]> git.zerfleddert.de Git - proxmark3-svn/blame - common/mbedtls/config.h
Bugfixes for LF FDX
[proxmark3-svn] / common / mbedtls / config.h
CommitLineData
700d8687
OM
1/**
2 * \file config.h
3 *
4 * \brief Configuration options (set of defines)
5 *
6 * This set of compile-time options may be used to enable
7 * or disable features selectively, and reduce the global
8 * memory footprint.
9 */
10/*
11 * Copyright (C) 2006-2018, ARM Limited, All Rights Reserved
12 * SPDX-License-Identifier: GPL-2.0
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License along
25 * with this program; if not, write to the Free Software Foundation, Inc.,
26 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
27 *
28 * This file is part of mbed TLS (https://tls.mbed.org)
29 */
30
31#ifndef MBEDTLS_CONFIG_H
32#define MBEDTLS_CONFIG_H
33
34#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
35#define _CRT_SECURE_NO_DEPRECATE 1
36#endif
37
38/**
39 * \name SECTION: System support
40 *
41 * This section sets system specific settings.
42 * \{
43 */
44
45/**
46 * \def MBEDTLS_HAVE_ASM
47 *
48 * The compiler has support for asm().
49 *
50 * Requires support for asm() in compiler.
51 *
52 * Used in:
53 * library/aria.c
54 * library/timing.c
55 * include/mbedtls/bn_mul.h
56 *
57 * Required by:
58 * MBEDTLS_AESNI_C
59 * MBEDTLS_PADLOCK_C
60 *
61 * Comment to disable the use of assembly code.
62 */
63//#define MBEDTLS_HAVE_ASM
64
65/**
66 * \def MBEDTLS_NO_UDBL_DIVISION
67 *
68 * The platform lacks support for double-width integer division (64-bit
69 * division on a 32-bit platform, 128-bit division on a 64-bit platform).
70 *
71 * Used in:
72 * include/mbedtls/bignum.h
73 * library/bignum.c
74 *
75 * The bignum code uses double-width division to speed up some operations.
76 * Double-width division is often implemented in software that needs to
77 * be linked with the program. The presence of a double-width integer
78 * type is usually detected automatically through preprocessor macros,
79 * but the automatic detection cannot know whether the code needs to
80 * and can be linked with an implementation of division for that type.
81 * By default division is assumed to be usable if the type is present.
82 * Uncomment this option to prevent the use of double-width division.
83 *
84 * Note that division for the native integer type is always required.
85 * Furthermore, a 64-bit type is always required even on a 32-bit
86 * platform, but it need not support multiplication or division. In some
87 * cases it is also desirable to disable some double-width operations. For
88 * example, if double-width division is implemented in software, disabling
89 * it can reduce code size in some embedded targets.
90 */
91//#define MBEDTLS_NO_UDBL_DIVISION
92
93/**
94 * \def MBEDTLS_NO_64BIT_MULTIPLICATION
95 *
96 * The platform lacks support for 32x32 -> 64-bit multiplication.
97 *
98 * Used in:
99 * library/poly1305.c
100 *
101 * Some parts of the library may use multiplication of two unsigned 32-bit
102 * operands with a 64-bit result in order to speed up computations. On some
103 * platforms, this is not available in hardware and has to be implemented in
104 * software, usually in a library provided by the toolchain.
105 *
106 * Sometimes it is not desirable to have to link to that library. This option
107 * removes the dependency of that library on platforms that lack a hardware
108 * 64-bit multiplier by embedding a software implementation in Mbed TLS.
109 *
110 * Note that depending on the compiler, this may decrease performance compared
111 * to using the library function provided by the toolchain.
112 */
113//#define MBEDTLS_NO_64BIT_MULTIPLICATION
114
115/**
116 * \def MBEDTLS_HAVE_SSE2
117 *
118 * CPU supports SSE2 instruction set.
119 *
120 * Uncomment if the CPU supports SSE2 (IA-32 specific).
121 */
122//#define MBEDTLS_HAVE_SSE2
123
124/**
125 * \def MBEDTLS_HAVE_TIME
126 *
127 * System has time.h and time().
128 * The time does not need to be correct, only time differences are used,
129 * by contrast with MBEDTLS_HAVE_TIME_DATE
130 *
131 * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT,
132 * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and
133 * MBEDTLS_PLATFORM_STD_TIME.
134 *
135 * Comment if your system does not support time functions
136 */
137//#define MBEDTLS_HAVE_TIME
138
139/**
140 * \def MBEDTLS_HAVE_TIME_DATE
141 *
142 * System has time.h and time(), gmtime() and the clock is correct.
143 * The time needs to be correct (not necesarily very accurate, but at least
144 * the date should be correct). This is used to verify the validity period of
145 * X.509 certificates.
146 *
147 * Comment if your system does not have a correct clock.
148 */
149//#define MBEDTLS_HAVE_TIME_DATE
150
151/**
152 * \def MBEDTLS_PLATFORM_MEMORY
153 *
154 * Enable the memory allocation layer.
155 *
156 * By default mbed TLS uses the system-provided calloc() and free().
157 * This allows different allocators (self-implemented or provided) to be
158 * provided to the platform abstraction layer.
159 *
160 * Enabling MBEDTLS_PLATFORM_MEMORY without the
161 * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
162 * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
163 * free() function pointer at runtime.
164 *
165 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying
166 * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
167 * alternate function at compile time.
168 *
169 * Requires: MBEDTLS_PLATFORM_C
170 *
171 * Enable this layer to allow use of alternative memory allocators.
172 */
173//#define MBEDTLS_PLATFORM_MEMORY
174
175/**
176 * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
177 *
178 * Do not assign standard functions in the platform layer (e.g. calloc() to
179 * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
180 *
181 * This makes sure there are no linking errors on platforms that do not support
182 * these functions. You will HAVE to provide alternatives, either at runtime
183 * via the platform_set_xxx() functions or at compile time by setting
184 * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a
185 * MBEDTLS_PLATFORM_XXX_MACRO.
186 *
187 * Requires: MBEDTLS_PLATFORM_C
188 *
189 * Uncomment to prevent default assignment of standard functions in the
190 * platform layer.
191 */
192//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
193
194/**
195 * \def MBEDTLS_PLATFORM_EXIT_ALT
196 *
197 * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the
198 * function in the platform abstraction layer.
199 *
200 * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will
201 * provide a function "mbedtls_platform_set_printf()" that allows you to set an
202 * alternative printf function pointer.
203 *
204 * All these define require MBEDTLS_PLATFORM_C to be defined!
205 *
206 * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows;
207 * it will be enabled automatically by check_config.h
208 *
209 * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as
210 * MBEDTLS_PLATFORM_XXX_MACRO!
211 *
212 * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME
213 *
214 * Uncomment a macro to enable alternate implementation of specific base
215 * platform function
216 */
217//#define MBEDTLS_PLATFORM_EXIT_ALT
218//#define MBEDTLS_PLATFORM_TIME_ALT
219//#define MBEDTLS_PLATFORM_FPRINTF_ALT
220//#define MBEDTLS_PLATFORM_PRINTF_ALT
221//#define MBEDTLS_PLATFORM_SNPRINTF_ALT
222//#define MBEDTLS_PLATFORM_NV_SEED_ALT
223//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
224
225/**
226 * \def MBEDTLS_DEPRECATED_WARNING
227 *
228 * Mark deprecated functions so that they generate a warning if used.
229 * Functions deprecated in one version will usually be removed in the next
230 * version. You can enable this to help you prepare the transition to a new
231 * major version by making sure your code is not using these functions.
232 *
233 * This only works with GCC and Clang. With other compilers, you may want to
234 * use MBEDTLS_DEPRECATED_REMOVED
235 *
236 * Uncomment to get warnings on using deprecated functions.
237 */
238//#define MBEDTLS_DEPRECATED_WARNING
239
240/**
241 * \def MBEDTLS_DEPRECATED_REMOVED
242 *
243 * Remove deprecated functions so that they generate an error if used.
244 * Functions deprecated in one version will usually be removed in the next
245 * version. You can enable this to help you prepare the transition to a new
246 * major version by making sure your code is not using these functions.
247 *
248 * Uncomment to get errors on using deprecated functions.
249 */
250//#define MBEDTLS_DEPRECATED_REMOVED
251
252/* \} name SECTION: System support */
253
254/**
255 * \name SECTION: mbed TLS feature support
256 *
257 * This section sets support for features that are or are not needed
258 * within the modules that are enabled.
259 * \{
260 */
261
262/**
263 * \def MBEDTLS_TIMING_ALT
264 *
265 * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(),
266 * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay()
267 *
268 * Only works if you have MBEDTLS_TIMING_C enabled.
269 *
270 * You will need to provide a header "timing_alt.h" and an implementation at
271 * compile time.
272 */
273//#define MBEDTLS_TIMING_ALT
274
275/**
276 * \def MBEDTLS_AES_ALT
277 *
278 * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your
279 * alternate core implementation of a symmetric crypto, an arithmetic or hash
280 * module (e.g. platform specific assembly optimized implementations). Keep
281 * in mind that the function prototypes should remain the same.
282 *
283 * This replaces the whole module. If you only want to replace one of the
284 * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags.
285 *
286 * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer
287 * provide the "struct mbedtls_aes_context" definition and omit the base
288 * function declarations and implementations. "aes_alt.h" will be included from
289 * "aes.h" to include the new function definitions.
290 *
291 * Uncomment a macro to enable alternate implementation of the corresponding
292 * module.
293 *
294 * \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their
295 * use constitutes a security risk. If possible, we recommend
296 * avoiding dependencies on them, and considering stronger message
297 * digests and ciphers instead.
298 *
299 */
300//#define MBEDTLS_AES_ALT
301//#define MBEDTLS_ARC4_ALT
302//#define MBEDTLS_ARIA_ALT
303//#define MBEDTLS_BLOWFISH_ALT
304//#define MBEDTLS_CAMELLIA_ALT
305//#define MBEDTLS_CCM_ALT
306//#define MBEDTLS_CHACHA20_ALT
307//#define MBEDTLS_CHACHAPOLY_ALT
308//#define MBEDTLS_CMAC_ALT
309//#define MBEDTLS_DES_ALT
310//#define MBEDTLS_DHM_ALT
311//#define MBEDTLS_ECJPAKE_ALT
312//#define MBEDTLS_GCM_ALT
313//#define MBEDTLS_NIST_KW_ALT
314//#define MBEDTLS_MD2_ALT
315//#define MBEDTLS_MD4_ALT
316//#define MBEDTLS_MD5_ALT
317//#define MBEDTLS_POLY1305_ALT
318//#define MBEDTLS_RIPEMD160_ALT
319//#define MBEDTLS_RSA_ALT
320//#define MBEDTLS_SHA1_ALT
321//#define MBEDTLS_SHA256_ALT
322//#define MBEDTLS_SHA512_ALT
323//#define MBEDTLS_XTEA_ALT
324
325/*
326 * When replacing the elliptic curve module, pleace consider, that it is
327 * implemented with two .c files:
328 * - ecp.c
329 * - ecp_curves.c
330 * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT
331 * macros as described above. The only difference is that you have to make sure
332 * that you provide functionality for both .c files.
333 */
334//#define MBEDTLS_ECP_ALT
335
336/**
337 * \def MBEDTLS_MD2_PROCESS_ALT
338 *
339 * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you
340 * alternate core implementation of symmetric crypto or hash function. Keep in
341 * mind that function prototypes should remain the same.
342 *
343 * This replaces only one function. The header file from mbed TLS is still
344 * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
345 *
346 * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will
347 * no longer provide the mbedtls_sha1_process() function, but it will still provide
348 * the other function (using your mbedtls_sha1_process() function) and the definition
349 * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible
350 * with this definition.
351 *
352 * \note Because of a signature change, the core AES encryption and decryption routines are
353 * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt,
354 * respectively. When setting up alternative implementations, these functions should
355 * be overriden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
356 * must stay untouched.
357 *
358 * \note If you use the AES_xxx_ALT macros, then is is recommended to also set
359 * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES
360 * tables.
361 *
362 * Uncomment a macro to enable alternate implementation of the corresponding
363 * function.
364 *
365 * \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use
366 * constitutes a security risk. If possible, we recommend avoiding
367 * dependencies on them, and considering stronger message digests
368 * and ciphers instead.
369 *
370 */
371//#define MBEDTLS_MD2_PROCESS_ALT
372//#define MBEDTLS_MD4_PROCESS_ALT
373//#define MBEDTLS_MD5_PROCESS_ALT
374//#define MBEDTLS_RIPEMD160_PROCESS_ALT
375//#define MBEDTLS_SHA1_PROCESS_ALT
376//#define MBEDTLS_SHA256_PROCESS_ALT
377//#define MBEDTLS_SHA512_PROCESS_ALT
378//#define MBEDTLS_DES_SETKEY_ALT
379//#define MBEDTLS_DES_CRYPT_ECB_ALT
380//#define MBEDTLS_DES3_CRYPT_ECB_ALT
381//#define MBEDTLS_AES_SETKEY_ENC_ALT
382//#define MBEDTLS_AES_SETKEY_DEC_ALT
383//#define MBEDTLS_AES_ENCRYPT_ALT
384//#define MBEDTLS_AES_DECRYPT_ALT
385//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT
386//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT
387//#define MBEDTLS_ECDSA_VERIFY_ALT
388//#define MBEDTLS_ECDSA_SIGN_ALT
389//#define MBEDTLS_ECDSA_GENKEY_ALT
390
391/**
392 * \def MBEDTLS_ECP_INTERNAL_ALT
393 *
394 * Expose a part of the internal interface of the Elliptic Curve Point module.
395 *
396 * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your
397 * alternative core implementation of elliptic curve arithmetic. Keep in mind
398 * that function prototypes should remain the same.
399 *
400 * This partially replaces one function. The header file from mbed TLS is still
401 * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation
402 * is still present and it is used for group structures not supported by the
403 * alternative.
404 *
405 * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT
406 * and implementing the following functions:
407 * unsigned char mbedtls_internal_ecp_grp_capable(
408 * const mbedtls_ecp_group *grp )
409 * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp )
410 * void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp )
411 * The mbedtls_internal_ecp_grp_capable function should return 1 if the
412 * replacement functions implement arithmetic for the given group and 0
413 * otherwise.
414 * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are
415 * called before and after each point operation and provide an opportunity to
416 * implement optimized set up and tear down instructions.
417 *
418 * Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and
419 * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac
420 * function, but will use your mbedtls_internal_ecp_double_jac if the group is
421 * supported (your mbedtls_internal_ecp_grp_capable function returns 1 when
422 * receives it as an argument). If the group is not supported then the original
423 * implementation is used. The other functions and the definition of
424 * mbedtls_ecp_group and mbedtls_ecp_point will not change, so your
425 * implementation of mbedtls_internal_ecp_double_jac and
426 * mbedtls_internal_ecp_grp_capable must be compatible with this definition.
427 *
428 * Uncomment a macro to enable alternate implementation of the corresponding
429 * function.
430 */
431/* Required for all the functions in this section */
432//#define MBEDTLS_ECP_INTERNAL_ALT
433/* Support for Weierstrass curves with Jacobi representation */
434//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT
435//#define MBEDTLS_ECP_ADD_MIXED_ALT
436//#define MBEDTLS_ECP_DOUBLE_JAC_ALT
437//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT
438//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT
439/* Support for curves with Montgomery arithmetic */
440//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT
441//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT
442//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT
443
444/**
445 * \def MBEDTLS_TEST_NULL_ENTROPY
446 *
447 * Enables testing and use of mbed TLS without any configured entropy sources.
448 * This permits use of the library on platforms before an entropy source has
449 * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the
450 * MBEDTLS_ENTROPY_NV_SEED switches).
451 *
452 * WARNING! This switch MUST be disabled in production builds, and is suitable
453 * only for development.
454 * Enabling the switch negates any security provided by the library.
455 *
456 * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
457 *
458 */
459//#define MBEDTLS_TEST_NULL_ENTROPY
460
461/**
462 * \def MBEDTLS_ENTROPY_HARDWARE_ALT
463 *
464 * Uncomment this macro to let mbed TLS use your own implementation of a
465 * hardware entropy collector.
466 *
467 * Your function must be called \c mbedtls_hardware_poll(), have the same
468 * prototype as declared in entropy_poll.h, and accept NULL as first argument.
469 *
470 * Uncomment to use your own hardware entropy collector.
471 */
472//#define MBEDTLS_ENTROPY_HARDWARE_ALT
473
474/**
475 * \def MBEDTLS_AES_ROM_TABLES
476 *
477 * Use precomputed AES tables stored in ROM.
478 *
479 * Uncomment this macro to use precomputed AES tables stored in ROM.
480 * Comment this macro to generate AES tables in RAM at runtime.
481 *
482 * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb
483 * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the
484 * initialization time before the first AES operation can be performed.
485 * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c
486 * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded
487 * performance if ROM access is slower than RAM access.
488 *
489 * This option is independent of \c MBEDTLS_AES_FEWER_TABLES.
490 *
491 */
492//#define MBEDTLS_AES_ROM_TABLES
493
494/**
495 * \def MBEDTLS_AES_FEWER_TABLES
496 *
497 * Use less ROM/RAM for AES tables.
498 *
499 * Uncommenting this macro omits 75% of the AES tables from
500 * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES)
501 * by computing their values on the fly during operations
502 * (the tables are entry-wise rotations of one another).
503 *
504 * Tradeoff: Uncommenting this reduces the RAM / ROM footprint
505 * by ~6kb but at the cost of more arithmetic operations during
506 * runtime. Specifically, one has to compare 4 accesses within
507 * different tables to 4 accesses with additional arithmetic
508 * operations within the same table. The performance gain/loss
509 * depends on the system and memory details.
510 *
511 * This option is independent of \c MBEDTLS_AES_ROM_TABLES.
512 *
513 */
514//#define MBEDTLS_AES_FEWER_TABLES
515
516/**
517 * \def MBEDTLS_CAMELLIA_SMALL_MEMORY
518 *
519 * Use less ROM for the Camellia implementation (saves about 768 bytes).
520 *
521 * Uncomment this macro to use less memory for Camellia.
522 */
523//#define MBEDTLS_CAMELLIA_SMALL_MEMORY
524
525/**
526 * \def MBEDTLS_CIPHER_MODE_CBC
527 *
528 * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
529 */
530#define MBEDTLS_CIPHER_MODE_CBC
531
532/**
533 * \def MBEDTLS_CIPHER_MODE_CFB
534 *
535 * Enable Cipher Feedback mode (CFB) for symmetric ciphers.
536 */
537#define MBEDTLS_CIPHER_MODE_CFB
538
539/**
540 * \def MBEDTLS_CIPHER_MODE_CTR
541 *
542 * Enable Counter Block Cipher mode (CTR) for symmetric ciphers.
543 */
544#define MBEDTLS_CIPHER_MODE_CTR
545
546/**
547 * \def MBEDTLS_CIPHER_MODE_OFB
548 *
549 * Enable Output Feedback mode (OFB) for symmetric ciphers.
550 */
551#define MBEDTLS_CIPHER_MODE_OFB
552
553/**
554 * \def MBEDTLS_CIPHER_MODE_XTS
555 *
556 * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES.
557 */
558#define MBEDTLS_CIPHER_MODE_XTS
559
560/**
561 * \def MBEDTLS_CIPHER_NULL_CIPHER
562 *
563 * Enable NULL cipher.
564 * Warning: Only do so when you know what you are doing. This allows for
565 * encryption or channels without any security!
566 *
567 * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable
568 * the following ciphersuites:
569 * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA
570 * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA
571 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA
572 * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA
573 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384
574 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256
575 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA
576 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384
577 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256
578 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA
579 * MBEDTLS_TLS_RSA_WITH_NULL_SHA256
580 * MBEDTLS_TLS_RSA_WITH_NULL_SHA
581 * MBEDTLS_TLS_RSA_WITH_NULL_MD5
582 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384
583 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256
584 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA
585 * MBEDTLS_TLS_PSK_WITH_NULL_SHA384
586 * MBEDTLS_TLS_PSK_WITH_NULL_SHA256
587 * MBEDTLS_TLS_PSK_WITH_NULL_SHA
588 *
589 * Uncomment this macro to enable the NULL cipher and ciphersuites
590 */
591//#define MBEDTLS_CIPHER_NULL_CIPHER
592
593/**
594 * \def MBEDTLS_CIPHER_PADDING_PKCS7
595 *
596 * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for
597 * specific padding modes in the cipher layer with cipher modes that support
598 * padding (e.g. CBC)
599 *
600 * If you disable all padding modes, only full blocks can be used with CBC.
601 *
602 * Enable padding modes in the cipher layer.
603 */
604#define MBEDTLS_CIPHER_PADDING_PKCS7
605#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
606#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
607#define MBEDTLS_CIPHER_PADDING_ZEROS
608
609/**
610 * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES
611 *
612 * Enable weak ciphersuites in SSL / TLS.
613 * Warning: Only do so when you know what you are doing. This allows for
614 * channels with virtually no security at all!
615 *
616 * This enables the following ciphersuites:
617 * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA
618 * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA
619 *
620 * Uncomment this macro to enable weak ciphersuites
621 *
622 * \warning DES is considered a weak cipher and its use constitutes a
623 * security risk. We recommend considering stronger ciphers instead.
624 */
625//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES
626
627/**
628 * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES
629 *
630 * Remove RC4 ciphersuites by default in SSL / TLS.
631 * This flag removes the ciphersuites based on RC4 from the default list as
632 * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to
633 * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them
634 * explicitly.
635 *
636 * Uncomment this macro to remove RC4 ciphersuites by default.
637 */
638#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
639
640/**
641 * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED
642 *
643 * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve
644 * module. By default all supported curves are enabled.
645 *
646 * Comment macros to disable the curve and functions for it
647 */
648#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
649#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
650#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
651#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
652#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
653#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
654#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
655#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
656#define MBEDTLS_ECP_DP_BP256R1_ENABLED
657#define MBEDTLS_ECP_DP_BP384R1_ENABLED
658#define MBEDTLS_ECP_DP_BP512R1_ENABLED
659#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
660#define MBEDTLS_ECP_DP_CURVE448_ENABLED
661
662/**
663 * \def MBEDTLS_ECP_NIST_OPTIM
664 *
665 * Enable specific 'modulo p' routines for each NIST prime.
666 * Depending on the prime and architecture, makes operations 4 to 8 times
667 * faster on the corresponding curve.
668 *
669 * Comment this macro to disable NIST curves optimisation.
670 */
671#define MBEDTLS_ECP_NIST_OPTIM
672
673/**
674 * \def MBEDTLS_ECDSA_DETERMINISTIC
675 *
676 * Enable deterministic ECDSA (RFC 6979).
677 * Standard ECDSA is "fragile" in the sense that lack of entropy when signing
678 * may result in a compromise of the long-term signing key. This is avoided by
679 * the deterministic variant.
680 *
681 * Requires: MBEDTLS_HMAC_DRBG_C
682 *
683 * Comment this macro to disable deterministic ECDSA.
684 */
685//#define MBEDTLS_ECDSA_DETERMINISTIC
686
687/**
688 * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
689 *
690 * Enable the PSK based ciphersuite modes in SSL / TLS.
691 *
692 * This enables the following ciphersuites (if other requisites are
693 * enabled as well):
694 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
695 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
696 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
697 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
698 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
699 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
700 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
701 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
702 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
703 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
704 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
705 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
706 */
707#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
708
709/**
710 * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
711 *
712 * Enable the DHE-PSK based ciphersuite modes in SSL / TLS.
713 *
714 * Requires: MBEDTLS_DHM_C
715 *
716 * This enables the following ciphersuites (if other requisites are
717 * enabled as well):
718 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
719 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
720 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
721 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
722 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
723 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
724 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
725 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
726 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
727 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
728 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
729 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
730 *
731 * \warning Using DHE constitutes a security risk as it
732 * is not possible to validate custom DH parameters.
733 * If possible, it is recommended users should consider
734 * preferring other methods of key exchange.
735 * See dhm.h for more details.
736 *
737 */
738//#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
739
740/**
741 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
742 *
743 * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.
744 *
745 * Requires: MBEDTLS_ECDH_C
746 *
747 * This enables the following ciphersuites (if other requisites are
748 * enabled as well):
749 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
750 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
751 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
752 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
753 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
754 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
755 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
756 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
757 */
758#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
759
760/**
761 * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
762 *
763 * Enable the RSA-PSK based ciphersuite modes in SSL / TLS.
764 *
765 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
766 * MBEDTLS_X509_CRT_PARSE_C
767 *
768 * This enables the following ciphersuites (if other requisites are
769 * enabled as well):
770 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
771 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
772 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
773 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
774 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
775 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
776 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
777 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
778 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
779 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
780 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
781 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
782 */
783#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
784
785/**
786 * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
787 *
788 * Enable the RSA-only based ciphersuite modes in SSL / TLS.
789 *
790 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
791 * MBEDTLS_X509_CRT_PARSE_C
792 *
793 * This enables the following ciphersuites (if other requisites are
794 * enabled as well):
795 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
796 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
797 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
798 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
799 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
800 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
801 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
802 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
803 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
804 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
805 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
806 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
807 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
808 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
809 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
810 */
811#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
812
813/**
814 * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
815 *
816 * Enable the DHE-RSA based ciphersuite modes in SSL / TLS.
817 *
818 * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
819 * MBEDTLS_X509_CRT_PARSE_C
820 *
821 * This enables the following ciphersuites (if other requisites are
822 * enabled as well):
823 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
824 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
825 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
826 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
827 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
828 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
829 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
830 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
831 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
832 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
833 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
834 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
835 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
836 *
837 * \warning Using DHE constitutes a security risk as it
838 * is not possible to validate custom DH parameters.
839 * If possible, it is recommended users should consider
840 * preferring other methods of key exchange.
841 * See dhm.h for more details.
842 *
843 */
844//#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
845
846/**
847 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
848 *
849 * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.
850 *
851 * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
852 * MBEDTLS_X509_CRT_PARSE_C
853 *
854 * This enables the following ciphersuites (if other requisites are
855 * enabled as well):
856 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
857 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
858 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
859 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
860 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
861 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
862 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
863 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
864 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
865 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
866 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
867 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
868 */
869#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
870
871/**
872 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
873 *
874 * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.
875 *
876 * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C,
877 *
878 * This enables the following ciphersuites (if other requisites are
879 * enabled as well):
880 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
881 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
882 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
883 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
884 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
885 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
886 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
887 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
888 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
889 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
890 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
891 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
892 */
893#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
894
895/**
896 * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
897 *
898 * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
899 *
900 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
901 *
902 * This enables the following ciphersuites (if other requisites are
903 * enabled as well):
904 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
905 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
906 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
907 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
908 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
909 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
910 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
911 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
912 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
913 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
914 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
915 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
916 */
917#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
918
919/**
920 * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
921 *
922 * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
923 *
924 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
925 *
926 * This enables the following ciphersuites (if other requisites are
927 * enabled as well):
928 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
929 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
930 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
931 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
932 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
933 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
934 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
935 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
936 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
937 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
938 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
939 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
940 */
941#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
942
943/**
944 * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
945 *
946 * Enable the ECJPAKE based ciphersuite modes in SSL / TLS.
947 *
948 * \warning This is currently experimental. EC J-PAKE support is based on the
949 * Thread v1.0.0 specification; incompatible changes to the specification
950 * might still happen. For this reason, this is disabled by default.
951 *
952 * Requires: MBEDTLS_ECJPAKE_C
953 * MBEDTLS_SHA256_C
954 * MBEDTLS_ECP_DP_SECP256R1_ENABLED
955 *
956 * This enables the following ciphersuites (if other requisites are
957 * enabled as well):
958 * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
959 */
960//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
961
962/**
963 * \def MBEDTLS_PK_PARSE_EC_EXTENDED
964 *
965 * Enhance support for reading EC keys using variants of SEC1 not allowed by
966 * RFC 5915 and RFC 5480.
967 *
968 * Currently this means parsing the SpecifiedECDomain choice of EC
969 * parameters (only known groups are supported, not arbitrary domains, to
970 * avoid validation issues).
971 *
972 * Disable if you only need to support RFC 5915 + 5480 key formats.
973 */
974#define MBEDTLS_PK_PARSE_EC_EXTENDED
975
976/**
977 * \def MBEDTLS_ERROR_STRERROR_DUMMY
978 *
979 * Enable a dummy error function to make use of mbedtls_strerror() in
980 * third party libraries easier when MBEDTLS_ERROR_C is disabled
981 * (no effect when MBEDTLS_ERROR_C is enabled).
982 *
983 * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're
984 * not using mbedtls_strerror() or error_strerror() in your application.
985 *
986 * Disable if you run into name conflicts and want to really remove the
987 * mbedtls_strerror()
988 */
989#define MBEDTLS_ERROR_STRERROR_DUMMY
990
991/**
992 * \def MBEDTLS_GENPRIME
993 *
994 * Enable the prime-number generation code.
995 *
996 * Requires: MBEDTLS_BIGNUM_C
997 */
998#define MBEDTLS_GENPRIME
999
1000/**
1001 * \def MBEDTLS_FS_IO
1002 *
1003 * Enable functions that use the filesystem.
1004 */
1005#define MBEDTLS_FS_IO
1006
1007/**
1008 * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
1009 *
1010 * Do not add default entropy sources. These are the platform specific,
1011 * mbedtls_timing_hardclock and HAVEGE based poll functions.
1012 *
1013 * This is useful to have more control over the added entropy sources in an
1014 * application.
1015 *
1016 * Uncomment this macro to prevent loading of default entropy functions.
1017 */
1018//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
1019
1020/**
1021 * \def MBEDTLS_NO_PLATFORM_ENTROPY
1022 *
1023 * Do not use built-in platform entropy functions.
1024 * This is useful if your platform does not support
1025 * standards like the /dev/urandom or Windows CryptoAPI.
1026 *
1027 * Uncomment this macro to disable the built-in platform entropy functions.
1028 */
1029//#define MBEDTLS_NO_PLATFORM_ENTROPY
1030
1031/**
1032 * \def MBEDTLS_ENTROPY_FORCE_SHA256
1033 *
1034 * Force the entropy accumulator to use a SHA-256 accumulator instead of the
1035 * default SHA-512 based one (if both are available).
1036 *
1037 * Requires: MBEDTLS_SHA256_C
1038 *
1039 * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
1040 * if you have performance concerns.
1041 *
1042 * This option is only useful if both MBEDTLS_SHA256_C and
1043 * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
1044 */
1045//#define MBEDTLS_ENTROPY_FORCE_SHA256
1046
1047/**
1048 * \def MBEDTLS_ENTROPY_NV_SEED
1049 *
1050 * Enable the non-volatile (NV) seed file-based entropy source.
1051 * (Also enables the NV seed read/write functions in the platform layer)
1052 *
1053 * This is crucial (if not required) on systems that do not have a
1054 * cryptographic entropy source (in hardware or kernel) available.
1055 *
1056 * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
1057 *
1058 * \note The read/write functions that are used by the entropy source are
1059 * determined in the platform layer, and can be modified at runtime and/or
1060 * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
1061 *
1062 * \note If you use the default implementation functions that read a seedfile
1063 * with regular fopen(), please make sure you make a seedfile with the
1064 * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
1065 * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
1066 * and written to or you will get an entropy source error! The default
1067 * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
1068 * bytes from the file.
1069 *
1070 * \note The entropy collector will write to the seed file before entropy is
1071 * given to an external source, to update it.
1072 */
1073//#define MBEDTLS_ENTROPY_NV_SEED
1074
1075/**
1076 * \def MBEDTLS_MEMORY_DEBUG
1077 *
1078 * Enable debugging of buffer allocator memory issues. Automatically prints
1079 * (to stderr) all (fatal) messages on memory allocation issues. Enables
1080 * function for 'debug output' of allocated memory.
1081 *
1082 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
1083 *
1084 * Uncomment this macro to let the buffer allocator print out error messages.
1085 */
1086//#define MBEDTLS_MEMORY_DEBUG
1087
1088/**
1089 * \def MBEDTLS_MEMORY_BACKTRACE
1090 *
1091 * Include backtrace information with each allocated block.
1092 *
1093 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
1094 * GLIBC-compatible backtrace() an backtrace_symbols() support
1095 *
1096 * Uncomment this macro to include backtrace information
1097 */
1098//#define MBEDTLS_MEMORY_BACKTRACE
1099
1100/**
1101 * \def MBEDTLS_PK_RSA_ALT_SUPPORT
1102 *
1103 * Support external private RSA keys (eg from a HSM) in the PK layer.
1104 *
1105 * Comment this macro to disable support for external private RSA keys.
1106 */
1107#define MBEDTLS_PK_RSA_ALT_SUPPORT
1108
1109/**
1110 * \def MBEDTLS_PKCS1_V15
1111 *
1112 * Enable support for PKCS#1 v1.5 encoding.
1113 *
1114 * Requires: MBEDTLS_RSA_C
1115 *
1116 * This enables support for PKCS#1 v1.5 operations.
1117 */
1118#define MBEDTLS_PKCS1_V15
1119
1120/**
1121 * \def MBEDTLS_PKCS1_V21
1122 *
1123 * Enable support for PKCS#1 v2.1 encoding.
1124 *
1125 * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C
1126 *
1127 * This enables support for RSAES-OAEP and RSASSA-PSS operations.
1128 */
1129#define MBEDTLS_PKCS1_V21
1130
1131/**
1132 * \def MBEDTLS_RSA_NO_CRT
1133 *
1134 * Do not use the Chinese Remainder Theorem
1135 * for the RSA private operation.
1136 *
1137 * Uncomment this macro to disable the use of CRT in RSA.
1138 *
1139 */
1140//#define MBEDTLS_RSA_NO_CRT
1141
1142/**
1143 * \def MBEDTLS_SELF_TEST
1144 *
1145 * Enable the checkup functions (*_self_test).
1146 */
1147#define MBEDTLS_SELF_TEST
1148
1149/**
1150 * \def MBEDTLS_SHA256_SMALLER
1151 *
1152 * Enable an implementation of SHA-256 that has lower ROM footprint but also
1153 * lower performance.
1154 *
1155 * The default implementation is meant to be a reasonnable compromise between
1156 * performance and size. This version optimizes more aggressively for size at
1157 * the expense of performance. Eg on Cortex-M4 it reduces the size of
1158 * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about
1159 * 30%.
1160 *
1161 * Uncomment to enable the smaller implementation of SHA256.
1162 */
1163//#define MBEDTLS_SHA256_SMALLER
1164
1165/**
1166 * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
1167 *
1168 * Enable sending of alert messages in case of encountered errors as per RFC.
1169 * If you choose not to send the alert messages, mbed TLS can still communicate
1170 * with other servers, only debugging of failures is harder.
1171 *
1172 * The advantage of not sending alert messages, is that no information is given
1173 * about reasons for failures thus preventing adversaries of gaining intel.
1174 *
1175 * Enable sending of all alert messages
1176 */
1177#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
1178
1179/**
1180 * \def MBEDTLS_SSL_ASYNC_PRIVATE
1181 *
1182 * Enable asynchronous external private key operations in SSL. This allows
1183 * you to configure an SSL connection to call an external cryptographic
1184 * module to perform private key operations instead of performing the
1185 * operation inside the library.
1186 *
1187 */
1188//#define MBEDTLS_SSL_ASYNC_PRIVATE
1189
1190/**
1191 * \def MBEDTLS_SSL_DEBUG_ALL
1192 *
1193 * Enable the debug messages in SSL module for all issues.
1194 * Debug messages have been disabled in some places to prevent timing
1195 * attacks due to (unbalanced) debugging function calls.
1196 *
1197 * If you need all error reporting you should enable this during debugging,
1198 * but remove this for production servers that should log as well.
1199 *
1200 * Uncomment this macro to report all debug messages on errors introducing
1201 * a timing side-channel.
1202 *
1203 */
1204//#define MBEDTLS_SSL_DEBUG_ALL
1205
1206/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC
1207 *
1208 * Enable support for Encrypt-then-MAC, RFC 7366.
1209 *
1210 * This allows peers that both support it to use a more robust protection for
1211 * ciphersuites using CBC, providing deep resistance against timing attacks
1212 * on the padding or underlying cipher.
1213 *
1214 * This only affects CBC ciphersuites, and is useless if none is defined.
1215 *
1216 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
1217 * MBEDTLS_SSL_PROTO_TLS1_1 or
1218 * MBEDTLS_SSL_PROTO_TLS1_2
1219 *
1220 * Comment this macro to disable support for Encrypt-then-MAC
1221 */
1222#define MBEDTLS_SSL_ENCRYPT_THEN_MAC
1223
1224/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET
1225 *
1226 * Enable support for Extended Master Secret, aka Session Hash
1227 * (draft-ietf-tls-session-hash-02).
1228 *
1229 * This was introduced as "the proper fix" to the Triple Handshake familiy of
1230 * attacks, but it is recommended to always use it (even if you disable
1231 * renegotiation), since it actually fixes a more fundamental issue in the
1232 * original SSL/TLS design, and has implications beyond Triple Handshake.
1233 *
1234 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
1235 * MBEDTLS_SSL_PROTO_TLS1_1 or
1236 * MBEDTLS_SSL_PROTO_TLS1_2
1237 *
1238 * Comment this macro to disable support for Extended Master Secret.
1239 */
1240#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
1241
1242/**
1243 * \def MBEDTLS_SSL_FALLBACK_SCSV
1244 *
1245 * Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00).
1246 *
1247 * For servers, it is recommended to always enable this, unless you support
1248 * only one version of TLS, or know for sure that none of your clients
1249 * implements a fallback strategy.
1250 *
1251 * For clients, you only need this if you're using a fallback strategy, which
1252 * is not recommended in the first place, unless you absolutely need it to
1253 * interoperate with buggy (version-intolerant) servers.
1254 *
1255 * Comment this macro to disable support for FALLBACK_SCSV
1256 */
1257#define MBEDTLS_SSL_FALLBACK_SCSV
1258
1259/**
1260 * \def MBEDTLS_SSL_HW_RECORD_ACCEL
1261 *
1262 * Enable hooking functions in SSL module for hardware acceleration of
1263 * individual records.
1264 *
1265 * Uncomment this macro to enable hooking functions.
1266 */
1267//#define MBEDTLS_SSL_HW_RECORD_ACCEL
1268
1269/**
1270 * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING
1271 *
1272 * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
1273 *
1274 * This is a countermeasure to the BEAST attack, which also minimizes the risk
1275 * of interoperability issues compared to sending 0-length records.
1276 *
1277 * Comment this macro to disable 1/n-1 record splitting.
1278 */
1279#define MBEDTLS_SSL_CBC_RECORD_SPLITTING
1280
1281/**
1282 * \def MBEDTLS_SSL_RENEGOTIATION
1283 *
1284 * Disable support for TLS renegotiation.
1285 *
1286 * The two main uses of renegotiation are (1) refresh keys on long-lived
1287 * connections and (2) client authentication after the initial handshake.
1288 * If you don't need renegotiation, it's probably better to disable it, since
1289 * it has been associated with security issues in the past and is easy to
1290 * misuse/misunderstand.
1291 *
1292 * Comment this to disable support for renegotiation.
1293 *
1294 * \note Even if this option is disabled, both client and server are aware
1295 * of the Renegotiation Indication Extension (RFC 5746) used to
1296 * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1).
1297 * (See \c mbedtls_ssl_conf_legacy_renegotiation for the
1298 * configuration of this extension).
1299 *
1300 */
1301#define MBEDTLS_SSL_RENEGOTIATION
1302
1303/**
1304 * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
1305 *
1306 * Enable support for receiving and parsing SSLv2 Client Hello messages for the
1307 * SSL Server module (MBEDTLS_SSL_SRV_C).
1308 *
1309 * Uncomment this macro to enable support for SSLv2 Client Hello messages.
1310 */
1311//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
1312
1313/**
1314 * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
1315 *
1316 * Pick the ciphersuite according to the client's preferences rather than ours
1317 * in the SSL Server module (MBEDTLS_SSL_SRV_C).
1318 *
1319 * Uncomment this macro to respect client's ciphersuite order
1320 */
1321//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
1322
1323/**
1324 * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
1325 *
1326 * Enable support for RFC 6066 max_fragment_length extension in SSL.
1327 *
1328 * Comment this macro to disable support for the max_fragment_length extension
1329 */
1330#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
1331
1332/**
1333 * \def MBEDTLS_SSL_PROTO_SSL3
1334 *
1335 * Enable support for SSL 3.0.
1336 *
1337 * Requires: MBEDTLS_MD5_C
1338 * MBEDTLS_SHA1_C
1339 *
1340 * Comment this macro to disable support for SSL 3.0
1341 */
1342//#define MBEDTLS_SSL_PROTO_SSL3
1343
1344/**
1345 * \def MBEDTLS_SSL_PROTO_TLS1
1346 *
1347 * Enable support for TLS 1.0.
1348 *
1349 * Requires: MBEDTLS_MD5_C
1350 * MBEDTLS_SHA1_C
1351 *
1352 * Comment this macro to disable support for TLS 1.0
1353 */
1354#define MBEDTLS_SSL_PROTO_TLS1
1355
1356/**
1357 * \def MBEDTLS_SSL_PROTO_TLS1_1
1358 *
1359 * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).
1360 *
1361 * Requires: MBEDTLS_MD5_C
1362 * MBEDTLS_SHA1_C
1363 *
1364 * Comment this macro to disable support for TLS 1.1 / DTLS 1.0
1365 */
1366#define MBEDTLS_SSL_PROTO_TLS1_1
1367
1368/**
1369 * \def MBEDTLS_SSL_PROTO_TLS1_2
1370 *
1371 * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
1372 *
1373 * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C
1374 * (Depends on ciphersuites)
1375 *
1376 * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
1377 */
1378#define MBEDTLS_SSL_PROTO_TLS1_2
1379
1380/**
1381 * \def MBEDTLS_SSL_PROTO_DTLS
1382 *
1383 * Enable support for DTLS (all available versions).
1384 *
1385 * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0,
1386 * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
1387 *
1388 * Requires: MBEDTLS_SSL_PROTO_TLS1_1
1389 * or MBEDTLS_SSL_PROTO_TLS1_2
1390 *
1391 * Comment this macro to disable support for DTLS
1392 */
1393#define MBEDTLS_SSL_PROTO_DTLS
1394
1395/**
1396 * \def MBEDTLS_SSL_ALPN
1397 *
1398 * Enable support for RFC 7301 Application Layer Protocol Negotiation.
1399 *
1400 * Comment this macro to disable support for ALPN.
1401 */
1402#define MBEDTLS_SSL_ALPN
1403
1404/**
1405 * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY
1406 *
1407 * Enable support for the anti-replay mechanism in DTLS.
1408 *
1409 * Requires: MBEDTLS_SSL_TLS_C
1410 * MBEDTLS_SSL_PROTO_DTLS
1411 *
1412 * \warning Disabling this is often a security risk!
1413 * See mbedtls_ssl_conf_dtls_anti_replay() for details.
1414 *
1415 * Comment this to disable anti-replay in DTLS.
1416 */
1417//#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
1418
1419/**
1420 * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY
1421 *
1422 * Enable support for HelloVerifyRequest on DTLS servers.
1423 *
1424 * This feature is highly recommended to prevent DTLS servers being used as
1425 * amplifiers in DoS attacks against other hosts. It should always be enabled
1426 * unless you know for sure amplification cannot be a problem in the
1427 * environment in which your server operates.
1428 *
1429 * \warning Disabling this can ba a security risk! (see above)
1430 *
1431 * Requires: MBEDTLS_SSL_PROTO_DTLS
1432 *
1433 * Comment this to disable support for HelloVerifyRequest.
1434 */
1435#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
1436
1437/**
1438 * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
1439 *
1440 * Enable server-side support for clients that reconnect from the same port.
1441 *
1442 * Some clients unexpectedly close the connection and try to reconnect using the
1443 * same source port. This needs special support from the server to handle the
1444 * new connection securely, as described in section 4.2.8 of RFC 6347. This
1445 * flag enables that support.
1446 *
1447 * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY
1448 *
1449 * Comment this to disable support for clients reusing the source port.
1450 */
1451#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
1452
1453/**
1454 * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT
1455 *
1456 * Enable support for a limit of records with bad MAC.
1457 *
1458 * See mbedtls_ssl_conf_dtls_badmac_limit().
1459 *
1460 * Requires: MBEDTLS_SSL_PROTO_DTLS
1461 */
1462//#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT
1463
1464/**
1465 * \def MBEDTLS_SSL_SESSION_TICKETS
1466 *
1467 * Enable support for RFC 5077 session tickets in SSL.
1468 * Client-side, provides full support for session tickets (maintainance of a
1469 * session store remains the responsibility of the application, though).
1470 * Server-side, you also need to provide callbacks for writing and parsing
1471 * tickets, including authenticated encryption and key management. Example
1472 * callbacks are provided by MBEDTLS_SSL_TICKET_C.
1473 *
1474 * Comment this macro to disable support for SSL session tickets
1475 */
1476#define MBEDTLS_SSL_SESSION_TICKETS
1477
1478/**
1479 * \def MBEDTLS_SSL_EXPORT_KEYS
1480 *
1481 * Enable support for exporting key block and master secret.
1482 * This is required for certain users of TLS, e.g. EAP-TLS.
1483 *
1484 * Comment this macro to disable support for key export
1485 */
1486#define MBEDTLS_SSL_EXPORT_KEYS
1487
1488/**
1489 * \def MBEDTLS_SSL_SERVER_NAME_INDICATION
1490 *
1491 * Enable support for RFC 6066 server name indication (SNI) in SSL.
1492 *
1493 * Requires: MBEDTLS_X509_CRT_PARSE_C
1494 *
1495 * Comment this macro to disable support for server name indication in SSL
1496 */
1497#define MBEDTLS_SSL_SERVER_NAME_INDICATION
1498
1499/**
1500 * \def MBEDTLS_SSL_TRUNCATED_HMAC
1501 *
1502 * Enable support for RFC 6066 truncated HMAC in SSL.
1503 *
1504 * Comment this macro to disable support for truncated HMAC in SSL
1505 */
1506#define MBEDTLS_SSL_TRUNCATED_HMAC
1507
1508/**
1509 * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
1510 *
1511 * Fallback to old (pre-2.7), non-conforming implementation of the truncated
1512 * HMAC extension which also truncates the HMAC key. Note that this option is
1513 * only meant for a transitory upgrade period and is likely to be removed in
1514 * a future version of the library.
1515 *
1516 * \warning The old implementation is non-compliant and has a security weakness
1517 * (2^80 brute force attack on the HMAC key used for a single,
1518 * uninterrupted connection). This should only be enabled temporarily
1519 * when (1) the use of truncated HMAC is essential in order to save
1520 * bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use
1521 * the fixed implementation yet (pre-2.7).
1522 *
1523 * \deprecated This option is deprecated and will likely be removed in a
1524 * future version of Mbed TLS.
1525 *
1526 * Uncomment to fallback to old, non-compliant truncated HMAC implementation.
1527 *
1528 * Requires: MBEDTLS_SSL_TRUNCATED_HMAC
1529 */
1530//#define MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
1531
1532/**
1533 * \def MBEDTLS_THREADING_ALT
1534 *
1535 * Provide your own alternate threading implementation.
1536 *
1537 * Requires: MBEDTLS_THREADING_C
1538 *
1539 * Uncomment this to allow your own alternate threading implementation.
1540 */
1541//#define MBEDTLS_THREADING_ALT
1542
1543/**
1544 * \def MBEDTLS_THREADING_PTHREAD
1545 *
1546 * Enable the pthread wrapper layer for the threading layer.
1547 *
1548 * Requires: MBEDTLS_THREADING_C
1549 *
1550 * Uncomment this to enable pthread mutexes.
1551 */
1552//#define MBEDTLS_THREADING_PTHREAD
1553
1554/**
1555 * \def MBEDTLS_VERSION_FEATURES
1556 *
1557 * Allow run-time checking of compile-time enabled features. Thus allowing users
1558 * to check at run-time if the library is for instance compiled with threading
1559 * support via mbedtls_version_check_feature().
1560 *
1561 * Requires: MBEDTLS_VERSION_C
1562 *
1563 * Comment this to disable run-time checking and save ROM space
1564 */
1565#define MBEDTLS_VERSION_FEATURES
1566
1567/**
1568 * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
1569 *
1570 * If set, the X509 parser will not break-off when parsing an X509 certificate
1571 * and encountering an extension in a v1 or v2 certificate.
1572 *
1573 * Uncomment to prevent an error.
1574 */
1575//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
1576
1577/**
1578 * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
1579 *
1580 * If set, the X509 parser will not break-off when parsing an X509 certificate
1581 * and encountering an unknown critical extension.
1582 *
1583 * \warning Depending on your PKI use, enabling this can be a security risk!
1584 *
1585 * Uncomment to prevent an error.
1586 */
1587//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
1588
1589/**
1590 * \def MBEDTLS_X509_CHECK_KEY_USAGE
1591 *
1592 * Enable verification of the keyUsage extension (CA and leaf certificates).
1593 *
1594 * Disabling this avoids problems with mis-issued and/or misused
1595 * (intermediate) CA and leaf certificates.
1596 *
1597 * \warning Depending on your PKI use, disabling this can be a security risk!
1598 *
1599 * Comment to skip keyUsage checking for both CA and leaf certificates.
1600 */
1601#define MBEDTLS_X509_CHECK_KEY_USAGE
1602
1603/**
1604 * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
1605 *
1606 * Enable verification of the extendedKeyUsage extension (leaf certificates).
1607 *
1608 * Disabling this avoids problems with mis-issued and/or misused certificates.
1609 *
1610 * \warning Depending on your PKI use, disabling this can be a security risk!
1611 *
1612 * Comment to skip extendedKeyUsage checking for certificates.
1613 */
1614#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
1615
1616/**
1617 * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
1618 *
1619 * Enable parsing and verification of X.509 certificates, CRLs and CSRS
1620 * signed with RSASSA-PSS (aka PKCS#1 v2.1).
1621 *
1622 * Comment this macro to disallow using RSASSA-PSS in certificates.
1623 */
1624#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
1625
1626/**
1627 * \def MBEDTLS_ZLIB_SUPPORT
1628 *
1629 * If set, the SSL/TLS module uses ZLIB to support compression and
1630 * decompression of packet data.
1631 *
1632 * \warning TLS-level compression MAY REDUCE SECURITY! See for example the
1633 * CRIME attack. Before enabling this option, you should examine with care if
1634 * CRIME or similar exploits may be a applicable to your use case.
1635 *
1636 * \note Currently compression can't be used with DTLS.
1637 *
1638 * \deprecated This feature is deprecated and will be removed
1639 * in the next major revision of the library.
1640 *
1641 * Used in: library/ssl_tls.c
1642 * library/ssl_cli.c
1643 * library/ssl_srv.c
1644 *
1645 * This feature requires zlib library and headers to be present.
1646 *
1647 * Uncomment to enable use of ZLIB
1648 */
1649//#define MBEDTLS_ZLIB_SUPPORT
1650/* \} name SECTION: mbed TLS feature support */
1651
1652/**
1653 * \name SECTION: mbed TLS modules
1654 *
1655 * This section enables or disables entire modules in mbed TLS
1656 * \{
1657 */
1658
1659/**
1660 * \def MBEDTLS_AESNI_C
1661 *
1662 * Enable AES-NI support on x86-64.
1663 *
1664 * Module: library/aesni.c
1665 * Caller: library/aes.c
1666 *
1667 * Requires: MBEDTLS_HAVE_ASM
1668 *
1669 * This modules adds support for the AES-NI instructions on x86-64
1670 */
1671//#define MBEDTLS_AESNI_C
1672
1673/**
1674 * \def MBEDTLS_AES_C
1675 *
1676 * Enable the AES block cipher.
1677 *
1678 * Module: library/aes.c
1679 * Caller: library/cipher.c
1680 * library/pem.c
1681 * library/ctr_drbg.c
1682 *
1683 * This module enables the following ciphersuites (if other requisites are
1684 * enabled as well):
1685 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1686 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
1687 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1688 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
1689 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
1690 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
1691 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
1692 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
1693 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
1694 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
1695 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
1696 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
1697 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1698 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1699 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
1700 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
1701 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
1702 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
1703 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1704 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1705 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1706 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1707 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1708 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
1709 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
1710 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
1711 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
1712 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1713 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1714 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1715 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
1716 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
1717 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
1718 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
1719 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
1720 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
1721 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
1722 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
1723 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
1724 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
1725 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
1726 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
1727 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
1728 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
1729 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
1730 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
1731 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
1732 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
1733 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
1734 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
1735 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
1736 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
1737 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
1738 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
1739 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
1740 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
1741 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
1742 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
1743 *
1744 * PEM_PARSE uses AES for decrypting encrypted keys.
1745 */
1746#define MBEDTLS_AES_C
1747
1748/**
1749 * \def MBEDTLS_ARC4_C
1750 *
1751 * Enable the ARCFOUR stream cipher.
1752 *
1753 * Module: library/arc4.c
1754 * Caller: library/cipher.c
1755 *
1756 * This module enables the following ciphersuites (if other requisites are
1757 * enabled as well):
1758 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
1759 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
1760 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1761 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
1762 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
1763 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
1764 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
1765 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
1766 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
1767 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
1768 *
1769 * \warning ARC4 is considered a weak cipher and its use constitutes a
1770 * security risk. If possible, we recommend avoidng dependencies on
1771 * it, and considering stronger ciphers instead.
1772 *
1773 */
1774#define MBEDTLS_ARC4_C
1775
1776/**
1777 * \def MBEDTLS_ASN1_PARSE_C
1778 *
1779 * Enable the generic ASN1 parser.
1780 *
1781 * Module: library/asn1.c
1782 * Caller: library/x509.c
1783 * library/dhm.c
1784 * library/pkcs12.c
1785 * library/pkcs5.c
1786 * library/pkparse.c
1787 */
1788#define MBEDTLS_ASN1_PARSE_C
1789
1790/**
1791 * \def MBEDTLS_ASN1_WRITE_C
1792 *
1793 * Enable the generic ASN1 writer.
1794 *
1795 * Module: library/asn1write.c
1796 * Caller: library/ecdsa.c
1797 * library/pkwrite.c
1798 * library/x509_create.c
1799 * library/x509write_crt.c
1800 * library/x509write_csr.c
1801 */
1802#define MBEDTLS_ASN1_WRITE_C
1803
1804/**
1805 * \def MBEDTLS_BASE64_C
1806 *
1807 * Enable the Base64 module.
1808 *
1809 * Module: library/base64.c
1810 * Caller: library/pem.c
1811 *
1812 * This module is required for PEM support (required by X.509).
1813 */
1814#define MBEDTLS_BASE64_C
1815
1816/**
1817 * \def MBEDTLS_BIGNUM_C
1818 *
1819 * Enable the multi-precision integer library.
1820 *
1821 * Module: library/bignum.c
1822 * Caller: library/dhm.c
1823 * library/ecp.c
1824 * library/ecdsa.c
1825 * library/rsa.c
1826 * library/rsa_internal.c
1827 * library/ssl_tls.c
1828 *
1829 * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support.
1830 */
1831#define MBEDTLS_BIGNUM_C
1832
1833/**
1834 * \def MBEDTLS_BLOWFISH_C
1835 *
1836 * Enable the Blowfish block cipher.
1837 *
1838 * Module: library/blowfish.c
1839 */
1840#define MBEDTLS_BLOWFISH_C
1841
1842/**
1843 * \def MBEDTLS_CAMELLIA_C
1844 *
1845 * Enable the Camellia block cipher.
1846 *
1847 * Module: library/camellia.c
1848 * Caller: library/cipher.c
1849 *
1850 * This module enables the following ciphersuites (if other requisites are
1851 * enabled as well):
1852 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1853 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1854 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
1855 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
1856 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1857 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1858 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
1859 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
1860 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1861 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1862 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1863 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1864 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
1865 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
1866 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
1867 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1868 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1869 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1870 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1871 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1872 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1873 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
1874 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
1875 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1876 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1877 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
1878 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1879 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1880 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
1881 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
1882 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
1883 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
1884 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
1885 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
1886 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
1887 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
1888 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
1889 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
1890 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
1891 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
1892 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
1893 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
1894 */
1895#define MBEDTLS_CAMELLIA_C
1896
1897/**
1898 * \def MBEDTLS_ARIA_C
1899 *
1900 * Enable the ARIA block cipher.
1901 *
1902 * Module: library/aria.c
1903 * Caller: library/cipher.c
1904 *
1905 * This module enables the following ciphersuites (if other requisites are
1906 * enabled as well):
1907 *
1908 * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256
1909 * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384
1910 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256
1911 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384
1912 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256
1913 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384
1914 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256
1915 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384
1916 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256
1917 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384
1918 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256
1919 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384
1920 * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256
1921 * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384
1922 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256
1923 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384
1924 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256
1925 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384
1926 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256
1927 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384
1928 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
1929 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
1930 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256
1931 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384
1932 * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256
1933 * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384
1934 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256
1935 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384
1936 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256
1937 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384
1938 * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256
1939 * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384
1940 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256
1941 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384
1942 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256
1943 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384
1944 * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
1945 * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
1946 */
1947//#define MBEDTLS_ARIA_C
1948
1949/**
1950 * \def MBEDTLS_CCM_C
1951 *
1952 * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
1953 *
1954 * Module: library/ccm.c
1955 *
1956 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
1957 *
1958 * This module enables the AES-CCM ciphersuites, if other requisites are
1959 * enabled as well.
1960 */
1961//#define MBEDTLS_CCM_C
1962
1963/**
1964 * \def MBEDTLS_CERTS_C
1965 *
1966 * Enable the test certificates.
1967 *
1968 * Module: library/certs.c
1969 * Caller:
1970 *
1971 * This module is used for testing (ssl_client/server).
1972 */
1973#define MBEDTLS_CERTS_C
1974
1975/**
1976 * \def MBEDTLS_CHACHA20_C
1977 *
1978 * Enable the ChaCha20 stream cipher.
1979 *
1980 * Module: library/chacha20.c
1981 */
1982//#define MBEDTLS_CHACHA20_C
1983
1984/**
1985 * \def MBEDTLS_CHACHAPOLY_C
1986 *
1987 * Enable the ChaCha20-Poly1305 AEAD algorithm.
1988 *
1989 * Module: library/chachapoly.c
1990 *
1991 * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
1992 */
1993//#define MBEDTLS_CHACHAPOLY_C
1994
1995/**
1996 * \def MBEDTLS_CIPHER_C
1997 *
1998 * Enable the generic cipher layer.
1999 *
2000 * Module: library/cipher.c
2001 * Caller: library/ssl_tls.c
2002 *
2003 * Uncomment to enable generic cipher wrappers.
2004 */
2005#define MBEDTLS_CIPHER_C
2006
2007/**
2008 * \def MBEDTLS_CMAC_C
2009 *
2010 * Enable the CMAC (Cipher-based Message Authentication Code) mode for block
2011 * ciphers.
2012 *
2013 * Module: library/cmac.c
2014 *
2015 * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C
2016 *
2017 */
2018#define MBEDTLS_CMAC_C
2019
2020/**
2021 * \def MBEDTLS_CTR_DRBG_C
2022 *
2023 * Enable the CTR_DRBG AES-256-based random generator.
2024 *
2025 * Module: library/ctr_drbg.c
2026 * Caller:
2027 *
2028 * Requires: MBEDTLS_AES_C
2029 *
2030 * This module provides the CTR_DRBG AES-256 random number generator.
2031 */
2032#define MBEDTLS_CTR_DRBG_C
2033
2034/**
2035 * \def MBEDTLS_DEBUG_C
2036 *
2037 * Enable the debug functions.
2038 *
2039 * Module: library/debug.c
2040 * Caller: library/ssl_cli.c
2041 * library/ssl_srv.c
2042 * library/ssl_tls.c
2043 *
2044 * This module provides debugging functions.
2045 */
2046#define MBEDTLS_DEBUG_C
2047
2048/**
2049 * \def MBEDTLS_DES_C
2050 *
2051 * Enable the DES block cipher.
2052 *
2053 * Module: library/des.c
2054 * Caller: library/pem.c
2055 * library/cipher.c
2056 *
2057 * This module enables the following ciphersuites (if other requisites are
2058 * enabled as well):
2059 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
2060 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
2061 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
2062 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
2063 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
2064 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
2065 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
2066 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
2067 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
2068 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
2069 *
2070 * PEM_PARSE uses DES/3DES for decrypting encrypted keys.
2071 *
2072 * \warning DES is considered a weak cipher and its use constitutes a
2073 * security risk. We recommend considering stronger ciphers instead.
2074 */
2075#define MBEDTLS_DES_C
2076
2077/**
2078 * \def MBEDTLS_DHM_C
2079 *
2080 * Enable the Diffie-Hellman-Merkle module.
2081 *
2082 * Module: library/dhm.c
2083 * Caller: library/ssl_cli.c
2084 * library/ssl_srv.c
2085 *
2086 * This module is used by the following key exchanges:
2087 * DHE-RSA, DHE-PSK
2088 *
2089 * \warning Using DHE constitutes a security risk as it
2090 * is not possible to validate custom DH parameters.
2091 * If possible, it is recommended users should consider
2092 * preferring other methods of key exchange.
2093 * See dhm.h for more details.
2094 *
2095 */
2096//#define MBEDTLS_DHM_C
2097
2098/**
2099 * \def MBEDTLS_ECDH_C
2100 *
2101 * Enable the elliptic curve Diffie-Hellman library.
2102 *
2103 * Module: library/ecdh.c
2104 * Caller: library/ssl_cli.c
2105 * library/ssl_srv.c
2106 *
2107 * This module is used by the following key exchanges:
2108 * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK
2109 *
2110 * Requires: MBEDTLS_ECP_C
2111 */
2112#define MBEDTLS_ECDH_C
2113
2114/**
2115 * \def MBEDTLS_ECDSA_C
2116 *
2117 * Enable the elliptic curve DSA library.
2118 *
2119 * Module: library/ecdsa.c
2120 * Caller:
2121 *
2122 * This module is used by the following key exchanges:
2123 * ECDHE-ECDSA
2124 *
2125 * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C
2126 */
2127#define MBEDTLS_ECDSA_C
2128
2129/**
2130 * \def MBEDTLS_ECJPAKE_C
2131 *
2132 * Enable the elliptic curve J-PAKE library.
2133 *
2134 * \warning This is currently experimental. EC J-PAKE support is based on the
2135 * Thread v1.0.0 specification; incompatible changes to the specification
2136 * might still happen. For this reason, this is disabled by default.
2137 *
2138 * Module: library/ecjpake.c
2139 * Caller:
2140 *
2141 * This module is used by the following key exchanges:
2142 * ECJPAKE
2143 *
2144 * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C
2145 */
2146//#define MBEDTLS_ECJPAKE_C
2147
2148/**
2149 * \def MBEDTLS_ECP_C
2150 *
2151 * Enable the elliptic curve over GF(p) library.
2152 *
2153 * Module: library/ecp.c
2154 * Caller: library/ecdh.c
2155 * library/ecdsa.c
2156 * library/ecjpake.c
2157 *
2158 * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED
2159 */
2160#define MBEDTLS_ECP_C
2161
2162/**
2163 * \def MBEDTLS_ENTROPY_C
2164 *
2165 * Enable the platform-specific entropy code.
2166 *
2167 * Module: library/entropy.c
2168 * Caller:
2169 *
2170 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
2171 *
2172 * This module provides a generic entropy pool
2173 */
2174#define MBEDTLS_ENTROPY_C
2175
2176/**
2177 * \def MBEDTLS_ERROR_C
2178 *
2179 * Enable error code to error string conversion.
2180 *
2181 * Module: library/error.c
2182 * Caller:
2183 *
2184 * This module enables mbedtls_strerror().
2185 */
2186#define MBEDTLS_ERROR_C
2187
2188/**
2189 * \def MBEDTLS_GCM_C
2190 *
2191 * Enable the Galois/Counter Mode (GCM) for AES.
2192 *
2193 * Module: library/gcm.c
2194 *
2195 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
2196 *
2197 * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other
2198 * requisites are enabled as well.
2199 */
2200//#define MBEDTLS_GCM_C
2201
2202/**
2203 * \def MBEDTLS_HAVEGE_C
2204 *
2205 * Enable the HAVEGE random generator.
2206 *
2207 * Warning: the HAVEGE random generator is not suitable for virtualized
2208 * environments
2209 *
2210 * Warning: the HAVEGE random generator is dependent on timing and specific
2211 * processor traits. It is therefore not advised to use HAVEGE as
2212 * your applications primary random generator or primary entropy pool
2213 * input. As a secondary input to your entropy pool, it IS able add
2214 * the (limited) extra entropy it provides.
2215 *
2216 * Module: library/havege.c
2217 * Caller:
2218 *
2219 * Requires: MBEDTLS_TIMING_C
2220 *
2221 * Uncomment to enable the HAVEGE random generator.
2222 */
2223//#define MBEDTLS_HAVEGE_C
2224
2225/**
2226 * \def MBEDTLS_HKDF_C
2227 *
2228 * Enable the HKDF algorithm (RFC 5869).
2229 *
2230 * Module: library/hkdf.c
2231 * Caller:
2232 *
2233 * Requires: MBEDTLS_MD_C
2234 *
2235 * This module adds support for the Hashed Message Authentication Code
2236 * (HMAC)-based key derivation function (HKDF).
2237 */
2238//#define MBEDTLS_HKDF_C
2239
2240/**
2241 * \def MBEDTLS_HMAC_DRBG_C
2242 *
2243 * Enable the HMAC_DRBG random generator.
2244 *
2245 * Module: library/hmac_drbg.c
2246 * Caller:
2247 *
2248 * Requires: MBEDTLS_MD_C
2249 *
2250 * Uncomment to enable the HMAC_DRBG random number geerator.
2251 */
2252//#define MBEDTLS_HMAC_DRBG_C
2253
2254/**
2255 * \def MBEDTLS_NIST_KW_C
2256 *
2257 * Enable the Key Wrapping mode for 128-bit block ciphers,
2258 * as defined in NIST SP 800-38F. Only KW and KWP modes
2259 * are supported. At the moment, only AES is approved by NIST.
2260 *
2261 * Module: library/nist_kw.c
2262 *
2263 * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C
2264 */
2265//#define MBEDTLS_NIST_KW_C
2266
2267/**
2268 * \def MBEDTLS_MD_C
2269 *
2270 * Enable the generic message digest layer.
2271 *
2272 * Module: library/md.c
2273 * Caller:
2274 *
2275 * Uncomment to enable generic message digest wrappers.
2276 */
2277#define MBEDTLS_MD_C
2278
2279/**
2280 * \def MBEDTLS_MD2_C
2281 *
2282 * Enable the MD2 hash algorithm.
2283 *
2284 * Module: library/md2.c
2285 * Caller:
2286 *
2287 * Uncomment to enable support for (rare) MD2-signed X.509 certs.
2288 *
2289 * \warning MD2 is considered a weak message digest and its use constitutes a
2290 * security risk. If possible, we recommend avoiding dependencies on
2291 * it, and considering stronger message digests instead.
2292 *
2293 */
2294//#define MBEDTLS_MD2_C
2295
2296/**
2297 * \def MBEDTLS_MD4_C
2298 *
2299 * Enable the MD4 hash algorithm.
2300 *
2301 * Module: library/md4.c
2302 * Caller:
2303 *
2304 * Uncomment to enable support for (rare) MD4-signed X.509 certs.
2305 *
2306 * \warning MD4 is considered a weak message digest and its use constitutes a
2307 * security risk. If possible, we recommend avoiding dependencies on
2308 * it, and considering stronger message digests instead.
2309 *
2310 */
2311//#define MBEDTLS_MD4_C
2312
2313/**
2314 * \def MBEDTLS_MD5_C
2315 *
2316 * Enable the MD5 hash algorithm.
2317 *
2318 * Module: library/md5.c
2319 * Caller: library/md.c
2320 * library/pem.c
2321 * library/ssl_tls.c
2322 *
2323 * This module is required for SSL/TLS up to version 1.1, and for TLS 1.2
2324 * depending on the handshake parameters. Further, it is used for checking
2325 * MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded
2326 * encrypted keys.
2327 *
2328 * \warning MD5 is considered a weak message digest and its use constitutes a
2329 * security risk. If possible, we recommend avoiding dependencies on
2330 * it, and considering stronger message digests instead.
2331 *
2332 */
2333#define MBEDTLS_MD5_C
2334
2335/**
2336 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
2337 *
2338 * Enable the buffer allocator implementation that makes use of a (stack)
2339 * based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
2340 * calls)
2341 *
2342 * Module: library/memory_buffer_alloc.c
2343 *
2344 * Requires: MBEDTLS_PLATFORM_C
2345 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS)
2346 *
2347 * Enable this module to enable the buffer memory allocator.
2348 */
2349//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
2350
2351/**
2352 * \def MBEDTLS_NET_C
2353 *
2354 * Enable the TCP and UDP over IPv6/IPv4 networking routines.
2355 *
2356 * \note This module only works on POSIX/Unix (including Linux, BSD and OS X)
2357 * and Windows. For other platforms, you'll want to disable it, and write your
2358 * own networking callbacks to be passed to \c mbedtls_ssl_set_bio().
2359 *
2360 * \note See also our Knowledge Base article about porting to a new
2361 * environment:
2362 * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
2363 *
2364 * Module: library/net_sockets.c
2365 *
2366 * This module provides networking routines.
2367 */
2368//#define MBEDTLS_NET_C
2369
2370/**
2371 * \def MBEDTLS_OID_C
2372 *
2373 * Enable the OID database.
2374 *
2375 * Module: library/oid.c
2376 * Caller: library/asn1write.c
2377 * library/pkcs5.c
2378 * library/pkparse.c
2379 * library/pkwrite.c
2380 * library/rsa.c
2381 * library/x509.c
2382 * library/x509_create.c
2383 * library/x509_crl.c
2384 * library/x509_crt.c
2385 * library/x509_csr.c
2386 * library/x509write_crt.c
2387 * library/x509write_csr.c
2388 *
2389 * This modules translates between OIDs and internal values.
2390 */
2391#define MBEDTLS_OID_C
2392
2393/**
2394 * \def MBEDTLS_PADLOCK_C
2395 *
2396 * Enable VIA Padlock support on x86.
2397 *
2398 * Module: library/padlock.c
2399 * Caller: library/aes.c
2400 *
2401 * Requires: MBEDTLS_HAVE_ASM
2402 *
2403 * This modules adds support for the VIA PadLock on x86.
2404 */
2405//#define MBEDTLS_PADLOCK_C
2406
2407/**
2408 * \def MBEDTLS_PEM_PARSE_C
2409 *
2410 * Enable PEM decoding / parsing.
2411 *
2412 * Module: library/pem.c
2413 * Caller: library/dhm.c
2414 * library/pkparse.c
2415 * library/x509_crl.c
2416 * library/x509_crt.c
2417 * library/x509_csr.c
2418 *
2419 * Requires: MBEDTLS_BASE64_C
2420 *
2421 * This modules adds support for decoding / parsing PEM files.
2422 */
2423#define MBEDTLS_PEM_PARSE_C
2424
2425/**
2426 * \def MBEDTLS_PEM_WRITE_C
2427 *
2428 * Enable PEM encoding / writing.
2429 *
2430 * Module: library/pem.c
2431 * Caller: library/pkwrite.c
2432 * library/x509write_crt.c
2433 * library/x509write_csr.c
2434 *
2435 * Requires: MBEDTLS_BASE64_C
2436 *
2437 * This modules adds support for encoding / writing PEM files.
2438 */
2439#define MBEDTLS_PEM_WRITE_C
2440
2441/**
2442 * \def MBEDTLS_PK_C
2443 *
2444 * Enable the generic public (asymetric) key layer.
2445 *
2446 * Module: library/pk.c
2447 * Caller: library/ssl_tls.c
2448 * library/ssl_cli.c
2449 * library/ssl_srv.c
2450 *
2451 * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C
2452 *
2453 * Uncomment to enable generic public key wrappers.
2454 */
2455#define MBEDTLS_PK_C
2456
2457/**
2458 * \def MBEDTLS_PK_PARSE_C
2459 *
2460 * Enable the generic public (asymetric) key parser.
2461 *
2462 * Module: library/pkparse.c
2463 * Caller: library/x509_crt.c
2464 * library/x509_csr.c
2465 *
2466 * Requires: MBEDTLS_PK_C
2467 *
2468 * Uncomment to enable generic public key parse functions.
2469 */
2470#define MBEDTLS_PK_PARSE_C
2471
2472/**
2473 * \def MBEDTLS_PK_WRITE_C
2474 *
2475 * Enable the generic public (asymetric) key writer.
2476 *
2477 * Module: library/pkwrite.c
2478 * Caller: library/x509write.c
2479 *
2480 * Requires: MBEDTLS_PK_C
2481 *
2482 * Uncomment to enable generic public key write functions.
2483 */
2484#define MBEDTLS_PK_WRITE_C
2485
2486/**
2487 * \def MBEDTLS_PKCS5_C
2488 *
2489 * Enable PKCS#5 functions.
2490 *
2491 * Module: library/pkcs5.c
2492 *
2493 * Requires: MBEDTLS_MD_C
2494 *
2495 * This module adds support for the PKCS#5 functions.
2496 */
2497#define MBEDTLS_PKCS5_C
2498
2499/**
2500 * \def MBEDTLS_PKCS11_C
2501 *
2502 * Enable wrapper for PKCS#11 smartcard support.
2503 *
2504 * Module: library/pkcs11.c
2505 * Caller: library/pk.c
2506 *
2507 * Requires: MBEDTLS_PK_C
2508 *
2509 * This module enables SSL/TLS PKCS #11 smartcard support.
2510 * Requires the presence of the PKCS#11 helper library (libpkcs11-helper)
2511 */
2512//#define MBEDTLS_PKCS11_C
2513
2514/**
2515 * \def MBEDTLS_PKCS12_C
2516 *
2517 * Enable PKCS#12 PBE functions.
2518 * Adds algorithms for parsing PKCS#8 encrypted private keys
2519 *
2520 * Module: library/pkcs12.c
2521 * Caller: library/pkparse.c
2522 *
2523 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2524 * Can use: MBEDTLS_ARC4_C
2525 *
2526 * This module enables PKCS#12 functions.
2527 */
2528#define MBEDTLS_PKCS12_C
2529
2530/**
2531 * \def MBEDTLS_PLATFORM_C
2532 *
2533 * Enable the platform abstraction layer that allows you to re-assign
2534 * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit().
2535 *
2536 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
2537 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
2538 * above to be specified at runtime or compile time respectively.
2539 *
2540 * \note This abstraction layer must be enabled on Windows (including MSYS2)
2541 * as other module rely on it for a fixed snprintf implementation.
2542 *
2543 * Module: library/platform.c
2544 * Caller: Most other .c files
2545 *
2546 * This module enables abstraction of common (libc) functions.
2547 */
2548#define MBEDTLS_PLATFORM_C
2549
2550/**
2551 * \def MBEDTLS_POLY1305_C
2552 *
2553 * Enable the Poly1305 MAC algorithm.
2554 *
2555 * Module: library/poly1305.c
2556 * Caller: library/chachapoly.c
2557 */
2558//#define MBEDTLS_POLY1305_C
2559
2560/**
2561 * \def MBEDTLS_RIPEMD160_C
2562 *
2563 * Enable the RIPEMD-160 hash algorithm.
2564 *
2565 * Module: library/ripemd160.c
2566 * Caller: library/md.c
2567 *
2568 */
2569//#define MBEDTLS_RIPEMD160_C
2570
2571/**
2572 * \def MBEDTLS_RSA_C
2573 *
2574 * Enable the RSA public-key cryptosystem.
2575 *
2576 * Module: library/rsa.c
2577 * library/rsa_internal.c
2578 * Caller: library/ssl_cli.c
2579 * library/ssl_srv.c
2580 * library/ssl_tls.c
2581 * library/x509.c
2582 *
2583 * This module is used by the following key exchanges:
2584 * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK
2585 *
2586 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C
2587 */
2588#define MBEDTLS_RSA_C
2589
2590/**
2591 * \def MBEDTLS_SHA1_C
2592 *
2593 * Enable the SHA1 cryptographic hash algorithm.
2594 *
2595 * Module: library/sha1.c
2596 * Caller: library/md.c
2597 * library/ssl_cli.c
2598 * library/ssl_srv.c
2599 * library/ssl_tls.c
2600 * library/x509write_crt.c
2601 *
2602 * This module is required for SSL/TLS up to version 1.1, for TLS 1.2
2603 * depending on the handshake parameters, and for SHA1-signed certificates.
2604 *
2605 * \warning SHA-1 is considered a weak message digest and its use constitutes
2606 * a security risk. If possible, we recommend avoiding dependencies
2607 * on it, and considering stronger message digests instead.
2608 *
2609 */
2610#define MBEDTLS_SHA1_C
2611
2612/**
2613 * \def MBEDTLS_SHA256_C
2614 *
2615 * Enable the SHA-224 and SHA-256 cryptographic hash algorithms.
2616 *
2617 * Module: library/sha256.c
2618 * Caller: library/entropy.c
2619 * library/md.c
2620 * library/ssl_cli.c
2621 * library/ssl_srv.c
2622 * library/ssl_tls.c
2623 *
2624 * This module adds support for SHA-224 and SHA-256.
2625 * This module is required for the SSL/TLS 1.2 PRF function.
2626 */
2627#define MBEDTLS_SHA256_C
2628
2629/**
2630 * \def MBEDTLS_SHA512_C
2631 *
2632 * Enable the SHA-384 and SHA-512 cryptographic hash algorithms.
2633 *
2634 * Module: library/sha512.c
2635 * Caller: library/entropy.c
2636 * library/md.c
2637 * library/ssl_cli.c
2638 * library/ssl_srv.c
2639 *
2640 * This module adds support for SHA-384 and SHA-512.
2641 */
2642#define MBEDTLS_SHA512_C
2643
2644/**
2645 * \def MBEDTLS_SSL_CACHE_C
2646 *
2647 * Enable simple SSL cache implementation.
2648 *
2649 * Module: library/ssl_cache.c
2650 * Caller:
2651 *
2652 * Requires: MBEDTLS_SSL_CACHE_C
2653 */
2654#define MBEDTLS_SSL_CACHE_C
2655
2656/**
2657 * \def MBEDTLS_SSL_COOKIE_C
2658 *
2659 * Enable basic implementation of DTLS cookies for hello verification.
2660 *
2661 * Module: library/ssl_cookie.c
2662 * Caller:
2663 */
2664#define MBEDTLS_SSL_COOKIE_C
2665
2666/**
2667 * \def MBEDTLS_SSL_TICKET_C
2668 *
2669 * Enable an implementation of TLS server-side callbacks for session tickets.
2670 *
2671 * Module: library/ssl_ticket.c
2672 * Caller:
2673 *
2674 * Requires: MBEDTLS_CIPHER_C
2675 */
2676#define MBEDTLS_SSL_TICKET_C
2677
2678/**
2679 * \def MBEDTLS_SSL_CLI_C
2680 *
2681 * Enable the SSL/TLS client code.
2682 *
2683 * Module: library/ssl_cli.c
2684 * Caller:
2685 *
2686 * Requires: MBEDTLS_SSL_TLS_C
2687 *
2688 * This module is required for SSL/TLS client support.
2689 */
2690//#define MBEDTLS_SSL_CLI_C
2691
2692/**
2693 * \def MBEDTLS_SSL_SRV_C
2694 *
2695 * Enable the SSL/TLS server code.
2696 *
2697 * Module: library/ssl_srv.c
2698 * Caller:
2699 *
2700 * Requires: MBEDTLS_SSL_TLS_C
2701 *
2702 * This module is required for SSL/TLS server support.
2703 */
2704//#define MBEDTLS_SSL_SRV_C
2705
2706/**
2707 * \def MBEDTLS_SSL_TLS_C
2708 *
2709 * Enable the generic SSL/TLS code.
2710 *
2711 * Module: library/ssl_tls.c
2712 * Caller: library/ssl_cli.c
2713 * library/ssl_srv.c
2714 *
2715 * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2716 * and at least one of the MBEDTLS_SSL_PROTO_XXX defines
2717 *
2718 * This module is required for SSL/TLS.
2719 */
2720//#define MBEDTLS_SSL_TLS_C
2721
2722/**
2723 * \def MBEDTLS_THREADING_C
2724 *
2725 * Enable the threading abstraction layer.
2726 * By default mbed TLS assumes it is used in a non-threaded environment or that
2727 * contexts are not shared between threads. If you do intend to use contexts
2728 * between threads, you will need to enable this layer to prevent race
2729 * conditions. See also our Knowledge Base article about threading:
2730 * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
2731 *
2732 * Module: library/threading.c
2733 *
2734 * This allows different threading implementations (self-implemented or
2735 * provided).
2736 *
2737 * You will have to enable either MBEDTLS_THREADING_ALT or
2738 * MBEDTLS_THREADING_PTHREAD.
2739 *
2740 * Enable this layer to allow use of mutexes within mbed TLS
2741 */
2742//#define MBEDTLS_THREADING_C
2743
2744/**
2745 * \def MBEDTLS_TIMING_C
2746 *
2747 * Enable the semi-portable timing interface.
2748 *
2749 * \note The provided implementation only works on POSIX/Unix (including Linux,
2750 * BSD and OS X) and Windows. On other platforms, you can either disable that
2751 * module and provide your own implementations of the callbacks needed by
2752 * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide
2753 * your own implementation of the whole module by setting
2754 * \c MBEDTLS_TIMING_ALT in the current file.
2755 *
2756 * \note See also our Knowledge Base article about porting to a new
2757 * environment:
2758 * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
2759 *
2760 * Module: library/timing.c
2761 * Caller: library/havege.c
2762 *
2763 * This module is used by the HAVEGE random number generator.
2764 */
2765#define MBEDTLS_TIMING_C
2766
2767/**
2768 * \def MBEDTLS_VERSION_C
2769 *
2770 * Enable run-time version information.
2771 *
2772 * Module: library/version.c
2773 *
2774 * This module provides run-time version information.
2775 */
2776#define MBEDTLS_VERSION_C
2777
2778/**
2779 * \def MBEDTLS_X509_USE_C
2780 *
2781 * Enable X.509 core for using certificates.
2782 *
2783 * Module: library/x509.c
2784 * Caller: library/x509_crl.c
2785 * library/x509_crt.c
2786 * library/x509_csr.c
2787 *
2788 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C,
2789 * MBEDTLS_PK_PARSE_C
2790 *
2791 * This module is required for the X.509 parsing modules.
2792 */
2793#define MBEDTLS_X509_USE_C
2794
2795/**
2796 * \def MBEDTLS_X509_CRT_PARSE_C
2797 *
2798 * Enable X.509 certificate parsing.
2799 *
2800 * Module: library/x509_crt.c
2801 * Caller: library/ssl_cli.c
2802 * library/ssl_srv.c
2803 * library/ssl_tls.c
2804 *
2805 * Requires: MBEDTLS_X509_USE_C
2806 *
2807 * This module is required for X.509 certificate parsing.
2808 */
2809#define MBEDTLS_X509_CRT_PARSE_C
2810
2811/**
2812 * \def MBEDTLS_X509_CRL_PARSE_C
2813 *
2814 * Enable X.509 CRL parsing.
2815 *
2816 * Module: library/x509_crl.c
2817 * Caller: library/x509_crt.c
2818 *
2819 * Requires: MBEDTLS_X509_USE_C
2820 *
2821 * This module is required for X.509 CRL parsing.
2822 */
2823#define MBEDTLS_X509_CRL_PARSE_C
2824
2825/**
2826 * \def MBEDTLS_X509_CSR_PARSE_C
2827 *
2828 * Enable X.509 Certificate Signing Request (CSR) parsing.
2829 *
2830 * Module: library/x509_csr.c
2831 * Caller: library/x509_crt_write.c
2832 *
2833 * Requires: MBEDTLS_X509_USE_C
2834 *
2835 * This module is used for reading X.509 certificate request.
2836 */
2837#define MBEDTLS_X509_CSR_PARSE_C
2838
2839/**
2840 * \def MBEDTLS_X509_CREATE_C
2841 *
2842 * Enable X.509 core for creating certificates.
2843 *
2844 * Module: library/x509_create.c
2845 *
2846 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C
2847 *
2848 * This module is the basis for creating X.509 certificates and CSRs.
2849 */
2850#define MBEDTLS_X509_CREATE_C
2851
2852/**
2853 * \def MBEDTLS_X509_CRT_WRITE_C
2854 *
2855 * Enable creating X.509 certificates.
2856 *
2857 * Module: library/x509_crt_write.c
2858 *
2859 * Requires: MBEDTLS_X509_CREATE_C
2860 *
2861 * This module is required for X.509 certificate creation.
2862 */
2863#define MBEDTLS_X509_CRT_WRITE_C
2864
2865/**
2866 * \def MBEDTLS_X509_CSR_WRITE_C
2867 *
2868 * Enable creating X.509 Certificate Signing Requests (CSR).
2869 *
2870 * Module: library/x509_csr_write.c
2871 *
2872 * Requires: MBEDTLS_X509_CREATE_C
2873 *
2874 * This module is required for X.509 certificate request writing.
2875 */
2876#define MBEDTLS_X509_CSR_WRITE_C
2877
2878/**
2879 * \def MBEDTLS_XTEA_C
2880 *
2881 * Enable the XTEA block cipher.
2882 *
2883 * Module: library/xtea.c
2884 * Caller:
2885 */
2886//#define MBEDTLS_XTEA_C
2887
2888/* \} name SECTION: mbed TLS modules */
2889
2890/**
2891 * \name SECTION: Module configuration options
2892 *
2893 * This section allows for the setting of module specific sizes and
2894 * configuration options. The default values are already present in the
2895 * relevant header files and should suffice for the regular use cases.
2896 *
2897 * Our advice is to enable options and change their values here
2898 * only if you have a good reason and know the consequences.
2899 *
2900 * Please check the respective header file for documentation on these
2901 * parameters (to prevent duplicate documentation).
2902 * \{
2903 */
2904
2905/* MPI / BIGNUM options */
2906//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */
2907//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */
2908
2909/* CTR_DRBG options */
2910//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */
2911//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2912//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2913//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2914//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
2915
2916/* HMAC_DRBG options */
2917//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2918//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2919//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2920//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
2921
2922/* ECP options */
2923//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */
2924//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
2925//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
2926
2927/* Entropy options */
2928//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
2929//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
2930//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */
2931
2932/* Memory buffer allocator options */
2933//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */
2934
2935/* Platform options */
2936//#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
2937//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */
2938//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */
2939//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
2940//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2941//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
2942//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */
2943/* Note: your snprintf must correclty zero-terminate the buffer! */
2944//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */
2945//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */
2946//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */
2947//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
2948//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
2949//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */
2950
2951/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */
2952/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
2953//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */
2954//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */
2955//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
2956//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2957//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2958//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */
2959//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */
2960/* Note: your snprintf must correclty zero-terminate the buffer! */
2961//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */
2962//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
2963//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
2964
2965/* SSL Cache options */
2966//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */
2967//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */
2968
2969/* SSL options */
2970
2971/** \def MBEDTLS_SSL_MAX_CONTENT_LEN
2972 *
2973 * Maximum fragment length in bytes.
2974 *
2975 * Determines the size of both the incoming and outgoing TLS I/O buffers.
2976 *
2977 * Uncommenting MBEDTLS_SSL_IN_CONTENT_LEN and/or MBEDTLS_SSL_OUT_CONTENT_LEN
2978 * will override this length by setting maximum incoming and/or outgoing
2979 * fragment length, respectively.
2980 */
2981//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384
2982
2983/** \def MBEDTLS_SSL_IN_CONTENT_LEN
2984 *
2985 * Maximum incoming fragment length in bytes.
2986 *
2987 * Uncomment to set the size of the inward TLS buffer independently of the
2988 * outward buffer.
2989 */
2990//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384
2991
2992/** \def MBEDTLS_SSL_OUT_CONTENT_LEN
2993 *
2994 * Maximum outgoing fragment length in bytes.
2995 *
2996 * Uncomment to set the size of the outward TLS buffer independently of the
2997 * inward buffer.
2998 *
2999 * It is possible to save RAM by setting a smaller outward buffer, while keeping
3000 * the default inward 16384 byte buffer to conform to the TLS specification.
3001 *
3002 * The minimum required outward buffer size is determined by the handshake
3003 * protocol's usage. Handshaking will fail if the outward buffer is too small.
3004 * The specific size requirement depends on the configured ciphers and any
3005 * certificate data which is sent during the handshake.
3006 *
3007 * For absolute minimum RAM usage, it's best to enable
3008 * MBEDTLS_SSL_MAX_FRAGMENT_LENGTH and reduce MBEDTLS_SSL_MAX_CONTENT_LEN. This
3009 * reduces both incoming and outgoing buffer sizes. However this is only
3010 * guaranteed if the other end of the connection also supports the TLS
3011 * max_fragment_len extension. Otherwise the connection may fail.
3012 */
3013//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384
3014
3015/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING
3016 *
3017 * Maximum number of heap-allocated bytes for the purpose of
3018 * DTLS handshake message reassembly and future message buffering.
3019 *
3020 * This should be at least 9/8 * MBEDTLSSL_IN_CONTENT_LEN
3021 * to account for a reassembled handshake message of maximum size,
3022 * together with its reassembly bitmap.
3023 *
3024 * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default)
3025 * should be sufficient for all practical situations as it allows
3026 * to reassembly a large handshake message (such as a certificate)
3027 * while buffering multiple smaller handshake messages.
3028 *
3029 */
3030//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768
3031
3032//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */
3033//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */
3034//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
3035
3036/**
3037 * Complete list of ciphersuites to use, in order of preference.
3038 *
3039 * \warning No dependency checking is done on that field! This option can only
3040 * be used to restrict the set of available ciphersuites. It is your
3041 * responsibility to make sure the needed modules are active.
3042 *
3043 * Use this to save a few hundred bytes of ROM (default ordering of all
3044 * available ciphersuites) and a few to a few hundred bytes of RAM.
3045 *
3046 * The value below is only an example, not the default.
3047 */
3048//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
3049
3050/* X509 options */
3051//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
3052//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
3053
3054/**
3055 * Allow SHA-1 in the default TLS configuration for certificate signing.
3056 * Without this build-time option, SHA-1 support must be activated explicitly
3057 * through mbedtls_ssl_conf_cert_profile. Turning on this option is not
3058 * recommended because of it is possible to generate SHA-1 collisions, however
3059 * this may be safe for legacy infrastructure where additional controls apply.
3060 *
3061 * \warning SHA-1 is considered a weak message digest and its use constitutes
3062 * a security risk. If possible, we recommend avoiding dependencies
3063 * on it, and considering stronger message digests instead.
3064 *
3065 */
3066// #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES
3067
3068/**
3069 * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake
3070 * signature and ciphersuite selection. Without this build-time option, SHA-1
3071 * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes.
3072 * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by
3073 * default. At the time of writing, there is no practical attack on the use
3074 * of SHA-1 in handshake signatures, hence this option is turned on by default
3075 * to preserve compatibility with existing peers, but the general
3076 * warning applies nonetheless:
3077 *
3078 * \warning SHA-1 is considered a weak message digest and its use constitutes
3079 * a security risk. If possible, we recommend avoiding dependencies
3080 * on it, and considering stronger message digests instead.
3081 *
3082 */
3083#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE
3084
3085/**
3086 * Uncomment the macro to let mbed TLS use your alternate implementation of
3087 * mbedtls_platform_zeroize(). This replaces the default implementation in
3088 * platform_util.c.
3089 *
3090 * mbedtls_platform_zeroize() is a widely used function across the library to
3091 * zero a block of memory. The implementation is expected to be secure in the
3092 * sense that it has been written to prevent the compiler from removing calls
3093 * to mbedtls_platform_zeroize() as part of redundant code elimination
3094 * optimizations. However, it is difficult to guarantee that calls to
3095 * mbedtls_platform_zeroize() will not be optimized by the compiler as older
3096 * versions of the C language standards do not provide a secure implementation
3097 * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to
3098 * configure their own implementation of mbedtls_platform_zeroize(), for
3099 * example by using directives specific to their compiler, features from newer
3100 * C standards (e.g using memset_s() in C11) or calling a secure memset() from
3101 * their system (e.g explicit_bzero() in BSD).
3102 */
3103//#define MBEDTLS_PLATFORM_ZEROIZE_ALT
3104
3105/* \} name SECTION: Customisation configuration options */
3106
3107/* Target and application specific configurations */
3108//#define YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE "target_config.h"
3109
3110#if defined(TARGET_LIKE_MBED) && defined(YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE)
3111#include YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE
3112#endif
3113
3114/*
3115 * Allow user to override any previous default.
3116 *
3117 * Use two macro names for that, as:
3118 * - with yotta the prefix YOTTA_CFG_ is forced
3119 * - without yotta is looks weird to have a YOTTA prefix.
3120 */
3121#if defined(YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE)
3122#include YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE
3123#elif defined(MBEDTLS_USER_CONFIG_FILE)
3124#include MBEDTLS_USER_CONFIG_FILE
3125#endif
3126
3127#include "check_config.h"
3128
3129#endif /* MBEDTLS_CONFIG_H */
Impressum, Datenschutz