Support for PC platform (#12)
* improvements for cross-platform compiling * moved tactility-core to libs/ * splitup improvements * remove git/gitmodules from freertos * better platformbetter platform checks * added build scripts * delete mbedtls * re-add mbedtls * fixes and improvements * added pc build * simplify build scripts * revert build scrpit * updated builds * fix for pc * fix for pc * fix for build
This commit is contained in:
Ken Van Hoeylandt
committed by
GitHub
GitHub
parent
c830c66063
commit
a94baf0d00
@@ -0,0 +1,24 @@
|
||||
This directory contains example configuration files.
|
||||
|
||||
The examples are generally focused on a particular usage case (eg, support for
|
||||
a restricted number of ciphersuites) and aim at minimizing resource usage for
|
||||
this target. They can be used as a basis for custom configurations.
|
||||
|
||||
These files are complete replacements for the default mbedtls_config.h. To use one of
|
||||
them, you can pick one of the following methods:
|
||||
|
||||
1. Replace the default file include/mbedtls/mbedtls_config.h with the chosen one.
|
||||
|
||||
2. Define MBEDTLS_CONFIG_FILE and adjust the include path accordingly.
|
||||
For example, using make:
|
||||
|
||||
CFLAGS="-I$PWD/configs -DMBEDTLS_CONFIG_FILE='<foo.h>'" make
|
||||
|
||||
Or, using cmake:
|
||||
|
||||
find . -iname '*cmake*' -not -name CMakeLists.txt -exec rm -rf {} +
|
||||
CFLAGS="-I$PWD/configs -DMBEDTLS_CONFIG_FILE='<foo.h>'" cmake .
|
||||
make
|
||||
|
||||
Note that the second method also works if you want to keep your custom
|
||||
configuration file outside the Mbed TLS tree.
|
||||
@@ -0,0 +1,92 @@
|
||||
/**
|
||||
* \file config-ccm-psk-dtls1_2.h
|
||||
*
|
||||
* \brief Small configuration for DTLS 1.2 with PSK and AES-CCM ciphersuites
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
/*
|
||||
* Minimal configuration for DTLS 1.2 with PSK and AES-CCM ciphersuites
|
||||
*
|
||||
* Distinguishing features:
|
||||
* - Optimized for small code size, low bandwidth (on an unreliable transport),
|
||||
* and low RAM usage.
|
||||
* - No asymmetric cryptography (no certificates, no Diffie-Hellman key
|
||||
* exchange).
|
||||
* - Fully modern and secure (provided the pre-shared keys are generated and
|
||||
* stored securely).
|
||||
* - Very low record overhead with CCM-8.
|
||||
* - Includes several optional DTLS features typically used in IoT.
|
||||
*
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */
|
||||
/* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_CCM_C
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_COOKIE_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
#define MBEDTLS_SSL_TLS_C
|
||||
#define MBEDTLS_TIMING_C
|
||||
|
||||
/* TLS protocol feature support */
|
||||
#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
|
||||
#define MBEDTLS_SSL_PROTO_TLS1_2
|
||||
#define MBEDTLS_SSL_PROTO_DTLS
|
||||
#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
|
||||
#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
|
||||
#define MBEDTLS_SSL_DTLS_CONNECTION_ID
|
||||
#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
|
||||
#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
|
||||
/*
|
||||
* Use only CCM_8 ciphersuites, and
|
||||
* save ROM and a few bytes of RAM by specifying our own ciphersuite list
|
||||
*/
|
||||
#define MBEDTLS_SSL_CIPHERSUITES \
|
||||
MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8, \
|
||||
MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8
|
||||
|
||||
/*
|
||||
* Save RAM at the expense of interoperability: do this only if you control
|
||||
* both ends of the connection! (See comments in "mbedtls/ssl.h".)
|
||||
* The optimal size here depends on the typical size of records.
|
||||
*/
|
||||
#define MBEDTLS_SSL_IN_CONTENT_LEN 256
|
||||
#define MBEDTLS_SSL_OUT_CONTENT_LEN 256
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save some RAM by adjusting to your exact needs */
|
||||
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "platform_entropy_poll" source, but you may want to add other ones
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
/* These defines are present so that the config modifying scripts can enable
|
||||
* them during tests/scripts/test-ref-configs.pl */
|
||||
//#define MBEDTLS_USE_PSA_CRYPTO
|
||||
//#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* Error messages and TLS debugging traces
|
||||
* (huge code size increase, needed for tests/ssl-opt.sh) */
|
||||
//#define MBEDTLS_DEBUG_C
|
||||
//#define MBEDTLS_ERROR_C
|
||||
@@ -0,0 +1,83 @@
|
||||
/**
|
||||
* \file config-ccm-psk-tls1_2.h
|
||||
*
|
||||
* \brief Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
/*
|
||||
* Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites
|
||||
*
|
||||
* Distinguishing features:
|
||||
* - Optimized for small code size, low bandwidth (on a reliable transport),
|
||||
* and low RAM usage.
|
||||
* - No asymmetric cryptography (no certificates, no Diffie-Hellman key
|
||||
* exchange).
|
||||
* - Fully modern and secure (provided the pre-shared keys are generated and
|
||||
* stored securely).
|
||||
* - Very low record overhead with CCM-8.
|
||||
*
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */
|
||||
/* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_CCM_C
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
#define MBEDTLS_SSL_TLS_C
|
||||
|
||||
/* TLS protocol feature support */
|
||||
#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
|
||||
#define MBEDTLS_SSL_PROTO_TLS1_2
|
||||
|
||||
/*
|
||||
* Use only CCM_8 ciphersuites, and
|
||||
* save ROM and a few bytes of RAM by specifying our own ciphersuite list
|
||||
*/
|
||||
#define MBEDTLS_SSL_CIPHERSUITES \
|
||||
MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8, \
|
||||
MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8
|
||||
|
||||
/*
|
||||
* Save RAM at the expense of interoperability: do this only if you control
|
||||
* both ends of the connection! (See comments in "mbedtls/ssl.h".)
|
||||
* The optimal size here depends on the typical size of records.
|
||||
*/
|
||||
#define MBEDTLS_SSL_IN_CONTENT_LEN 1024
|
||||
#define MBEDTLS_SSL_OUT_CONTENT_LEN 1024
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save some RAM by adjusting to your exact needs */
|
||||
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "platform_entropy_poll" source, but you may want to add other ones
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
/* These defines are present so that the config modifying scripts can enable
|
||||
* them during tests/scripts/test-ref-configs.pl */
|
||||
//#define MBEDTLS_USE_PSA_CRYPTO
|
||||
//#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* Error messages and TLS debugging traces
|
||||
* (huge code size increase, needed for tests/ssl-opt.sh) */
|
||||
//#define MBEDTLS_DEBUG_C
|
||||
//#define MBEDTLS_ERROR_C
|
||||
@@ -0,0 +1,73 @@
|
||||
/**
|
||||
* \file config-no-entropy.h
|
||||
*
|
||||
* \brief Minimal configuration of features that do not require an entropy source
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
/*
|
||||
* Minimal configuration of features that do not require an entropy source
|
||||
* Distinguishing features:
|
||||
* - no entropy module
|
||||
* - no TLS protocol implementation available due to absence of an entropy
|
||||
* source
|
||||
*
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_CIPHER_MODE_CBC
|
||||
#define MBEDTLS_CIPHER_PADDING_PKCS7
|
||||
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
||||
#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
|
||||
#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
#define MBEDTLS_ECDSA_DETERMINISTIC
|
||||
#define MBEDTLS_PK_RSA_ALT_SUPPORT
|
||||
#define MBEDTLS_PKCS1_V15
|
||||
#define MBEDTLS_PKCS1_V21
|
||||
#define MBEDTLS_SELF_TEST
|
||||
#define MBEDTLS_VERSION_FEATURES
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_CCM_C
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_ECDSA_C
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_ERROR_C
|
||||
#define MBEDTLS_GCM_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_PK_WRITE_C
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
#define MBEDTLS_RSA_C
|
||||
/* The library does not currently support enabling SHA-224 without SHA-256.
|
||||
* A future version of the library will have this option disabled
|
||||
* by default. */
|
||||
#define MBEDTLS_SHA224_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_SHA384_C
|
||||
#define MBEDTLS_SHA512_C
|
||||
#define MBEDTLS_VERSION_C
|
||||
#define MBEDTLS_X509_USE_C
|
||||
#define MBEDTLS_X509_CRT_PARSE_C
|
||||
#define MBEDTLS_X509_CRL_PARSE_C
|
||||
//#define MBEDTLS_CMAC_C
|
||||
|
||||
/* Miscellaneous options */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
@@ -0,0 +1,106 @@
|
||||
/**
|
||||
* \file config-suite-b.h
|
||||
*
|
||||
* \brief Minimal configuration for TLS NSA Suite B Profile (RFC 6460)
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
/*
|
||||
* Minimal configuration for TLS NSA Suite B Profile (RFC 6460)
|
||||
*
|
||||
* Distinguishing features:
|
||||
* - no RSA or classic DH, fully based on ECC
|
||||
* - optimized for low RAM usage
|
||||
*
|
||||
* Possible improvements:
|
||||
* - if 128-bit security is enough, disable secp384r1 and SHA-512
|
||||
* - use embedded certs in DER format and disable PEM_PARSE_C and BASE64_C
|
||||
*
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
||||
#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
|
||||
#define MBEDTLS_SSL_PROTO_TLS1_2
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ECDH_C
|
||||
#define MBEDTLS_ECDSA_C
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_GCM_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_SHA384_C
|
||||
#define MBEDTLS_SHA512_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
#define MBEDTLS_SSL_TLS_C
|
||||
#define MBEDTLS_X509_CRT_PARSE_C
|
||||
#define MBEDTLS_X509_USE_C
|
||||
|
||||
/* For test certificates */
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save RAM by adjusting to our exact needs */
|
||||
#define MBEDTLS_MPI_MAX_SIZE 48 // 384-bit EC curve = 48 bytes
|
||||
|
||||
/* Save RAM at the expense of speed, see ecp.h */
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 2
|
||||
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 0
|
||||
|
||||
/* Significant speed benefit at the expense of some ROM */
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "mbedtls_platform_entropy_poll" source, but you may want to add other ones.
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
/* Save ROM and a few bytes of RAM by specifying our own ciphersuite list */
|
||||
#define MBEDTLS_SSL_CIPHERSUITES \
|
||||
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, \
|
||||
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
/*
|
||||
* Save RAM at the expense of interoperability: do this only if you control
|
||||
* both ends of the connection! (See comments in "mbedtls/ssl.h".)
|
||||
* The minimum size here depends on the certificate chain used as well as the
|
||||
* typical size of records.
|
||||
*/
|
||||
#define MBEDTLS_SSL_IN_CONTENT_LEN 1024
|
||||
#define MBEDTLS_SSL_OUT_CONTENT_LEN 1024
|
||||
|
||||
/* These defines are present so that the config modifying scripts can enable
|
||||
* them during tests/scripts/test-ref-configs.pl */
|
||||
//#define MBEDTLS_USE_PSA_CRYPTO
|
||||
//#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* Error messages and TLS debugging traces
|
||||
* (huge code size increase, needed for tests/ssl-opt.sh) */
|
||||
//#define MBEDTLS_DEBUG_C
|
||||
//#define MBEDTLS_ERROR_C
|
||||
@@ -0,0 +1,77 @@
|
||||
/**
|
||||
* \file config-symmetric-only.h
|
||||
*
|
||||
* \brief Configuration without any asymmetric cryptography.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
#define MBEDTLS_HAVE_TIME_DATE
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_CIPHER_MODE_CBC
|
||||
#define MBEDTLS_CIPHER_MODE_CFB
|
||||
#define MBEDTLS_CIPHER_MODE_CTR
|
||||
#define MBEDTLS_CIPHER_MODE_OFB
|
||||
#define MBEDTLS_CIPHER_MODE_XTS
|
||||
#define MBEDTLS_CIPHER_PADDING_PKCS7
|
||||
#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
|
||||
#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
|
||||
#define MBEDTLS_CIPHER_PADDING_ZEROS
|
||||
#define MBEDTLS_ERROR_STRERROR_DUMMY
|
||||
#define MBEDTLS_FS_IO
|
||||
#define MBEDTLS_ENTROPY_NV_SEED
|
||||
#define MBEDTLS_SELF_TEST
|
||||
#define MBEDTLS_USE_PSA_CRYPTO
|
||||
#define MBEDTLS_VERSION_FEATURES
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_CAMELLIA_C
|
||||
#define MBEDTLS_ARIA_C
|
||||
#define MBEDTLS_CCM_C
|
||||
#define MBEDTLS_CHACHA20_C
|
||||
#define MBEDTLS_CHACHAPOLY_C
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_CMAC_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_DES_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_ERROR_C
|
||||
#define MBEDTLS_GCM_C
|
||||
#define MBEDTLS_HKDF_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_NIST_KW_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_MD5_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
#define MBEDTLS_PEM_WRITE_C
|
||||
#define MBEDTLS_PKCS5_C
|
||||
#define MBEDTLS_PKCS12_C
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
#define MBEDTLS_POLY1305_C
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_PSA_CRYPTO_SE_C
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
#define MBEDTLS_PSA_ITS_FILE_C
|
||||
#define MBEDTLS_RIPEMD160_C
|
||||
#define MBEDTLS_SHA1_C
|
||||
/* The library does not currently support enabling SHA-224 without SHA-256.
|
||||
* A future version of the library will have this option disabled
|
||||
* by default. */
|
||||
#define MBEDTLS_SHA224_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_SHA384_C
|
||||
#define MBEDTLS_SHA512_C
|
||||
//#define MBEDTLS_THREADING_C
|
||||
#define MBEDTLS_TIMING_C
|
||||
#define MBEDTLS_VERSION_C
|
||||
@@ -0,0 +1,68 @@
|
||||
/**
|
||||
* \file config-tfm.h
|
||||
*
|
||||
* \brief TF-M medium profile, adapted to work on other platforms.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
/* TF-M medium profile: mbedtls legacy configuration */
|
||||
#include "../configs/ext/tfm_mbedcrypto_config_profile_medium.h"
|
||||
|
||||
/* TF-M medium profile: PSA crypto configuration */
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/ext/crypto_config_profile_medium.h"
|
||||
|
||||
/***********************************************************/
|
||||
/* Tweak the configuration to remove dependencies on TF-M. */
|
||||
/***********************************************************/
|
||||
|
||||
/* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */
|
||||
#undef MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
/* Disable buffer-based memory allocator. This isn't strictly required,
|
||||
* but using the native allocator is faster and works better with
|
||||
* memory management analysis frameworks such as ASan. */
|
||||
#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
|
||||
// This macro is enabled in TFM Medium but is disabled here because it is
|
||||
// incompatible with baremetal builds in Mbed TLS.
|
||||
#undef MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
|
||||
// This macro is enabled in TFM Medium but is disabled here because it is
|
||||
// incompatible with baremetal builds in Mbed TLS.
|
||||
#undef MBEDTLS_ENTROPY_NV_SEED
|
||||
|
||||
// These platform-related TF-M settings are not useful here.
|
||||
#undef MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
|
||||
#undef MBEDTLS_PLATFORM_STD_MEM_HDR
|
||||
#undef MBEDTLS_PLATFORM_SNPRINTF_MACRO
|
||||
#undef MBEDTLS_PLATFORM_PRINTF_ALT
|
||||
#undef MBEDTLS_PLATFORM_STD_EXIT_SUCCESS
|
||||
#undef MBEDTLS_PLATFORM_STD_EXIT_FAILURE
|
||||
|
||||
/*
|
||||
* In order to get an example config that works cleanly out-of-the-box
|
||||
* for both baremetal and non-baremetal builds, we detect baremetal builds
|
||||
* (either IAR, Arm compiler or __ARM_EABI__ defined), and adjust some
|
||||
* variables accordingly.
|
||||
*/
|
||||
#if defined(__IAR_SYSTEMS_ICC__) || defined(__ARMCC_VERSION) || defined(__ARM_EABI__)
|
||||
#define MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
#else
|
||||
/* Use built-in platform entropy functions (TF-M provides its own). */
|
||||
#undef MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
#endif
|
||||
|
||||
/***********************************************************************
|
||||
* Local changes to crypto config below this delimiter
|
||||
**********************************************************************/
|
||||
|
||||
// We expect TF-M to pick this up soon
|
||||
#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
|
||||
|
||||
/* CCM is the only cipher/AEAD enabled in TF-M configuration files, but it
|
||||
* does not need CIPHER_C to be enabled, so we can disable it in order
|
||||
* to reduce code size further. */
|
||||
#undef MBEDTLS_CIPHER_C
|
||||
@@ -0,0 +1,76 @@
|
||||
/**
|
||||
* \file config-thread.h
|
||||
*
|
||||
* \brief Minimal configuration for using TLS as part of Thread
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
/*
|
||||
* Minimal configuration for using TLS a part of Thread
|
||||
* http://threadgroup.org/
|
||||
*
|
||||
* Distinguishing features:
|
||||
* - no RSA or classic DH, fully based on ECC
|
||||
* - no X.509
|
||||
* - support for experimental EC J-PAKE key exchange
|
||||
*
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
|
||||
#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
#define MBEDTLS_SSL_PROTO_TLS1_2
|
||||
#define MBEDTLS_SSL_PROTO_DTLS
|
||||
#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
|
||||
#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_BIGNUM_C
|
||||
#define MBEDTLS_CCM_C
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_CMAC_C
|
||||
#define MBEDTLS_ECJPAKE_C
|
||||
#define MBEDTLS_ECP_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_SSL_COOKIE_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
#define MBEDTLS_SSL_TLS_C
|
||||
|
||||
/* For tests using ssl-opt.sh */
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_TIMING_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save RAM by adjusting to our exact needs */
|
||||
#define MBEDTLS_MPI_MAX_SIZE 32 // 256-bit EC curve = 32 bytes
|
||||
|
||||
/* Save ROM and a few bytes of RAM by specifying our own ciphersuite list */
|
||||
#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
|
||||
|
||||
/* These defines are present so that the config modifying scripts can enable
|
||||
* them during tests/scripts/test-ref-configs.pl */
|
||||
//#define MBEDTLS_USE_PSA_CRYPTO
|
||||
//#define MBEDTLS_PSA_CRYPTO_C
|
||||
@@ -0,0 +1,25 @@
|
||||
/**
|
||||
* \file configs/crypto-config-ccm-aes-sha256.h
|
||||
*
|
||||
* \brief PSA crypto configuration with only symmetric cryptography: CCM-AES,
|
||||
* SHA-256, HMAC and key derivation
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_CONFIG_H
|
||||
#define PSA_CRYPTO_CONFIG_H
|
||||
|
||||
#define PSA_WANT_ALG_CCM 1
|
||||
#define PSA_WANT_ALG_HMAC 1
|
||||
#define PSA_WANT_ALG_SHA_256 1
|
||||
#define PSA_WANT_ALG_TLS12_PRF 1
|
||||
#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1
|
||||
#define PSA_WANT_KEY_TYPE_DERIVE 1
|
||||
#define PSA_WANT_KEY_TYPE_HMAC 1
|
||||
#define PSA_WANT_KEY_TYPE_AES 1
|
||||
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
|
||||
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
@@ -0,0 +1,25 @@
|
||||
Summary
|
||||
-------
|
||||
|
||||
The two files:
|
||||
|
||||
* crypto_config_profile_medium.h
|
||||
* tfm_mbedcrypto_config_profile_medium.h
|
||||
|
||||
are copyright The Mbed TLS Contributors, and are distributed under the license normally
|
||||
used by Mbed TLS: a dual Apache 2.0 or GPLv2-or-later license.
|
||||
|
||||
Background
|
||||
----------
|
||||
|
||||
The two files crypto_config_profile_medium.h and tfm_mbedcrypto_config_profile_medium.h
|
||||
are taken verbatim from the TF-M source code here:
|
||||
|
||||
https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/lib/ext/mbedcrypto/mbedcrypto_config
|
||||
|
||||
In TF-M, they are distributed under a 3-Clause BSD license, as noted at the top of the files.
|
||||
|
||||
In Mbed TLS, with permission from the TF-M project, they are distributed under a dual [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) OR [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) license, with copyright assigned to The Mbed TLS Contributors.
|
||||
|
||||
We only retain the note at the top of the files because we are taking the files verbatim, for ease of
|
||||
maintenance.
|
||||
@@ -0,0 +1,13 @@
|
||||
/*
|
||||
* Empty placeholder
|
||||
*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file is intentionally empty.
|
||||
*
|
||||
* Having an empty file here allows us to build the TF-M config, which references this file,
|
||||
* without making any changes to the TF-M config.
|
||||
*/
|
||||
@@ -0,0 +1,132 @@
|
||||
/*
|
||||
* Copyright (c) 2018-2023, Arm Limited. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*
|
||||
*/
|
||||
/**
|
||||
* \file psa/crypto_config.h
|
||||
* \brief PSA crypto configuration options (set of defines)
|
||||
*
|
||||
*/
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
|
||||
/**
|
||||
* When #MBEDTLS_PSA_CRYPTO_CONFIG is enabled in mbedtls_config.h,
|
||||
* this file determines which cryptographic mechanisms are enabled
|
||||
* through the PSA Cryptography API (\c psa_xxx() functions).
|
||||
*
|
||||
* To enable a cryptographic mechanism, uncomment the definition of
|
||||
* the corresponding \c PSA_WANT_xxx preprocessor symbol.
|
||||
* To disable a cryptographic mechanism, comment out the definition of
|
||||
* the corresponding \c PSA_WANT_xxx preprocessor symbol.
|
||||
* The names of cryptographic mechanisms correspond to values
|
||||
* defined in psa/crypto_values.h, with the prefix \c PSA_WANT_ instead
|
||||
* of \c PSA_.
|
||||
*
|
||||
* Note that many cryptographic mechanisms involve two symbols: one for
|
||||
* the key type (\c PSA_WANT_KEY_TYPE_xxx) and one for the algorithm
|
||||
* (\c PSA_WANT_ALG_xxx). Mechanisms with additional parameters may involve
|
||||
* additional symbols.
|
||||
*/
|
||||
#else
|
||||
/**
|
||||
* When \c MBEDTLS_PSA_CRYPTO_CONFIG is disabled in mbedtls_config.h,
|
||||
* this file is not used, and cryptographic mechanisms are supported
|
||||
* through the PSA API if and only if they are supported through the
|
||||
* mbedtls_xxx API.
|
||||
*/
|
||||
#endif
|
||||
|
||||
#ifndef PROFILE_M_PSA_CRYPTO_CONFIG_H
|
||||
#define PROFILE_M_PSA_CRYPTO_CONFIG_H
|
||||
|
||||
/*
|
||||
* CBC-MAC is not yet supported via the PSA API in Mbed TLS.
|
||||
*/
|
||||
//#define PSA_WANT_ALG_CBC_MAC 1
|
||||
//#define PSA_WANT_ALG_CBC_NO_PADDING 1
|
||||
//#define PSA_WANT_ALG_CBC_PKCS7 1
|
||||
#define PSA_WANT_ALG_CCM 1
|
||||
//#define PSA_WANT_ALG_CMAC 1
|
||||
//#define PSA_WANT_ALG_CFB 1
|
||||
//#define PSA_WANT_ALG_CHACHA20_POLY1305 1
|
||||
//#define PSA_WANT_ALG_CTR 1
|
||||
//#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1
|
||||
//#define PSA_WANT_ALG_ECB_NO_PADDING 1
|
||||
#define PSA_WANT_ALG_ECDH 1
|
||||
#define PSA_WANT_ALG_ECDSA 1
|
||||
//#define PSA_WANT_ALG_GCM 1
|
||||
#define PSA_WANT_ALG_HKDF 1
|
||||
#define PSA_WANT_ALG_HMAC 1
|
||||
//#define PSA_WANT_ALG_MD5 1
|
||||
//#define PSA_WANT_ALG_OFB 1
|
||||
/* PBKDF2-HMAC is not yet supported via the PSA API in Mbed TLS.
|
||||
* Note: when adding support, also adjust include/mbedtls/config_psa.h */
|
||||
//#define PSA_WANT_ALG_PBKDF2_HMAC 1
|
||||
//#define PSA_WANT_ALG_RIPEMD160 1
|
||||
//#define PSA_WANT_ALG_RSA_OAEP 1
|
||||
//#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1
|
||||
//#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1
|
||||
//#define PSA_WANT_ALG_RSA_PSS 1
|
||||
//#define PSA_WANT_ALG_SHA_1 1
|
||||
#define PSA_WANT_ALG_SHA_224 1
|
||||
#define PSA_WANT_ALG_SHA_256 1
|
||||
//#define PSA_WANT_ALG_SHA_384 1
|
||||
//#define PSA_WANT_ALG_SHA_512 1
|
||||
//#define PSA_WANT_ALG_STREAM_CIPHER 1
|
||||
#define PSA_WANT_ALG_TLS12_PRF 1
|
||||
#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1
|
||||
/* PBKDF2-HMAC is not yet supported via the PSA API in Mbed TLS.
|
||||
* Note: when adding support, also adjust include/mbedtls/config_psa.h */
|
||||
//#define PSA_WANT_ALG_XTS 1
|
||||
|
||||
//#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1
|
||||
//#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1
|
||||
//#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1
|
||||
//#define PSA_WANT_ECC_MONTGOMERY_255 1
|
||||
//#define PSA_WANT_ECC_MONTGOMERY_448 1
|
||||
//#define PSA_WANT_ECC_SECP_K1_192 1
|
||||
/*
|
||||
* SECP224K1 is buggy via the PSA API in Mbed TLS
|
||||
* (https://github.com/Mbed-TLS/mbedtls/issues/3541). Thus, do not enable it by
|
||||
* default.
|
||||
*/
|
||||
//#define PSA_WANT_ECC_SECP_K1_224 1
|
||||
//#define PSA_WANT_ECC_SECP_K1_256 1
|
||||
//#define PSA_WANT_ECC_SECP_R1_192 1
|
||||
//#define PSA_WANT_ECC_SECP_R1_224 1
|
||||
#define PSA_WANT_ECC_SECP_R1_256 1
|
||||
//#define PSA_WANT_ECC_SECP_R1_384 1
|
||||
//#define PSA_WANT_ECC_SECP_R1_521 1
|
||||
|
||||
#define PSA_WANT_KEY_TYPE_DERIVE 1
|
||||
#define PSA_WANT_KEY_TYPE_HMAC 1
|
||||
#define PSA_WANT_KEY_TYPE_AES 1
|
||||
//#define PSA_WANT_KEY_TYPE_ARIA 1
|
||||
//#define PSA_WANT_KEY_TYPE_CAMELLIA 1
|
||||
//#define PSA_WANT_KEY_TYPE_CHACHA20 1
|
||||
//#define PSA_WANT_KEY_TYPE_DES 1
|
||||
//#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 /* Deprecated */
|
||||
#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1
|
||||
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
|
||||
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 /* Deprecated */
|
||||
//#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
|
||||
|
||||
/*
|
||||
* The following symbols extend and deprecate the legacy
|
||||
* PSA_WANT_KEY_TYPE_xxx_KEY_PAIR ones. They include the usage of that key in
|
||||
* the name's suffix. "_USE" is the most generic and it can be used to describe
|
||||
* a generic suport, whereas other ones add more features on top of that and
|
||||
* they are more specific.
|
||||
*/
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
|
||||
//#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1
|
||||
|
||||
#ifdef CRYPTO_HW_ACCELERATOR
|
||||
#include "crypto_accelerator_config.h"
|
||||
#endif
|
||||
|
||||
#endif /* PROFILE_M_PSA_CRYPTO_CONFIG_H */
|
||||
@@ -0,0 +1,13 @@
|
||||
/*
|
||||
* Empty placeholder
|
||||
*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file is intentionally empty.
|
||||
*
|
||||
* Having an empty file here allows us to build the TF-M config, which references this file,
|
||||
* without making any changes to the TF-M config.
|
||||
*/
|
||||
@@ -0,0 +1,573 @@
|
||||
/**
|
||||
* \file config.h
|
||||
*
|
||||
* \brief Configuration options (set of defines)
|
||||
*
|
||||
* This set of compile-time options may be used to enable
|
||||
* or disable features selectively, and reduce the global
|
||||
* memory footprint.
|
||||
*/
|
||||
/*
|
||||
* Copyright (C) 2006-2023, ARM Limited, All Rights Reserved
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
* not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#ifndef PROFILE_M_MBEDTLS_CONFIG_H
|
||||
#define PROFILE_M_MBEDTLS_CONFIG_H
|
||||
|
||||
#include "config_tfm.h"
|
||||
|
||||
#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
|
||||
#define _CRT_SECURE_NO_DEPRECATE 1
|
||||
#endif
|
||||
|
||||
/**
|
||||
* \name SECTION: System support
|
||||
*
|
||||
* This section sets system specific settings.
|
||||
* \{
|
||||
*/
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_HAVE_ASM
|
||||
*
|
||||
* The compiler has support for asm().
|
||||
*
|
||||
* Requires support for asm() in compiler.
|
||||
*
|
||||
* Used in:
|
||||
* library/aria.c
|
||||
* library/timing.c
|
||||
* include/mbedtls/bn_mul.h
|
||||
*
|
||||
* Required by:
|
||||
* MBEDTLS_AESNI_C
|
||||
* MBEDTLS_PADLOCK_C
|
||||
*
|
||||
* Comment to disable the use of assembly code.
|
||||
*/
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PLATFORM_MEMORY
|
||||
*
|
||||
* Enable the memory allocation layer.
|
||||
*
|
||||
* By default mbed TLS uses the system-provided calloc() and free().
|
||||
* This allows different allocators (self-implemented or provided) to be
|
||||
* provided to the platform abstraction layer.
|
||||
*
|
||||
* Enabling MBEDTLS_PLATFORM_MEMORY without the
|
||||
* MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
|
||||
* "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
|
||||
* free() function pointer at runtime.
|
||||
*
|
||||
* Enabling MBEDTLS_PLATFORM_MEMORY and specifying
|
||||
* MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
|
||||
* alternate function at compile time.
|
||||
*
|
||||
* Requires: MBEDTLS_PLATFORM_C
|
||||
*
|
||||
* Enable this layer to allow use of alternative memory allocators.
|
||||
*/
|
||||
#define MBEDTLS_PLATFORM_MEMORY
|
||||
|
||||
/* \} name SECTION: System support */
|
||||
|
||||
/**
|
||||
* \name SECTION: mbed TLS feature support
|
||||
*
|
||||
* This section sets support for features that are or are not needed
|
||||
* within the modules that are enabled.
|
||||
* \{
|
||||
*/
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_AES_ROM_TABLES
|
||||
*
|
||||
* Use precomputed AES tables stored in ROM.
|
||||
*
|
||||
* Uncomment this macro to use precomputed AES tables stored in ROM.
|
||||
* Comment this macro to generate AES tables in RAM at runtime.
|
||||
*
|
||||
* Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb
|
||||
* (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the
|
||||
* initialization time before the first AES operation can be performed.
|
||||
* It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c
|
||||
* MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded
|
||||
* performance if ROM access is slower than RAM access.
|
||||
*
|
||||
* This option is independent of \c MBEDTLS_AES_FEWER_TABLES.
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_AES_FEWER_TABLES
|
||||
*
|
||||
* Use less ROM/RAM for AES tables.
|
||||
*
|
||||
* Uncommenting this macro omits 75% of the AES tables from
|
||||
* ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES)
|
||||
* by computing their values on the fly during operations
|
||||
* (the tables are entry-wise rotations of one another).
|
||||
*
|
||||
* Tradeoff: Uncommenting this reduces the RAM / ROM footprint
|
||||
* by ~6kb but at the cost of more arithmetic operations during
|
||||
* runtime. Specifically, one has to compare 4 accesses within
|
||||
* different tables to 4 accesses with additional arithmetic
|
||||
* operations within the same table. The performance gain/loss
|
||||
* depends on the system and memory details.
|
||||
*
|
||||
* This option is independent of \c MBEDTLS_AES_ROM_TABLES.
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_AES_FEWER_TABLES
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ECP_NIST_OPTIM
|
||||
*
|
||||
* Enable specific 'modulo p' routines for each NIST prime.
|
||||
* Depending on the prime and architecture, makes operations 4 to 8 times
|
||||
* faster on the corresponding curve.
|
||||
*
|
||||
* Comment this macro to disable NIST curves optimisation.
|
||||
*/
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
*
|
||||
* Do not use built-in platform entropy functions.
|
||||
* This is useful if your platform does not support
|
||||
* standards like the /dev/urandom or Windows CryptoAPI.
|
||||
*
|
||||
* Uncomment this macro to disable the built-in platform entropy functions.
|
||||
*/
|
||||
#define MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ENTROPY_NV_SEED
|
||||
*
|
||||
* Enable the non-volatile (NV) seed file-based entropy source.
|
||||
* (Also enables the NV seed read/write functions in the platform layer)
|
||||
*
|
||||
* This is crucial (if not required) on systems that do not have a
|
||||
* cryptographic entropy source (in hardware or kernel) available.
|
||||
*
|
||||
* Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
|
||||
*
|
||||
* \note The read/write functions that are used by the entropy source are
|
||||
* determined in the platform layer, and can be modified at runtime and/or
|
||||
* compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
|
||||
*
|
||||
* \note If you use the default implementation functions that read a seedfile
|
||||
* with regular fopen(), please make sure you make a seedfile with the
|
||||
* proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
|
||||
* least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
|
||||
* and written to or you will get an entropy source error! The default
|
||||
* implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
|
||||
* bytes from the file.
|
||||
*
|
||||
* \note The entropy collector will write to the seed file before entropy is
|
||||
* given to an external source, to update it.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_NV_SEED
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_SPM
|
||||
*
|
||||
* When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure
|
||||
* Partition Manager) integration which separates the code into two parts: a
|
||||
* NSPE (Non-Secure Process Environment) and an SPE (Secure Process
|
||||
* Environment).
|
||||
*
|
||||
* Module: library/psa_crypto.c
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_SHA256_SMALLER
|
||||
*
|
||||
* Enable an implementation of SHA-256 that has lower ROM footprint but also
|
||||
* lower performance.
|
||||
*
|
||||
* The default implementation is meant to be a reasonnable compromise between
|
||||
* performance and size. This version optimizes more aggressively for size at
|
||||
* the expense of performance. Eg on Cortex-M4 it reduces the size of
|
||||
* mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about
|
||||
* 30%.
|
||||
*
|
||||
* Uncomment to enable the smaller implementation of SHA256.
|
||||
*/
|
||||
#define MBEDTLS_SHA256_SMALLER
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
*
|
||||
* This setting allows support for cryptographic mechanisms through the PSA
|
||||
* API to be configured separately from support through the mbedtls API.
|
||||
*
|
||||
* When this option is disabled, the PSA API exposes the cryptographic
|
||||
* mechanisms that can be implemented on top of the `mbedtls_xxx` API
|
||||
* configured with `MBEDTLS_XXX` symbols.
|
||||
*
|
||||
* When this option is enabled, the PSA API exposes the cryptographic
|
||||
* mechanisms requested by the `PSA_WANT_XXX` symbols defined in
|
||||
* include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are
|
||||
* automatically enabled if required (i.e. if no PSA driver provides the
|
||||
* mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols
|
||||
* in mbedtls_config.h.
|
||||
*
|
||||
* If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies
|
||||
* an alternative header to include instead of include/psa/crypto_config.h.
|
||||
*
|
||||
* This feature is still experimental and is not ready for production since
|
||||
* it is not completed.
|
||||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
|
||||
/* \} name SECTION: mbed TLS feature support */
|
||||
|
||||
/**
|
||||
* \name SECTION: mbed TLS modules
|
||||
*
|
||||
* This section enables or disables entire modules in mbed TLS
|
||||
* \{
|
||||
*/
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_AES_C
|
||||
*
|
||||
* Enable the AES block cipher.
|
||||
*
|
||||
* Module: library/aes.c
|
||||
* Caller: library/cipher.c
|
||||
* library/pem.c
|
||||
* library/ctr_drbg.c
|
||||
*
|
||||
* This module is required to support the TLS ciphersuites that use the AES
|
||||
* cipher.
|
||||
*
|
||||
* PEM_PARSE uses AES for decrypting encrypted keys.
|
||||
*/
|
||||
#define MBEDTLS_AES_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
|
||||
*
|
||||
* Use only 128-bit keys in AES operations to save ROM.
|
||||
*
|
||||
* Uncomment this macro to remove support for AES operations that use 192-
|
||||
* or 256-bit keys.
|
||||
*
|
||||
* Uncommenting this macro reduces the size of AES code by ~300 bytes
|
||||
* on v8-M/Thumb2.
|
||||
*
|
||||
* Module: library/aes.c
|
||||
*
|
||||
* Requires: MBEDTLS_AES_C
|
||||
*/
|
||||
#define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_CIPHER_C
|
||||
*
|
||||
* Enable the generic cipher layer.
|
||||
*
|
||||
* Module: library/cipher.c
|
||||
*
|
||||
* Uncomment to enable generic cipher wrappers.
|
||||
*/
|
||||
#define MBEDTLS_CIPHER_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_CTR_DRBG_C
|
||||
*
|
||||
* Enable the CTR_DRBG AES-based random generator.
|
||||
* The CTR_DRBG generator uses AES-256 by default.
|
||||
* To use AES-128 instead, enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY below.
|
||||
*
|
||||
* Module: library/ctr_drbg.c
|
||||
* Caller:
|
||||
*
|
||||
* Requires: MBEDTLS_AES_C
|
||||
*
|
||||
* This module provides the CTR_DRBG AES random number generator.
|
||||
*/
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ENTROPY_C
|
||||
*
|
||||
* Enable the platform-specific entropy code.
|
||||
*
|
||||
* Module: library/entropy.c
|
||||
* Caller:
|
||||
*
|
||||
* Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
|
||||
*
|
||||
* This module provides a generic entropy pool
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_HKDF_C
|
||||
*
|
||||
* Enable the HKDF algorithm (RFC 5869).
|
||||
*
|
||||
* Module: library/hkdf.c
|
||||
* Caller:
|
||||
*
|
||||
* Requires: MBEDTLS_MD_C
|
||||
*
|
||||
* This module adds support for the Hashed Message Authentication Code
|
||||
* (HMAC)-based key derivation function (HKDF).
|
||||
*/
|
||||
//#define MBEDTLS_HKDF_C /* Used for HUK deriviation */
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
*
|
||||
* Enable the buffer allocator implementation that makes use of a (stack)
|
||||
* based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
|
||||
* calls)
|
||||
*
|
||||
* Module: library/memory_buffer_alloc.c
|
||||
*
|
||||
* Requires: MBEDTLS_PLATFORM_C
|
||||
* MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS)
|
||||
*
|
||||
* Enable this module to enable the buffer memory allocator.
|
||||
*/
|
||||
#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PLATFORM_C
|
||||
*
|
||||
* Enable the platform abstraction layer that allows you to re-assign
|
||||
* functions like calloc(), free(), snprintf(), printf(), fprintf(), exit().
|
||||
*
|
||||
* Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
|
||||
* or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
|
||||
* above to be specified at runtime or compile time respectively.
|
||||
*
|
||||
* \note This abstraction layer must be enabled on Windows (including MSYS2)
|
||||
* as other module rely on it for a fixed snprintf implementation.
|
||||
*
|
||||
* Module: library/platform.c
|
||||
* Caller: Most other .c files
|
||||
*
|
||||
* This module enables abstraction of common (libc) functions.
|
||||
*/
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
|
||||
#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
|
||||
#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h>
|
||||
|
||||
#include <stdio.h>
|
||||
|
||||
#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf
|
||||
#define MBEDTLS_PLATFORM_PRINTF_ALT
|
||||
#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS
|
||||
#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_C
|
||||
*
|
||||
* Enable the Platform Security Architecture cryptography API.
|
||||
*
|
||||
* Module: library/psa_crypto.c
|
||||
*
|
||||
* Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C
|
||||
*
|
||||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
*
|
||||
* Enable the Platform Security Architecture persistent key storage.
|
||||
*
|
||||
* Module: library/psa_crypto_storage.c
|
||||
*
|
||||
* Requires: MBEDTLS_PSA_CRYPTO_C,
|
||||
* either MBEDTLS_PSA_ITS_FILE_C or a native implementation of
|
||||
* the PSA ITS interface
|
||||
*/
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
|
||||
/* \} name SECTION: mbed TLS modules */
|
||||
|
||||
/**
|
||||
* \name SECTION: General configuration options
|
||||
*
|
||||
* This section contains Mbed TLS build settings that are not associated
|
||||
* with a particular module.
|
||||
*
|
||||
* \{
|
||||
*/
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_CONFIG_FILE
|
||||
*
|
||||
* If defined, this is a header which will be included instead of
|
||||
* `"mbedtls/mbedtls_config.h"`.
|
||||
* This header file specifies the compile-time configuration of Mbed TLS.
|
||||
* Unlike other configuration options, this one must be defined on the
|
||||
* compiler command line: a definition in `mbedtls_config.h` would have
|
||||
* no effect.
|
||||
*
|
||||
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
||||
* non-standard feature of the C language, so this feature is only available
|
||||
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
||||
*
|
||||
* The value of this symbol is typically a path in double quotes, either
|
||||
* absolute or relative to a directory on the include search path.
|
||||
*/
|
||||
//#define MBEDTLS_CONFIG_FILE "mbedtls/mbedtls_config.h"
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_USER_CONFIG_FILE
|
||||
*
|
||||
* If defined, this is a header which will be included after
|
||||
* `"mbedtls/mbedtls_config.h"` or #MBEDTLS_CONFIG_FILE.
|
||||
* This allows you to modify the default configuration, including the ability
|
||||
* to undefine options that are enabled by default.
|
||||
*
|
||||
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
||||
* non-standard feature of the C language, so this feature is only available
|
||||
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
||||
*
|
||||
* The value of this symbol is typically a path in double quotes, either
|
||||
* absolute or relative to a directory on the include search path.
|
||||
*/
|
||||
//#define MBEDTLS_USER_CONFIG_FILE "/dev/null"
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE
|
||||
*
|
||||
* If defined, this is a header which will be included instead of
|
||||
* `"psa/crypto_config.h"`.
|
||||
* This header file specifies which cryptographic mechanisms are available
|
||||
* through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and
|
||||
* is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled.
|
||||
*
|
||||
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
||||
* non-standard feature of the C language, so this feature is only available
|
||||
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
||||
*
|
||||
* The value of this symbol is typically a path in double quotes, either
|
||||
* absolute or relative to a directory on the include search path.
|
||||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h"
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE
|
||||
*
|
||||
* If defined, this is a header which will be included after
|
||||
* `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE.
|
||||
* This allows you to modify the default configuration, including the ability
|
||||
* to undefine options that are enabled by default.
|
||||
*
|
||||
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
||||
* non-standard feature of the C language, so this feature is only available
|
||||
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
||||
*
|
||||
* The value of this symbol is typically a path in double quotes, either
|
||||
* absolute or relative to a directory on the include search path.
|
||||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null"
|
||||
|
||||
/** \} name SECTION: General configuration options */
|
||||
|
||||
/**
|
||||
* \name SECTION: Module configuration options
|
||||
*
|
||||
* This section allows for the setting of module specific sizes and
|
||||
* configuration options. The default values are already present in the
|
||||
* relevant header files and should suffice for the regular use cases.
|
||||
*
|
||||
* Our advice is to enable options and change their values here
|
||||
* only if you have a good reason and know the consequences.
|
||||
*
|
||||
* Please check the respective header file for documentation on these
|
||||
* parameters (to prevent duplicate documentation).
|
||||
* \{
|
||||
*/
|
||||
|
||||
/* ECP options */
|
||||
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 0 /**< Disable fixed-point speed-up */
|
||||
|
||||
/**
|
||||
* Uncomment to enable p256-m. This is an alternative implementation of
|
||||
* key generation, ECDH and (randomized) ECDSA on the curve SECP256R1.
|
||||
* Compared to the default implementation:
|
||||
*
|
||||
* - p256-m has a much smaller code size and RAM footprint.
|
||||
* - p256-m is only available via the PSA API. This includes the pk module
|
||||
* when #MBEDTLS_USE_PSA_CRYPTO is enabled.
|
||||
* - p256-m does not support deterministic ECDSA, EC-JPAKE, custom protocols
|
||||
* over the core arithmetic, or deterministic derivation of keys.
|
||||
*
|
||||
* We recommend enabling this option if your application uses the PSA API
|
||||
* and the only elliptic curve support it needs is ECDH and ECDSA over
|
||||
* SECP256R1.
|
||||
*
|
||||
* If you enable this option, you do not need to enable any ECC-related
|
||||
* MBEDTLS_xxx option. You do need to separately request support for the
|
||||
* cryptographic mechanisms through the PSA API:
|
||||
* - #MBEDTLS_PSA_CRYPTO_C and #MBEDTLS_PSA_CRYPTO_CONFIG for PSA-based
|
||||
* configuration;
|
||||
* - #MBEDTLS_USE_PSA_CRYPTO if you want to use p256-m from PK, X.509 or TLS;
|
||||
* - #PSA_WANT_ECC_SECP_R1_256;
|
||||
* - #PSA_WANT_ALG_ECDH and/or #PSA_WANT_ALG_ECDSA as needed;
|
||||
* - #PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY, #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC,
|
||||
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT,
|
||||
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT and/or
|
||||
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE as needed.
|
||||
*
|
||||
* \note To benefit from the smaller code size of p256-m, make sure that you
|
||||
* do not enable any ECC-related option not supported by p256-m: this
|
||||
* would cause the built-in ECC implementation to be built as well, in
|
||||
* order to provide the required option.
|
||||
* Make sure #PSA_WANT_ALG_DETERMINISTIC_ECDSA, #PSA_WANT_ALG_JPAKE and
|
||||
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE, and curves other than
|
||||
* SECP256R1 are disabled as they are not supported by this driver.
|
||||
* Also, avoid defining #MBEDTLS_PK_PARSE_EC_COMPRESSED or
|
||||
* #MBEDTLS_PK_PARSE_EC_EXTENDED as those currently require a subset of
|
||||
* the built-in ECC implementation, see docs/driver-only-builds.md.
|
||||
*/
|
||||
#define MBEDTLS_PSA_P256M_DRIVER_ENABLED
|
||||
|
||||
/* \} name SECTION: Customisation configuration options */
|
||||
|
||||
#if CRYPTO_NV_SEED
|
||||
#include "tfm_mbedcrypto_config_extra_nv_seed.h"
|
||||
#endif /* CRYPTO_NV_SEED */
|
||||
|
||||
#if !defined(CRYPTO_HW_ACCELERATOR) && defined(MBEDTLS_ENTROPY_NV_SEED)
|
||||
#include "mbedtls_entropy_nv_seed_config.h"
|
||||
#endif
|
||||
|
||||
#ifdef CRYPTO_HW_ACCELERATOR
|
||||
#include "mbedtls_accelerator_config.h"
|
||||
#endif
|
||||
|
||||
#endif /* PROFILE_M_MBEDTLS_CONFIG_H */
|
||||
Reference in New Issue
Block a user