src/build-data/policy/bsi.txt


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189

<required>
# block
aes

# modes
gcm
cbc
mode_pad

# stream
ctr

# hash
sha2_32
sha2_64
sha3

# mac
cmac
hmac
gmac

# kdf
kdf1_iso18033
sp800_108
sp800_56c

# pk_pad
eme_oaep
emsa_pssr
emsa1
iso9796

# pubkey
dlies
dh
rsa
dsa
ecdsa
ecgdsa
ecies
eckcdsa
ecdh
xmss

# rng
auto_rng
hmac_drbg
</required>

<if_available>
# block
aes_ni
aes_vperm
aes_armv8
aes_power8

# modes
clmul_cpu
clmul_ssse3

# hash
sha2_32_x86
sha2_32_armv8
sha2_32_bmi2
sha2_64_bmi2
sha3_bmi2

# entropy sources
dev_random
proc_walk
rdrand
rdseed
win32_stats

# rng
rdrand_rng
system_rng

# utils
http_util # needed by x509 for OCSP online checks
locking_allocator
simd
</if_available>

<prohibited>
# block
aria
blowfish
camellia
cascade
cast128
cast256
des
gost_28147
idea
idea_sse2
kasumi
lion
misty1
noekeon
noekeon_simd
seed
serpent
serpent_simd
serpent_avx2
shacal2
shacal2_x86
shacal2_simd
sm4
threefish_512
threefish_512_avx2
twofish
xtea

# modes
ccm
chacha20poly1305
eax
ocb
siv
cfb

# stream
chacha
chacha_simd32
chacha_avx2
ofb
rc4
salsa20
shake_cipher

# kdf
hkdf
kdf1
kdf2
prf_x942
sp800_56a

# pubkey
cecpq1
curve25519
ed25519
elgamal
gost_3410
mce
mceies
rfc6979
newhope
sm2

# pk_pad
#eme_pkcs1 // needed for tls
#emsa_pkcs1 // needed for tls
emsa_raw
emsa_x931

# hash
blake2
comb4p
gost_3411
md4
md5
rmd160
shake
skein
#sha1 // needed for x509
sm3
streebog
tiger
whirlpool
keccak

# rng
chacha_rng

# mac
cbc_mac
poly1305
siphash
x919_mac

# misc
bcrypt

# tls
tls_10

</prohibited>