]> git.zerfleddert.de Git - proxmark3-svn/blob - common/mbedtls/config.h
gcc10 compiler fixes:
[proxmark3-svn] / common / mbedtls / config.h
1 /**
2 * \file config.h
3 *
4 * \brief Configuration options (set of defines)
5 *
6 * This set of compile-time options may be used to enable
7 * or disable features selectively, and reduce the global
8 * memory footprint.
9 */
10 /*
11 * Copyright (C) 2006-2018, ARM Limited, All Rights Reserved
12 * SPDX-License-Identifier: GPL-2.0
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License along
25 * with this program; if not, write to the Free Software Foundation, Inc.,
26 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
27 *
28 * This file is part of mbed TLS (https://tls.mbed.org)
29 */
30
31 #ifndef MBEDTLS_CONFIG_H
32 #define MBEDTLS_CONFIG_H
33
34 #if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
35 #define _CRT_SECURE_NO_DEPRECATE 1
36 #endif
37
38 /**
39 * \name SECTION: System support
40 *
41 * This section sets system specific settings.
42 * \{
43 */
44
45 /**
46 * \def MBEDTLS_HAVE_ASM
47 *
48 * The compiler has support for asm().
49 *
50 * Requires support for asm() in compiler.
51 *
52 * Used in:
53 * library/aria.c
54 * library/timing.c
55 * include/mbedtls/bn_mul.h
56 *
57 * Required by:
58 * MBEDTLS_AESNI_C
59 * MBEDTLS_PADLOCK_C
60 *
61 * Comment to disable the use of assembly code.
62 */
63 //#define MBEDTLS_HAVE_ASM
64
65 /**
66 * \def MBEDTLS_NO_UDBL_DIVISION
67 *
68 * The platform lacks support for double-width integer division (64-bit
69 * division on a 32-bit platform, 128-bit division on a 64-bit platform).
70 *
71 * Used in:
72 * include/mbedtls/bignum.h
73 * library/bignum.c
74 *
75 * The bignum code uses double-width division to speed up some operations.
76 * Double-width division is often implemented in software that needs to
77 * be linked with the program. The presence of a double-width integer
78 * type is usually detected automatically through preprocessor macros,
79 * but the automatic detection cannot know whether the code needs to
80 * and can be linked with an implementation of division for that type.
81 * By default division is assumed to be usable if the type is present.
82 * Uncomment this option to prevent the use of double-width division.
83 *
84 * Note that division for the native integer type is always required.
85 * Furthermore, a 64-bit type is always required even on a 32-bit
86 * platform, but it need not support multiplication or division. In some
87 * cases it is also desirable to disable some double-width operations. For
88 * example, if double-width division is implemented in software, disabling
89 * it can reduce code size in some embedded targets.
90 */
91 //#define MBEDTLS_NO_UDBL_DIVISION
92
93 /**
94 * \def MBEDTLS_NO_64BIT_MULTIPLICATION
95 *
96 * The platform lacks support for 32x32 -> 64-bit multiplication.
97 *
98 * Used in:
99 * library/poly1305.c
100 *
101 * Some parts of the library may use multiplication of two unsigned 32-bit
102 * operands with a 64-bit result in order to speed up computations. On some
103 * platforms, this is not available in hardware and has to be implemented in
104 * software, usually in a library provided by the toolchain.
105 *
106 * Sometimes it is not desirable to have to link to that library. This option
107 * removes the dependency of that library on platforms that lack a hardware
108 * 64-bit multiplier by embedding a software implementation in Mbed TLS.
109 *
110 * Note that depending on the compiler, this may decrease performance compared
111 * to using the library function provided by the toolchain.
112 */
113 //#define MBEDTLS_NO_64BIT_MULTIPLICATION
114
115 /**
116 * \def MBEDTLS_HAVE_SSE2
117 *
118 * CPU supports SSE2 instruction set.
119 *
120 * Uncomment if the CPU supports SSE2 (IA-32 specific).
121 */
122 //#define MBEDTLS_HAVE_SSE2
123
124 /**
125 * \def MBEDTLS_HAVE_TIME
126 *
127 * System has time.h and time().
128 * The time does not need to be correct, only time differences are used,
129 * by contrast with MBEDTLS_HAVE_TIME_DATE
130 *
131 * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT,
132 * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and
133 * MBEDTLS_PLATFORM_STD_TIME.
134 *
135 * Comment if your system does not support time functions
136 */
137 //#define MBEDTLS_HAVE_TIME
138
139 /**
140 * \def MBEDTLS_HAVE_TIME_DATE
141 *
142 * System has time.h and time(), gmtime() and the clock is correct.
143 * The time needs to be correct (not necesarily very accurate, but at least
144 * the date should be correct). This is used to verify the validity period of
145 * X.509 certificates.
146 *
147 * Comment if your system does not have a correct clock.
148 */
149 //#define MBEDTLS_HAVE_TIME_DATE
150
151 /**
152 * \def MBEDTLS_PLATFORM_MEMORY
153 *
154 * Enable the memory allocation layer.
155 *
156 * By default mbed TLS uses the system-provided calloc() and free().
157 * This allows different allocators (self-implemented or provided) to be
158 * provided to the platform abstraction layer.
159 *
160 * Enabling MBEDTLS_PLATFORM_MEMORY without the
161 * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
162 * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
163 * free() function pointer at runtime.
164 *
165 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying
166 * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
167 * alternate function at compile time.
168 *
169 * Requires: MBEDTLS_PLATFORM_C
170 *
171 * Enable this layer to allow use of alternative memory allocators.
172 */
173 //#define MBEDTLS_PLATFORM_MEMORY
174
175 /**
176 * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
177 *
178 * Do not assign standard functions in the platform layer (e.g. calloc() to
179 * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
180 *
181 * This makes sure there are no linking errors on platforms that do not support
182 * these functions. You will HAVE to provide alternatives, either at runtime
183 * via the platform_set_xxx() functions or at compile time by setting
184 * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a
185 * MBEDTLS_PLATFORM_XXX_MACRO.
186 *
187 * Requires: MBEDTLS_PLATFORM_C
188 *
189 * Uncomment to prevent default assignment of standard functions in the
190 * platform layer.
191 */
192 //#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
193
194 /**
195 * \def MBEDTLS_PLATFORM_EXIT_ALT
196 *
197 * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the
198 * function in the platform abstraction layer.
199 *
200 * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will
201 * provide a function "mbedtls_platform_set_printf()" that allows you to set an
202 * alternative printf function pointer.
203 *
204 * All these define require MBEDTLS_PLATFORM_C to be defined!
205 *
206 * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows;
207 * it will be enabled automatically by check_config.h
208 *
209 * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as
210 * MBEDTLS_PLATFORM_XXX_MACRO!
211 *
212 * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME
213 *
214 * Uncomment a macro to enable alternate implementation of specific base
215 * platform function
216 */
217 //#define MBEDTLS_PLATFORM_EXIT_ALT
218 //#define MBEDTLS_PLATFORM_TIME_ALT
219 //#define MBEDTLS_PLATFORM_FPRINTF_ALT
220 //#define MBEDTLS_PLATFORM_PRINTF_ALT
221 //#define MBEDTLS_PLATFORM_SNPRINTF_ALT
222 //#define MBEDTLS_PLATFORM_NV_SEED_ALT
223 //#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
224
225 /**
226 * \def MBEDTLS_DEPRECATED_WARNING
227 *
228 * Mark deprecated functions so that they generate a warning if used.
229 * Functions deprecated in one version will usually be removed in the next
230 * version. You can enable this to help you prepare the transition to a new
231 * major version by making sure your code is not using these functions.
232 *
233 * This only works with GCC and Clang. With other compilers, you may want to
234 * use MBEDTLS_DEPRECATED_REMOVED
235 *
236 * Uncomment to get warnings on using deprecated functions.
237 */
238 //#define MBEDTLS_DEPRECATED_WARNING
239
240 /**
241 * \def MBEDTLS_DEPRECATED_REMOVED
242 *
243 * Remove deprecated functions so that they generate an error if used.
244 * Functions deprecated in one version will usually be removed in the next
245 * version. You can enable this to help you prepare the transition to a new
246 * major version by making sure your code is not using these functions.
247 *
248 * Uncomment to get errors on using deprecated functions.
249 */
250 //#define MBEDTLS_DEPRECATED_REMOVED
251
252 /* \} name SECTION: System support */
253
254 /**
255 * \name SECTION: mbed TLS feature support
256 *
257 * This section sets support for features that are or are not needed
258 * within the modules that are enabled.
259 * \{
260 */
261
262 /**
263 * \def MBEDTLS_TIMING_ALT
264 *
265 * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(),
266 * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay()
267 *
268 * Only works if you have MBEDTLS_TIMING_C enabled.
269 *
270 * You will need to provide a header "timing_alt.h" and an implementation at
271 * compile time.
272 */
273 //#define MBEDTLS_TIMING_ALT
274
275 /**
276 * \def MBEDTLS_AES_ALT
277 *
278 * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your
279 * alternate core implementation of a symmetric crypto, an arithmetic or hash
280 * module (e.g. platform specific assembly optimized implementations). Keep
281 * in mind that the function prototypes should remain the same.
282 *
283 * This replaces the whole module. If you only want to replace one of the
284 * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags.
285 *
286 * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer
287 * provide the "struct mbedtls_aes_context" definition and omit the base
288 * function declarations and implementations. "aes_alt.h" will be included from
289 * "aes.h" to include the new function definitions.
290 *
291 * Uncomment a macro to enable alternate implementation of the corresponding
292 * module.
293 *
294 * \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their
295 * use constitutes a security risk. If possible, we recommend
296 * avoiding dependencies on them, and considering stronger message
297 * digests and ciphers instead.
298 *
299 */
300 //#define MBEDTLS_AES_ALT
301 //#define MBEDTLS_ARC4_ALT
302 //#define MBEDTLS_ARIA_ALT
303 //#define MBEDTLS_BLOWFISH_ALT
304 //#define MBEDTLS_CAMELLIA_ALT
305 //#define MBEDTLS_CCM_ALT
306 //#define MBEDTLS_CHACHA20_ALT
307 //#define MBEDTLS_CHACHAPOLY_ALT
308 //#define MBEDTLS_CMAC_ALT
309 //#define MBEDTLS_DES_ALT
310 //#define MBEDTLS_DHM_ALT
311 //#define MBEDTLS_ECJPAKE_ALT
312 //#define MBEDTLS_GCM_ALT
313 //#define MBEDTLS_NIST_KW_ALT
314 //#define MBEDTLS_MD2_ALT
315 //#define MBEDTLS_MD4_ALT
316 //#define MBEDTLS_MD5_ALT
317 //#define MBEDTLS_POLY1305_ALT
318 //#define MBEDTLS_RIPEMD160_ALT
319 //#define MBEDTLS_RSA_ALT
320 //#define MBEDTLS_SHA1_ALT
321 //#define MBEDTLS_SHA256_ALT
322 //#define MBEDTLS_SHA512_ALT
323 //#define MBEDTLS_XTEA_ALT
324
325 /*
326 * When replacing the elliptic curve module, pleace consider, that it is
327 * implemented with two .c files:
328 * - ecp.c
329 * - ecp_curves.c
330 * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT
331 * macros as described above. The only difference is that you have to make sure
332 * that you provide functionality for both .c files.
333 */
334 //#define MBEDTLS_ECP_ALT
335
336 /**
337 * \def MBEDTLS_MD2_PROCESS_ALT
338 *
339 * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you
340 * alternate core implementation of symmetric crypto or hash function. Keep in
341 * mind that function prototypes should remain the same.
342 *
343 * This replaces only one function. The header file from mbed TLS is still
344 * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
345 *
346 * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will
347 * no longer provide the mbedtls_sha1_process() function, but it will still provide
348 * the other function (using your mbedtls_sha1_process() function) and the definition
349 * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible
350 * with this definition.
351 *
352 * \note Because of a signature change, the core AES encryption and decryption routines are
353 * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt,
354 * respectively. When setting up alternative implementations, these functions should
355 * be overriden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
356 * must stay untouched.
357 *
358 * \note If you use the AES_xxx_ALT macros, then is is recommended to also set
359 * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES
360 * tables.
361 *
362 * Uncomment a macro to enable alternate implementation of the corresponding
363 * function.
364 *
365 * \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use
366 * constitutes a security risk. If possible, we recommend avoiding
367 * dependencies on them, and considering stronger message digests
368 * and ciphers instead.
369 *
370 */
371 //#define MBEDTLS_MD2_PROCESS_ALT
372 //#define MBEDTLS_MD4_PROCESS_ALT
373 //#define MBEDTLS_MD5_PROCESS_ALT
374 //#define MBEDTLS_RIPEMD160_PROCESS_ALT
375 //#define MBEDTLS_SHA1_PROCESS_ALT
376 //#define MBEDTLS_SHA256_PROCESS_ALT
377 //#define MBEDTLS_SHA512_PROCESS_ALT
378 //#define MBEDTLS_DES_SETKEY_ALT
379 //#define MBEDTLS_DES_CRYPT_ECB_ALT
380 //#define MBEDTLS_DES3_CRYPT_ECB_ALT
381 //#define MBEDTLS_AES_SETKEY_ENC_ALT
382 //#define MBEDTLS_AES_SETKEY_DEC_ALT
383 //#define MBEDTLS_AES_ENCRYPT_ALT
384 //#define MBEDTLS_AES_DECRYPT_ALT
385 //#define MBEDTLS_ECDH_GEN_PUBLIC_ALT
386 //#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT
387 //#define MBEDTLS_ECDSA_VERIFY_ALT
388 //#define MBEDTLS_ECDSA_SIGN_ALT
389 //#define MBEDTLS_ECDSA_GENKEY_ALT
390
391 /**
392 * \def MBEDTLS_ECP_INTERNAL_ALT
393 *
394 * Expose a part of the internal interface of the Elliptic Curve Point module.
395 *
396 * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your
397 * alternative core implementation of elliptic curve arithmetic. Keep in mind
398 * that function prototypes should remain the same.
399 *
400 * This partially replaces one function. The header file from mbed TLS is still
401 * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation
402 * is still present and it is used for group structures not supported by the
403 * alternative.
404 *
405 * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT
406 * and implementing the following functions:
407 * unsigned char mbedtls_internal_ecp_grp_capable(
408 * const mbedtls_ecp_group *grp )
409 * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp )
410 * void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp )
411 * The mbedtls_internal_ecp_grp_capable function should return 1 if the
412 * replacement functions implement arithmetic for the given group and 0
413 * otherwise.
414 * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are
415 * called before and after each point operation and provide an opportunity to
416 * implement optimized set up and tear down instructions.
417 *
418 * Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and
419 * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac
420 * function, but will use your mbedtls_internal_ecp_double_jac if the group is
421 * supported (your mbedtls_internal_ecp_grp_capable function returns 1 when
422 * receives it as an argument). If the group is not supported then the original
423 * implementation is used. The other functions and the definition of
424 * mbedtls_ecp_group and mbedtls_ecp_point will not change, so your
425 * implementation of mbedtls_internal_ecp_double_jac and
426 * mbedtls_internal_ecp_grp_capable must be compatible with this definition.
427 *
428 * Uncomment a macro to enable alternate implementation of the corresponding
429 * function.
430 */
431 /* Required for all the functions in this section */
432 //#define MBEDTLS_ECP_INTERNAL_ALT
433 /* Support for Weierstrass curves with Jacobi representation */
434 //#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT
435 //#define MBEDTLS_ECP_ADD_MIXED_ALT
436 //#define MBEDTLS_ECP_DOUBLE_JAC_ALT
437 //#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT
438 //#define MBEDTLS_ECP_NORMALIZE_JAC_ALT
439 /* Support for curves with Montgomery arithmetic */
440 //#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT
441 //#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT
442 //#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT
443
444 /**
445 * \def MBEDTLS_TEST_NULL_ENTROPY
446 *
447 * Enables testing and use of mbed TLS without any configured entropy sources.
448 * This permits use of the library on platforms before an entropy source has
449 * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the
450 * MBEDTLS_ENTROPY_NV_SEED switches).
451 *
452 * WARNING! This switch MUST be disabled in production builds, and is suitable
453 * only for development.
454 * Enabling the switch negates any security provided by the library.
455 *
456 * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
457 *
458 */
459 //#define MBEDTLS_TEST_NULL_ENTROPY
460
461 /**
462 * \def MBEDTLS_ENTROPY_HARDWARE_ALT
463 *
464 * Uncomment this macro to let mbed TLS use your own implementation of a
465 * hardware entropy collector.
466 *
467 * Your function must be called \c mbedtls_hardware_poll(), have the same
468 * prototype as declared in entropy_poll.h, and accept NULL as first argument.
469 *
470 * Uncomment to use your own hardware entropy collector.
471 */
472 //#define MBEDTLS_ENTROPY_HARDWARE_ALT
473
474 /**
475 * \def MBEDTLS_AES_ROM_TABLES
476 *
477 * Use precomputed AES tables stored in ROM.
478 *
479 * Uncomment this macro to use precomputed AES tables stored in ROM.
480 * Comment this macro to generate AES tables in RAM at runtime.
481 *
482 * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb
483 * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the
484 * initialization time before the first AES operation can be performed.
485 * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c
486 * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded
487 * performance if ROM access is slower than RAM access.
488 *
489 * This option is independent of \c MBEDTLS_AES_FEWER_TABLES.
490 *
491 */
492 //#define MBEDTLS_AES_ROM_TABLES
493
494 /**
495 * \def MBEDTLS_AES_FEWER_TABLES
496 *
497 * Use less ROM/RAM for AES tables.
498 *
499 * Uncommenting this macro omits 75% of the AES tables from
500 * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES)
501 * by computing their values on the fly during operations
502 * (the tables are entry-wise rotations of one another).
503 *
504 * Tradeoff: Uncommenting this reduces the RAM / ROM footprint
505 * by ~6kb but at the cost of more arithmetic operations during
506 * runtime. Specifically, one has to compare 4 accesses within
507 * different tables to 4 accesses with additional arithmetic
508 * operations within the same table. The performance gain/loss
509 * depends on the system and memory details.
510 *
511 * This option is independent of \c MBEDTLS_AES_ROM_TABLES.
512 *
513 */
514 //#define MBEDTLS_AES_FEWER_TABLES
515
516 /**
517 * \def MBEDTLS_CAMELLIA_SMALL_MEMORY
518 *
519 * Use less ROM for the Camellia implementation (saves about 768 bytes).
520 *
521 * Uncomment this macro to use less memory for Camellia.
522 */
523 //#define MBEDTLS_CAMELLIA_SMALL_MEMORY
524
525 /**
526 * \def MBEDTLS_CIPHER_MODE_CBC
527 *
528 * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
529 */
530 #define MBEDTLS_CIPHER_MODE_CBC
531
532 /**
533 * \def MBEDTLS_CIPHER_MODE_CFB
534 *
535 * Enable Cipher Feedback mode (CFB) for symmetric ciphers.
536 */
537 #define MBEDTLS_CIPHER_MODE_CFB
538
539 /**
540 * \def MBEDTLS_CIPHER_MODE_CTR
541 *
542 * Enable Counter Block Cipher mode (CTR) for symmetric ciphers.
543 */
544 #define MBEDTLS_CIPHER_MODE_CTR
545
546 /**
547 * \def MBEDTLS_CIPHER_MODE_OFB
548 *
549 * Enable Output Feedback mode (OFB) for symmetric ciphers.
550 */
551 #define MBEDTLS_CIPHER_MODE_OFB
552
553 /**
554 * \def MBEDTLS_CIPHER_MODE_XTS
555 *
556 * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES.
557 */
558 #define MBEDTLS_CIPHER_MODE_XTS
559
560 /**
561 * \def MBEDTLS_CIPHER_NULL_CIPHER
562 *
563 * Enable NULL cipher.
564 * Warning: Only do so when you know what you are doing. This allows for
565 * encryption or channels without any security!
566 *
567 * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable
568 * the following ciphersuites:
569 * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA
570 * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA
571 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA
572 * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA
573 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384
574 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256
575 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA
576 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384
577 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256
578 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA
579 * MBEDTLS_TLS_RSA_WITH_NULL_SHA256
580 * MBEDTLS_TLS_RSA_WITH_NULL_SHA
581 * MBEDTLS_TLS_RSA_WITH_NULL_MD5
582 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384
583 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256
584 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA
585 * MBEDTLS_TLS_PSK_WITH_NULL_SHA384
586 * MBEDTLS_TLS_PSK_WITH_NULL_SHA256
587 * MBEDTLS_TLS_PSK_WITH_NULL_SHA
588 *
589 * Uncomment this macro to enable the NULL cipher and ciphersuites
590 */
591 //#define MBEDTLS_CIPHER_NULL_CIPHER
592
593 /**
594 * \def MBEDTLS_CIPHER_PADDING_PKCS7
595 *
596 * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for
597 * specific padding modes in the cipher layer with cipher modes that support
598 * padding (e.g. CBC)
599 *
600 * If you disable all padding modes, only full blocks can be used with CBC.
601 *
602 * Enable padding modes in the cipher layer.
603 */
604 #define MBEDTLS_CIPHER_PADDING_PKCS7
605 #define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
606 #define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
607 #define MBEDTLS_CIPHER_PADDING_ZEROS
608
609 /**
610 * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES
611 *
612 * Enable weak ciphersuites in SSL / TLS.
613 * Warning: Only do so when you know what you are doing. This allows for
614 * channels with virtually no security at all!
615 *
616 * This enables the following ciphersuites:
617 * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA
618 * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA
619 *
620 * Uncomment this macro to enable weak ciphersuites
621 *
622 * \warning DES is considered a weak cipher and its use constitutes a
623 * security risk. We recommend considering stronger ciphers instead.
624 */
625 //#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES
626
627 /**
628 * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES
629 *
630 * Remove RC4 ciphersuites by default in SSL / TLS.
631 * This flag removes the ciphersuites based on RC4 from the default list as
632 * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to
633 * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them
634 * explicitly.
635 *
636 * Uncomment this macro to remove RC4 ciphersuites by default.
637 */
638 #define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
639
640 /**
641 * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED
642 *
643 * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve
644 * module. By default all supported curves are enabled.
645 *
646 * Comment macros to disable the curve and functions for it
647 */
648 #define MBEDTLS_ECP_DP_SECP128R1_ENABLED
649 #define MBEDTLS_ECP_DP_SECP192R1_ENABLED
650 #define MBEDTLS_ECP_DP_SECP224R1_ENABLED
651 #define MBEDTLS_ECP_DP_SECP256R1_ENABLED
652 #define MBEDTLS_ECP_DP_SECP384R1_ENABLED
653 #define MBEDTLS_ECP_DP_SECP521R1_ENABLED
654 #define MBEDTLS_ECP_DP_SECP192K1_ENABLED
655 #define MBEDTLS_ECP_DP_SECP224K1_ENABLED
656 #define MBEDTLS_ECP_DP_SECP256K1_ENABLED
657 #define MBEDTLS_ECP_DP_BP256R1_ENABLED
658 #define MBEDTLS_ECP_DP_BP384R1_ENABLED
659 #define MBEDTLS_ECP_DP_BP512R1_ENABLED
660 #define MBEDTLS_ECP_DP_CURVE25519_ENABLED
661 #define MBEDTLS_ECP_DP_CURVE448_ENABLED
662
663 /**
664 * \def MBEDTLS_ECP_NIST_OPTIM
665 *
666 * Enable specific 'modulo p' routines for each NIST prime.
667 * Depending on the prime and architecture, makes operations 4 to 8 times
668 * faster on the corresponding curve.
669 *
670 * Comment this macro to disable NIST curves optimisation.
671 */
672 #define MBEDTLS_ECP_NIST_OPTIM
673
674 /**
675 * \def MBEDTLS_ECDSA_DETERMINISTIC
676 *
677 * Enable deterministic ECDSA (RFC 6979).
678 * Standard ECDSA is "fragile" in the sense that lack of entropy when signing
679 * may result in a compromise of the long-term signing key. This is avoided by
680 * the deterministic variant.
681 *
682 * Requires: MBEDTLS_HMAC_DRBG_C
683 *
684 * Comment this macro to disable deterministic ECDSA.
685 */
686 //#define MBEDTLS_ECDSA_DETERMINISTIC
687
688 /**
689 * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
690 *
691 * Enable the PSK based ciphersuite modes in SSL / TLS.
692 *
693 * This enables the following ciphersuites (if other requisites are
694 * enabled as well):
695 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
696 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
697 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
698 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
699 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
700 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
701 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
702 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
703 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
704 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
705 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
706 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
707 */
708 #define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
709
710 /**
711 * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
712 *
713 * Enable the DHE-PSK based ciphersuite modes in SSL / TLS.
714 *
715 * Requires: MBEDTLS_DHM_C
716 *
717 * This enables the following ciphersuites (if other requisites are
718 * enabled as well):
719 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
720 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
721 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
722 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
723 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
724 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
725 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
726 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
727 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
728 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
729 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
730 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
731 *
732 * \warning Using DHE constitutes a security risk as it
733 * is not possible to validate custom DH parameters.
734 * If possible, it is recommended users should consider
735 * preferring other methods of key exchange.
736 * See dhm.h for more details.
737 *
738 */
739 //#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
740
741 /**
742 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
743 *
744 * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.
745 *
746 * Requires: MBEDTLS_ECDH_C
747 *
748 * This enables the following ciphersuites (if other requisites are
749 * enabled as well):
750 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
751 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
752 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
753 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
754 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
755 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
756 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
757 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
758 */
759 #define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
760
761 /**
762 * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
763 *
764 * Enable the RSA-PSK based ciphersuite modes in SSL / TLS.
765 *
766 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
767 * MBEDTLS_X509_CRT_PARSE_C
768 *
769 * This enables the following ciphersuites (if other requisites are
770 * enabled as well):
771 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
772 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
773 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
774 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
775 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
776 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
777 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
778 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
779 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
780 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
781 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
782 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
783 */
784 #define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
785
786 /**
787 * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
788 *
789 * Enable the RSA-only based ciphersuite modes in SSL / TLS.
790 *
791 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
792 * MBEDTLS_X509_CRT_PARSE_C
793 *
794 * This enables the following ciphersuites (if other requisites are
795 * enabled as well):
796 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
797 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
798 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
799 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
800 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
801 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
802 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
803 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
804 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
805 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
806 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
807 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
808 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
809 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
810 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
811 */
812 #define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
813
814 /**
815 * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
816 *
817 * Enable the DHE-RSA based ciphersuite modes in SSL / TLS.
818 *
819 * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
820 * MBEDTLS_X509_CRT_PARSE_C
821 *
822 * This enables the following ciphersuites (if other requisites are
823 * enabled as well):
824 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
825 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
826 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
827 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
828 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
829 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
830 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
831 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
832 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
833 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
834 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
835 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
836 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
837 *
838 * \warning Using DHE constitutes a security risk as it
839 * is not possible to validate custom DH parameters.
840 * If possible, it is recommended users should consider
841 * preferring other methods of key exchange.
842 * See dhm.h for more details.
843 *
844 */
845 //#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
846
847 /**
848 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
849 *
850 * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.
851 *
852 * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
853 * MBEDTLS_X509_CRT_PARSE_C
854 *
855 * This enables the following ciphersuites (if other requisites are
856 * enabled as well):
857 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
858 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
859 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
860 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
861 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
862 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
863 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
864 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
865 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
866 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
867 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
868 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
869 */
870 #define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
871
872 /**
873 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
874 *
875 * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.
876 *
877 * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C,
878 *
879 * This enables the following ciphersuites (if other requisites are
880 * enabled as well):
881 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
882 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
883 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
884 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
885 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
886 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
887 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
888 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
889 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
890 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
891 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
892 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
893 */
894 #define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
895
896 /**
897 * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
898 *
899 * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
900 *
901 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
902 *
903 * This enables the following ciphersuites (if other requisites are
904 * enabled as well):
905 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
906 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
907 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
908 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
909 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
910 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
911 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
912 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
913 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
914 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
915 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
916 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
917 */
918 #define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
919
920 /**
921 * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
922 *
923 * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
924 *
925 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
926 *
927 * This enables the following ciphersuites (if other requisites are
928 * enabled as well):
929 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
930 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
931 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
932 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
933 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
934 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
935 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
936 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
937 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
938 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
939 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
940 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
941 */
942 #define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
943
944 /**
945 * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
946 *
947 * Enable the ECJPAKE based ciphersuite modes in SSL / TLS.
948 *
949 * \warning This is currently experimental. EC J-PAKE support is based on the
950 * Thread v1.0.0 specification; incompatible changes to the specification
951 * might still happen. For this reason, this is disabled by default.
952 *
953 * Requires: MBEDTLS_ECJPAKE_C
954 * MBEDTLS_SHA256_C
955 * MBEDTLS_ECP_DP_SECP256R1_ENABLED
956 *
957 * This enables the following ciphersuites (if other requisites are
958 * enabled as well):
959 * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
960 */
961 //#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
962
963 /**
964 * \def MBEDTLS_PK_PARSE_EC_EXTENDED
965 *
966 * Enhance support for reading EC keys using variants of SEC1 not allowed by
967 * RFC 5915 and RFC 5480.
968 *
969 * Currently this means parsing the SpecifiedECDomain choice of EC
970 * parameters (only known groups are supported, not arbitrary domains, to
971 * avoid validation issues).
972 *
973 * Disable if you only need to support RFC 5915 + 5480 key formats.
974 */
975 #define MBEDTLS_PK_PARSE_EC_EXTENDED
976
977 /**
978 * \def MBEDTLS_ERROR_STRERROR_DUMMY
979 *
980 * Enable a dummy error function to make use of mbedtls_strerror() in
981 * third party libraries easier when MBEDTLS_ERROR_C is disabled
982 * (no effect when MBEDTLS_ERROR_C is enabled).
983 *
984 * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're
985 * not using mbedtls_strerror() or error_strerror() in your application.
986 *
987 * Disable if you run into name conflicts and want to really remove the
988 * mbedtls_strerror()
989 */
990 #define MBEDTLS_ERROR_STRERROR_DUMMY
991
992 /**
993 * \def MBEDTLS_GENPRIME
994 *
995 * Enable the prime-number generation code.
996 *
997 * Requires: MBEDTLS_BIGNUM_C
998 */
999 #define MBEDTLS_GENPRIME
1000
1001 /**
1002 * \def MBEDTLS_FS_IO
1003 *
1004 * Enable functions that use the filesystem.
1005 */
1006 #define MBEDTLS_FS_IO
1007
1008 /**
1009 * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
1010 *
1011 * Do not add default entropy sources. These are the platform specific,
1012 * mbedtls_timing_hardclock and HAVEGE based poll functions.
1013 *
1014 * This is useful to have more control over the added entropy sources in an
1015 * application.
1016 *
1017 * Uncomment this macro to prevent loading of default entropy functions.
1018 */
1019 //#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
1020
1021 /**
1022 * \def MBEDTLS_NO_PLATFORM_ENTROPY
1023 *
1024 * Do not use built-in platform entropy functions.
1025 * This is useful if your platform does not support
1026 * standards like the /dev/urandom or Windows CryptoAPI.
1027 *
1028 * Uncomment this macro to disable the built-in platform entropy functions.
1029 */
1030 //#define MBEDTLS_NO_PLATFORM_ENTROPY
1031
1032 /**
1033 * \def MBEDTLS_ENTROPY_FORCE_SHA256
1034 *
1035 * Force the entropy accumulator to use a SHA-256 accumulator instead of the
1036 * default SHA-512 based one (if both are available).
1037 *
1038 * Requires: MBEDTLS_SHA256_C
1039 *
1040 * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
1041 * if you have performance concerns.
1042 *
1043 * This option is only useful if both MBEDTLS_SHA256_C and
1044 * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
1045 */
1046 //#define MBEDTLS_ENTROPY_FORCE_SHA256
1047
1048 /**
1049 * \def MBEDTLS_ENTROPY_NV_SEED
1050 *
1051 * Enable the non-volatile (NV) seed file-based entropy source.
1052 * (Also enables the NV seed read/write functions in the platform layer)
1053 *
1054 * This is crucial (if not required) on systems that do not have a
1055 * cryptographic entropy source (in hardware or kernel) available.
1056 *
1057 * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
1058 *
1059 * \note The read/write functions that are used by the entropy source are
1060 * determined in the platform layer, and can be modified at runtime and/or
1061 * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
1062 *
1063 * \note If you use the default implementation functions that read a seedfile
1064 * with regular fopen(), please make sure you make a seedfile with the
1065 * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
1066 * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
1067 * and written to or you will get an entropy source error! The default
1068 * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
1069 * bytes from the file.
1070 *
1071 * \note The entropy collector will write to the seed file before entropy is
1072 * given to an external source, to update it.
1073 */
1074 //#define MBEDTLS_ENTROPY_NV_SEED
1075
1076 /**
1077 * \def MBEDTLS_MEMORY_DEBUG
1078 *
1079 * Enable debugging of buffer allocator memory issues. Automatically prints
1080 * (to stderr) all (fatal) messages on memory allocation issues. Enables
1081 * function for 'debug output' of allocated memory.
1082 *
1083 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
1084 *
1085 * Uncomment this macro to let the buffer allocator print out error messages.
1086 */
1087 //#define MBEDTLS_MEMORY_DEBUG
1088
1089 /**
1090 * \def MBEDTLS_MEMORY_BACKTRACE
1091 *
1092 * Include backtrace information with each allocated block.
1093 *
1094 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
1095 * GLIBC-compatible backtrace() an backtrace_symbols() support
1096 *
1097 * Uncomment this macro to include backtrace information
1098 */
1099 //#define MBEDTLS_MEMORY_BACKTRACE
1100
1101 /**
1102 * \def MBEDTLS_PK_RSA_ALT_SUPPORT
1103 *
1104 * Support external private RSA keys (eg from a HSM) in the PK layer.
1105 *
1106 * Comment this macro to disable support for external private RSA keys.
1107 */
1108 #define MBEDTLS_PK_RSA_ALT_SUPPORT
1109
1110 /**
1111 * \def MBEDTLS_PKCS1_V15
1112 *
1113 * Enable support for PKCS#1 v1.5 encoding.
1114 *
1115 * Requires: MBEDTLS_RSA_C
1116 *
1117 * This enables support for PKCS#1 v1.5 operations.
1118 */
1119 #define MBEDTLS_PKCS1_V15
1120
1121 /**
1122 * \def MBEDTLS_PKCS1_V21
1123 *
1124 * Enable support for PKCS#1 v2.1 encoding.
1125 *
1126 * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C
1127 *
1128 * This enables support for RSAES-OAEP and RSASSA-PSS operations.
1129 */
1130 #define MBEDTLS_PKCS1_V21
1131
1132 /**
1133 * \def MBEDTLS_RSA_NO_CRT
1134 *
1135 * Do not use the Chinese Remainder Theorem
1136 * for the RSA private operation.
1137 *
1138 * Uncomment this macro to disable the use of CRT in RSA.
1139 *
1140 */
1141 //#define MBEDTLS_RSA_NO_CRT
1142
1143 /**
1144 * \def MBEDTLS_SELF_TEST
1145 *
1146 * Enable the checkup functions (*_self_test).
1147 */
1148 #define MBEDTLS_SELF_TEST
1149
1150 /**
1151 * \def MBEDTLS_SHA256_SMALLER
1152 *
1153 * Enable an implementation of SHA-256 that has lower ROM footprint but also
1154 * lower performance.
1155 *
1156 * The default implementation is meant to be a reasonnable compromise between
1157 * performance and size. This version optimizes more aggressively for size at
1158 * the expense of performance. Eg on Cortex-M4 it reduces the size of
1159 * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about
1160 * 30%.
1161 *
1162 * Uncomment to enable the smaller implementation of SHA256.
1163 */
1164 //#define MBEDTLS_SHA256_SMALLER
1165
1166 /**
1167 * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
1168 *
1169 * Enable sending of alert messages in case of encountered errors as per RFC.
1170 * If you choose not to send the alert messages, mbed TLS can still communicate
1171 * with other servers, only debugging of failures is harder.
1172 *
1173 * The advantage of not sending alert messages, is that no information is given
1174 * about reasons for failures thus preventing adversaries of gaining intel.
1175 *
1176 * Enable sending of all alert messages
1177 */
1178 #define MBEDTLS_SSL_ALL_ALERT_MESSAGES
1179
1180 /**
1181 * \def MBEDTLS_SSL_ASYNC_PRIVATE
1182 *
1183 * Enable asynchronous external private key operations in SSL. This allows
1184 * you to configure an SSL connection to call an external cryptographic
1185 * module to perform private key operations instead of performing the
1186 * operation inside the library.
1187 *
1188 */
1189 //#define MBEDTLS_SSL_ASYNC_PRIVATE
1190
1191 /**
1192 * \def MBEDTLS_SSL_DEBUG_ALL
1193 *
1194 * Enable the debug messages in SSL module for all issues.
1195 * Debug messages have been disabled in some places to prevent timing
1196 * attacks due to (unbalanced) debugging function calls.
1197 *
1198 * If you need all error reporting you should enable this during debugging,
1199 * but remove this for production servers that should log as well.
1200 *
1201 * Uncomment this macro to report all debug messages on errors introducing
1202 * a timing side-channel.
1203 *
1204 */
1205 //#define MBEDTLS_SSL_DEBUG_ALL
1206
1207 /** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC
1208 *
1209 * Enable support for Encrypt-then-MAC, RFC 7366.
1210 *
1211 * This allows peers that both support it to use a more robust protection for
1212 * ciphersuites using CBC, providing deep resistance against timing attacks
1213 * on the padding or underlying cipher.
1214 *
1215 * This only affects CBC ciphersuites, and is useless if none is defined.
1216 *
1217 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
1218 * MBEDTLS_SSL_PROTO_TLS1_1 or
1219 * MBEDTLS_SSL_PROTO_TLS1_2
1220 *
1221 * Comment this macro to disable support for Encrypt-then-MAC
1222 */
1223 #define MBEDTLS_SSL_ENCRYPT_THEN_MAC
1224
1225 /** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET
1226 *
1227 * Enable support for Extended Master Secret, aka Session Hash
1228 * (draft-ietf-tls-session-hash-02).
1229 *
1230 * This was introduced as "the proper fix" to the Triple Handshake familiy of
1231 * attacks, but it is recommended to always use it (even if you disable
1232 * renegotiation), since it actually fixes a more fundamental issue in the
1233 * original SSL/TLS design, and has implications beyond Triple Handshake.
1234 *
1235 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
1236 * MBEDTLS_SSL_PROTO_TLS1_1 or
1237 * MBEDTLS_SSL_PROTO_TLS1_2
1238 *
1239 * Comment this macro to disable support for Extended Master Secret.
1240 */
1241 #define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
1242
1243 /**
1244 * \def MBEDTLS_SSL_FALLBACK_SCSV
1245 *
1246 * Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00).
1247 *
1248 * For servers, it is recommended to always enable this, unless you support
1249 * only one version of TLS, or know for sure that none of your clients
1250 * implements a fallback strategy.
1251 *
1252 * For clients, you only need this if you're using a fallback strategy, which
1253 * is not recommended in the first place, unless you absolutely need it to
1254 * interoperate with buggy (version-intolerant) servers.
1255 *
1256 * Comment this macro to disable support for FALLBACK_SCSV
1257 */
1258 #define MBEDTLS_SSL_FALLBACK_SCSV
1259
1260 /**
1261 * \def MBEDTLS_SSL_HW_RECORD_ACCEL
1262 *
1263 * Enable hooking functions in SSL module for hardware acceleration of
1264 * individual records.
1265 *
1266 * Uncomment this macro to enable hooking functions.
1267 */
1268 //#define MBEDTLS_SSL_HW_RECORD_ACCEL
1269
1270 /**
1271 * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING
1272 *
1273 * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
1274 *
1275 * This is a countermeasure to the BEAST attack, which also minimizes the risk
1276 * of interoperability issues compared to sending 0-length records.
1277 *
1278 * Comment this macro to disable 1/n-1 record splitting.
1279 */
1280 #define MBEDTLS_SSL_CBC_RECORD_SPLITTING
1281
1282 /**
1283 * \def MBEDTLS_SSL_RENEGOTIATION
1284 *
1285 * Disable support for TLS renegotiation.
1286 *
1287 * The two main uses of renegotiation are (1) refresh keys on long-lived
1288 * connections and (2) client authentication after the initial handshake.
1289 * If you don't need renegotiation, it's probably better to disable it, since
1290 * it has been associated with security issues in the past and is easy to
1291 * misuse/misunderstand.
1292 *
1293 * Comment this to disable support for renegotiation.
1294 *
1295 * \note Even if this option is disabled, both client and server are aware
1296 * of the Renegotiation Indication Extension (RFC 5746) used to
1297 * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1).
1298 * (See \c mbedtls_ssl_conf_legacy_renegotiation for the
1299 * configuration of this extension).
1300 *
1301 */
1302 #define MBEDTLS_SSL_RENEGOTIATION
1303
1304 /**
1305 * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
1306 *
1307 * Enable support for receiving and parsing SSLv2 Client Hello messages for the
1308 * SSL Server module (MBEDTLS_SSL_SRV_C).
1309 *
1310 * Uncomment this macro to enable support for SSLv2 Client Hello messages.
1311 */
1312 //#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
1313
1314 /**
1315 * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
1316 *
1317 * Pick the ciphersuite according to the client's preferences rather than ours
1318 * in the SSL Server module (MBEDTLS_SSL_SRV_C).
1319 *
1320 * Uncomment this macro to respect client's ciphersuite order
1321 */
1322 //#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
1323
1324 /**
1325 * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
1326 *
1327 * Enable support for RFC 6066 max_fragment_length extension in SSL.
1328 *
1329 * Comment this macro to disable support for the max_fragment_length extension
1330 */
1331 #define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
1332
1333 /**
1334 * \def MBEDTLS_SSL_PROTO_SSL3
1335 *
1336 * Enable support for SSL 3.0.
1337 *
1338 * Requires: MBEDTLS_MD5_C
1339 * MBEDTLS_SHA1_C
1340 *
1341 * Comment this macro to disable support for SSL 3.0
1342 */
1343 //#define MBEDTLS_SSL_PROTO_SSL3
1344
1345 /**
1346 * \def MBEDTLS_SSL_PROTO_TLS1
1347 *
1348 * Enable support for TLS 1.0.
1349 *
1350 * Requires: MBEDTLS_MD5_C
1351 * MBEDTLS_SHA1_C
1352 *
1353 * Comment this macro to disable support for TLS 1.0
1354 */
1355 #define MBEDTLS_SSL_PROTO_TLS1
1356
1357 /**
1358 * \def MBEDTLS_SSL_PROTO_TLS1_1
1359 *
1360 * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).
1361 *
1362 * Requires: MBEDTLS_MD5_C
1363 * MBEDTLS_SHA1_C
1364 *
1365 * Comment this macro to disable support for TLS 1.1 / DTLS 1.0
1366 */
1367 #define MBEDTLS_SSL_PROTO_TLS1_1
1368
1369 /**
1370 * \def MBEDTLS_SSL_PROTO_TLS1_2
1371 *
1372 * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
1373 *
1374 * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C
1375 * (Depends on ciphersuites)
1376 *
1377 * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
1378 */
1379 #define MBEDTLS_SSL_PROTO_TLS1_2
1380
1381 /**
1382 * \def MBEDTLS_SSL_PROTO_DTLS
1383 *
1384 * Enable support for DTLS (all available versions).
1385 *
1386 * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0,
1387 * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
1388 *
1389 * Requires: MBEDTLS_SSL_PROTO_TLS1_1
1390 * or MBEDTLS_SSL_PROTO_TLS1_2
1391 *
1392 * Comment this macro to disable support for DTLS
1393 */
1394 #define MBEDTLS_SSL_PROTO_DTLS
1395
1396 /**
1397 * \def MBEDTLS_SSL_ALPN
1398 *
1399 * Enable support for RFC 7301 Application Layer Protocol Negotiation.
1400 *
1401 * Comment this macro to disable support for ALPN.
1402 */
1403 #define MBEDTLS_SSL_ALPN
1404
1405 /**
1406 * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY
1407 *
1408 * Enable support for the anti-replay mechanism in DTLS.
1409 *
1410 * Requires: MBEDTLS_SSL_TLS_C
1411 * MBEDTLS_SSL_PROTO_DTLS
1412 *
1413 * \warning Disabling this is often a security risk!
1414 * See mbedtls_ssl_conf_dtls_anti_replay() for details.
1415 *
1416 * Comment this to disable anti-replay in DTLS.
1417 */
1418 //#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
1419
1420 /**
1421 * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY
1422 *
1423 * Enable support for HelloVerifyRequest on DTLS servers.
1424 *
1425 * This feature is highly recommended to prevent DTLS servers being used as
1426 * amplifiers in DoS attacks against other hosts. It should always be enabled
1427 * unless you know for sure amplification cannot be a problem in the
1428 * environment in which your server operates.
1429 *
1430 * \warning Disabling this can ba a security risk! (see above)
1431 *
1432 * Requires: MBEDTLS_SSL_PROTO_DTLS
1433 *
1434 * Comment this to disable support for HelloVerifyRequest.
1435 */
1436 #define MBEDTLS_SSL_DTLS_HELLO_VERIFY
1437
1438 /**
1439 * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
1440 *
1441 * Enable server-side support for clients that reconnect from the same port.
1442 *
1443 * Some clients unexpectedly close the connection and try to reconnect using the
1444 * same source port. This needs special support from the server to handle the
1445 * new connection securely, as described in section 4.2.8 of RFC 6347. This
1446 * flag enables that support.
1447 *
1448 * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY
1449 *
1450 * Comment this to disable support for clients reusing the source port.
1451 */
1452 #define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
1453
1454 /**
1455 * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT
1456 *
1457 * Enable support for a limit of records with bad MAC.
1458 *
1459 * See mbedtls_ssl_conf_dtls_badmac_limit().
1460 *
1461 * Requires: MBEDTLS_SSL_PROTO_DTLS
1462 */
1463 //#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT
1464
1465 /**
1466 * \def MBEDTLS_SSL_SESSION_TICKETS
1467 *
1468 * Enable support for RFC 5077 session tickets in SSL.
1469 * Client-side, provides full support for session tickets (maintainance of a
1470 * session store remains the responsibility of the application, though).
1471 * Server-side, you also need to provide callbacks for writing and parsing
1472 * tickets, including authenticated encryption and key management. Example
1473 * callbacks are provided by MBEDTLS_SSL_TICKET_C.
1474 *
1475 * Comment this macro to disable support for SSL session tickets
1476 */
1477 #define MBEDTLS_SSL_SESSION_TICKETS
1478
1479 /**
1480 * \def MBEDTLS_SSL_EXPORT_KEYS
1481 *
1482 * Enable support for exporting key block and master secret.
1483 * This is required for certain users of TLS, e.g. EAP-TLS.
1484 *
1485 * Comment this macro to disable support for key export
1486 */
1487 #define MBEDTLS_SSL_EXPORT_KEYS
1488
1489 /**
1490 * \def MBEDTLS_SSL_SERVER_NAME_INDICATION
1491 *
1492 * Enable support for RFC 6066 server name indication (SNI) in SSL.
1493 *
1494 * Requires: MBEDTLS_X509_CRT_PARSE_C
1495 *
1496 * Comment this macro to disable support for server name indication in SSL
1497 */
1498 #define MBEDTLS_SSL_SERVER_NAME_INDICATION
1499
1500 /**
1501 * \def MBEDTLS_SSL_TRUNCATED_HMAC
1502 *
1503 * Enable support for RFC 6066 truncated HMAC in SSL.
1504 *
1505 * Comment this macro to disable support for truncated HMAC in SSL
1506 */
1507 #define MBEDTLS_SSL_TRUNCATED_HMAC
1508
1509 /**
1510 * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
1511 *
1512 * Fallback to old (pre-2.7), non-conforming implementation of the truncated
1513 * HMAC extension which also truncates the HMAC key. Note that this option is
1514 * only meant for a transitory upgrade period and is likely to be removed in
1515 * a future version of the library.
1516 *
1517 * \warning The old implementation is non-compliant and has a security weakness
1518 * (2^80 brute force attack on the HMAC key used for a single,
1519 * uninterrupted connection). This should only be enabled temporarily
1520 * when (1) the use of truncated HMAC is essential in order to save
1521 * bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use
1522 * the fixed implementation yet (pre-2.7).
1523 *
1524 * \deprecated This option is deprecated and will likely be removed in a
1525 * future version of Mbed TLS.
1526 *
1527 * Uncomment to fallback to old, non-compliant truncated HMAC implementation.
1528 *
1529 * Requires: MBEDTLS_SSL_TRUNCATED_HMAC
1530 */
1531 //#define MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
1532
1533 /**
1534 * \def MBEDTLS_THREADING_ALT
1535 *
1536 * Provide your own alternate threading implementation.
1537 *
1538 * Requires: MBEDTLS_THREADING_C
1539 *
1540 * Uncomment this to allow your own alternate threading implementation.
1541 */
1542 //#define MBEDTLS_THREADING_ALT
1543
1544 /**
1545 * \def MBEDTLS_THREADING_PTHREAD
1546 *
1547 * Enable the pthread wrapper layer for the threading layer.
1548 *
1549 * Requires: MBEDTLS_THREADING_C
1550 *
1551 * Uncomment this to enable pthread mutexes.
1552 */
1553 //#define MBEDTLS_THREADING_PTHREAD
1554
1555 /**
1556 * \def MBEDTLS_VERSION_FEATURES
1557 *
1558 * Allow run-time checking of compile-time enabled features. Thus allowing users
1559 * to check at run-time if the library is for instance compiled with threading
1560 * support via mbedtls_version_check_feature().
1561 *
1562 * Requires: MBEDTLS_VERSION_C
1563 *
1564 * Comment this to disable run-time checking and save ROM space
1565 */
1566 #define MBEDTLS_VERSION_FEATURES
1567
1568 /**
1569 * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
1570 *
1571 * If set, the X509 parser will not break-off when parsing an X509 certificate
1572 * and encountering an extension in a v1 or v2 certificate.
1573 *
1574 * Uncomment to prevent an error.
1575 */
1576 //#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
1577
1578 /**
1579 * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
1580 *
1581 * If set, the X509 parser will not break-off when parsing an X509 certificate
1582 * and encountering an unknown critical extension.
1583 *
1584 * \warning Depending on your PKI use, enabling this can be a security risk!
1585 *
1586 * Uncomment to prevent an error.
1587 */
1588 //#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
1589
1590 /**
1591 * \def MBEDTLS_X509_CHECK_KEY_USAGE
1592 *
1593 * Enable verification of the keyUsage extension (CA and leaf certificates).
1594 *
1595 * Disabling this avoids problems with mis-issued and/or misused
1596 * (intermediate) CA and leaf certificates.
1597 *
1598 * \warning Depending on your PKI use, disabling this can be a security risk!
1599 *
1600 * Comment to skip keyUsage checking for both CA and leaf certificates.
1601 */
1602 #define MBEDTLS_X509_CHECK_KEY_USAGE
1603
1604 /**
1605 * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
1606 *
1607 * Enable verification of the extendedKeyUsage extension (leaf certificates).
1608 *
1609 * Disabling this avoids problems with mis-issued and/or misused certificates.
1610 *
1611 * \warning Depending on your PKI use, disabling this can be a security risk!
1612 *
1613 * Comment to skip extendedKeyUsage checking for certificates.
1614 */
1615 #define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
1616
1617 /**
1618 * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
1619 *
1620 * Enable parsing and verification of X.509 certificates, CRLs and CSRS
1621 * signed with RSASSA-PSS (aka PKCS#1 v2.1).
1622 *
1623 * Comment this macro to disallow using RSASSA-PSS in certificates.
1624 */
1625 #define MBEDTLS_X509_RSASSA_PSS_SUPPORT
1626
1627 /**
1628 * \def MBEDTLS_ZLIB_SUPPORT
1629 *
1630 * If set, the SSL/TLS module uses ZLIB to support compression and
1631 * decompression of packet data.
1632 *
1633 * \warning TLS-level compression MAY REDUCE SECURITY! See for example the
1634 * CRIME attack. Before enabling this option, you should examine with care if
1635 * CRIME or similar exploits may be a applicable to your use case.
1636 *
1637 * \note Currently compression can't be used with DTLS.
1638 *
1639 * \deprecated This feature is deprecated and will be removed
1640 * in the next major revision of the library.
1641 *
1642 * Used in: library/ssl_tls.c
1643 * library/ssl_cli.c
1644 * library/ssl_srv.c
1645 *
1646 * This feature requires zlib library and headers to be present.
1647 *
1648 * Uncomment to enable use of ZLIB
1649 */
1650 //#define MBEDTLS_ZLIB_SUPPORT
1651 /* \} name SECTION: mbed TLS feature support */
1652
1653 /**
1654 * \name SECTION: mbed TLS modules
1655 *
1656 * This section enables or disables entire modules in mbed TLS
1657 * \{
1658 */
1659
1660 /**
1661 * \def MBEDTLS_AESNI_C
1662 *
1663 * Enable AES-NI support on x86-64.
1664 *
1665 * Module: library/aesni.c
1666 * Caller: library/aes.c
1667 *
1668 * Requires: MBEDTLS_HAVE_ASM
1669 *
1670 * This modules adds support for the AES-NI instructions on x86-64
1671 */
1672 //#define MBEDTLS_AESNI_C
1673
1674 /**
1675 * \def MBEDTLS_AES_C
1676 *
1677 * Enable the AES block cipher.
1678 *
1679 * Module: library/aes.c
1680 * Caller: library/cipher.c
1681 * library/pem.c
1682 * library/ctr_drbg.c
1683 *
1684 * This module enables the following ciphersuites (if other requisites are
1685 * enabled as well):
1686 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1687 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
1688 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1689 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
1690 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
1691 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
1692 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
1693 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
1694 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
1695 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
1696 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
1697 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
1698 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1699 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1700 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
1701 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
1702 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
1703 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
1704 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1705 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1706 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1707 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1708 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1709 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
1710 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
1711 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
1712 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
1713 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1714 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1715 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1716 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
1717 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
1718 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
1719 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
1720 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
1721 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
1722 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
1723 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
1724 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
1725 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
1726 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
1727 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
1728 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
1729 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
1730 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
1731 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
1732 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
1733 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
1734 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
1735 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
1736 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
1737 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
1738 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
1739 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
1740 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
1741 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
1742 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
1743 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
1744 *
1745 * PEM_PARSE uses AES for decrypting encrypted keys.
1746 */
1747 #define MBEDTLS_AES_C
1748
1749 /**
1750 * \def MBEDTLS_ARC4_C
1751 *
1752 * Enable the ARCFOUR stream cipher.
1753 *
1754 * Module: library/arc4.c
1755 * Caller: library/cipher.c
1756 *
1757 * This module enables the following ciphersuites (if other requisites are
1758 * enabled as well):
1759 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
1760 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
1761 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1762 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
1763 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
1764 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
1765 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
1766 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
1767 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
1768 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
1769 *
1770 * \warning ARC4 is considered a weak cipher and its use constitutes a
1771 * security risk. If possible, we recommend avoidng dependencies on
1772 * it, and considering stronger ciphers instead.
1773 *
1774 */
1775 #define MBEDTLS_ARC4_C
1776
1777 /**
1778 * \def MBEDTLS_ASN1_PARSE_C
1779 *
1780 * Enable the generic ASN1 parser.
1781 *
1782 * Module: library/asn1.c
1783 * Caller: library/x509.c
1784 * library/dhm.c
1785 * library/pkcs12.c
1786 * library/pkcs5.c
1787 * library/pkparse.c
1788 */
1789 #define MBEDTLS_ASN1_PARSE_C
1790
1791 /**
1792 * \def MBEDTLS_ASN1_WRITE_C
1793 *
1794 * Enable the generic ASN1 writer.
1795 *
1796 * Module: library/asn1write.c
1797 * Caller: library/ecdsa.c
1798 * library/pkwrite.c
1799 * library/x509_create.c
1800 * library/x509write_crt.c
1801 * library/x509write_csr.c
1802 */
1803 #define MBEDTLS_ASN1_WRITE_C
1804
1805 /**
1806 * \def MBEDTLS_BASE64_C
1807 *
1808 * Enable the Base64 module.
1809 *
1810 * Module: library/base64.c
1811 * Caller: library/pem.c
1812 *
1813 * This module is required for PEM support (required by X.509).
1814 */
1815 #define MBEDTLS_BASE64_C
1816
1817 /**
1818 * \def MBEDTLS_BIGNUM_C
1819 *
1820 * Enable the multi-precision integer library.
1821 *
1822 * Module: library/bignum.c
1823 * Caller: library/dhm.c
1824 * library/ecp.c
1825 * library/ecdsa.c
1826 * library/rsa.c
1827 * library/rsa_internal.c
1828 * library/ssl_tls.c
1829 *
1830 * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support.
1831 */
1832 #define MBEDTLS_BIGNUM_C
1833
1834 /**
1835 * \def MBEDTLS_BLOWFISH_C
1836 *
1837 * Enable the Blowfish block cipher.
1838 *
1839 * Module: library/blowfish.c
1840 */
1841 #define MBEDTLS_BLOWFISH_C
1842
1843 /**
1844 * \def MBEDTLS_CAMELLIA_C
1845 *
1846 * Enable the Camellia block cipher.
1847 *
1848 * Module: library/camellia.c
1849 * Caller: library/cipher.c
1850 *
1851 * This module enables the following ciphersuites (if other requisites are
1852 * enabled as well):
1853 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1854 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1855 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
1856 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
1857 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1858 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1859 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
1860 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
1861 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1862 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1863 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1864 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1865 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
1866 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
1867 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
1868 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1869 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1870 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1871 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1872 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1873 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1874 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
1875 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
1876 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1877 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1878 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
1879 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1880 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1881 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
1882 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
1883 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
1884 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
1885 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
1886 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
1887 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
1888 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
1889 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
1890 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
1891 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
1892 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
1893 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
1894 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
1895 */
1896 #define MBEDTLS_CAMELLIA_C
1897
1898 /**
1899 * \def MBEDTLS_ARIA_C
1900 *
1901 * Enable the ARIA block cipher.
1902 *
1903 * Module: library/aria.c
1904 * Caller: library/cipher.c
1905 *
1906 * This module enables the following ciphersuites (if other requisites are
1907 * enabled as well):
1908 *
1909 * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256
1910 * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384
1911 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256
1912 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384
1913 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256
1914 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384
1915 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256
1916 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384
1917 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256
1918 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384
1919 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256
1920 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384
1921 * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256
1922 * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384
1923 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256
1924 * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384
1925 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256
1926 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384
1927 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256
1928 * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384
1929 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
1930 * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
1931 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256
1932 * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384
1933 * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256
1934 * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384
1935 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256
1936 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384
1937 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256
1938 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384
1939 * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256
1940 * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384
1941 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256
1942 * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384
1943 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256
1944 * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384
1945 * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
1946 * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
1947 */
1948 //#define MBEDTLS_ARIA_C
1949
1950 /**
1951 * \def MBEDTLS_CCM_C
1952 *
1953 * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
1954 *
1955 * Module: library/ccm.c
1956 *
1957 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
1958 *
1959 * This module enables the AES-CCM ciphersuites, if other requisites are
1960 * enabled as well.
1961 */
1962 //#define MBEDTLS_CCM_C
1963
1964 /**
1965 * \def MBEDTLS_CERTS_C
1966 *
1967 * Enable the test certificates.
1968 *
1969 * Module: library/certs.c
1970 * Caller:
1971 *
1972 * This module is used for testing (ssl_client/server).
1973 */
1974 #define MBEDTLS_CERTS_C
1975
1976 /**
1977 * \def MBEDTLS_CHACHA20_C
1978 *
1979 * Enable the ChaCha20 stream cipher.
1980 *
1981 * Module: library/chacha20.c
1982 */
1983 //#define MBEDTLS_CHACHA20_C
1984
1985 /**
1986 * \def MBEDTLS_CHACHAPOLY_C
1987 *
1988 * Enable the ChaCha20-Poly1305 AEAD algorithm.
1989 *
1990 * Module: library/chachapoly.c
1991 *
1992 * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
1993 */
1994 //#define MBEDTLS_CHACHAPOLY_C
1995
1996 /**
1997 * \def MBEDTLS_CIPHER_C
1998 *
1999 * Enable the generic cipher layer.
2000 *
2001 * Module: library/cipher.c
2002 * Caller: library/ssl_tls.c
2003 *
2004 * Uncomment to enable generic cipher wrappers.
2005 */
2006 #define MBEDTLS_CIPHER_C
2007
2008 /**
2009 * \def MBEDTLS_CMAC_C
2010 *
2011 * Enable the CMAC (Cipher-based Message Authentication Code) mode for block
2012 * ciphers.
2013 *
2014 * Module: library/cmac.c
2015 *
2016 * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C
2017 *
2018 */
2019 #define MBEDTLS_CMAC_C
2020
2021 /**
2022 * \def MBEDTLS_CTR_DRBG_C
2023 *
2024 * Enable the CTR_DRBG AES-256-based random generator.
2025 *
2026 * Module: library/ctr_drbg.c
2027 * Caller:
2028 *
2029 * Requires: MBEDTLS_AES_C
2030 *
2031 * This module provides the CTR_DRBG AES-256 random number generator.
2032 */
2033 #define MBEDTLS_CTR_DRBG_C
2034
2035 /**
2036 * \def MBEDTLS_DEBUG_C
2037 *
2038 * Enable the debug functions.
2039 *
2040 * Module: library/debug.c
2041 * Caller: library/ssl_cli.c
2042 * library/ssl_srv.c
2043 * library/ssl_tls.c
2044 *
2045 * This module provides debugging functions.
2046 */
2047 #define MBEDTLS_DEBUG_C
2048
2049 /**
2050 * \def MBEDTLS_DES_C
2051 *
2052 * Enable the DES block cipher.
2053 *
2054 * Module: library/des.c
2055 * Caller: library/pem.c
2056 * library/cipher.c
2057 *
2058 * This module enables the following ciphersuites (if other requisites are
2059 * enabled as well):
2060 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
2061 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
2062 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
2063 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
2064 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
2065 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
2066 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
2067 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
2068 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
2069 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
2070 *
2071 * PEM_PARSE uses DES/3DES for decrypting encrypted keys.
2072 *
2073 * \warning DES is considered a weak cipher and its use constitutes a
2074 * security risk. We recommend considering stronger ciphers instead.
2075 */
2076 #define MBEDTLS_DES_C
2077
2078 /**
2079 * \def MBEDTLS_DHM_C
2080 *
2081 * Enable the Diffie-Hellman-Merkle module.
2082 *
2083 * Module: library/dhm.c
2084 * Caller: library/ssl_cli.c
2085 * library/ssl_srv.c
2086 *
2087 * This module is used by the following key exchanges:
2088 * DHE-RSA, DHE-PSK
2089 *
2090 * \warning Using DHE constitutes a security risk as it
2091 * is not possible to validate custom DH parameters.
2092 * If possible, it is recommended users should consider
2093 * preferring other methods of key exchange.
2094 * See dhm.h for more details.
2095 *
2096 */
2097 //#define MBEDTLS_DHM_C
2098
2099 /**
2100 * \def MBEDTLS_ECDH_C
2101 *
2102 * Enable the elliptic curve Diffie-Hellman library.
2103 *
2104 * Module: library/ecdh.c
2105 * Caller: library/ssl_cli.c
2106 * library/ssl_srv.c
2107 *
2108 * This module is used by the following key exchanges:
2109 * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK
2110 *
2111 * Requires: MBEDTLS_ECP_C
2112 */
2113 #define MBEDTLS_ECDH_C
2114
2115 /**
2116 * \def MBEDTLS_ECDSA_C
2117 *
2118 * Enable the elliptic curve DSA library.
2119 *
2120 * Module: library/ecdsa.c
2121 * Caller:
2122 *
2123 * This module is used by the following key exchanges:
2124 * ECDHE-ECDSA
2125 *
2126 * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C
2127 */
2128 #define MBEDTLS_ECDSA_C
2129
2130 /**
2131 * \def MBEDTLS_ECJPAKE_C
2132 *
2133 * Enable the elliptic curve J-PAKE library.
2134 *
2135 * \warning This is currently experimental. EC J-PAKE support is based on the
2136 * Thread v1.0.0 specification; incompatible changes to the specification
2137 * might still happen. For this reason, this is disabled by default.
2138 *
2139 * Module: library/ecjpake.c
2140 * Caller:
2141 *
2142 * This module is used by the following key exchanges:
2143 * ECJPAKE
2144 *
2145 * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C
2146 */
2147 //#define MBEDTLS_ECJPAKE_C
2148
2149 /**
2150 * \def MBEDTLS_ECP_C
2151 *
2152 * Enable the elliptic curve over GF(p) library.
2153 *
2154 * Module: library/ecp.c
2155 * Caller: library/ecdh.c
2156 * library/ecdsa.c
2157 * library/ecjpake.c
2158 *
2159 * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED
2160 */
2161 #define MBEDTLS_ECP_C
2162
2163 /**
2164 * \def MBEDTLS_ENTROPY_C
2165 *
2166 * Enable the platform-specific entropy code.
2167 *
2168 * Module: library/entropy.c
2169 * Caller:
2170 *
2171 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
2172 *
2173 * This module provides a generic entropy pool
2174 */
2175 #define MBEDTLS_ENTROPY_C
2176
2177 /**
2178 * \def MBEDTLS_ERROR_C
2179 *
2180 * Enable error code to error string conversion.
2181 *
2182 * Module: library/error.c
2183 * Caller:
2184 *
2185 * This module enables mbedtls_strerror().
2186 */
2187 #define MBEDTLS_ERROR_C
2188
2189 /**
2190 * \def MBEDTLS_GCM_C
2191 *
2192 * Enable the Galois/Counter Mode (GCM) for AES.
2193 *
2194 * Module: library/gcm.c
2195 *
2196 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
2197 *
2198 * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other
2199 * requisites are enabled as well.
2200 */
2201 //#define MBEDTLS_GCM_C
2202
2203 /**
2204 * \def MBEDTLS_HAVEGE_C
2205 *
2206 * Enable the HAVEGE random generator.
2207 *
2208 * Warning: the HAVEGE random generator is not suitable for virtualized
2209 * environments
2210 *
2211 * Warning: the HAVEGE random generator is dependent on timing and specific
2212 * processor traits. It is therefore not advised to use HAVEGE as
2213 * your applications primary random generator or primary entropy pool
2214 * input. As a secondary input to your entropy pool, it IS able add
2215 * the (limited) extra entropy it provides.
2216 *
2217 * Module: library/havege.c
2218 * Caller:
2219 *
2220 * Requires: MBEDTLS_TIMING_C
2221 *
2222 * Uncomment to enable the HAVEGE random generator.
2223 */
2224 //#define MBEDTLS_HAVEGE_C
2225
2226 /**
2227 * \def MBEDTLS_HKDF_C
2228 *
2229 * Enable the HKDF algorithm (RFC 5869).
2230 *
2231 * Module: library/hkdf.c
2232 * Caller:
2233 *
2234 * Requires: MBEDTLS_MD_C
2235 *
2236 * This module adds support for the Hashed Message Authentication Code
2237 * (HMAC)-based key derivation function (HKDF).
2238 */
2239 //#define MBEDTLS_HKDF_C
2240
2241 /**
2242 * \def MBEDTLS_HMAC_DRBG_C
2243 *
2244 * Enable the HMAC_DRBG random generator.
2245 *
2246 * Module: library/hmac_drbg.c
2247 * Caller:
2248 *
2249 * Requires: MBEDTLS_MD_C
2250 *
2251 * Uncomment to enable the HMAC_DRBG random number geerator.
2252 */
2253 //#define MBEDTLS_HMAC_DRBG_C
2254
2255 /**
2256 * \def MBEDTLS_NIST_KW_C
2257 *
2258 * Enable the Key Wrapping mode for 128-bit block ciphers,
2259 * as defined in NIST SP 800-38F. Only KW and KWP modes
2260 * are supported. At the moment, only AES is approved by NIST.
2261 *
2262 * Module: library/nist_kw.c
2263 *
2264 * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C
2265 */
2266 //#define MBEDTLS_NIST_KW_C
2267
2268 /**
2269 * \def MBEDTLS_MD_C
2270 *
2271 * Enable the generic message digest layer.
2272 *
2273 * Module: library/md.c
2274 * Caller:
2275 *
2276 * Uncomment to enable generic message digest wrappers.
2277 */
2278 #define MBEDTLS_MD_C
2279
2280 /**
2281 * \def MBEDTLS_MD2_C
2282 *
2283 * Enable the MD2 hash algorithm.
2284 *
2285 * Module: library/md2.c
2286 * Caller:
2287 *
2288 * Uncomment to enable support for (rare) MD2-signed X.509 certs.
2289 *
2290 * \warning MD2 is considered a weak message digest and its use constitutes a
2291 * security risk. If possible, we recommend avoiding dependencies on
2292 * it, and considering stronger message digests instead.
2293 *
2294 */
2295 //#define MBEDTLS_MD2_C
2296
2297 /**
2298 * \def MBEDTLS_MD4_C
2299 *
2300 * Enable the MD4 hash algorithm.
2301 *
2302 * Module: library/md4.c
2303 * Caller:
2304 *
2305 * Uncomment to enable support for (rare) MD4-signed X.509 certs.
2306 *
2307 * \warning MD4 is considered a weak message digest and its use constitutes a
2308 * security risk. If possible, we recommend avoiding dependencies on
2309 * it, and considering stronger message digests instead.
2310 *
2311 */
2312 //#define MBEDTLS_MD4_C
2313
2314 /**
2315 * \def MBEDTLS_MD5_C
2316 *
2317 * Enable the MD5 hash algorithm.
2318 *
2319 * Module: library/md5.c
2320 * Caller: library/md.c
2321 * library/pem.c
2322 * library/ssl_tls.c
2323 *
2324 * This module is required for SSL/TLS up to version 1.1, and for TLS 1.2
2325 * depending on the handshake parameters. Further, it is used for checking
2326 * MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded
2327 * encrypted keys.
2328 *
2329 * \warning MD5 is considered a weak message digest and its use constitutes a
2330 * security risk. If possible, we recommend avoiding dependencies on
2331 * it, and considering stronger message digests instead.
2332 *
2333 */
2334 #define MBEDTLS_MD5_C
2335
2336 /**
2337 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
2338 *
2339 * Enable the buffer allocator implementation that makes use of a (stack)
2340 * based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
2341 * calls)
2342 *
2343 * Module: library/memory_buffer_alloc.c
2344 *
2345 * Requires: MBEDTLS_PLATFORM_C
2346 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS)
2347 *
2348 * Enable this module to enable the buffer memory allocator.
2349 */
2350 //#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
2351
2352 /**
2353 * \def MBEDTLS_NET_C
2354 *
2355 * Enable the TCP and UDP over IPv6/IPv4 networking routines.
2356 *
2357 * \note This module only works on POSIX/Unix (including Linux, BSD and OS X)
2358 * and Windows. For other platforms, you'll want to disable it, and write your
2359 * own networking callbacks to be passed to \c mbedtls_ssl_set_bio().
2360 *
2361 * \note See also our Knowledge Base article about porting to a new
2362 * environment:
2363 * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
2364 *
2365 * Module: library/net_sockets.c
2366 *
2367 * This module provides networking routines.
2368 */
2369 //#define MBEDTLS_NET_C
2370
2371 /**
2372 * \def MBEDTLS_OID_C
2373 *
2374 * Enable the OID database.
2375 *
2376 * Module: library/oid.c
2377 * Caller: library/asn1write.c
2378 * library/pkcs5.c
2379 * library/pkparse.c
2380 * library/pkwrite.c
2381 * library/rsa.c
2382 * library/x509.c
2383 * library/x509_create.c
2384 * library/x509_crl.c
2385 * library/x509_crt.c
2386 * library/x509_csr.c
2387 * library/x509write_crt.c
2388 * library/x509write_csr.c
2389 *
2390 * This modules translates between OIDs and internal values.
2391 */
2392 #define MBEDTLS_OID_C
2393
2394 /**
2395 * \def MBEDTLS_PADLOCK_C
2396 *
2397 * Enable VIA Padlock support on x86.
2398 *
2399 * Module: library/padlock.c
2400 * Caller: library/aes.c
2401 *
2402 * Requires: MBEDTLS_HAVE_ASM
2403 *
2404 * This modules adds support for the VIA PadLock on x86.
2405 */
2406 //#define MBEDTLS_PADLOCK_C
2407
2408 /**
2409 * \def MBEDTLS_PEM_PARSE_C
2410 *
2411 * Enable PEM decoding / parsing.
2412 *
2413 * Module: library/pem.c
2414 * Caller: library/dhm.c
2415 * library/pkparse.c
2416 * library/x509_crl.c
2417 * library/x509_crt.c
2418 * library/x509_csr.c
2419 *
2420 * Requires: MBEDTLS_BASE64_C
2421 *
2422 * This modules adds support for decoding / parsing PEM files.
2423 */
2424 #define MBEDTLS_PEM_PARSE_C
2425
2426 /**
2427 * \def MBEDTLS_PEM_WRITE_C
2428 *
2429 * Enable PEM encoding / writing.
2430 *
2431 * Module: library/pem.c
2432 * Caller: library/pkwrite.c
2433 * library/x509write_crt.c
2434 * library/x509write_csr.c
2435 *
2436 * Requires: MBEDTLS_BASE64_C
2437 *
2438 * This modules adds support for encoding / writing PEM files.
2439 */
2440 #define MBEDTLS_PEM_WRITE_C
2441
2442 /**
2443 * \def MBEDTLS_PK_C
2444 *
2445 * Enable the generic public (asymetric) key layer.
2446 *
2447 * Module: library/pk.c
2448 * Caller: library/ssl_tls.c
2449 * library/ssl_cli.c
2450 * library/ssl_srv.c
2451 *
2452 * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C
2453 *
2454 * Uncomment to enable generic public key wrappers.
2455 */
2456 #define MBEDTLS_PK_C
2457
2458 /**
2459 * \def MBEDTLS_PK_PARSE_C
2460 *
2461 * Enable the generic public (asymetric) key parser.
2462 *
2463 * Module: library/pkparse.c
2464 * Caller: library/x509_crt.c
2465 * library/x509_csr.c
2466 *
2467 * Requires: MBEDTLS_PK_C
2468 *
2469 * Uncomment to enable generic public key parse functions.
2470 */
2471 #define MBEDTLS_PK_PARSE_C
2472
2473 /**
2474 * \def MBEDTLS_PK_WRITE_C
2475 *
2476 * Enable the generic public (asymetric) key writer.
2477 *
2478 * Module: library/pkwrite.c
2479 * Caller: library/x509write.c
2480 *
2481 * Requires: MBEDTLS_PK_C
2482 *
2483 * Uncomment to enable generic public key write functions.
2484 */
2485 #define MBEDTLS_PK_WRITE_C
2486
2487 /**
2488 * \def MBEDTLS_PKCS5_C
2489 *
2490 * Enable PKCS#5 functions.
2491 *
2492 * Module: library/pkcs5.c
2493 *
2494 * Requires: MBEDTLS_MD_C
2495 *
2496 * This module adds support for the PKCS#5 functions.
2497 */
2498 #define MBEDTLS_PKCS5_C
2499
2500 /**
2501 * \def MBEDTLS_PKCS11_C
2502 *
2503 * Enable wrapper for PKCS#11 smartcard support.
2504 *
2505 * Module: library/pkcs11.c
2506 * Caller: library/pk.c
2507 *
2508 * Requires: MBEDTLS_PK_C
2509 *
2510 * This module enables SSL/TLS PKCS #11 smartcard support.
2511 * Requires the presence of the PKCS#11 helper library (libpkcs11-helper)
2512 */
2513 //#define MBEDTLS_PKCS11_C
2514
2515 /**
2516 * \def MBEDTLS_PKCS12_C
2517 *
2518 * Enable PKCS#12 PBE functions.
2519 * Adds algorithms for parsing PKCS#8 encrypted private keys
2520 *
2521 * Module: library/pkcs12.c
2522 * Caller: library/pkparse.c
2523 *
2524 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2525 * Can use: MBEDTLS_ARC4_C
2526 *
2527 * This module enables PKCS#12 functions.
2528 */
2529 #define MBEDTLS_PKCS12_C
2530
2531 /**
2532 * \def MBEDTLS_PLATFORM_C
2533 *
2534 * Enable the platform abstraction layer that allows you to re-assign
2535 * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit().
2536 *
2537 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
2538 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
2539 * above to be specified at runtime or compile time respectively.
2540 *
2541 * \note This abstraction layer must be enabled on Windows (including MSYS2)
2542 * as other module rely on it for a fixed snprintf implementation.
2543 *
2544 * Module: library/platform.c
2545 * Caller: Most other .c files
2546 *
2547 * This module enables abstraction of common (libc) functions.
2548 */
2549 #define MBEDTLS_PLATFORM_C
2550
2551 /**
2552 * \def MBEDTLS_POLY1305_C
2553 *
2554 * Enable the Poly1305 MAC algorithm.
2555 *
2556 * Module: library/poly1305.c
2557 * Caller: library/chachapoly.c
2558 */
2559 //#define MBEDTLS_POLY1305_C
2560
2561 /**
2562 * \def MBEDTLS_RIPEMD160_C
2563 *
2564 * Enable the RIPEMD-160 hash algorithm.
2565 *
2566 * Module: library/ripemd160.c
2567 * Caller: library/md.c
2568 *
2569 */
2570 //#define MBEDTLS_RIPEMD160_C
2571
2572 /**
2573 * \def MBEDTLS_RSA_C
2574 *
2575 * Enable the RSA public-key cryptosystem.
2576 *
2577 * Module: library/rsa.c
2578 * library/rsa_internal.c
2579 * Caller: library/ssl_cli.c
2580 * library/ssl_srv.c
2581 * library/ssl_tls.c
2582 * library/x509.c
2583 *
2584 * This module is used by the following key exchanges:
2585 * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK
2586 *
2587 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C
2588 */
2589 #define MBEDTLS_RSA_C
2590
2591 /**
2592 * \def MBEDTLS_SHA1_C
2593 *
2594 * Enable the SHA1 cryptographic hash algorithm.
2595 *
2596 * Module: library/sha1.c
2597 * Caller: library/md.c
2598 * library/ssl_cli.c
2599 * library/ssl_srv.c
2600 * library/ssl_tls.c
2601 * library/x509write_crt.c
2602 *
2603 * This module is required for SSL/TLS up to version 1.1, for TLS 1.2
2604 * depending on the handshake parameters, and for SHA1-signed certificates.
2605 *
2606 * \warning SHA-1 is considered a weak message digest and its use constitutes
2607 * a security risk. If possible, we recommend avoiding dependencies
2608 * on it, and considering stronger message digests instead.
2609 *
2610 */
2611 #define MBEDTLS_SHA1_C
2612
2613 /**
2614 * \def MBEDTLS_SHA256_C
2615 *
2616 * Enable the SHA-224 and SHA-256 cryptographic hash algorithms.
2617 *
2618 * Module: library/sha256.c
2619 * Caller: library/entropy.c
2620 * library/md.c
2621 * library/ssl_cli.c
2622 * library/ssl_srv.c
2623 * library/ssl_tls.c
2624 *
2625 * This module adds support for SHA-224 and SHA-256.
2626 * This module is required for the SSL/TLS 1.2 PRF function.
2627 */
2628 #define MBEDTLS_SHA256_C
2629
2630 /**
2631 * \def MBEDTLS_SHA512_C
2632 *
2633 * Enable the SHA-384 and SHA-512 cryptographic hash algorithms.
2634 *
2635 * Module: library/sha512.c
2636 * Caller: library/entropy.c
2637 * library/md.c
2638 * library/ssl_cli.c
2639 * library/ssl_srv.c
2640 *
2641 * This module adds support for SHA-384 and SHA-512.
2642 */
2643 #define MBEDTLS_SHA512_C
2644
2645 /**
2646 * \def MBEDTLS_SSL_CACHE_C
2647 *
2648 * Enable simple SSL cache implementation.
2649 *
2650 * Module: library/ssl_cache.c
2651 * Caller:
2652 *
2653 * Requires: MBEDTLS_SSL_CACHE_C
2654 */
2655 #define MBEDTLS_SSL_CACHE_C
2656
2657 /**
2658 * \def MBEDTLS_SSL_COOKIE_C
2659 *
2660 * Enable basic implementation of DTLS cookies for hello verification.
2661 *
2662 * Module: library/ssl_cookie.c
2663 * Caller:
2664 */
2665 #define MBEDTLS_SSL_COOKIE_C
2666
2667 /**
2668 * \def MBEDTLS_SSL_TICKET_C
2669 *
2670 * Enable an implementation of TLS server-side callbacks for session tickets.
2671 *
2672 * Module: library/ssl_ticket.c
2673 * Caller:
2674 *
2675 * Requires: MBEDTLS_CIPHER_C
2676 */
2677 #define MBEDTLS_SSL_TICKET_C
2678
2679 /**
2680 * \def MBEDTLS_SSL_CLI_C
2681 *
2682 * Enable the SSL/TLS client code.
2683 *
2684 * Module: library/ssl_cli.c
2685 * Caller:
2686 *
2687 * Requires: MBEDTLS_SSL_TLS_C
2688 *
2689 * This module is required for SSL/TLS client support.
2690 */
2691 //#define MBEDTLS_SSL_CLI_C
2692
2693 /**
2694 * \def MBEDTLS_SSL_SRV_C
2695 *
2696 * Enable the SSL/TLS server code.
2697 *
2698 * Module: library/ssl_srv.c
2699 * Caller:
2700 *
2701 * Requires: MBEDTLS_SSL_TLS_C
2702 *
2703 * This module is required for SSL/TLS server support.
2704 */
2705 //#define MBEDTLS_SSL_SRV_C
2706
2707 /**
2708 * \def MBEDTLS_SSL_TLS_C
2709 *
2710 * Enable the generic SSL/TLS code.
2711 *
2712 * Module: library/ssl_tls.c
2713 * Caller: library/ssl_cli.c
2714 * library/ssl_srv.c
2715 *
2716 * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2717 * and at least one of the MBEDTLS_SSL_PROTO_XXX defines
2718 *
2719 * This module is required for SSL/TLS.
2720 */
2721 //#define MBEDTLS_SSL_TLS_C
2722
2723 /**
2724 * \def MBEDTLS_THREADING_C
2725 *
2726 * Enable the threading abstraction layer.
2727 * By default mbed TLS assumes it is used in a non-threaded environment or that
2728 * contexts are not shared between threads. If you do intend to use contexts
2729 * between threads, you will need to enable this layer to prevent race
2730 * conditions. See also our Knowledge Base article about threading:
2731 * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
2732 *
2733 * Module: library/threading.c
2734 *
2735 * This allows different threading implementations (self-implemented or
2736 * provided).
2737 *
2738 * You will have to enable either MBEDTLS_THREADING_ALT or
2739 * MBEDTLS_THREADING_PTHREAD.
2740 *
2741 * Enable this layer to allow use of mutexes within mbed TLS
2742 */
2743 //#define MBEDTLS_THREADING_C
2744
2745 /**
2746 * \def MBEDTLS_TIMING_C
2747 *
2748 * Enable the semi-portable timing interface.
2749 *
2750 * \note The provided implementation only works on POSIX/Unix (including Linux,
2751 * BSD and OS X) and Windows. On other platforms, you can either disable that
2752 * module and provide your own implementations of the callbacks needed by
2753 * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide
2754 * your own implementation of the whole module by setting
2755 * \c MBEDTLS_TIMING_ALT in the current file.
2756 *
2757 * \note See also our Knowledge Base article about porting to a new
2758 * environment:
2759 * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
2760 *
2761 * Module: library/timing.c
2762 * Caller: library/havege.c
2763 *
2764 * This module is used by the HAVEGE random number generator.
2765 */
2766 #define MBEDTLS_TIMING_C
2767
2768 /**
2769 * \def MBEDTLS_VERSION_C
2770 *
2771 * Enable run-time version information.
2772 *
2773 * Module: library/version.c
2774 *
2775 * This module provides run-time version information.
2776 */
2777 #define MBEDTLS_VERSION_C
2778
2779 /**
2780 * \def MBEDTLS_X509_USE_C
2781 *
2782 * Enable X.509 core for using certificates.
2783 *
2784 * Module: library/x509.c
2785 * Caller: library/x509_crl.c
2786 * library/x509_crt.c
2787 * library/x509_csr.c
2788 *
2789 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C,
2790 * MBEDTLS_PK_PARSE_C
2791 *
2792 * This module is required for the X.509 parsing modules.
2793 */
2794 #define MBEDTLS_X509_USE_C
2795
2796 /**
2797 * \def MBEDTLS_X509_CRT_PARSE_C
2798 *
2799 * Enable X.509 certificate parsing.
2800 *
2801 * Module: library/x509_crt.c
2802 * Caller: library/ssl_cli.c
2803 * library/ssl_srv.c
2804 * library/ssl_tls.c
2805 *
2806 * Requires: MBEDTLS_X509_USE_C
2807 *
2808 * This module is required for X.509 certificate parsing.
2809 */
2810 #define MBEDTLS_X509_CRT_PARSE_C
2811
2812 /**
2813 * \def MBEDTLS_X509_CRL_PARSE_C
2814 *
2815 * Enable X.509 CRL parsing.
2816 *
2817 * Module: library/x509_crl.c
2818 * Caller: library/x509_crt.c
2819 *
2820 * Requires: MBEDTLS_X509_USE_C
2821 *
2822 * This module is required for X.509 CRL parsing.
2823 */
2824 #define MBEDTLS_X509_CRL_PARSE_C
2825
2826 /**
2827 * \def MBEDTLS_X509_CSR_PARSE_C
2828 *
2829 * Enable X.509 Certificate Signing Request (CSR) parsing.
2830 *
2831 * Module: library/x509_csr.c
2832 * Caller: library/x509_crt_write.c
2833 *
2834 * Requires: MBEDTLS_X509_USE_C
2835 *
2836 * This module is used for reading X.509 certificate request.
2837 */
2838 #define MBEDTLS_X509_CSR_PARSE_C
2839
2840 /**
2841 * \def MBEDTLS_X509_CREATE_C
2842 *
2843 * Enable X.509 core for creating certificates.
2844 *
2845 * Module: library/x509_create.c
2846 *
2847 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C
2848 *
2849 * This module is the basis for creating X.509 certificates and CSRs.
2850 */
2851 #define MBEDTLS_X509_CREATE_C
2852
2853 /**
2854 * \def MBEDTLS_X509_CRT_WRITE_C
2855 *
2856 * Enable creating X.509 certificates.
2857 *
2858 * Module: library/x509_crt_write.c
2859 *
2860 * Requires: MBEDTLS_X509_CREATE_C
2861 *
2862 * This module is required for X.509 certificate creation.
2863 */
2864 #define MBEDTLS_X509_CRT_WRITE_C
2865
2866 /**
2867 * \def MBEDTLS_X509_CSR_WRITE_C
2868 *
2869 * Enable creating X.509 Certificate Signing Requests (CSR).
2870 *
2871 * Module: library/x509_csr_write.c
2872 *
2873 * Requires: MBEDTLS_X509_CREATE_C
2874 *
2875 * This module is required for X.509 certificate request writing.
2876 */
2877 #define MBEDTLS_X509_CSR_WRITE_C
2878
2879 /**
2880 * \def MBEDTLS_XTEA_C
2881 *
2882 * Enable the XTEA block cipher.
2883 *
2884 * Module: library/xtea.c
2885 * Caller:
2886 */
2887 //#define MBEDTLS_XTEA_C
2888
2889 /* \} name SECTION: mbed TLS modules */
2890
2891 /**
2892 * \name SECTION: Module configuration options
2893 *
2894 * This section allows for the setting of module specific sizes and
2895 * configuration options. The default values are already present in the
2896 * relevant header files and should suffice for the regular use cases.
2897 *
2898 * Our advice is to enable options and change their values here
2899 * only if you have a good reason and know the consequences.
2900 *
2901 * Please check the respective header file for documentation on these
2902 * parameters (to prevent duplicate documentation).
2903 * \{
2904 */
2905
2906 /* MPI / BIGNUM options */
2907 //#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */
2908 //#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */
2909
2910 /* CTR_DRBG options */
2911 //#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */
2912 //#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2913 //#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2914 //#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2915 //#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
2916
2917 /* HMAC_DRBG options */
2918 //#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2919 //#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2920 //#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2921 //#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
2922
2923 /* ECP options */
2924 //#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */
2925 //#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
2926 //#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
2927
2928 /* Entropy options */
2929 //#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
2930 //#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
2931 //#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */
2932
2933 /* Memory buffer allocator options */
2934 //#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */
2935
2936 /* Platform options */
2937 //#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
2938 //#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */
2939 //#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */
2940 //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
2941 //#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2942 //#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
2943 //#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */
2944 /* Note: your snprintf must correclty zero-terminate the buffer! */
2945 //#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */
2946 //#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */
2947 //#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */
2948 //#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
2949 //#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
2950 //#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */
2951
2952 /* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */
2953 /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
2954 //#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */
2955 //#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */
2956 //#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
2957 //#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2958 //#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2959 //#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */
2960 //#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */
2961 /* Note: your snprintf must correclty zero-terminate the buffer! */
2962 //#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */
2963 //#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
2964 //#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
2965
2966 /* SSL Cache options */
2967 //#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */
2968 //#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */
2969
2970 /* SSL options */
2971
2972 /** \def MBEDTLS_SSL_MAX_CONTENT_LEN
2973 *
2974 * Maximum fragment length in bytes.
2975 *
2976 * Determines the size of both the incoming and outgoing TLS I/O buffers.
2977 *
2978 * Uncommenting MBEDTLS_SSL_IN_CONTENT_LEN and/or MBEDTLS_SSL_OUT_CONTENT_LEN
2979 * will override this length by setting maximum incoming and/or outgoing
2980 * fragment length, respectively.
2981 */
2982 //#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384
2983
2984 /** \def MBEDTLS_SSL_IN_CONTENT_LEN
2985 *
2986 * Maximum incoming fragment length in bytes.
2987 *
2988 * Uncomment to set the size of the inward TLS buffer independently of the
2989 * outward buffer.
2990 */
2991 //#define MBEDTLS_SSL_IN_CONTENT_LEN 16384
2992
2993 /** \def MBEDTLS_SSL_OUT_CONTENT_LEN
2994 *
2995 * Maximum outgoing fragment length in bytes.
2996 *
2997 * Uncomment to set the size of the outward TLS buffer independently of the
2998 * inward buffer.
2999 *
3000 * It is possible to save RAM by setting a smaller outward buffer, while keeping
3001 * the default inward 16384 byte buffer to conform to the TLS specification.
3002 *
3003 * The minimum required outward buffer size is determined by the handshake
3004 * protocol's usage. Handshaking will fail if the outward buffer is too small.
3005 * The specific size requirement depends on the configured ciphers and any
3006 * certificate data which is sent during the handshake.
3007 *
3008 * For absolute minimum RAM usage, it's best to enable
3009 * MBEDTLS_SSL_MAX_FRAGMENT_LENGTH and reduce MBEDTLS_SSL_MAX_CONTENT_LEN. This
3010 * reduces both incoming and outgoing buffer sizes. However this is only
3011 * guaranteed if the other end of the connection also supports the TLS
3012 * max_fragment_len extension. Otherwise the connection may fail.
3013 */
3014 //#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384
3015
3016 /** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING
3017 *
3018 * Maximum number of heap-allocated bytes for the purpose of
3019 * DTLS handshake message reassembly and future message buffering.
3020 *
3021 * This should be at least 9/8 * MBEDTLSSL_IN_CONTENT_LEN
3022 * to account for a reassembled handshake message of maximum size,
3023 * together with its reassembly bitmap.
3024 *
3025 * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default)
3026 * should be sufficient for all practical situations as it allows
3027 * to reassembly a large handshake message (such as a certificate)
3028 * while buffering multiple smaller handshake messages.
3029 *
3030 */
3031 //#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768
3032
3033 //#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */
3034 //#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */
3035 //#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
3036
3037 /**
3038 * Complete list of ciphersuites to use, in order of preference.
3039 *
3040 * \warning No dependency checking is done on that field! This option can only
3041 * be used to restrict the set of available ciphersuites. It is your
3042 * responsibility to make sure the needed modules are active.
3043 *
3044 * Use this to save a few hundred bytes of ROM (default ordering of all
3045 * available ciphersuites) and a few to a few hundred bytes of RAM.
3046 *
3047 * The value below is only an example, not the default.
3048 */
3049 //#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
3050
3051 /* X509 options */
3052 //#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
3053 //#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
3054
3055 /**
3056 * Allow SHA-1 in the default TLS configuration for certificate signing.
3057 * Without this build-time option, SHA-1 support must be activated explicitly
3058 * through mbedtls_ssl_conf_cert_profile. Turning on this option is not
3059 * recommended because of it is possible to generate SHA-1 collisions, however
3060 * this may be safe for legacy infrastructure where additional controls apply.
3061 *
3062 * \warning SHA-1 is considered a weak message digest and its use constitutes
3063 * a security risk. If possible, we recommend avoiding dependencies
3064 * on it, and considering stronger message digests instead.
3065 *
3066 */
3067 // #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES
3068
3069 /**
3070 * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake
3071 * signature and ciphersuite selection. Without this build-time option, SHA-1
3072 * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes.
3073 * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by
3074 * default. At the time of writing, there is no practical attack on the use
3075 * of SHA-1 in handshake signatures, hence this option is turned on by default
3076 * to preserve compatibility with existing peers, but the general
3077 * warning applies nonetheless:
3078 *
3079 * \warning SHA-1 is considered a weak message digest and its use constitutes
3080 * a security risk. If possible, we recommend avoiding dependencies
3081 * on it, and considering stronger message digests instead.
3082 *
3083 */
3084 #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE
3085
3086 /**
3087 * Uncomment the macro to let mbed TLS use your alternate implementation of
3088 * mbedtls_platform_zeroize(). This replaces the default implementation in
3089 * platform_util.c.
3090 *
3091 * mbedtls_platform_zeroize() is a widely used function across the library to
3092 * zero a block of memory. The implementation is expected to be secure in the
3093 * sense that it has been written to prevent the compiler from removing calls
3094 * to mbedtls_platform_zeroize() as part of redundant code elimination
3095 * optimizations. However, it is difficult to guarantee that calls to
3096 * mbedtls_platform_zeroize() will not be optimized by the compiler as older
3097 * versions of the C language standards do not provide a secure implementation
3098 * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to
3099 * configure their own implementation of mbedtls_platform_zeroize(), for
3100 * example by using directives specific to their compiler, features from newer
3101 * C standards (e.g using memset_s() in C11) or calling a secure memset() from
3102 * their system (e.g explicit_bzero() in BSD).
3103 */
3104 //#define MBEDTLS_PLATFORM_ZEROIZE_ALT
3105
3106 /* \} name SECTION: Customisation configuration options */
3107
3108 /* Target and application specific configurations */
3109 //#define YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE "target_config.h"
3110
3111 #if defined(TARGET_LIKE_MBED) && defined(YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE)
3112 #include YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE
3113 #endif
3114
3115 /*
3116 * Allow user to override any previous default.
3117 *
3118 * Use two macro names for that, as:
3119 * - with yotta the prefix YOTTA_CFG_ is forced
3120 * - without yotta is looks weird to have a YOTTA prefix.
3121 */
3122 #if defined(YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE)
3123 #include YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE
3124 #elif defined(MBEDTLS_USER_CONFIG_FILE)
3125 #include MBEDTLS_USER_CONFIG_FILE
3126 #endif
3127
3128 #include "check_config.h"
3129
3130 #endif /* MBEDTLS_CONFIG_H */
Impressum, Datenschutz