[PATCH v2 01/19] crypto: add Kconfig options for standalone crypto module

Jay Wang
2026-04-18T00:21:01Z

Add Kconfig option `CRYPTO_FIPS140_EXTMOD` to enable standalone crypto
module support that can override built-in cryptographic implementations.

Currently supports X86_64 and ARM64 architectures and requires CRYPTO
and MODULES to be enabled.

Signed-off-by: Jay Wang <wanjay@amazon.com>
---
crypto/Kconfig | 1 +
crypto/fips140/Kconfig | 15 +++++++++++++++
2 files changed, 16 insertions(+)
create mode 100644 crypto/fips140/Kconfig

diff --git a/crypto/Kconfig b/crypto/Kconfig
index b54a1bef6adef..d792ff01298b7 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1387,6 +1387,7 @@ endif
endif

source "drivers/crypto/Kconfig"
+source "crypto/fips140/Kconfig"
source "crypto/asymmetric_keys/Kconfig"
source "certs/Kconfig"
source "crypto/krb5/Kconfig"
diff --git a/crypto/fips140/Kconfig b/crypto/fips140/Kconfig
new file mode 100644
index 0000000000000..0665e94b9fe05
--- /dev/null
+++ b/crypto/fips140/Kconfig
@@ -0,0 +1,15 @@
+config CRYPTO_FIPS140_EXTMOD
+ bool "FIPS 140 compliant algorithms as a kernel module"
+ depends on CRYPTO && (X86_64 || ARM64) && MODULES
+ select CRYPTO_FIPS
+ help
+ This option enables building a kernel module that contains
+ copies of crypto algorithms that are built in a way that
+ complies with the FIPS 140 standard.
+
+ The module registers the algorithms it contains with the
+ kernel crypto API, and the kernel crypto API's FIPS 140 mode
+ can be enabled to restrict crypto algorithm usage to only
+ those provided by this module.
+
+ If unsure, say N.
--
2.47.3