#
# For a description of the syntax of this configuration file,
# see the file kconfig-language.txt in the NuttX tools repository.
#

config FSUTILS_PASSWD
	bool "Password file support"
	default n
	depends on CRYPTO_CRYPTODEV
	depends on CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO || CRYPTO_CRYPTODEV_HARDWARE
	depends on NETUTILS_CODECS
	depends on CODECS_BASE64
	---help---
		Enables support for /etc/passwd file access routines.

		Requires CONFIG_CRYPTO=y, CRYPTO_CRYPTODEV (and
		ALLOW_BSD_COMPONENTS), a cryptodev backend
		(CONFIG_CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO or
		CONFIG_CRYPTO_CRYPTODEV_HARDWARE), plus NETUTILS_CODECS/CODECS_BASE64
		for base64url hash encoding.

		NOTE: Password hashes use PBKDF2-HMAC-SHA256 (modular crypt format).
		Existing TEA-encrypted /etc/passwd entries are NOT compatible and
		must be regenerated.

if FSUTILS_PASSWD

config FSUTILS_PASSWD_PATH
	string "Path to the passwd file"
	default "/etc/passwd"

config FSUTILS_PASSWD_READONLY
	bool "Read-only /etc/passwd file?"
	default n

config FSUTILS_PASSWD_IOBUFFER_SIZE
	int "Allocated I/O buffer size"
	default 512

config FSUTILS_PASSWD_PBKDF2_ITERATIONS
	int "Default PBKDF2 iteration count for new passwords"
	default 10000
	range 1000 200000
	---help---
		Number of PBKDF2-HMAC-SHA256 iterations applied when setting a new
		password.  Higher values slow brute-force attacks but also increase
		login latency on low-MHz MCUs.  The iteration count is stored in each
		hash string, so changing this option only affects newly-set passwords.

endif # FSUTILS_PASSWD