linux: enable the NIST SP800-90A DRBG

2023-11-13 15:33:33 +01:00
parent edfad58322
commit ee137e017c
1 changed files with 7 additions and 0 deletions
@@ -562,6 +562,13 @@ let
      KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
      # randomized slab caches
      RANDOM_KMALLOC_CACHES            = whenAtLeast "6.6" yes;
+
+      # NIST SP800-90A DRBG modes - enabled by most distributions
+      #   and required by some out-of-tree modules (ShuffleCake)
+      #   This does not include the NSA-backdoored Dual-EC mode from the same NIST publication.
+      CRYPTO_DRBG_HASH                 = yes;
+      CRYPTO_DRBG_CTR                  = yes;
+
    } // optionalAttrs stdenv.hostPlatform.isx86_64 {
      # Enable Intel SGX
      X86_SGX     = whenAtLeast "5.11" yes;