You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by ac...@apache.org on 2026/10/16 12:19:30 UTC
(nuttx-apps) 01/02: crypto/mbedtls: Allow a minimal crypto-only configuration.
This is an automated email from the ASF dual-hosted git repository.
acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
commit c16a266ac968d906edc158817fef76d395c718bf
Author: raiden00pl <ra...@railab.me>
AuthorDate: Wed Oct 14 10:58:32 2026 +0200
crypto/mbedtls: Allow a minimal crypto-only configuration.
Mbed TLS defaults suit full TLS stacks. Libraries that only need a few
primitives, such as NimBLE, still build every cipher and curve, and the
generic cipher layer links them all.
Add MBEDTLS_MINIMAL, which turns all optional module defaults off so
only selected or explicitly enabled options are built. Make the modules
that were always defined in mbedtls_config.h configurable, defaulting
to enabled unless MBEDTLS_MINIMAL is set. Add options for
MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH, MBEDTLS_AES_FEWER_TABLES and
MBEDTLS_BLOCK_CIPHER_NO_DECRYPT.
Without MBEDTLS_MINIMAL the configuration is unchanged.
Tested: nrf54l15-tag NimBLE mesh build; the linked Mbed TLS for NimBLE
shrinks from 57 KB flash and 9 KB RAM to about 21 KB flash and no RAM.
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: raiden00pl <ra...@railab.me>
---
crypto/mbedtls/Kconfig | 312 +++++++++++++++---------
crypto/mbedtls/include/mbedtls/mbedtls_config.h | 38 ++-
2 files changed, 227 insertions(+), 123 deletions(-)
diff --git a/crypto/mbedtls/Kconfig b/crypto/mbedtls/Kconfig
index 53b043017..8b418e575 100644
--- a/crypto/mbedtls/Kconfig
+++ b/crypto/mbedtls/Kconfig
@@ -15,6 +15,14 @@ config MBEDTLS_VERSION
string "Mbed TLS Version"
default "3.6.2"
+config MBEDTLS_MINIMAL
+ bool "Minimal configuration"
+ default n
+ ---help---
+ Disable optional modules and features by default. Only options
+ that are selected or explicitly enabled are built. Use this when
+ Mbed TLS only backs another library's crypto, for example NimBLE.
+
config MBEDTLS_DEBUG_C
bool "This module provides debugging functions."
default DEBUG_CRYPTO_INFO
@@ -35,7 +43,7 @@ config MBEDTLS_SSL_OUT_CONTENT_LEN
config MBEDTLS_SSL_SRV_C
bool "This module is required for SSL/TLS server support."
- default y
+ default !MBEDTLS_MINIMAL
---help---
This module is required for SSL/TLS server support.
@@ -70,7 +78,7 @@ config MBEDTLS_SELF_TEST
config MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
bool "Enable server-side support for clients that reconnect from the same port."
depends on MBEDTLS_SSL_DTLS_HELLO_VERIFY
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_BLOWFISH_C
bool "Enable the Blowfish block cipher."
@@ -78,37 +86,37 @@ config MBEDTLS_BLOWFISH_C
config MBEDTLS_CAMELLIA_C
bool "Enable the Camellia block cipher."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PADLOCK_C
bool "Enable VIA Padlock support on x86."
- default !MBEDTLS_AES_ALT
+ default !MBEDTLS_AES_ALT && !MBEDTLS_MINIMAL
config MBEDTLS_TIMING_C
bool "Enable the semi-portable timing interface."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
bool "Enable the availability of the API mbedtls_ssl_get_peer_cert() giving access to the peer's certificate after completion of the handshake."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_PROTO_DTLS
bool "Enable support for DTLS (all available versions)."
- default y
+ default !MBEDTLS_MINIMAL
if MBEDTLS_SSL_PROTO_DTLS
config MBEDTLS_SSL_DTLS_ANTI_REPLAY
bool "Enable support for the anti-replay mechanism in DTLS."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_DTLS_HELLO_VERIFY
bool "Enable support for HelloVerifyRequest on DTLS servers."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_DTLS_CONNECTION_ID
bool "Enable support for the DTLS Connection ID (CID) extension."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT
int "Enable the standard version of DTLS Connection ID feature."
@@ -119,7 +127,7 @@ endif # MBEDTLS_SSL_PROTO_DTLS
config MBEDTLS_SSL_ALPN
bool "Enable support for RFC 7301 Application Layer Protocol Negotiation."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_AESNI_C
bool "Enable AES-NI support on x86-64."
@@ -136,7 +144,7 @@ config MBEDTLS_ECP_FIXED_POINT_OPTIM
config MBEDTLS_CMAC_C
bool "Enable the CMAC (Cipher-based Message Authentication Code) mode for block"
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_NET_C
bool "Enable the TCP and UDP over IPv6/IPv4 networking routines"
@@ -144,56 +152,56 @@ config MBEDTLS_NET_C
config MBEDTLS_OID_C
bool "Enable the OID database."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECDSA_C
bool "Enable the elliptic curve DSA library."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_C
bool "Enable the elliptic curve over GF(p) library."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP256R1_ENABLED
bool "Enables specific curves within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PEM_WRITE_C
bool "Enable PEM encoding / writing."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PK_C
bool "Enable the generic public (asymmetric) key layer."
depends on MBEDTLS_MD_C && MBEDTLS_RSA_C && MBEDTLS_ECP_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PK_PARSE_C
bool "Enable the generic public (asymmetric) key parser"
depends on MBEDTLS_ASN1_PARSE_C && MBEDTLS_OID_C && MBEDTLS_PK_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PK_WRITE_C
bool "Enable the generic public (asymmetric) key writer."
depends on MBEDTLS_ASN1_WRITE_C && MBEDTLS_OID_C && MBEDTLS_PK_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CREATE_C
bool "Enable X.509 core for creating certificates."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CRT_WRITE_C
bool "Enable creating X.509 certificates."
depends on MBEDTLS_X509_CREATE_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CSR_WRITE_C
bool "Enable creating X.509 Certificate Signing Requests (CSR)."
depends on MBEDTLS_X509_CREATE_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CSR_PARSE_C
bool "Enable X.509 Certificate Signing Request (CSR) parsing."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CRT_POOL
bool "Enable the X509 Certificate Pool"
@@ -206,87 +214,87 @@ config MBEDTLS_HAVE_ASM
config MBEDTLS_HAVE_TIME_DATE
bool "Enable to verify the validity period of X.509 certificates when system have correct clock."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_MODE_CFB
bool "Enable Cipher Feedback mode (CFB) for symmetric ciphers."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_MODE_CTR
bool "Enable Counter Block Cipher mode (CTR) for symmetric ciphers."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_MODE_OFB
bool "Enable Output Feedback mode (OFB) for symmetric ciphers."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_MODE_XTS
bool "Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_PADDING_PKCS7
bool "Enable PKCS7 padding mode in the cipher layer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
bool "Enable bit padding mode in the cipher layer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
bool "Enable zero and length padding mode in the cipher layer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CIPHER_PADDING_ZEROS
bool "Enable zeros padding mode in the cipher layer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP192R1_ENABLED
bool "Enables SECP192R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP224R1_ENABLED
bool "Enables SECP224R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP384R1_ENABLED
bool "Enables SECP384R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP521R1_ENABLED
bool "Enables SECP521R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP192K1_ENABLED
bool "Enables SECP192K1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP224K1_ENABLED
bool "Enables SECP224K1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_SECP256K1_ENABLED
bool "Enables SECP256K1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_BP256R1_ENABLED
bool "Enables BP256R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_BP384R1_ENABLED
bool "Enables BP384R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_BP512R1_ENABLED
bool "Enables BP512R1 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_CURVE25519_ENABLED
bool "Enables CURVE25519 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_DP_CURVE448_ENABLED
bool "Enables CURVE448 curve within the Elliptic Curve module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_NIST_OPTIM
bool "Enable specific 'modulo p' routines for each NIST prime."
@@ -295,69 +303,69 @@ config MBEDTLS_ECP_NIST_OPTIM
config MBEDTLS_ECDSA_DETERMINISTIC
bool "Enable deterministic ECDSA (RFC 6979)."
depends on MBEDTLS_HMAC_DRBG_C && MBEDTLS_ECDSA_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
bool "Enable the PSK based ciphersuite modes in SSL / TLS."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
bool "Enable the DHE-PSK based ciphersuite modes in SSL / TLS."
depends on MBEDTLS_DHM_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
bool "Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS."
depends on MBEDTLS_ECDH_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
bool "Enable the RSA-PSK based ciphersuite modes in SSL / TLS."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
bool "Enable the DHE-RSA based ciphersuite modes in SSL / TLS."
depends on MBEDTLS_DHM_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
bool "Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS."
depends on MBEDTLS_ECDH_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
bool "Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS."
depends on MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
bool "Enable the ECDH-RSA based ciphersuite modes in SSL / TLS."
depends on MBEDTLS_ECDH_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PK_PARSE_EC_EXTENDED
bool "Enhance support for reading EC keys using variants of SEC1 not allowed by RFC 5915 and RFC 5480."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PK_PARSE_EC_COMPRESSED
bool "Enable the support for parsing public keys of type Short Weierstrass (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX) which are using the compressed point format."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ERROR_STRERROR_DUMMY
bool "Enable a dummy error function to make use of mbedtls_strerror()."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_GENPRIME
bool "Enable the prime-number generation code."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PK_RSA_ALT_SUPPORT
bool "Support external private RSA keys (eg from a HSM) in the PK layer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PKCS1_V21
bool "Enable support for PKCS#1 v2.1 encoding."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
bool "Make the PSA Crypto module use an external random generator provided by a driver, instead of Mbed TLS's entropy and DRBG modules."
@@ -367,7 +375,7 @@ config MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
config MBEDTLS_PSA_KEY_STORE_DYNAMIC
bool "Dynamically resize the PSA key store to accommodate any number of volatile keys (until the heap memory is exhausted)."
depends on MBEDTLS_PSA_CRYPTO_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
bool "Assume all buffers passed to PSA functions are owned exclusively by the PSA function and are not stored in shared memory."
@@ -376,29 +384,29 @@ config MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
config MBEDTLS_SSL_CONTEXT_SERIALIZATION
bool "Enable serialization of the TLS context structures."
depends on MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_ENCRYPT_THEN_MAC
bool "Enable support for Encrypt-then-MAC, RFC 7366."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_EXTENDED_MASTER_SECRET
bool "Enable Session Hash and Extended Master Secret Extension."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_RENEGOTIATION
bool "Enable support for TLS renegotiation."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
bool "Enable support for RFC 6066 max_fragment_length extension in SSL."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_PROTO_TLS1_2
bool "Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled)."
depends on (MBEDTLS_USE_PSA_CRYPTO ||\
(MBEDTLS_MD_C && (MBEDTLS_SHA256_C || MBEDTLS_SHA384_C)))
- default y
+ default !MBEDTLS_MINIMAL
---help---
If MBEDTLS_USE_PSA_CRYPTO is set, then PSA_WANT_ALG_SHA_256 or PSA_WANT_ALG_SHA_384
must be defined.
@@ -406,21 +414,21 @@ config MBEDTLS_SSL_PROTO_TLS1_2
config MBEDTLS_SSL_PROTO_TLS1_3
bool "Enable support for TLS 1.3."
depends on MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_PSA_CRYPTO_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
bool "Enable TLS 1.3 middlebox compatibility mode."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
bool "Enable TLS 1.3 PSK key exchange mode."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
bool "Enable TLS 1.3 ephemeral key exchange mode."
depends on MBEDTLS_X509_CRT_PARSE_C && \
(MBEDTLS_ECDSA_C || MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_PKCS1_V21)
- default y
+ default !MBEDTLS_MINIMAL
---help---
Requires PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH to be defined. Also, if
MBEDTLS_USE_PSA_CRYPTO is used to satisfy its dependencies, then PSA_WANT_ALG_ECDSA
@@ -428,17 +436,17 @@ config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
bool "Enable TLS 1.3 PSK ephemeral key exchange mode."
- default y
+ default !MBEDTLS_MINIMAL
---help---
Requires PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH.
config MBEDTLS_SSL_SESSION_TICKETS
bool "Enable support for RFC 5077 session tickets in SSL."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_SERVER_NAME_INDICATION
bool "Enable support for RFC 6066 server name indication (SNI) in SSL."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_THREADING_PTHREAD
bool "Enable the pthread wrapper layer for the threading layer."
@@ -453,29 +461,29 @@ config MBEDTLS_USE_PSA_CRYPTO
config MBEDTLS_VERSION_FEATURES
bool "Allow run-time checking of compile-time enabled features."
depends on MBEDTLS_VERSION_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_RSASSA_PSS_SUPPORT
bool "Enable parsing and verification of X.509 certificates, CRLs and CSRS signed with RSASSA-PSS."
depends on MBEDTLS_PKCS1_V21
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_AESCE_C
bool "Enable AES cryptographic extension support on 64-bit Arm."
depends on MBEDTLS_AES_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_AES_C
bool "Enable the AES block cipher."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ASN1_PARSE_C
bool "Enable the generic ASN1 parser."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ASN1_WRITE_C
bool "Enable the generic ASN1 writer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ARC4_C
bool "Enable the ARCFOUR stream cipher."
@@ -483,39 +491,39 @@ config MBEDTLS_ARC4_C
config MBEDTLS_ARIA_C
bool "Enable the ARIA block cipher."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CCM_C
bool "Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CHACHA20_C
bool "Enable the ChaCha20 stream cipher."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_CHACHAPOLY_C
bool "Enable the ChaCha20-Poly1305 AEAD algorithm."
depends on MBEDTLS_CHACHA20_C && MBEDTLS_POLY1305_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_DHM_C
bool "Enable the Diffie-Hellman-Merkle module."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECDH_C
bool "Enable the elliptic curve Diffie-Hellman library."
depends on MBEDTLS_ECP_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECDSA_C
bool "Enable the elliptic curve DSA library."
depends on MBEDTLS_ECP_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECJPAKE_C
bool "Enable the elliptic curve J-PAKE library."
depends on MBEDTLS_ECP_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ECP_C
bool "Enable the elliptic curve over GF(p) library."
@@ -526,128 +534,128 @@ config MBEDTLS_ECP_C
|| MBEDTLS_ECP_DP_BP256R1_ENABLED || MBEDTLS_ECP_DP_BP384R1_ENABLED \
|| MBEDTLS_ECP_DP_BP512R1_ENABLED || MBEDTLS_ECP_DP_CURVE25519_ENABLED \
|| MBEDTLS_ECP_DP_CURVE448_ENABLED
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_ERROR_C
bool "Enable error code to error string conversion."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_GCM_C
bool "Enable the Galois/Counter Mode (GCM)."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_HKDF_C
bool "Enable the HKDF algorithm (RFC 5869)."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_HMAC_DRBG_C
bool "Enable the HMAC_DRBG random generator."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_LMS_C
bool "Enable the LMS stateful-hash asymmetric signature algorithm."
depends on MBEDTLS_PSA_CRYPTO_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_NIST_KW_C
bool "Enable the Key Wrapping mode for 128-bit block ciphers."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_MD_C
bool "Enable the generic layer for message digest (hashing) and HMAC."
depends on MBEDTLS_MD5_C || MBEDTLS_RIPEMD160_C || MBEDTLS_SHA1_C ||\
MBEDTLS_SHA224_C || MBEDTLS_SHA256_C || MBEDTLS_SHA384_C ||\
MBEDTLS_SHA512_C || MBEDTLS_PSA_CRYPTO_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_MD5_C
bool "Enable the MD5 hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PKCS5_C
bool "Enable PKCS#5 functions."
select MBEDTLS_MD_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PKCS7_C
bool "Enable PKCS #7 core for using PKCS #7-formatted signatures."
depends on MBEDTLS_ASN1_PARSE_C && MBEDTLS_OID_C && MBEDTLS_PK_PARSE_C &&\
MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_X509_CRL_PARSE_C &&\
MBEDTLS_MD_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PKCS12_C
bool "Enable PKCS#12 PBE functions."
depends on MBEDTLS_ASN1_PARSE_C && (MBEDTLS_MD_C || MBEDTLS_PSA_CRYPTO_C)
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PLATFORM_C
bool "Enable the platform abstraction layer."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_POLY1305_C
bool "Enable the Poly1305 MAC algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PSA_CRYPTO_C
bool "Enable the Platform Security Architecture cryptography API."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PSA_CRYPTO_STORAGE_C
bool "Enable the Platform Security Architecture persistent key storage."
depends on MBEDTLS_PSA_CRYPTO_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_PSA_ITS_FILE_C
bool "Enable the emulation of the Platform Security Architecture Internal Trusted Storage (PSA ITS) over files."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_RIPEMD160_C
bool "Enable the RIPEMD-160 hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_RSA_C
bool "Enable the RSA public-key cryptosystem."
depends on MBEDTLS_OID_C
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SHA1_C
bool "Enable the SHA1 cryptographic hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SHA224_C
bool "Enable the SHA-224 cryptographic hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SHA256_C
bool "Enable the SHA-256 cryptographic hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SHA384_C
bool "Enable the SHA-384 cryptographic hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SHA512_C
bool "Enable SHA-512 cryptographic hash algorithms."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SHA3_C
bool "Enable the SHA3 cryptographic hash algorithm."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_CACHE_C
bool "Enable simple SSL cache implementation."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_COOKIE_C
bool "Enable SSL cookie implementation."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_SSL_TICKET_C
bool "Enable an implementation of TLS server-side callbacks for session tickets."
depends on (MBEDTLS_CIPHER_C || MBEDTLS_USE_PSA_CRYPTO) && \
(MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C)
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_THREADING_C
bool "Enable the threading abstraction layer."
@@ -655,21 +663,21 @@ config MBEDTLS_THREADING_C
config MBEDTLS_VERSION_C
bool "Enable run-time version information."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_USE_C
bool "Enable X.509 core for using certificates."
depends on MBEDTLS_ASN1_PARSE_C && MBEDTLS_OID_C && MBEDTLS_PK_PARSE_C &&\
(MBEDTLS_MD_C || MBEDTLS_USE_PSA_CRYPTO)
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CRT_PARSE_C
bool "Enable X.509 certificate parsing."
- default y
+ default !MBEDTLS_MINIMAL
config MBEDTLS_X509_CRL_PARSE_C
bool "Enable X.509 CRL parsing."
- default y
+ default !MBEDTLS_MINIMAL
if CRYPTO_CRYPTODEV
@@ -726,6 +734,70 @@ config MBEDTLS_BIGNUM_ALT
endif # CRYPTO_CRYPTODEV
+config MBEDTLS_HAVE_TIME
+ bool "Enable time functions."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_CIPHER_MODE_CBC
+ bool "Enable Cipher Block Chaining mode (CBC) for symmetric ciphers."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+ bool "Enable the RSA-only based ciphersuite modes."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_FS_IO
+ bool "Enable functions that use the filesystem."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_PKCS1_V15
+ bool "Enable support for PKCS#1 v1.5 encoding."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_SSL_ALL_ALERT_MESSAGES
+ bool "Enable sending of alert messages in case of encountered errors."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_BASE64_C
+ bool "Enable the Base64 module."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_CTR_DRBG_C
+ bool "Enable the CTR_DRBG AES-based random generator."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_DES_C
+ bool "Enable the DES block cipher."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_ENTROPY_C
+ bool "Enable the platform-specific entropy code."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_PEM_PARSE_C
+ bool "Enable PEM decoding / parsing."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_SSL_CLI_C
+ bool "Enable the SSL/TLS client code."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_SSL_TLS_C
+ bool "Enable the generic SSL/TLS code."
+ default !MBEDTLS_MINIMAL
+
+config MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+ bool "Use only 128-bit keys in AES operations."
+ default n
+
+config MBEDTLS_AES_FEWER_TABLES
+ bool "Use less ROM/RAM for AES tables."
+ default n
+
+config MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
+ bool "Remove decryption operation for AES, ARIA and Camellia block cipher."
+ default n
+
menuconfig MBEDTLS_APPS
tristate "Mbed TLS Applications"
default n
diff --git a/crypto/mbedtls/include/mbedtls/mbedtls_config.h b/crypto/mbedtls/include/mbedtls/mbedtls_config.h
index f61cb60c0..829f95727 100644
--- a/crypto/mbedtls/include/mbedtls/mbedtls_config.h
+++ b/crypto/mbedtls/include/mbedtls/mbedtls_config.h
@@ -161,7 +161,9 @@
* regardless of the setting of MBEDTLS_HAVE_TIME, unless
* MBEDTLS_TIMING_ALT is used. See timing.c for more information.
*/
+#ifdef CONFIG_MBEDTLS_HAVE_TIME
#define MBEDTLS_HAVE_TIME
+#endif
/**
* \def MBEDTLS_HAVE_TIME_DATE
@@ -686,7 +688,9 @@
*
*/
-/* #define MBEDTLS_AES_FEWER_TABLES */
+#ifdef CONFIG_MBEDTLS_AES_FEWER_TABLES
+#define MBEDTLS_AES_FEWER_TABLES
+#endif
/**
* \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
@@ -704,7 +708,9 @@
* Requires: MBEDTLS_AES_C
*/
-/* #define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH */
+#ifdef CONFIG_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+#define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+#endif
/**
* \def MBEDTLS_AES_USE_HARDWARE_ONLY
@@ -762,7 +768,9 @@
*
* Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
*/
+#ifdef CONFIG_MBEDTLS_CIPHER_MODE_CBC
#define MBEDTLS_CIPHER_MODE_CBC
+#endif
/**
* \def MBEDTLS_CIPHER_MODE_CFB
@@ -1163,7 +1171,9 @@
* MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
* MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
*/
+#ifdef CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+#endif
/**
* \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
@@ -1396,7 +1406,9 @@
*
* Enable functions that use the filesystem.
*/
+#ifdef CONFIG_MBEDTLS_FS_IO
#define MBEDTLS_FS_IO
+#endif
/**
* \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
@@ -1533,7 +1545,9 @@
*
* This enables support for PKCS#1 v1.5 operations.
*/
+#ifdef CONFIG_MBEDTLS_PKCS1_V15
#define MBEDTLS_PKCS1_V15
+#endif
/**
* \def MBEDTLS_PKCS1_V21
@@ -1809,7 +1823,9 @@
*
* Enable sending of all alert messages
*/
+#ifdef CONFIG_MBEDTLS_SSL_ALL_ALERT_MESSAGES
#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
+#endif
/**
* \def MBEDTLS_SSL_DTLS_CONNECTION_ID
@@ -2748,7 +2764,9 @@
*
* This module is required for PEM support (required by X.509).
*/
+#ifdef CONFIG_MBEDTLS_BASE64_C
#define MBEDTLS_BASE64_C
+#endif
/**
* \def MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
@@ -2772,7 +2790,9 @@
* library/cipher.c
*/
-/* #define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */
+#ifdef CONFIG_MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
+#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
+#endif
/**
* \def MBEDTLS_BIGNUM_C
@@ -3033,7 +3053,9 @@
*
* This module provides the CTR_DRBG AES random number generator.
*/
+#ifdef CONFIG_MBEDTLS_CTR_DRBG_C
#define MBEDTLS_CTR_DRBG_C
+#endif
/**
* \def MBEDTLS_DEBUG_C
@@ -3067,7 +3089,9 @@
* a security risk. We recommend considering stronger ciphers
*instead.
*/
+#ifdef CONFIG_MBEDTLS_DES_C
#define MBEDTLS_DES_C
+#endif
/**
* \def MBEDTLS_DHM_C
@@ -3184,7 +3208,9 @@
*
* This module provides a generic entropy pool
*/
+#ifdef CONFIG_MBEDTLS_ENTROPY_C
#define MBEDTLS_ENTROPY_C
+#endif
/**
* \def MBEDTLS_ERROR_C
@@ -3474,7 +3500,9 @@
*
* This modules adds support for decoding / parsing PEM files.
*/
+#ifdef CONFIG_MBEDTLS_PEM_PARSE_C
#define MBEDTLS_PEM_PARSE_C
+#endif
/**
* \def MBEDTLS_PEM_WRITE_C
@@ -4040,7 +4068,9 @@
*
* This module is required for SSL/TLS client support.
*/
+#ifdef CONFIG_MBEDTLS_SSL_CLI_C
#define MBEDTLS_SSL_CLI_C
+#endif
/**
* \def MBEDTLS_SSL_SRV_C
@@ -4072,7 +4102,9 @@
*
* This module is required for SSL/TLS.
*/
+#ifdef CONFIG_MBEDTLS_SSL_TLS_C
#define MBEDTLS_SSL_TLS_C
+#endif
/**
* \def MBEDTLS_THREADING_C