized over it unless
NETLINK_CRYPTO is used to change the algorithm priorities.

There's also no compelling reason to support more than one of
[HMAC_DRBG, HASH_DRBG, CTR_DRBG].  By definition, callers cannot tell
any difference in their outputs.  And all are FIPS-certifiable, which is
the only point of the kernel's NIST DRBGs anyway.

Switching to HASH_DRBG doesn't seem all that compelling, either.  For
one, it's more complex than HMAC_DRBG.

Thus, let's just drop HASH_DRBG support and focus on HMAC_DRBG.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
21 files changed:
Documentation/crypto/api-samples.rst
Documentation/crypto/userspace-if.rst
arch/m68k/configs/amiga_defconfig
arch/m68k/configs/apollo_defconfig
arch/m68k/configs/atari_defconfig
arch/m68k/configs/bvme6000_defconfig
arch/m68k/configs/hp300_defconfig
arch/m68k/configs/mac_defconfig
arch/m68k/configs/multi_defconfig
arch/m68k/configs/mvme147_defconfig
arch/m68k/configs/mvme16x_defconfig
arch/m68k/configs/q40_defconfig
arch/m68k/configs/sun3_defconfig
arch/m68k/configs/sun3x_defconfig
arch/mips/configs/decstation_64_defconfig
arch/mips/configs/decstation_defconfig
arch/mips/configs/decstation_r4k_defconfig
crypto/Kconfig
crypto/drbg.c
crypto/testmgr.c
crypto/testmgr.h