+if PACKAGE_libopenssl
+
+comment "Build Options"
+
+config OPENSSL_OPTIMIZE_SPEED
+ bool
+ default y if x86_64 || i386
+ prompt "Enable optimization for speed instead of size"
+ select OPENSSL_WITH_ASM
+ help
+ Enabling this option increases code size (around 20%) and
+ performance. The increase in performance and size depends on the
+ target CPU. EC and AES seem to benefit the most, with EC speed
+ increased by 20%-50% (mipsel & x86).
+ AES-GCM is supposed to be 3x faster on x86. YMMV.
+
+config OPENSSL_WITH_ASM
+ bool
+ default y if !SMALL_FLASH || !arm
+ prompt "Compile with optimized assembly code"
+ depends on !arc
+ help
+ Disabling this option will reduce code size and performance.
+ The increase in performance and size depends on the target
+ CPU and on the algorithms being optimized. As of 1.1.0i*:
+
+ Platform Pkg Inc. Algorithms where assembly is used - ~% Speed Increase
+ aarch64 174K BN, aes, sha1, sha256, sha512, nist256, poly1305
+ arm 152K BN, aes, sha1, sha256, sha512, nist256, poly1305
+ i386 183K BN+147%, aes+300%, rc4+55%, sha1+160%, sha256+114%, sha512+270%, nist256+282%, poly1305+292%
+ mipsel 1.5K BN+97%, aes+4%, sha1+94%, sha256+60%
+ mips64 3.7K BN, aes, sha1, sha256, sha512, poly1305
+ powerpc 20K BN, aes, sha1, sha256, sha512, poly1305
+ x86_64 228K BN+220%, aes+173%, rc4+38%, sha1+40%, sha256+64%, sha512+31%, nist256+354%, poly1305+228%
+
+ * Only most common algorithms shown. Your mileage may vary.
+ BN (bignum) performance was measured using RSA sign/verify.
+
+config OPENSSL_WITH_SSE2
+ bool
+ default y if !TARGET_x86_legacy && !TARGET_x86_geode
+ prompt "Enable use of x86 SSE2 instructions"
+ depends on OPENSSL_WITH_ASM && i386
+ help
+ Use of SSE2 instructions greatly increase performance (up to
+ 3x faster) with a minimum (~0.2%, or 23KB) increase in package
+ size, but it will bring no benefit if your hardware does not
+ support them, such as Geode GX and LX. In this case you may
+ save 23KB by saying yes here. AMD Geode NX, and Intel
+ Pentium 4 and above support SSE2.
+
+config OPENSSL_WITH_DEPRECATED
+ bool
+ default y
+ prompt "Include deprecated APIs (See help for a list of packages that need this)"
+ help
+ Since openssl 1.1.x is still new to openwrt, some packages
+ requiring this option do not list it as a requirement yet:
+ * freeswitch-stable, freeswitch, python, python3, squid.
+
+config OPENSSL_NO_DEPRECATED
+ bool
+ default !OPENSSL_WITH_DEPRECATED
+
+config OPENSSL_WITH_ERROR_MESSAGES
+ bool
+ default y if !SMALL_FLASH && !LOW_MEMORY_FOOTPRINT
+ prompt "Include error messages"
+ help
+ This option aids debugging, but increases package size and
+ memory usage.
+
+comment "Protocol Support"
+
+config OPENSSL_WITH_TLS13
+ bool
+ default y
+ prompt "Enable support for TLS 1.3"
+ select OPENSSL_WITH_EC
+ help
+ TLS 1.3 is the newest version of the TLS specification.
+ It aims:
+ * to increase the overall security of the protocol,
+ removing outdated algorithms, and encrypting more of the
+ protocol;
+ * to increase performance by reducing the number of round-trips
+ when performing a full handshake.
+ It increases package size by ~4KB.
+
+config OPENSSL_WITH_DTLS
+ bool
+ prompt "Enable DTLS support"
+ help
+ Datagram Transport Layer Security (DTLS) provides TLS-like security
+ for datagram-based (UDP, DCCP, CAPWAP, SCTP & SRTP) applications.
+
+config OPENSSL_WITH_NPN
+ bool
+ default y
+ prompt "Enable NPN support"
+ help
+ NPN is a TLS extension, obsoleted and replaced with ALPN,
+ used to negotiate SPDY, and HTTP/2.
+
+config OPENSSL_WITH_SRP
+ bool
+ default y
+ prompt "Enable SRP support"
+ help
+ The Secure Remote Password protocol (SRP) is an augmented
+ password-authenticated key agreement (PAKE) protocol, specifically
+ designed to work around existing patents.
+
+config OPENSSL_WITH_CMS
+ bool
+ default y
+ prompt "Enable CMS (RFC 5652) support"
+ help
+ Cryptographic Message Syntax (CMS) is used to digitally sign,
+ digest, authenticate, or encrypt arbitrary message content.
+
+comment "Algorithm Selection"