blob: 1848ac125a0afee72d184797db43010b9941dd63 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/**
2 * \file config.h
3 *
Paul Bakker37ca75d2011-01-06 12:28:03 +00004 * \brief Configuration options (set of defines)
5 *
Simon Butcher5b331b92016-01-03 16:14:14 +00006 * This set of compile-time options may be used to enable
7 * or disable features selectively, and reduce the global
8 * memory footprint.
9 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +020010 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +020011 * SPDX-License-Identifier: Apache-2.0
12 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000024 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000025 * This file is part of mbed TLS (https://tls.mbed.org)
Manuel Pégourié-Gonnarde2b0efe2015-08-11 10:38:37 +020026 */
27
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#ifndef MBEDTLS_CONFIG_H
29#define MBEDTLS_CONFIG_H
Paul Bakker5121ce52009-01-03 21:22:43 +000030
Paul Bakkercce9d772011-11-18 14:26:47 +000031#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
Paul Bakker5121ce52009-01-03 21:22:43 +000032#define _CRT_SECURE_NO_DEPRECATE 1
33#endif
34
Paul Bakkerf3b86c12011-01-27 15:24:17 +000035/**
Paul Bakker0a62cd12011-01-21 11:00:08 +000036 * \name SECTION: System support
37 *
38 * This section sets system specific settings.
39 * \{
40 */
41
Paul Bakkerf3b86c12011-01-27 15:24:17 +000042/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020043 * \def MBEDTLS_HAVE_ASM
Paul Bakkerf3b86c12011-01-27 15:24:17 +000044 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +020045 * The compiler has support for asm().
Paul Bakker68041ec2009-04-19 21:17:55 +000046 *
47 * Requires support for asm() in compiler.
48 *
49 * Used in:
50 * library/timing.c
51 * library/padlock.c
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000052 * include/mbedtls/bn_mul.h
Paul Bakker68041ec2009-04-19 21:17:55 +000053 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +020054 * Comment to disable the use of assembly code.
Paul Bakker5121ce52009-01-03 21:22:43 +000055 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020056#define MBEDTLS_HAVE_ASM
Paul Bakker5121ce52009-01-03 21:22:43 +000057
Paul Bakkerf3b86c12011-01-27 15:24:17 +000058/**
Gilles Peskineb1a977f2017-06-08 15:19:20 +020059 * \def MBEDTLS_NO_UDBL_DIVISION
60 *
61 * The platform lacks support for double-width integer division (64-bit
62 * division on a 32-bit platform, 128-bit division on a 64-bit platform).
63 *
64 * Used in:
65 * include/mbedtls/bignum.h
66 * library/bignum.c
67 *
68 * The bignum code uses double-width division to speed up some operations.
69 * Double-width division is often implemented in software that needs to
70 * be linked with the program. The presence of a double-width integer
71 * type is usually detected automatically through preprocessor macros,
72 * but the automatic detection cannot know whether the code needs to
73 * and can be linked with an implementation of division for that type.
74 * By default division is assumed to be usable if the type is present.
75 * Uncomment this option to prevent the use of double-width division.
76 *
77 * Note that division for the native integer type is always required.
78 * Furthermore, a 64-bit type is always required even on a 32-bit
Andres Amaya Garciac630ce62017-07-21 10:56:22 +010079 * platform, but it need not support multiplication or division. In some
80 * cases it is also desirable to disable some double-width operations. For
81 * example, if double-width division is implemented in software, disabling
82 * it can reduce code size in some embedded targets.
Gilles Peskineb1a977f2017-06-08 15:19:20 +020083 */
84//#define MBEDTLS_NO_UDBL_DIVISION
85
86/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020087 * \def MBEDTLS_HAVE_SSE2
Paul Bakkerf3b86c12011-01-27 15:24:17 +000088 *
Paul Bakkere23c3152012-10-01 14:42:47 +000089 * CPU supports SSE2 instruction set.
Paul Bakkerf3b86c12011-01-27 15:24:17 +000090 *
Paul Bakker5121ce52009-01-03 21:22:43 +000091 * Uncomment if the CPU supports SSE2 (IA-32 specific).
Paul Bakker5121ce52009-01-03 21:22:43 +000092 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020093//#define MBEDTLS_HAVE_SSE2
Paul Bakkerfa9b1002013-07-03 15:31:03 +020094
95/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020096 * \def MBEDTLS_HAVE_TIME
Paul Bakkerfa9b1002013-07-03 15:31:03 +020097 *
Manuel Pégourié-Gonnard60c793b2015-06-18 20:52:58 +020098 * System has time.h and time().
99 * The time does not need to be correct, only time differences are used,
100 * by contrast with MBEDTLS_HAVE_TIME_DATE
Paul Bakkerfa9b1002013-07-03 15:31:03 +0200101 *
Andres Amaya Garcia1e4ec662016-07-20 10:16:25 +0100102 * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT,
103 * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and
104 * MBEDTLS_PLATFORM_STD_TIME.
105 *
Paul Bakkerfa9b1002013-07-03 15:31:03 +0200106 * Comment if your system does not support time functions
107 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200108#define MBEDTLS_HAVE_TIME
Manuel Pégourié-Gonnard10934de2013-12-13 12:54:09 +0100109
110/**
Manuel Pégourié-Gonnard60c793b2015-06-18 20:52:58 +0200111 * \def MBEDTLS_HAVE_TIME_DATE
112 *
113 * System has time.h and time(), gmtime() and the clock is correct.
114 * The time needs to be correct (not necesarily very accurate, but at least
115 * the date should be correct). This is used to verify the validity period of
116 * X.509 certificates.
117 *
118 * Comment if your system does not have a correct clock.
119 */
120#define MBEDTLS_HAVE_TIME_DATE
121
122/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200123 * \def MBEDTLS_PLATFORM_MEMORY
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100124 *
125 * Enable the memory allocation layer.
126 *
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +0200127 * By default mbed TLS uses the system-provided calloc() and free().
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100128 * This allows different allocators (self-implemented or provided) to be
129 * provided to the platform abstraction layer.
130 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200131 * Enabling MBEDTLS_PLATFORM_MEMORY without the
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +0200132 * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
133 * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
Rich Evans16f8cd82015-02-06 16:14:34 +0000134 * free() function pointer at runtime.
135 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200136 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +0200137 * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
Rich Evans16f8cd82015-02-06 16:14:34 +0000138 * alternate function at compile time.
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100139 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200140 * Requires: MBEDTLS_PLATFORM_C
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100141 *
142 * Enable this layer to allow use of alternative memory allocators.
143 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200144//#define MBEDTLS_PLATFORM_MEMORY
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100145
146/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200147 * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
Paul Bakker088c5c52014-04-25 11:11:10 +0200148 *
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +0200149 * Do not assign standard functions in the platform layer (e.g. calloc() to
150 * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
Paul Bakker088c5c52014-04-25 11:11:10 +0200151 *
152 * This makes sure there are no linking errors on platforms that do not support
153 * these functions. You will HAVE to provide alternatives, either at runtime
154 * via the platform_set_xxx() functions or at compile time by setting
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200155 * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a
156 * MBEDTLS_PLATFORM_XXX_MACRO.
Paul Bakker088c5c52014-04-25 11:11:10 +0200157 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200158 * Requires: MBEDTLS_PLATFORM_C
Paul Bakker088c5c52014-04-25 11:11:10 +0200159 *
160 * Uncomment to prevent default assignment of standard functions in the
161 * platform layer.
162 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200163//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
Paul Bakker088c5c52014-04-25 11:11:10 +0200164
165/**
Janos Follathc351d182016-03-21 08:43:59 +0000166 * \def MBEDTLS_PLATFORM_EXIT_ALT
Paul Bakker747a83a2014-02-01 22:50:07 +0100167 *
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100168 * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the
169 * function in the platform abstraction layer.
Paul Bakker747a83a2014-02-01 22:50:07 +0100170 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200171 * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will
172 * provide a function "mbedtls_platform_set_printf()" that allows you to set an
Paul Bakker747a83a2014-02-01 22:50:07 +0100173 * alternative printf function pointer.
174 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200175 * All these define require MBEDTLS_PLATFORM_C to be defined!
Paul Bakker747a83a2014-02-01 22:50:07 +0100176 *
Manuel Pégourié-Gonnard9db28872015-06-26 10:52:01 +0200177 * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows;
178 * it will be enabled automatically by check_config.h
179 *
Manuel Pégourié-Gonnard6c0c8e02015-06-22 10:23:34 +0200180 * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200181 * MBEDTLS_PLATFORM_XXX_MACRO!
Rich Evans16f8cd82015-02-06 16:14:34 +0000182 *
Andres Amaya Garcia1e4ec662016-07-20 10:16:25 +0100183 * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME
184 *
Paul Bakker747a83a2014-02-01 22:50:07 +0100185 * Uncomment a macro to enable alternate implementation of specific base
186 * platform function
187 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188//#define MBEDTLS_PLATFORM_EXIT_ALT
SimonBd5800b72016-04-26 07:43:27 +0100189//#define MBEDTLS_PLATFORM_TIME_ALT
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200190//#define MBEDTLS_PLATFORM_FPRINTF_ALT
191//#define MBEDTLS_PLATFORM_PRINTF_ALT
192//#define MBEDTLS_PLATFORM_SNPRINTF_ALT
Paul Bakkercf0a9f92016-06-01 11:25:44 +0100193//#define MBEDTLS_PLATFORM_NV_SEED_ALT
Andres Amaya Garciad91f99f2017-07-18 10:23:04 +0100194//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100195
196/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200197 * \def MBEDTLS_DEPRECATED_WARNING
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100198 *
199 * Mark deprecated functions so that they generate a warning if used.
200 * Functions deprecated in one version will usually be removed in the next
201 * version. You can enable this to help you prepare the transition to a new
202 * major version by making sure your code is not using these functions.
203 *
204 * This only works with GCC and Clang. With other compilers, you may want to
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200205 * use MBEDTLS_DEPRECATED_REMOVED
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100206 *
207 * Uncomment to get warnings on using deprecated functions.
208 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200209//#define MBEDTLS_DEPRECATED_WARNING
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100210
211/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200212 * \def MBEDTLS_DEPRECATED_REMOVED
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100213 *
214 * Remove deprecated functions so that they generate an error if used.
215 * Functions deprecated in one version will usually be removed in the next
216 * version. You can enable this to help you prepare the transition to a new
217 * major version by making sure your code is not using these functions.
218 *
219 * Uncomment to get errors on using deprecated functions.
220 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200221//#define MBEDTLS_DEPRECATED_REMOVED
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100222
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200223/* \} name SECTION: System support */
Paul Bakker0a62cd12011-01-21 11:00:08 +0000224
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000225/**
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +0000226 * \name SECTION: mbed TLS feature support
Paul Bakker0a62cd12011-01-21 11:00:08 +0000227 *
228 * This section sets support for features that are or are not needed
229 * within the modules that are enabled.
230 * \{
231 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000232
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000233/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200234 * \def MBEDTLS_TIMING_ALT
Paul Bakkerf2561b32014-02-06 15:11:55 +0100235 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200236 * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(),
Manuel Pégourié-Gonnarda63bc942015-05-14 18:22:47 +0200237 * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay()
Paul Bakkerf2561b32014-02-06 15:11:55 +0100238 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200239 * Only works if you have MBEDTLS_TIMING_C enabled.
Paul Bakkerf2561b32014-02-06 15:11:55 +0100240 *
241 * You will need to provide a header "timing_alt.h" and an implementation at
242 * compile time.
243 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244//#define MBEDTLS_TIMING_ALT
Paul Bakkerf2561b32014-02-06 15:11:55 +0100245
246/**
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100247 * \def MBEDTLS_AES_ALT
Paul Bakker90995b52013-06-24 19:20:35 +0200248 *
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100249 * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your
Janos Follathb0697532016-08-18 12:38:46 +0100250 * alternate core implementation of a symmetric crypto, an arithmetic or hash
251 * module (e.g. platform specific assembly optimized implementations). Keep
252 * in mind that the function prototypes should remain the same.
Paul Bakker90995b52013-06-24 19:20:35 +0200253 *
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200254 * This replaces the whole module. If you only want to replace one of the
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200255 * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags.
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200256 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200257 * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer
Janos Follathee782bc2016-11-07 15:41:26 +0000258 * provide the "struct mbedtls_aes_context" definition and omit the base
259 * function declarations and implementations. "aes_alt.h" will be included from
Paul Bakker90995b52013-06-24 19:20:35 +0200260 * "aes.h" to include the new function definitions.
261 *
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200262 * Uncomment a macro to enable alternate implementation of the corresponding
263 * module.
Paul Bakker90995b52013-06-24 19:20:35 +0200264 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200265//#define MBEDTLS_AES_ALT
266//#define MBEDTLS_ARC4_ALT
267//#define MBEDTLS_BLOWFISH_ALT
268//#define MBEDTLS_CAMELLIA_ALT
Steven Cooreman222e2ff2017-04-04 11:37:15 +0200269//#define MBEDTLS_CCM_ALT
Steven Cooreman63342772017-04-04 11:47:16 +0200270//#define MBEDTLS_CMAC_ALT
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200271//#define MBEDTLS_DES_ALT
Jaeden Amero15263302017-09-21 12:53:48 +0100272//#define MBEDTLS_GCM_ALT
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200273//#define MBEDTLS_XTEA_ALT
274//#define MBEDTLS_MD2_ALT
275//#define MBEDTLS_MD4_ALT
276//#define MBEDTLS_MD5_ALT
277//#define MBEDTLS_RIPEMD160_ALT
278//#define MBEDTLS_SHA1_ALT
279//#define MBEDTLS_SHA256_ALT
280//#define MBEDTLS_SHA512_ALT
Janos Follathb0697532016-08-18 12:38:46 +0100281/*
282 * When replacing the elliptic curve module, pleace consider, that it is
283 * implemented with two .c files:
284 * - ecp.c
285 * - ecp_curves.c
Janos Follathee782bc2016-11-07 15:41:26 +0000286 * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT
287 * macros as described above. The only difference is that you have to make sure
288 * that you provide functionality for both .c files.
Janos Follathb0697532016-08-18 12:38:46 +0100289 */
290//#define MBEDTLS_ECP_ALT
Paul Bakker90995b52013-06-24 19:20:35 +0200291
292/**
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100293 * \def MBEDTLS_MD2_PROCESS_ALT
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200294 *
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100295 * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you
296 * alternate core implementation of symmetric crypto or hash function. Keep in
297 * mind that function prototypes should remain the same.
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200298 *
299 * This replaces only one function. The header file from mbed TLS is still
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200300 * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200301 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200302 * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will
303 * no longer provide the mbedtls_sha1_process() function, but it will still provide
304 * the other function (using your mbedtls_sha1_process() function) and the definition
305 * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200306 * with this definition.
307 *
Hanno Becker6d84ae72017-06-26 12:46:19 +0100308 * \note Because of a signature change, the core AES encryption and decryption routines are
309 * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt,
310 * respectively. When setting up alternative implementations, these functions should
311 * be overriden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
Hanno Beckerca1cdb22017-07-20 09:50:59 +0100312 * must stay untouched.
Hanno Becker6d84ae72017-06-26 12:46:19 +0100313 *
314 * \note If you use the AES_xxx_ALT macros, then is is recommended to also set
315 * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES
316 * tables.
Manuel Pégourié-Gonnard31993f22015-05-12 15:41:08 +0200317 *
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200318 * Uncomment a macro to enable alternate implementation of the corresponding
319 * function.
320 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200321//#define MBEDTLS_MD2_PROCESS_ALT
322//#define MBEDTLS_MD4_PROCESS_ALT
323//#define MBEDTLS_MD5_PROCESS_ALT
324//#define MBEDTLS_RIPEMD160_PROCESS_ALT
325//#define MBEDTLS_SHA1_PROCESS_ALT
326//#define MBEDTLS_SHA256_PROCESS_ALT
327//#define MBEDTLS_SHA512_PROCESS_ALT
Manuel Pégourié-Gonnard70a50102015-05-12 15:02:45 +0200328//#define MBEDTLS_DES_SETKEY_ALT
329//#define MBEDTLS_DES_CRYPT_ECB_ALT
330//#define MBEDTLS_DES3_CRYPT_ECB_ALT
Manuel Pégourié-Gonnard31993f22015-05-12 15:41:08 +0200331//#define MBEDTLS_AES_SETKEY_ENC_ALT
332//#define MBEDTLS_AES_SETKEY_DEC_ALT
333//#define MBEDTLS_AES_ENCRYPT_ALT
334//#define MBEDTLS_AES_DECRYPT_ALT
Ron Eldor314adb62017-10-10 18:28:25 +0300335//#define MBEDTLS_ECDSA_VERIFY_ALT
336//#define MBEDTLS_ECDSA_SIGN_ALT
337//#define MBEDTLS_ECDSA_GENKEY_ALT
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200338
339/**
Janos Follathc44ab972016-11-18 16:38:23 +0000340 * \def MBEDTLS_ECP_INTERNAL_ALT
341 *
342 * Expose a part of the internal interface of the Elliptic Curve Point module.
Janos Follathb0697532016-08-18 12:38:46 +0100343 *
344 * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your
Janos Follath372697b2016-10-28 16:53:11 +0100345 * alternative core implementation of elliptic curve arithmetic. Keep in mind
346 * that function prototypes should remain the same.
Janos Follathb0697532016-08-18 12:38:46 +0100347 *
348 * This partially replaces one function. The header file from mbed TLS is still
349 * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation
350 * is still present and it is used for group structures not supported by the
351 * alternative.
352 *
Janos Follathc44ab972016-11-18 16:38:23 +0000353 * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT
354 * and implementing the following functions:
355 * unsigned char mbedtls_internal_ecp_grp_capable(
356 * const mbedtls_ecp_group *grp )
357 * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp )
358 * void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp )
359 * The mbedtls_internal_ecp_grp_capable function should return 1 if the
360 * replacement functions implement arithmetic for the given group and 0
361 * otherwise.
362 * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are
363 * called before and after each point operation and provide an opportunity to
364 * implement optimized set up and tear down instructions.
Janos Follathb0697532016-08-18 12:38:46 +0100365 *
Janos Follathc44ab972016-11-18 16:38:23 +0000366 * Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and
Janos Follath4d9c69d2016-11-01 13:27:03 +0000367 * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac
Janos Follathc44ab972016-11-18 16:38:23 +0000368 * function, but will use your mbedtls_internal_ecp_double_jac if the group is
369 * supported (your mbedtls_internal_ecp_grp_capable function returns 1 when
370 * receives it as an argument). If the group is not supported then the original
Janos Follathee782bc2016-11-07 15:41:26 +0000371 * implementation is used. The other functions and the definition of
372 * mbedtls_ecp_group and mbedtls_ecp_point will not change, so your
Janos Follathc44ab972016-11-18 16:38:23 +0000373 * implementation of mbedtls_internal_ecp_double_jac and
374 * mbedtls_internal_ecp_grp_capable must be compatible with this definition.
Janos Follathb0697532016-08-18 12:38:46 +0100375 *
376 * Uncomment a macro to enable alternate implementation of the corresponding
377 * function.
378 */
379/* Required for all the functions in this section */
Janos Follathc44ab972016-11-18 16:38:23 +0000380//#define MBEDTLS_ECP_INTERNAL_ALT
Janos Follathb0697532016-08-18 12:38:46 +0100381/* Support for Weierstrass curves with Jacobi representation */
382//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT
383//#define MBEDTLS_ECP_ADD_MIXED_ALT
384//#define MBEDTLS_ECP_DOUBLE_JAC_ALT
385//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT
386//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT
387/* Support for curves with Montgomery arithmetic */
388//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT
389//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT
390//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT
391
392/**
Simon Butcherab5df402016-06-11 02:31:21 +0100393 * \def MBEDTLS_TEST_NULL_ENTROPY
Janos Follath53de7842016-06-08 15:29:18 +0100394 *
Simon Butcherab5df402016-06-11 02:31:21 +0100395 * Enables testing and use of mbed TLS without any configured entropy sources.
396 * This permits use of the library on platforms before an entropy source has
397 * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the
398 * MBEDTLS_ENTROPY_NV_SEED switches).
399 *
400 * WARNING! This switch MUST be disabled in production builds, and is suitable
401 * only for development.
402 * Enabling the switch negates any security provided by the library.
Janos Follath53de7842016-06-08 15:29:18 +0100403 *
Janos Follathf93b8bc2016-06-09 13:54:15 +0100404 * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
405 *
Janos Follath53de7842016-06-08 15:29:18 +0100406 */
Simon Butcherab5df402016-06-11 02:31:21 +0100407//#define MBEDTLS_TEST_NULL_ENTROPY
Janos Follath53de7842016-06-08 15:29:18 +0100408
409/**
Manuel Pégourié-Gonnard8ba88f02015-06-22 12:14:20 +0200410 * \def MBEDTLS_ENTROPY_HARDWARE_ALT
Manuel Pégourié-Gonnard3f77dfb2015-06-19 10:06:21 +0200411 *
412 * Uncomment this macro to let mbed TLS use your own implementation of a
413 * hardware entropy collector.
414 *
415 * Your function must be called \c mbedtls_hardware_poll(), have the same
416 * prototype as declared in entropy_poll.h, and accept NULL as first argument.
417 *
418 * Uncomment to use your own hardware entropy collector.
419 */
420//#define MBEDTLS_ENTROPY_HARDWARE_ALT
421
422/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200423 * \def MBEDTLS_AES_ROM_TABLES
Paul Bakker15566e42011-04-24 21:19:15 +0000424 *
425 * Store the AES tables in ROM.
426 *
427 * Uncomment this macro to store the AES tables in ROM.
Paul Bakker15566e42011-04-24 21:19:15 +0000428 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200429//#define MBEDTLS_AES_ROM_TABLES
Paul Bakker15566e42011-04-24 21:19:15 +0000430
431/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 * \def MBEDTLS_CAMELLIA_SMALL_MEMORY
Manuel Pégourié-Gonnard62edcc82015-04-03 16:28:19 +0200433 *
434 * Use less ROM for the Camellia implementation (saves about 768 bytes).
435 *
436 * Uncomment this macro to use less memory for Camellia.
437 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200438//#define MBEDTLS_CAMELLIA_SMALL_MEMORY
Manuel Pégourié-Gonnard62edcc82015-04-03 16:28:19 +0200439
440/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200441 * \def MBEDTLS_CIPHER_MODE_CBC
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +0200442 *
443 * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
444 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200445#define MBEDTLS_CIPHER_MODE_CBC
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +0200446
447/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200448 * \def MBEDTLS_CIPHER_MODE_CFB
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000449 *
450 * Enable Cipher Feedback mode (CFB) for symmetric ciphers.
451 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200452#define MBEDTLS_CIPHER_MODE_CFB
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000453
454/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200455 * \def MBEDTLS_CIPHER_MODE_CTR
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000456 *
457 * Enable Counter Block Cipher mode (CTR) for symmetric ciphers.
458 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459#define MBEDTLS_CIPHER_MODE_CTR
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000460
461/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200462 * \def MBEDTLS_CIPHER_NULL_CIPHER
Paul Bakkerfab5c822012-02-06 16:45:10 +0000463 *
464 * Enable NULL cipher.
465 * Warning: Only do so when you know what you are doing. This allows for
466 * encryption or channels without any security!
467 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468 * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable
Paul Bakkerfab5c822012-02-06 16:45:10 +0000469 * the following ciphersuites:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200470 * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA
471 * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA
472 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA
473 * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA
474 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384
475 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256
476 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA
477 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384
478 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256
479 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA
480 * MBEDTLS_TLS_RSA_WITH_NULL_SHA256
481 * MBEDTLS_TLS_RSA_WITH_NULL_SHA
482 * MBEDTLS_TLS_RSA_WITH_NULL_MD5
483 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384
484 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256
485 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA
486 * MBEDTLS_TLS_PSK_WITH_NULL_SHA384
487 * MBEDTLS_TLS_PSK_WITH_NULL_SHA256
488 * MBEDTLS_TLS_PSK_WITH_NULL_SHA
Paul Bakkerfab5c822012-02-06 16:45:10 +0000489 *
490 * Uncomment this macro to enable the NULL cipher and ciphersuites
Paul Bakkerfab5c822012-02-06 16:45:10 +0000491 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200492//#define MBEDTLS_CIPHER_NULL_CIPHER
Paul Bakkerfab5c822012-02-06 16:45:10 +0000493
494/**
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100495 * \def MBEDTLS_CIPHER_PADDING_PKCS7
Paul Bakker48e93c82013-08-14 12:21:18 +0200496 *
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100497 * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for
498 * specific padding modes in the cipher layer with cipher modes that support
499 * padding (e.g. CBC)
Paul Bakker48e93c82013-08-14 12:21:18 +0200500 *
501 * If you disable all padding modes, only full blocks can be used with CBC.
502 *
503 * Enable padding modes in the cipher layer.
504 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200505#define MBEDTLS_CIPHER_PADDING_PKCS7
506#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
507#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
508#define MBEDTLS_CIPHER_PADDING_ZEROS
Paul Bakker48e93c82013-08-14 12:21:18 +0200509
510/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200511 * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES
Paul Bakkerfab5c822012-02-06 16:45:10 +0000512 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200513 * Enable weak ciphersuites in SSL / TLS.
Paul Bakkerfab5c822012-02-06 16:45:10 +0000514 * Warning: Only do so when you know what you are doing. This allows for
Paul Bakker9a736322012-11-14 12:39:52 +0000515 * channels with virtually no security at all!
Paul Bakkerfab5c822012-02-06 16:45:10 +0000516 *
517 * This enables the following ciphersuites:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200518 * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA
519 * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA
Paul Bakkerfab5c822012-02-06 16:45:10 +0000520 *
521 * Uncomment this macro to enable weak ciphersuites
Paul Bakkerfab5c822012-02-06 16:45:10 +0000522 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES
Paul Bakkerfab5c822012-02-06 16:45:10 +0000524
525/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526 * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES
Manuel Pégourié-Gonnard01edb102014-06-24 22:42:34 +0200527 *
528 * Remove RC4 ciphersuites by default in SSL / TLS.
529 * This flag removes the ciphersuites based on RC4 from the default list as
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200530 * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +0200531 * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them
Manuel Pégourié-Gonnard01edb102014-06-24 22:42:34 +0200532 * explicitly.
533 *
534 * Uncomment this macro to remove RC4 ciphersuites by default.
535 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200536#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
Manuel Pégourié-Gonnard01edb102014-06-24 22:42:34 +0200537
538/**
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100539 * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200540 *
Manuel Pégourié-Gonnard76da60c2016-01-04 13:51:01 +0100541 * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve
542 * module. By default all supported curves are enabled.
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200543 *
544 * Comment macros to disable the curve and functions for it
545 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200546#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
547#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
548#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
549#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
550#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
551#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
552#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
553#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
554#define MBEDTLS_ECP_DP_BP256R1_ENABLED
555#define MBEDTLS_ECP_DP_BP384R1_ENABLED
556#define MBEDTLS_ECP_DP_BP512R1_ENABLED
Manuel Pégourié-Gonnard07894332015-06-23 00:18:41 +0200557#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200558
559/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200560 * \def MBEDTLS_ECP_NIST_OPTIM
Manuel Pégourié-Gonnardc04c5302013-10-23 16:11:52 +0200561 *
562 * Enable specific 'modulo p' routines for each NIST prime.
563 * Depending on the prime and architecture, makes operations 4 to 8 times
564 * faster on the corresponding curve.
565 *
566 * Comment this macro to disable NIST curves optimisation.
567 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200568#define MBEDTLS_ECP_NIST_OPTIM
Manuel Pégourié-Gonnardc04c5302013-10-23 16:11:52 +0200569
570/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200571 * \def MBEDTLS_ECDSA_DETERMINISTIC
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100572 *
573 * Enable deterministic ECDSA (RFC 6979).
574 * Standard ECDSA is "fragile" in the sense that lack of entropy when signing
575 * may result in a compromise of the long-term signing key. This is avoided by
576 * the deterministic variant.
577 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200578 * Requires: MBEDTLS_HMAC_DRBG_C
Manuel Pégourié-Gonnard5b1a5732014-01-07 16:46:17 +0100579 *
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100580 * Comment this macro to disable deterministic ECDSA.
581 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200582#define MBEDTLS_ECDSA_DETERMINISTIC
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100583
584/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200585 * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200586 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200587 * Enable the PSK based ciphersuite modes in SSL / TLS.
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200588 *
Paul Bakkere07f41d2013-04-19 09:08:57 +0200589 * This enables the following ciphersuites (if other requisites are
590 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200591 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
592 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
593 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
594 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
595 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
596 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
597 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
598 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
599 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
600 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
601 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
602 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200603 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200604#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200605
606/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200608 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200609 * Enable the DHE-PSK based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200610 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200611 * Requires: MBEDTLS_DHM_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200612 *
613 * This enables the following ciphersuites (if other requisites are
614 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200615 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
616 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
617 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
618 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
619 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
620 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
621 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
622 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
623 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
624 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
625 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
626 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200627 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200629
630/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200631 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200632 *
633 * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.
634 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200635 * Requires: MBEDTLS_ECDH_C
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200636 *
637 * This enables the following ciphersuites (if other requisites are
638 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200639 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
640 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
641 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
642 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
643 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
644 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
645 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
646 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200647 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200649
650/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651 * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200652 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200653 * Enable the RSA-PSK based ciphersuite modes in SSL / TLS.
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +0200654 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
656 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200657 *
658 * This enables the following ciphersuites (if other requisites are
659 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200660 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
661 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
662 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
663 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
664 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
665 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
666 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
667 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
668 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
669 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
670 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
671 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200672 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200673#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200674
675/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200676 * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200677 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200678 * Enable the RSA-only based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200679 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200680 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
681 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200682 *
683 * This enables the following ciphersuites (if other requisites are
684 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
686 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
687 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
688 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
689 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
690 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
691 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
692 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
693 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
694 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
695 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
696 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
697 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
698 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
699 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
Paul Bakkere07f41d2013-04-19 09:08:57 +0200700 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200701#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200702
703/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200704 * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200705 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200706 * Enable the DHE-RSA based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200707 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200708 * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
709 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200710 *
711 * This enables the following ciphersuites (if other requisites are
712 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200713 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
714 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
715 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
716 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
717 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
718 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
719 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
720 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
721 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
722 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
723 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
724 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
725 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200726 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200727#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200728
729/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200730 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200731 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200732 * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200733 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734 * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
735 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200736 *
737 * This enables the following ciphersuites (if other requisites are
738 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
740 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
741 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
742 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
743 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
744 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
745 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
746 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
747 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
748 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
749 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
750 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200751 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200752#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200753
754/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200756 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200757 * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200758 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200759 * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C,
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200760 *
761 * This enables the following ciphersuites (if other requisites are
762 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
764 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
765 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
766 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
767 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
768 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
769 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
770 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
771 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
772 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
773 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
774 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200775 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200776#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200777
778/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200779 * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100780 *
781 * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
782 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200783 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100784 *
785 * This enables the following ciphersuites (if other requisites are
786 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200787 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
788 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
789 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
790 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
791 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
792 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
793 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
794 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
795 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
796 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
797 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
798 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100799 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200800#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100801
802/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200803 * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100804 *
805 * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
806 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200807 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100808 *
809 * This enables the following ciphersuites (if other requisites are
810 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200811 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
812 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
813 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
814 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
815 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
816 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
817 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
818 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
819 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
820 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
821 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
822 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100823 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200824#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100825
826/**
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +0200827 * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
828 *
829 * Enable the ECJPAKE based ciphersuite modes in SSL / TLS.
830 *
Manuel Pégourié-Gonnard75df9022015-09-16 23:21:01 +0200831 * \warning This is currently experimental. EC J-PAKE support is based on the
832 * Thread v1.0.0 specification; incompatible changes to the specification
833 * might still happen. For this reason, this is disabled by default.
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +0200834 *
835 * Requires: MBEDTLS_ECJPAKE_C
836 * MBEDTLS_SHA256_C
837 * MBEDTLS_ECP_DP_SECP256R1_ENABLED
838 *
839 * This enables the following ciphersuites (if other requisites are
840 * enabled as well):
841 * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
842 */
Manuel Pégourié-Gonnardcf828932015-10-20 14:57:00 +0200843//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +0200844
845/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200846 * \def MBEDTLS_PK_PARSE_EC_EXTENDED
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100847 *
848 * Enhance support for reading EC keys using variants of SEC1 not allowed by
849 * RFC 5915 and RFC 5480.
850 *
851 * Currently this means parsing the SpecifiedECDomain choice of EC
852 * parameters (only known groups are supported, not arbitrary domains, to
853 * avoid validation issues).
854 *
855 * Disable if you only need to support RFC 5915 + 5480 key formats.
856 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857#define MBEDTLS_PK_PARSE_EC_EXTENDED
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100858
859/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200860 * \def MBEDTLS_ERROR_STRERROR_DUMMY
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100861 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200862 * Enable a dummy error function to make use of mbedtls_strerror() in
863 * third party libraries easier when MBEDTLS_ERROR_C is disabled
864 * (no effect when MBEDTLS_ERROR_C is enabled).
Manuel Pégourié-Gonnarddc16aa72014-06-25 12:55:12 +0200865 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200866 * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're
867 * not using mbedtls_strerror() or error_strerror() in your application.
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100868 *
869 * Disable if you run into name conflicts and want to really remove the
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200870 * mbedtls_strerror()
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100871 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200872#define MBEDTLS_ERROR_STRERROR_DUMMY
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100873
874/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200875 * \def MBEDTLS_GENPRIME
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000876 *
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +0200877 * Enable the prime-number generation code.
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200878 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200879 * Requires: MBEDTLS_BIGNUM_C
Paul Bakker5121ce52009-01-03 21:22:43 +0000880 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200881#define MBEDTLS_GENPRIME
Paul Bakker5121ce52009-01-03 21:22:43 +0000882
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000883/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200884 * \def MBEDTLS_FS_IO
Paul Bakker335db3f2011-04-25 15:28:35 +0000885 *
886 * Enable functions that use the filesystem.
887 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200888#define MBEDTLS_FS_IO
Paul Bakker335db3f2011-04-25 15:28:35 +0000889
890/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
Paul Bakker43655f42011-12-15 20:11:16 +0000892 *
893 * Do not add default entropy sources. These are the platform specific,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200894 * mbedtls_timing_hardclock and HAVEGE based poll functions.
Paul Bakker43655f42011-12-15 20:11:16 +0000895 *
Shuo Chen95a0d112014-04-04 21:04:40 -0700896 * This is useful to have more control over the added entropy sources in an
Paul Bakker43655f42011-12-15 20:11:16 +0000897 * application.
898 *
899 * Uncomment this macro to prevent loading of default entropy functions.
Paul Bakker43655f42011-12-15 20:11:16 +0000900 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200901//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
Paul Bakker43655f42011-12-15 20:11:16 +0000902
903/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200904 * \def MBEDTLS_NO_PLATFORM_ENTROPY
Paul Bakker6083fd22011-12-03 21:45:14 +0000905 *
906 * Do not use built-in platform entropy functions.
907 * This is useful if your platform does not support
908 * standards like the /dev/urandom or Windows CryptoAPI.
909 *
910 * Uncomment this macro to disable the built-in platform entropy functions.
Paul Bakker6083fd22011-12-03 21:45:14 +0000911 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200912//#define MBEDTLS_NO_PLATFORM_ENTROPY
Paul Bakker6083fd22011-12-03 21:45:14 +0000913
914/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200915 * \def MBEDTLS_ENTROPY_FORCE_SHA256
Paul Bakker2ceda572014-02-06 15:55:25 +0100916 *
917 * Force the entropy accumulator to use a SHA-256 accumulator instead of the
918 * default SHA-512 based one (if both are available).
919 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920 * Requires: MBEDTLS_SHA256_C
Paul Bakker2ceda572014-02-06 15:55:25 +0100921 *
922 * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
923 * if you have performance concerns.
924 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200925 * This option is only useful if both MBEDTLS_SHA256_C and
926 * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
Paul Bakker2ceda572014-02-06 15:55:25 +0100927 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200928//#define MBEDTLS_ENTROPY_FORCE_SHA256
Paul Bakker2ceda572014-02-06 15:55:25 +0100929
930/**
Paul Bakkercf0a9f92016-06-01 11:25:44 +0100931 * \def MBEDTLS_ENTROPY_NV_SEED
932 *
933 * Enable the non-volatile (NV) seed file-based entropy source.
934 * (Also enables the NV seed read/write functions in the platform layer)
935 *
936 * This is crucial (if not required) on systems that do not have a
937 * cryptographic entropy source (in hardware or kernel) available.
938 *
939 * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
940 *
Paul Bakker71a597a2016-06-07 10:59:03 +0100941 * \note The read/write functions that are used by the entropy source are
942 * determined in the platform layer, and can be modified at runtime and/or
943 * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
944 *
945 * \note If you use the default implementation functions that read a seedfile
Paul Bakkercf0a9f92016-06-01 11:25:44 +0100946 * with regular fopen(), please make sure you make a seedfile with the
947 * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
948 * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
Paul Bakker71a597a2016-06-07 10:59:03 +0100949 * and written to or you will get an entropy source error! The default
950 * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
951 * bytes from the file.
952 *
953 * \note The entropy collector will write to the seed file before entropy is
954 * given to an external source, to update it.
Paul Bakkercf0a9f92016-06-01 11:25:44 +0100955 */
956//#define MBEDTLS_ENTROPY_NV_SEED
957
958/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200959 * \def MBEDTLS_MEMORY_DEBUG
Paul Bakker6e339b52013-07-03 13:37:05 +0200960 *
961 * Enable debugging of buffer allocator memory issues. Automatically prints
962 * (to stderr) all (fatal) messages on memory allocation issues. Enables
963 * function for 'debug output' of allocated memory.
964 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200965 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
Paul Bakker6e339b52013-07-03 13:37:05 +0200966 *
967 * Uncomment this macro to let the buffer allocator print out error messages.
Paul Bakkera7ea6a52013-10-15 11:55:10 +0200968 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200969//#define MBEDTLS_MEMORY_DEBUG
Paul Bakker6e339b52013-07-03 13:37:05 +0200970
971/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200972 * \def MBEDTLS_MEMORY_BACKTRACE
Paul Bakker6e339b52013-07-03 13:37:05 +0200973 *
974 * Include backtrace information with each allocated block.
975 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200976 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
Paul Bakker6e339b52013-07-03 13:37:05 +0200977 * GLIBC-compatible backtrace() an backtrace_symbols() support
978 *
979 * Uncomment this macro to include backtrace information
Paul Bakker6e339b52013-07-03 13:37:05 +0200980 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200981//#define MBEDTLS_MEMORY_BACKTRACE
Paul Bakker6e339b52013-07-03 13:37:05 +0200982
983/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984 * \def MBEDTLS_PK_RSA_ALT_SUPPORT
Manuel Pégourié-Gonnard348bcb32015-03-31 14:01:33 +0200985 *
986 * Support external private RSA keys (eg from a HSM) in the PK layer.
987 *
988 * Comment this macro to disable support for external private RSA keys.
989 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200990#define MBEDTLS_PK_RSA_ALT_SUPPORT
Manuel Pégourié-Gonnard348bcb32015-03-31 14:01:33 +0200991
992/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200993 * \def MBEDTLS_PKCS1_V15
Paul Bakker48377d92013-08-30 12:06:24 +0200994 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200995 * Enable support for PKCS#1 v1.5 encoding.
996 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200997 * Requires: MBEDTLS_RSA_C
Paul Bakker48377d92013-08-30 12:06:24 +0200998 *
Paul Bakker48377d92013-08-30 12:06:24 +0200999 * This enables support for PKCS#1 v1.5 operations.
1000 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001001#define MBEDTLS_PKCS1_V15
Paul Bakker48377d92013-08-30 12:06:24 +02001002
1003/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001004 * \def MBEDTLS_PKCS1_V21
Paul Bakker9dcc3222011-03-08 14:16:06 +00001005 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001006 * Enable support for PKCS#1 v2.1 encoding.
1007 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001008 * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001009 *
Paul Bakker9dcc3222011-03-08 14:16:06 +00001010 * This enables support for RSAES-OAEP and RSASSA-PSS operations.
1011 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001012#define MBEDTLS_PKCS1_V21
Paul Bakker9dcc3222011-03-08 14:16:06 +00001013
1014/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001015 * \def MBEDTLS_RSA_NO_CRT
Paul Bakker0216cc12011-03-26 13:40:23 +00001016 *
1017 * Do not use the Chinese Remainder Theorem for the RSA private operation.
1018 *
1019 * Uncomment this macro to disable the use of CRT in RSA.
1020 *
Paul Bakker0216cc12011-03-26 13:40:23 +00001021 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001022//#define MBEDTLS_RSA_NO_CRT
Paul Bakker15566e42011-04-24 21:19:15 +00001023
1024/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001025 * \def MBEDTLS_SELF_TEST
Paul Bakker15566e42011-04-24 21:19:15 +00001026 *
1027 * Enable the checkup functions (*_self_test).
1028 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001029#define MBEDTLS_SELF_TEST
Paul Bakker5c721f92011-07-27 16:51:09 +00001030
1031/**
Manuel Pégourié-Gonnardeb0d8702015-05-28 12:54:04 +02001032 * \def MBEDTLS_SHA256_SMALLER
1033 *
1034 * Enable an implementation of SHA-256 that has lower ROM footprint but also
1035 * lower performance.
1036 *
1037 * The default implementation is meant to be a reasonnable compromise between
1038 * performance and size. This version optimizes more aggressively for size at
1039 * the expense of performance. Eg on Cortex-M4 it reduces the size of
1040 * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about
1041 * 30%.
1042 *
1043 * Uncomment to enable the smaller implementation of SHA256.
1044 */
1045//#define MBEDTLS_SHA256_SMALLER
1046
1047/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001048 * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
Paul Bakker40865c82013-01-31 17:13:13 +01001049 *
1050 * Enable sending of alert messages in case of encountered errors as per RFC.
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001051 * If you choose not to send the alert messages, mbed TLS can still communicate
Paul Bakker40865c82013-01-31 17:13:13 +01001052 * with other servers, only debugging of failures is harder.
1053 *
1054 * The advantage of not sending alert messages, is that no information is given
1055 * about reasons for failures thus preventing adversaries of gaining intel.
1056 *
1057 * Enable sending of all alert messages
1058 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001059#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
Paul Bakker40865c82013-01-31 17:13:13 +01001060
1061/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001062 * \def MBEDTLS_SSL_DEBUG_ALL
Paul Bakkerd66f0702013-01-31 16:57:45 +01001063 *
1064 * Enable the debug messages in SSL module for all issues.
1065 * Debug messages have been disabled in some places to prevent timing
1066 * attacks due to (unbalanced) debugging function calls.
1067 *
1068 * If you need all error reporting you should enable this during debugging,
1069 * but remove this for production servers that should log as well.
1070 *
1071 * Uncomment this macro to report all debug messages on errors introducing
1072 * a timing side-channel.
1073 *
Paul Bakkerd66f0702013-01-31 16:57:45 +01001074 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001075//#define MBEDTLS_SSL_DEBUG_ALL
Paul Bakkerd66f0702013-01-31 16:57:45 +01001076
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001077/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001078 *
1079 * Enable support for Encrypt-then-MAC, RFC 7366.
1080 *
1081 * This allows peers that both support it to use a more robust protection for
1082 * ciphersuites using CBC, providing deep resistance against timing attacks
1083 * on the padding or underlying cipher.
1084 *
1085 * This only affects CBC ciphersuites, and is useless if none is defined.
1086 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001087 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
1088 * MBEDTLS_SSL_PROTO_TLS1_1 or
1089 * MBEDTLS_SSL_PROTO_TLS1_2
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001090 *
1091 * Comment this macro to disable support for Encrypt-then-MAC
1092 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001093#define MBEDTLS_SSL_ENCRYPT_THEN_MAC
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001094
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001096 *
1097 * Enable support for Extended Master Secret, aka Session Hash
1098 * (draft-ietf-tls-session-hash-02).
1099 *
1100 * This was introduced as "the proper fix" to the Triple Handshake familiy of
1101 * attacks, but it is recommended to always use it (even if you disable
1102 * renegotiation), since it actually fixes a more fundamental issue in the
1103 * original SSL/TLS design, and has implications beyond Triple Handshake.
1104 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
1106 * MBEDTLS_SSL_PROTO_TLS1_1 or
1107 * MBEDTLS_SSL_PROTO_TLS1_2
Manuel Pégourié-Gonnard769c6b62014-10-28 14:13:55 +01001108 *
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001109 * Comment this macro to disable support for Extended Master Secret.
1110 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001111#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001112
Paul Bakkerd66f0702013-01-31 16:57:45 +01001113/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001114 * \def MBEDTLS_SSL_FALLBACK_SCSV
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001115 *
1116 * Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00).
1117 *
1118 * For servers, it is recommended to always enable this, unless you support
1119 * only one version of TLS, or know for sure that none of your clients
1120 * implements a fallback strategy.
1121 *
1122 * For clients, you only need this if you're using a fallback strategy, which
1123 * is not recommended in the first place, unless you absolutely need it to
1124 * interoperate with buggy (version-intolerant) servers.
1125 *
1126 * Comment this macro to disable support for FALLBACK_SCSV
1127 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001128#define MBEDTLS_SSL_FALLBACK_SCSV
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001129
1130/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001131 * \def MBEDTLS_SSL_HW_RECORD_ACCEL
Paul Bakker05ef8352012-05-08 09:17:57 +00001132 *
1133 * Enable hooking functions in SSL module for hardware acceleration of
1134 * individual records.
1135 *
1136 * Uncomment this macro to enable hooking functions.
Paul Bakker05ef8352012-05-08 09:17:57 +00001137 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001138//#define MBEDTLS_SSL_HW_RECORD_ACCEL
Paul Bakker05ef8352012-05-08 09:17:57 +00001139
1140/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001141 * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01001142 *
1143 * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
1144 *
1145 * This is a countermeasure to the BEAST attack, which also minimizes the risk
1146 * of interoperability issues compared to sending 0-length records.
1147 *
1148 * Comment this macro to disable 1/n-1 record splitting.
1149 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001150#define MBEDTLS_SSL_CBC_RECORD_SPLITTING
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01001151
1152/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001153 * \def MBEDTLS_SSL_RENEGOTIATION
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001154 *
Manuel Pégourié-Gonnard03717042014-11-04 19:52:10 +01001155 * Disable support for TLS renegotiation.
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001156 *
1157 * The two main uses of renegotiation are (1) refresh keys on long-lived
1158 * connections and (2) client authentication after the initial handshake.
1159 * If you don't need renegotiation, it's probably better to disable it, since
1160 * it has been associated with security issues in the past and is easy to
1161 * misuse/misunderstand.
Manuel Pégourié-Gonnard03717042014-11-04 19:52:10 +01001162 *
Manuel Pégourié-Gonnard55f968b2015-03-09 16:23:15 +00001163 * Comment this to disable support for renegotiation.
Hanno Becker6851b102017-10-12 14:57:48 +01001164 *
1165 * \note Even if this option is disabled, both client and server are aware
1166 * of the Renegotiation Indication Extension (RFC 5746) used to
1167 * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1).
1168 * (See \c mbedtls_ssl_conf_legacy_renegotiation for the
1169 * configuration of this extension).
1170 *
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001171 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001172#define MBEDTLS_SSL_RENEGOTIATION
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001173
1174/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001175 * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
Paul Bakker78a8c712013-03-06 17:01:52 +01001176 *
1177 * Enable support for receiving and parsing SSLv2 Client Hello messages for the
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001178 * SSL Server module (MBEDTLS_SSL_SRV_C).
Paul Bakker78a8c712013-03-06 17:01:52 +01001179 *
Manuel Pégourié-Gonnard265dd5c2015-03-10 13:48:34 +00001180 * Uncomment this macro to enable support for SSLv2 Client Hello messages.
Paul Bakker78a8c712013-03-06 17:01:52 +01001181 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001182//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
Paul Bakker78a8c712013-03-06 17:01:52 +01001183
1184/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001185 * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001186 *
1187 * Pick the ciphersuite according to the client's preferences rather than ours
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001188 * in the SSL Server module (MBEDTLS_SSL_SRV_C).
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001189 *
1190 * Uncomment this macro to respect client's ciphersuite order
1191 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001193
1194/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195 * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
Paul Bakker05decb22013-08-15 13:33:48 +02001196 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001197 * Enable support for RFC 6066 max_fragment_length extension in SSL.
Paul Bakker05decb22013-08-15 13:33:48 +02001198 *
1199 * Comment this macro to disable support for the max_fragment_length extension
1200 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001201#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
Paul Bakker05decb22013-08-15 13:33:48 +02001202
1203/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204 * \def MBEDTLS_SSL_PROTO_SSL3
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001205 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001206 * Enable support for SSL 3.0.
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001207 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001208 * Requires: MBEDTLS_MD5_C
1209 * MBEDTLS_SHA1_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001210 *
1211 * Comment this macro to disable support for SSL 3.0
1212 */
Janos Follathe2681a42016-03-07 15:57:05 +00001213//#define MBEDTLS_SSL_PROTO_SSL3
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001214
1215/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216 * \def MBEDTLS_SSL_PROTO_TLS1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001217 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001218 * Enable support for TLS 1.0.
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001219 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220 * Requires: MBEDTLS_MD5_C
1221 * MBEDTLS_SHA1_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001222 *
1223 * Comment this macro to disable support for TLS 1.0
1224 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001225#define MBEDTLS_SSL_PROTO_TLS1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001226
1227/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001228 * \def MBEDTLS_SSL_PROTO_TLS1_1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001229 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001230 * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001231 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001232 * Requires: MBEDTLS_MD5_C
1233 * MBEDTLS_SHA1_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001234 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001235 * Comment this macro to disable support for TLS 1.1 / DTLS 1.0
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001236 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001237#define MBEDTLS_SSL_PROTO_TLS1_1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001238
1239/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001240 * \def MBEDTLS_SSL_PROTO_TLS1_2
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001241 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001242 * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001243 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001244 * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001245 * (Depends on ciphersuites)
1246 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001247 * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001248 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001249#define MBEDTLS_SSL_PROTO_TLS1_2
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001250
1251/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001252 * \def MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001253 *
1254 * Enable support for DTLS (all available versions).
1255 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001256 * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0,
1257 * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001258 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001259 * Requires: MBEDTLS_SSL_PROTO_TLS1_1
1260 * or MBEDTLS_SSL_PROTO_TLS1_2
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001261 *
1262 * Comment this macro to disable support for DTLS
1263 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001264#define MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001265
1266/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001267 * \def MBEDTLS_SSL_ALPN
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001268 *
Manuel Pégourié-Gonnard6b298e62014-11-20 18:28:50 +01001269 * Enable support for RFC 7301 Application Layer Protocol Negotiation.
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001270 *
Paul Bakker27e36d32014-04-08 12:33:37 +02001271 * Comment this macro to disable support for ALPN.
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001272 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001273#define MBEDTLS_SSL_ALPN
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001274
1275/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001276 * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001277 *
1278 * Enable support for the anti-replay mechanism in DTLS.
1279 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001280 * Requires: MBEDTLS_SSL_TLS_C
1281 * MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001282 *
Manuel Pégourié-Gonnarda6fcffe2014-10-13 18:15:52 +02001283 * \warning Disabling this is often a security risk!
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001284 * See mbedtls_ssl_conf_dtls_anti_replay() for details.
Manuel Pégourié-Gonnarda6fcffe2014-10-13 18:15:52 +02001285 *
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001286 * Comment this to disable anti-replay in DTLS.
1287 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001288#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001289
1290/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001291 * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001292 *
1293 * Enable support for HelloVerifyRequest on DTLS servers.
1294 *
1295 * This feature is highly recommended to prevent DTLS servers being used as
1296 * amplifiers in DoS attacks against other hosts. It should always be enabled
1297 * unless you know for sure amplification cannot be a problem in the
1298 * environment in which your server operates.
1299 *
Manuel Pégourié-Gonnarda6fcffe2014-10-13 18:15:52 +02001300 * \warning Disabling this can ba a security risk! (see above)
1301 *
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001302 * Requires: MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001303 *
1304 * Comment this to disable support for HelloVerifyRequest.
1305 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001306#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001307
1308/**
Manuel Pégourié-Gonnard26d227d2015-09-04 10:53:25 +02001309 * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
1310 *
1311 * Enable server-side support for clients that reconnect from the same port.
1312 *
1313 * Some clients unexpectedly close the connection and try to reconnect using the
1314 * same source port. This needs special support from the server to handle the
Simon Butcher4f6882a2015-09-11 17:12:46 +01001315 * new connection securely, as described in section 4.2.8 of RFC 6347. This
Manuel Pégourié-Gonnard26d227d2015-09-04 10:53:25 +02001316 * flag enables that support.
1317 *
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02001318 * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02001319 *
Manuel Pégourié-Gonnard26d227d2015-09-04 10:53:25 +02001320 * Comment this to disable support for clients reusing the source port.
1321 */
1322#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
1323
1324/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001325 * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001326 *
1327 * Enable support for a limit of records with bad MAC.
1328 *
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001329 * See mbedtls_ssl_conf_dtls_badmac_limit().
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001330 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001331 * Requires: MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001332 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001333#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001334
1335/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001336 * \def MBEDTLS_SSL_SESSION_TICKETS
Paul Bakkera503a632013-08-14 13:48:06 +02001337 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001338 * Enable support for RFC 5077 session tickets in SSL.
Manuel Pégourié-Gonnard0c0f11f2015-05-20 09:55:50 +02001339 * Client-side, provides full support for session tickets (maintainance of a
1340 * session store remains the responsibility of the application, though).
1341 * Server-side, you also need to provide callbacks for writing and parsing
1342 * tickets, including authenticated encryption and key management. Example
1343 * callbacks are provided by MBEDTLS_SSL_TICKET_C.
Paul Bakkera503a632013-08-14 13:48:06 +02001344 *
1345 * Comment this macro to disable support for SSL session tickets
1346 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001347#define MBEDTLS_SSL_SESSION_TICKETS
Paul Bakkera503a632013-08-14 13:48:06 +02001348
1349/**
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001350 * \def MBEDTLS_SSL_EXPORT_KEYS
1351 *
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001352 * Enable support for exporting key block and master secret.
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001353 * This is required for certain users of TLS, e.g. EAP-TLS.
1354 *
1355 * Comment this macro to disable support for key export
1356 */
1357#define MBEDTLS_SSL_EXPORT_KEYS
1358
1359/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001360 * \def MBEDTLS_SSL_SERVER_NAME_INDICATION
Paul Bakker0be444a2013-08-27 21:55:01 +02001361 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001362 * Enable support for RFC 6066 server name indication (SNI) in SSL.
Paul Bakker0be444a2013-08-27 21:55:01 +02001363 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001364 * Requires: MBEDTLS_X509_CRT_PARSE_C
Manuel Pégourié-Gonnardbbbb3cf2015-01-28 16:44:37 +00001365 *
Paul Bakker0be444a2013-08-27 21:55:01 +02001366 * Comment this macro to disable support for server name indication in SSL
1367 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001368#define MBEDTLS_SSL_SERVER_NAME_INDICATION
Paul Bakker0be444a2013-08-27 21:55:01 +02001369
1370/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001371 * \def MBEDTLS_SSL_TRUNCATED_HMAC
Paul Bakker1f2bc622013-08-15 13:45:55 +02001372 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001373 * Enable support for RFC 6066 truncated HMAC in SSL.
Paul Bakker1f2bc622013-08-15 13:45:55 +02001374 *
1375 * Comment this macro to disable support for truncated HMAC in SSL
1376 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001377#define MBEDTLS_SSL_TRUNCATED_HMAC
Paul Bakker1f2bc622013-08-15 13:45:55 +02001378
1379/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001380 * \def MBEDTLS_THREADING_ALT
Paul Bakker2466d932013-09-28 14:40:38 +02001381 *
1382 * Provide your own alternate threading implementation.
1383 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001384 * Requires: MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02001385 *
1386 * Uncomment this to allow your own alternate threading implementation.
Paul Bakker2466d932013-09-28 14:40:38 +02001387 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001388//#define MBEDTLS_THREADING_ALT
Paul Bakker2466d932013-09-28 14:40:38 +02001389
1390/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001391 * \def MBEDTLS_THREADING_PTHREAD
Paul Bakker2466d932013-09-28 14:40:38 +02001392 *
1393 * Enable the pthread wrapper layer for the threading layer.
1394 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001395 * Requires: MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02001396 *
1397 * Uncomment this to enable pthread mutexes.
Paul Bakker2466d932013-09-28 14:40:38 +02001398 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001399//#define MBEDTLS_THREADING_PTHREAD
Paul Bakker2466d932013-09-28 14:40:38 +02001400
1401/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001402 * \def MBEDTLS_VERSION_FEATURES
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001403 *
1404 * Allow run-time checking of compile-time enabled features. Thus allowing users
1405 * to check at run-time if the library is for instance compiled with threading
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001406 * support via mbedtls_version_check_feature().
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001407 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408 * Requires: MBEDTLS_VERSION_C
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001409 *
1410 * Comment this to disable run-time checking and save ROM space
1411 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001412#define MBEDTLS_VERSION_FEATURES
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001413
1414/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001415 * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
Paul Bakkerc27c4e22013-09-23 15:01:36 +02001416 *
1417 * If set, the X509 parser will not break-off when parsing an X509 certificate
1418 * and encountering an extension in a v1 or v2 certificate.
1419 *
1420 * Uncomment to prevent an error.
Paul Bakkerc27c4e22013-09-23 15:01:36 +02001421 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001422//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
Paul Bakkerc27c4e22013-09-23 15:01:36 +02001423
1424/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001425 * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
Paul Bakker5c721f92011-07-27 16:51:09 +00001426 *
1427 * If set, the X509 parser will not break-off when parsing an X509 certificate
1428 * and encountering an unknown critical extension.
1429 *
Manuel Pégourié-Gonnardcb6af002015-10-05 12:12:39 +01001430 * \warning Depending on your PKI use, enabling this can be a security risk!
1431 *
Paul Bakker5c721f92011-07-27 16:51:09 +00001432 * Uncomment to prevent an error.
Paul Bakker5c721f92011-07-27 16:51:09 +00001433 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001434//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
Paul Bakker2770fbd2012-07-03 13:30:23 +00001435
1436/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437 * \def MBEDTLS_X509_CHECK_KEY_USAGE
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001438 *
1439 * Enable verification of the keyUsage extension (CA and leaf certificates).
1440 *
1441 * Disabling this avoids problems with mis-issued and/or misused
1442 * (intermediate) CA and leaf certificates.
1443 *
1444 * \warning Depending on your PKI use, disabling this can be a security risk!
1445 *
1446 * Comment to skip keyUsage checking for both CA and leaf certificates.
1447 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001448#define MBEDTLS_X509_CHECK_KEY_USAGE
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001449
1450/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001451 * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001452 *
1453 * Enable verification of the extendedKeyUsage extension (leaf certificates).
1454 *
1455 * Disabling this avoids problems with mis-issued and/or misused certificates.
1456 *
1457 * \warning Depending on your PKI use, disabling this can be a security risk!
1458 *
1459 * Comment to skip extendedKeyUsage checking for certificates.
1460 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001461#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001462
1463/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001464 * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
Manuel Pégourié-Gonnardd1539b12014-06-06 16:42:37 +02001465 *
1466 * Enable parsing and verification of X.509 certificates, CRLs and CSRS
1467 * signed with RSASSA-PSS (aka PKCS#1 v2.1).
1468 *
1469 * Comment this macro to disallow using RSASSA-PSS in certificates.
1470 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001471#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
Manuel Pégourié-Gonnardd1539b12014-06-06 16:42:37 +02001472
1473/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001474 * \def MBEDTLS_ZLIB_SUPPORT
Paul Bakker2770fbd2012-07-03 13:30:23 +00001475 *
1476 * If set, the SSL/TLS module uses ZLIB to support compression and
1477 * decompression of packet data.
1478 *
Manuel Pégourié-Gonnardbb4dd372014-03-11 10:30:38 +01001479 * \warning TLS-level compression MAY REDUCE SECURITY! See for example the
1480 * CRIME attack. Before enabling this option, you should examine with care if
1481 * CRIME or similar exploits may be a applicable to your use case.
1482 *
Manuel Pégourié-Gonnard7c3b4ab2015-07-02 17:59:52 +02001483 * \note Currently compression can't be used with DTLS.
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001484 *
Paul Bakker2770fbd2012-07-03 13:30:23 +00001485 * Used in: library/ssl_tls.c
1486 * library/ssl_cli.c
1487 * library/ssl_srv.c
1488 *
1489 * This feature requires zlib library and headers to be present.
1490 *
1491 * Uncomment to enable use of ZLIB
Paul Bakker2770fbd2012-07-03 13:30:23 +00001492 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001493//#define MBEDTLS_ZLIB_SUPPORT
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001494/* \} name SECTION: mbed TLS feature support */
Paul Bakker0a62cd12011-01-21 11:00:08 +00001495
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001496/**
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001497 * \name SECTION: mbed TLS modules
Paul Bakker0a62cd12011-01-21 11:00:08 +00001498 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001499 * This section enables or disables entire modules in mbed TLS
Paul Bakker0a62cd12011-01-21 11:00:08 +00001500 * \{
1501 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001502
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001503/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001504 * \def MBEDTLS_AESNI_C
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001505 *
1506 * Enable AES-NI support on x86-64.
1507 *
1508 * Module: library/aesni.c
1509 * Caller: library/aes.c
1510 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001511 * Requires: MBEDTLS_HAVE_ASM
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001512 *
1513 * This modules adds support for the AES-NI instructions on x86-64
1514 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001515#define MBEDTLS_AESNI_C
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001516
1517/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001518 * \def MBEDTLS_AES_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001519 *
1520 * Enable the AES block cipher.
1521 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001522 * Module: library/aes.c
1523 * Caller: library/ssl_tls.c
Paul Bakker96743fc2011-02-12 14:30:57 +00001524 * library/pem.c
Paul Bakker6083fd22011-12-03 21:45:14 +00001525 * library/ctr_drbg.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001526 *
Paul Bakker645ce3a2012-10-31 12:32:41 +00001527 * This module enables the following ciphersuites (if other requisites are
1528 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001529 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1530 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
1531 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1532 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
1533 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
1534 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
1535 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
1536 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
1537 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
1538 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
1539 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
1540 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
1541 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1542 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1543 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
1544 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
1545 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
1546 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
1547 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1548 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1549 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1550 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1551 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1552 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
1553 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
1554 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
1555 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
1556 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1557 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1558 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1559 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
1560 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
1561 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
1562 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
1563 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
1564 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
1565 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
1566 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
1567 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
1568 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
1569 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
1570 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
1571 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
1572 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
1573 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
1574 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
1575 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
1576 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
1577 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
1578 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
1579 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
1580 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
1581 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
1582 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
1583 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
1584 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
1585 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
1586 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
Paul Bakker6deb37e2013-02-19 13:17:08 +01001587 *
Paul Bakkercff68422013-09-15 20:43:33 +02001588 * PEM_PARSE uses AES for decrypting encrypted keys.
Paul Bakker5121ce52009-01-03 21:22:43 +00001589 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001590#define MBEDTLS_AES_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001591
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001592/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001593 * \def MBEDTLS_ARC4_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001594 *
1595 * Enable the ARCFOUR stream cipher.
1596 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001597 * Module: library/arc4.c
1598 * Caller: library/ssl_tls.c
1599 *
Paul Bakker41c83d32013-03-20 14:39:14 +01001600 * This module enables the following ciphersuites (if other requisites are
1601 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001602 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
1603 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
1604 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1605 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
1606 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
1607 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
1608 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
1609 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
1610 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
1611 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
Paul Bakker5121ce52009-01-03 21:22:43 +00001612 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001613#define MBEDTLS_ARC4_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001614
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001615/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001616 * \def MBEDTLS_ASN1_PARSE_C
Paul Bakkerefc30292011-11-10 14:43:23 +00001617 *
1618 * Enable the generic ASN1 parser.
1619 *
1620 * Module: library/asn1.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001621 * Caller: library/x509.c
1622 * library/dhm.c
1623 * library/pkcs12.c
1624 * library/pkcs5.c
1625 * library/pkparse.c
Paul Bakkerefc30292011-11-10 14:43:23 +00001626 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001627#define MBEDTLS_ASN1_PARSE_C
Paul Bakkerefc30292011-11-10 14:43:23 +00001628
1629/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001630 * \def MBEDTLS_ASN1_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001631 *
1632 * Enable the generic ASN1 writer.
1633 *
1634 * Module: library/asn1write.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001635 * Caller: library/ecdsa.c
1636 * library/pkwrite.c
1637 * library/x509_create.c
1638 * library/x509write_crt.c
Simon Butcher2cb47392016-11-04 12:23:11 +00001639 * library/x509write_csr.c
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001640 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001641#define MBEDTLS_ASN1_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001642
1643/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001644 * \def MBEDTLS_BASE64_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001645 *
1646 * Enable the Base64 module.
1647 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001648 * Module: library/base64.c
Paul Bakker5690efc2011-05-26 13:16:06 +00001649 * Caller: library/pem.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001650 *
Paul Bakker5690efc2011-05-26 13:16:06 +00001651 * This module is required for PEM support (required by X.509).
Paul Bakker5121ce52009-01-03 21:22:43 +00001652 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653#define MBEDTLS_BASE64_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001654
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001655/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001656 * \def MBEDTLS_BIGNUM_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001657 *
Paul Bakker9a736322012-11-14 12:39:52 +00001658 * Enable the multi-precision integer library.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001659 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001660 * Module: library/bignum.c
1661 * Caller: library/dhm.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001662 * library/ecp.c
Manuel Pégourié-Gonnardbf319772014-06-25 13:00:17 +02001663 * library/ecdsa.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001664 * library/rsa.c
1665 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001666 *
Manuel Pégourié-Gonnardbf319772014-06-25 13:00:17 +02001667 * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support.
Paul Bakker5121ce52009-01-03 21:22:43 +00001668 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001669#define MBEDTLS_BIGNUM_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001670
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001671/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001672 * \def MBEDTLS_BLOWFISH_C
Paul Bakkera9379c02012-07-04 11:02:11 +00001673 *
1674 * Enable the Blowfish block cipher.
1675 *
1676 * Module: library/blowfish.c
1677 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001678#define MBEDTLS_BLOWFISH_C
Paul Bakkera9379c02012-07-04 11:02:11 +00001679
1680/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001681 * \def MBEDTLS_CAMELLIA_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001682 *
1683 * Enable the Camellia block cipher.
1684 *
Paul Bakker38119b12009-01-10 23:31:23 +00001685 * Module: library/camellia.c
Paul Bakker13e2dfe2009-07-28 07:18:38 +00001686 * Caller: library/ssl_tls.c
Paul Bakker38119b12009-01-10 23:31:23 +00001687 *
Paul Bakker645ce3a2012-10-31 12:32:41 +00001688 * This module enables the following ciphersuites (if other requisites are
1689 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001690 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1691 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1692 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
1693 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
1694 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1695 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1696 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
1697 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
1698 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1699 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1700 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1701 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1702 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
1703 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
1704 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
1705 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1706 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1707 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1708 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1709 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1710 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1711 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
1712 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
1713 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1714 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1715 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
1716 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1717 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1718 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
1719 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
1720 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
1721 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
1722 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
1723 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
1724 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
1725 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
1726 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
1727 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
1728 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
1729 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
1730 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
1731 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
Paul Bakker38119b12009-01-10 23:31:23 +00001732 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733#define MBEDTLS_CAMELLIA_C
Paul Bakker38119b12009-01-10 23:31:23 +00001734
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001735/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736 * \def MBEDTLS_CCM_C
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001737 *
1738 * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
1739 *
1740 * Module: library/ccm.c
1741 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001742 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001743 *
1744 * This module enables the AES-CCM ciphersuites, if other requisites are
1745 * enabled as well.
1746 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001747#define MBEDTLS_CCM_C
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001748
1749/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001750 * \def MBEDTLS_CERTS_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001751 *
1752 * Enable the test certificates.
1753 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001754 * Module: library/certs.c
1755 * Caller:
1756 *
1757 * This module is used for testing (ssl_client/server).
1758 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001759#define MBEDTLS_CERTS_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001760
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001761/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001762 * \def MBEDTLS_CIPHER_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001763 *
1764 * Enable the generic cipher layer.
1765 *
Paul Bakker8123e9d2011-01-06 15:37:30 +00001766 * Module: library/cipher.c
Paul Bakker04784f52013-08-19 13:30:57 +02001767 * Caller: library/ssl_tls.c
Paul Bakker8123e9d2011-01-06 15:37:30 +00001768 *
1769 * Uncomment to enable generic cipher wrappers.
1770 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001771#define MBEDTLS_CIPHER_C
Paul Bakker8123e9d2011-01-06 15:37:30 +00001772
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001773/**
Robert Cragiedc5c7b92015-12-11 15:49:45 +00001774 * \def MBEDTLS_CMAC_C
1775 *
Simon Butcher327398a2016-10-05 14:09:11 +01001776 * Enable the CMAC (Cipher-based Message Authentication Code) mode for block
1777 * ciphers.
Robert Cragiedc5c7b92015-12-11 15:49:45 +00001778 *
1779 * Module: library/cmac.c
1780 *
Simon Butcher69283e52016-10-06 12:49:58 +01001781 * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C
Robert Cragiedc5c7b92015-12-11 15:49:45 +00001782 *
1783 */
Brian Murray53e23b62016-09-13 14:00:15 -07001784//#define MBEDTLS_CMAC_C
Robert Cragiedc5c7b92015-12-11 15:49:45 +00001785
1786/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001787 * \def MBEDTLS_CTR_DRBG_C
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001788 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001789 * Enable the CTR_DRBG AES-256-based random generator.
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001790 *
1791 * Module: library/ctr_drbg.c
1792 * Caller:
1793 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001794 * Requires: MBEDTLS_AES_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001795 *
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001796 * This module provides the CTR_DRBG AES-256 random number generator.
1797 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001798#define MBEDTLS_CTR_DRBG_C
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001799
1800/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001801 * \def MBEDTLS_DEBUG_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001802 *
1803 * Enable the debug functions.
1804 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001805 * Module: library/debug.c
1806 * Caller: library/ssl_cli.c
1807 * library/ssl_srv.c
1808 * library/ssl_tls.c
1809 *
1810 * This module provides debugging functions.
1811 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001812#define MBEDTLS_DEBUG_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001813
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001814/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815 * \def MBEDTLS_DES_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001816 *
1817 * Enable the DES block cipher.
1818 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001819 * Module: library/des.c
Paul Bakker6deb37e2013-02-19 13:17:08 +01001820 * Caller: library/pem.c
1821 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001822 *
Paul Bakker645ce3a2012-10-31 12:32:41 +00001823 * This module enables the following ciphersuites (if other requisites are
1824 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001825 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1826 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
1827 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
1828 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
1829 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1830 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
1831 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
1832 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
1833 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
1834 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
Paul Bakker6deb37e2013-02-19 13:17:08 +01001835 *
Paul Bakkercff68422013-09-15 20:43:33 +02001836 * PEM_PARSE uses DES/3DES for decrypting encrypted keys.
Paul Bakker5121ce52009-01-03 21:22:43 +00001837 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001838#define MBEDTLS_DES_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001839
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001840/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001841 * \def MBEDTLS_DHM_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001842 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001843 * Enable the Diffie-Hellman-Merkle module.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001844 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001845 * Module: library/dhm.c
1846 * Caller: library/ssl_cli.c
1847 * library/ssl_srv.c
1848 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001849 * This module is used by the following key exchanges:
1850 * DHE-RSA, DHE-PSK
Paul Bakker5121ce52009-01-03 21:22:43 +00001851 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001852#define MBEDTLS_DHM_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001853
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001854/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001855 * \def MBEDTLS_ECDH_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001856 *
1857 * Enable the elliptic curve Diffie-Hellman library.
1858 *
1859 * Module: library/ecdh.c
Paul Bakker41c83d32013-03-20 14:39:14 +01001860 * Caller: library/ssl_cli.c
1861 * library/ssl_srv.c
1862 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001863 * This module is used by the following key exchanges:
1864 * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001865 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001866 * Requires: MBEDTLS_ECP_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001867 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001868#define MBEDTLS_ECDH_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001869
1870/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001871 * \def MBEDTLS_ECDSA_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001872 *
1873 * Enable the elliptic curve DSA library.
1874 *
1875 * Module: library/ecdsa.c
1876 * Caller:
1877 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001878 * This module is used by the following key exchanges:
1879 * ECDHE-ECDSA
1880 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001881 * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001882 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001883#define MBEDTLS_ECDSA_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001884
1885/**
Manuel Pégourié-Gonnard4d8685b2015-08-05 15:44:42 +02001886 * \def MBEDTLS_ECJPAKE_C
1887 *
1888 * Enable the elliptic curve J-PAKE library.
1889 *
Manuel Pégourié-Gonnard75df9022015-09-16 23:21:01 +02001890 * \warning This is currently experimental. EC J-PAKE support is based on the
1891 * Thread v1.0.0 specification; incompatible changes to the specification
1892 * might still happen. For this reason, this is disabled by default.
1893 *
Manuel Pégourié-Gonnard4d8685b2015-08-05 15:44:42 +02001894 * Module: library/ecjpake.c
1895 * Caller:
1896 *
1897 * This module is used by the following key exchanges:
1898 * ECJPAKE
1899 *
1900 * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C
1901 */
Manuel Pégourié-Gonnardcf828932015-10-20 14:57:00 +02001902//#define MBEDTLS_ECJPAKE_C
Manuel Pégourié-Gonnard4d8685b2015-08-05 15:44:42 +02001903
1904/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001905 * \def MBEDTLS_ECP_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001906 *
1907 * Enable the elliptic curve over GF(p) library.
1908 *
1909 * Module: library/ecp.c
1910 * Caller: library/ecdh.c
1911 * library/ecdsa.c
Manuel Pégourié-Gonnard4d8685b2015-08-05 15:44:42 +02001912 * library/ecjpake.c
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001913 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001914 * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001915 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001916#define MBEDTLS_ECP_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001917
1918/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001919 * \def MBEDTLS_ENTROPY_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001920 *
1921 * Enable the platform-specific entropy code.
1922 *
1923 * Module: library/entropy.c
1924 * Caller:
1925 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001926 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001927 *
1928 * This module provides a generic entropy pool
1929 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001930#define MBEDTLS_ENTROPY_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001931
1932/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001933 * \def MBEDTLS_ERROR_C
Paul Bakker9d781402011-05-09 16:17:09 +00001934 *
1935 * Enable error code to error string conversion.
1936 *
1937 * Module: library/error.c
1938 * Caller:
1939 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001940 * This module enables mbedtls_strerror().
Paul Bakker9d781402011-05-09 16:17:09 +00001941 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001942#define MBEDTLS_ERROR_C
Paul Bakker9d781402011-05-09 16:17:09 +00001943
1944/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001945 * \def MBEDTLS_GCM_C
Paul Bakker89e80c92012-03-20 13:50:09 +00001946 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001947 * Enable the Galois/Counter Mode (GCM) for AES.
Paul Bakker89e80c92012-03-20 13:50:09 +00001948 *
1949 * Module: library/gcm.c
1950 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001951 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
Paul Bakker645ce3a2012-10-31 12:32:41 +00001952 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001953 * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other
1954 * requisites are enabled as well.
Paul Bakker89e80c92012-03-20 13:50:09 +00001955 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001956#define MBEDTLS_GCM_C
Paul Bakker89e80c92012-03-20 13:50:09 +00001957
1958/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001959 * \def MBEDTLS_HAVEGE_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001960 *
1961 * Enable the HAVEGE random generator.
1962 *
Paul Bakker2a844242013-06-24 13:01:53 +02001963 * Warning: the HAVEGE random generator is not suitable for virtualized
1964 * environments
1965 *
1966 * Warning: the HAVEGE random generator is dependent on timing and specific
1967 * processor traits. It is therefore not advised to use HAVEGE as
1968 * your applications primary random generator or primary entropy pool
1969 * input. As a secondary input to your entropy pool, it IS able add
1970 * the (limited) extra entropy it provides.
1971 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001972 * Module: library/havege.c
1973 * Caller:
1974 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001975 * Requires: MBEDTLS_TIMING_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001976 *
Paul Bakker2a844242013-06-24 13:01:53 +02001977 * Uncomment to enable the HAVEGE random generator.
Paul Bakker2a844242013-06-24 13:01:53 +02001978 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001979//#define MBEDTLS_HAVEGE_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001980
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001981/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001982 * \def MBEDTLS_HMAC_DRBG_C
Manuel Pégourié-Gonnard490bdf32014-01-27 14:03:10 +01001983 *
1984 * Enable the HMAC_DRBG random generator.
1985 *
1986 * Module: library/hmac_drbg.c
1987 * Caller:
1988 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001989 * Requires: MBEDTLS_MD_C
Manuel Pégourié-Gonnard490bdf32014-01-27 14:03:10 +01001990 *
1991 * Uncomment to enable the HMAC_DRBG random number geerator.
1992 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001993#define MBEDTLS_HMAC_DRBG_C
Manuel Pégourié-Gonnard490bdf32014-01-27 14:03:10 +01001994
1995/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001996 * \def MBEDTLS_MD_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001997 *
1998 * Enable the generic message digest layer.
1999 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002000 * Module: library/md.c
Paul Bakker17373852011-01-06 14:20:01 +00002001 * Caller:
2002 *
2003 * Uncomment to enable generic message digest wrappers.
2004 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002005#define MBEDTLS_MD_C
Paul Bakker17373852011-01-06 14:20:01 +00002006
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002007/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002008 * \def MBEDTLS_MD2_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002009 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002010 * Enable the MD2 hash algorithm.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002011 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002012 * Module: library/md2.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002013 * Caller:
Paul Bakker5121ce52009-01-03 21:22:43 +00002014 *
2015 * Uncomment to enable support for (rare) MD2-signed X.509 certs.
Paul Bakker6506aff2009-07-28 20:52:02 +00002016 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002017//#define MBEDTLS_MD2_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002018
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002019/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002020 * \def MBEDTLS_MD4_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002021 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002022 * Enable the MD4 hash algorithm.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002023 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002024 * Module: library/md4.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002025 * Caller:
Paul Bakker5121ce52009-01-03 21:22:43 +00002026 *
2027 * Uncomment to enable support for (rare) MD4-signed X.509 certs.
Paul Bakker6506aff2009-07-28 20:52:02 +00002028 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002029//#define MBEDTLS_MD4_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002030
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002031/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002032 * \def MBEDTLS_MD5_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002033 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002034 * Enable the MD5 hash algorithm.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002035 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002036 * Module: library/md5.c
2037 * Caller: library/md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002038 * library/pem.c
Paul Bakker6deb37e2013-02-19 13:17:08 +01002039 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002040 *
2041 * This module is required for SSL/TLS and X.509.
Paul Bakkercff68422013-09-15 20:43:33 +02002042 * PEM_PARSE uses MD5 for decrypting encrypted keys.
Paul Bakker5121ce52009-01-03 21:22:43 +00002043 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002044#define MBEDTLS_MD5_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002045
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002046/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002047 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002048 *
2049 * Enable the buffer allocator implementation that makes use of a (stack)
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +02002050 * based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002051 * calls)
Paul Bakker6e339b52013-07-03 13:37:05 +02002052 *
2053 * Module: library/memory_buffer_alloc.c
2054 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002055 * Requires: MBEDTLS_PLATFORM_C
2056 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS)
Paul Bakker6e339b52013-07-03 13:37:05 +02002057 *
2058 * Enable this module to enable the buffer memory allocator.
Paul Bakker6e339b52013-07-03 13:37:05 +02002059 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002060//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
Paul Bakker6e339b52013-07-03 13:37:05 +02002061
2062/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002063 * \def MBEDTLS_NET_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002064 *
Manuel Pégourié-Gonnard325ce092016-02-22 10:33:34 +01002065 * Enable the TCP and UDP over IPv6/IPv4 networking routines.
2066 *
Simon Butcherd567a232016-03-09 20:19:21 +00002067 * \note This module only works on POSIX/Unix (including Linux, BSD and OS X)
2068 * and Windows. For other platforms, you'll want to disable it, and write your
Manuel Pégourié-Gonnard325ce092016-02-22 10:33:34 +01002069 * own networking callbacks to be passed to \c mbedtls_ssl_set_bio().
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002070 *
Manuel Pégourié-Gonnard02049dc2016-02-22 16:42:51 +00002071 * \note See also our Knowledge Base article about porting to a new
2072 * environment:
2073 * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
2074 *
Andres AG788aa4a2016-09-14 14:32:09 +01002075 * Module: library/net_sockets.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002076 *
Manuel Pégourié-Gonnard325ce092016-02-22 10:33:34 +01002077 * This module provides networking routines.
Paul Bakker5121ce52009-01-03 21:22:43 +00002078 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002079#define MBEDTLS_NET_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002080
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002081/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002082 * \def MBEDTLS_OID_C
Paul Bakkerc70b9822013-04-07 22:00:46 +02002083 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002084 * Enable the OID database.
Paul Bakkerc70b9822013-04-07 22:00:46 +02002085 *
2086 * Module: library/oid.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002087 * Caller: library/asn1write.c
2088 * library/pkcs5.c
2089 * library/pkparse.c
2090 * library/pkwrite.c
2091 * library/rsa.c
2092 * library/x509.c
2093 * library/x509_create.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002094 * library/x509_crl.c
2095 * library/x509_crt.c
2096 * library/x509_csr.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002097 * library/x509write_crt.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002098 * library/x509write_csr.c
Paul Bakkerc70b9822013-04-07 22:00:46 +02002099 *
2100 * This modules translates between OIDs and internal values.
2101 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002102#define MBEDTLS_OID_C
Paul Bakkerc70b9822013-04-07 22:00:46 +02002103
2104/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002105 * \def MBEDTLS_PADLOCK_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002106 *
2107 * Enable VIA Padlock support on x86.
2108 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002109 * Module: library/padlock.c
2110 * Caller: library/aes.c
2111 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002112 * Requires: MBEDTLS_HAVE_ASM
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01002113 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002114 * This modules adds support for the VIA PadLock on x86.
2115 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002116#define MBEDTLS_PADLOCK_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002117
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002118/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002119 * \def MBEDTLS_PEM_PARSE_C
Paul Bakker96743fc2011-02-12 14:30:57 +00002120 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002121 * Enable PEM decoding / parsing.
Paul Bakker96743fc2011-02-12 14:30:57 +00002122 *
2123 * Module: library/pem.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002124 * Caller: library/dhm.c
Paul Bakkercff68422013-09-15 20:43:33 +02002125 * library/pkparse.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002126 * library/x509_crl.c
2127 * library/x509_crt.c
2128 * library/x509_csr.c
Paul Bakker96743fc2011-02-12 14:30:57 +00002129 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002130 * Requires: MBEDTLS_BASE64_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002131 *
Paul Bakkercff68422013-09-15 20:43:33 +02002132 * This modules adds support for decoding / parsing PEM files.
Paul Bakker96743fc2011-02-12 14:30:57 +00002133 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002134#define MBEDTLS_PEM_PARSE_C
Paul Bakkercff68422013-09-15 20:43:33 +02002135
2136/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002137 * \def MBEDTLS_PEM_WRITE_C
Paul Bakkercff68422013-09-15 20:43:33 +02002138 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002139 * Enable PEM encoding / writing.
Paul Bakkercff68422013-09-15 20:43:33 +02002140 *
2141 * Module: library/pem.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002142 * Caller: library/pkwrite.c
2143 * library/x509write_crt.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002144 * library/x509write_csr.c
Paul Bakkercff68422013-09-15 20:43:33 +02002145 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002146 * Requires: MBEDTLS_BASE64_C
Paul Bakkercff68422013-09-15 20:43:33 +02002147 *
2148 * This modules adds support for encoding / writing PEM files.
2149 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002150#define MBEDTLS_PEM_WRITE_C
Paul Bakker96743fc2011-02-12 14:30:57 +00002151
2152/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002153 * \def MBEDTLS_PK_C
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02002154 *
2155 * Enable the generic public (asymetric) key layer.
2156 *
2157 * Module: library/pk.c
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02002158 * Caller: library/ssl_tls.c
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02002159 * library/ssl_cli.c
2160 * library/ssl_srv.c
2161 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002162 * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02002163 *
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02002164 * Uncomment to enable generic public key wrappers.
2165 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002166#define MBEDTLS_PK_C
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02002167
2168/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002169 * \def MBEDTLS_PK_PARSE_C
Paul Bakker4606c732013-09-15 17:04:23 +02002170 *
2171 * Enable the generic public (asymetric) key parser.
2172 *
2173 * Module: library/pkparse.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002174 * Caller: library/x509_crt.c
2175 * library/x509_csr.c
Paul Bakker4606c732013-09-15 17:04:23 +02002176 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002177 * Requires: MBEDTLS_PK_C
Paul Bakker4606c732013-09-15 17:04:23 +02002178 *
2179 * Uncomment to enable generic public key parse functions.
2180 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002181#define MBEDTLS_PK_PARSE_C
Paul Bakker4606c732013-09-15 17:04:23 +02002182
2183/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002184 * \def MBEDTLS_PK_WRITE_C
Paul Bakker4606c732013-09-15 17:04:23 +02002185 *
Paul Bakkerf20ba4b2013-09-16 22:46:20 +02002186 * Enable the generic public (asymetric) key writer.
Paul Bakker4606c732013-09-15 17:04:23 +02002187 *
2188 * Module: library/pkwrite.c
2189 * Caller: library/x509write.c
2190 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002191 * Requires: MBEDTLS_PK_C
Paul Bakker4606c732013-09-15 17:04:23 +02002192 *
2193 * Uncomment to enable generic public key write functions.
2194 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002195#define MBEDTLS_PK_WRITE_C
Paul Bakker4606c732013-09-15 17:04:23 +02002196
2197/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002198 * \def MBEDTLS_PKCS5_C
Paul Bakkerb0c19a42013-06-24 19:26:38 +02002199 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002200 * Enable PKCS#5 functions.
Paul Bakkerb0c19a42013-06-24 19:26:38 +02002201 *
2202 * Module: library/pkcs5.c
2203 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002204 * Requires: MBEDTLS_MD_C
Paul Bakkerb0c19a42013-06-24 19:26:38 +02002205 *
2206 * This module adds support for the PKCS#5 functions.
2207 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002208#define MBEDTLS_PKCS5_C
Paul Bakkerb0c19a42013-06-24 19:26:38 +02002209
2210/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002211 * \def MBEDTLS_PKCS11_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002212 *
Paul Bakkereb2c6582012-09-27 19:15:01 +00002213 * Enable wrapper for PKCS#11 smartcard support.
Paul Bakker5690efc2011-05-26 13:16:06 +00002214 *
Manuel Pégourié-Gonnard51be5592013-08-22 13:35:53 +02002215 * Module: library/pkcs11.c
2216 * Caller: library/pk.c
Paul Bakker5690efc2011-05-26 13:16:06 +00002217 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002218 * Requires: MBEDTLS_PK_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002219 *
Paul Bakkereb2c6582012-09-27 19:15:01 +00002220 * This module enables SSL/TLS PKCS #11 smartcard support.
Paul Bakker5690efc2011-05-26 13:16:06 +00002221 * Requires the presence of the PKCS#11 helper library (libpkcs11-helper)
Paul Bakker5690efc2011-05-26 13:16:06 +00002222 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002223//#define MBEDTLS_PKCS11_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002224
2225/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002226 * \def MBEDTLS_PKCS12_C
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02002227 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002228 * Enable PKCS#12 PBE functions.
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02002229 * Adds algorithms for parsing PKCS#8 encrypted private keys
2230 *
2231 * Module: library/pkcs12.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002232 * Caller: library/pkparse.c
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02002233 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002234 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2235 * Can use: MBEDTLS_ARC4_C
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02002236 *
2237 * This module enables PKCS#12 functions.
2238 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002239#define MBEDTLS_PKCS12_C
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02002240
2241/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002242 * \def MBEDTLS_PLATFORM_C
Paul Bakker747a83a2014-02-01 22:50:07 +01002243 *
2244 * Enable the platform abstraction layer that allows you to re-assign
Manuel Pégourié-Gonnard6c0c8e02015-06-22 10:23:34 +02002245 * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit().
Paul Bakker747a83a2014-02-01 22:50:07 +01002246 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002247 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
2248 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
Rich Evans16f8cd82015-02-06 16:14:34 +00002249 * above to be specified at runtime or compile time respectively.
Paul Bakker747a83a2014-02-01 22:50:07 +01002250 *
Manuel Pégourié-Gonnard6c0c8e02015-06-22 10:23:34 +02002251 * \note This abstraction layer must be enabled on Windows (including MSYS2)
2252 * as other module rely on it for a fixed snprintf implementation.
2253 *
Paul Bakker747a83a2014-02-01 22:50:07 +01002254 * Module: library/platform.c
2255 * Caller: Most other .c files
2256 *
2257 * This module enables abstraction of common (libc) functions.
2258 */
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +02002259#define MBEDTLS_PLATFORM_C
Paul Bakker747a83a2014-02-01 22:50:07 +01002260
2261/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002262 * \def MBEDTLS_RIPEMD160_C
Manuel Pégourié-Gonnardcab4a882014-01-17 12:42:35 +01002263 *
2264 * Enable the RIPEMD-160 hash algorithm.
2265 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002266 * Module: library/ripemd160.c
2267 * Caller: library/md.c
Manuel Pégourié-Gonnardcab4a882014-01-17 12:42:35 +01002268 *
2269 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002270#define MBEDTLS_RIPEMD160_C
Manuel Pégourié-Gonnardcab4a882014-01-17 12:42:35 +01002271
2272/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002273 * \def MBEDTLS_RSA_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002274 *
2275 * Enable the RSA public-key cryptosystem.
2276 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002277 * Module: library/rsa.c
2278 * Caller: library/ssl_cli.c
2279 * library/ssl_srv.c
2280 * library/ssl_tls.c
2281 * library/x509.c
2282 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02002283 * This module is used by the following key exchanges:
2284 * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK
Paul Bakker5690efc2011-05-26 13:16:06 +00002285 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002286 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002287 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002288#define MBEDTLS_RSA_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002289
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002290/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002291 * \def MBEDTLS_SHA1_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002292 *
2293 * Enable the SHA1 cryptographic hash algorithm.
2294 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002295 * Module: library/sha1.c
2296 * Caller: library/md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002297 * library/ssl_cli.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002298 * library/ssl_srv.c
2299 * library/ssl_tls.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002300 * library/x509write_crt.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002301 *
Gilles Peskine5e79cb32017-05-04 16:17:21 +02002302 * This module is required for SSL/TLS up to version 1.1, for TLS 1.2
2303 * depending on the handshake parameters, and for SHA1-signed certificates.
Paul Bakker5121ce52009-01-03 21:22:43 +00002304 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002305#define MBEDTLS_SHA1_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002306
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002307/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002308 * \def MBEDTLS_SHA256_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002309 *
2310 * Enable the SHA-224 and SHA-256 cryptographic hash algorithms.
2311 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002312 * Module: library/sha256.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002313 * Caller: library/entropy.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002314 * library/md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002315 * library/ssl_cli.c
2316 * library/ssl_srv.c
2317 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002318 *
2319 * This module adds support for SHA-224 and SHA-256.
Paul Bakker769075d2012-11-24 11:26:46 +01002320 * This module is required for the SSL/TLS 1.2 PRF function.
Paul Bakker5121ce52009-01-03 21:22:43 +00002321 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002322#define MBEDTLS_SHA256_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002323
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002324/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002325 * \def MBEDTLS_SHA512_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002326 *
2327 * Enable the SHA-384 and SHA-512 cryptographic hash algorithms.
2328 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002329 * Module: library/sha512.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002330 * Caller: library/entropy.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002331 * library/md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002332 * library/ssl_cli.c
2333 * library/ssl_srv.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002334 *
2335 * This module adds support for SHA-384 and SHA-512.
2336 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002337#define MBEDTLS_SHA512_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002338
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002339/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002340 * \def MBEDTLS_SSL_CACHE_C
Paul Bakker0a597072012-09-25 21:55:46 +00002341 *
2342 * Enable simple SSL cache implementation.
2343 *
2344 * Module: library/ssl_cache.c
2345 * Caller:
2346 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002347 * Requires: MBEDTLS_SSL_CACHE_C
Paul Bakker0a597072012-09-25 21:55:46 +00002348 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002349#define MBEDTLS_SSL_CACHE_C
Paul Bakker0a597072012-09-25 21:55:46 +00002350
2351/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002352 * \def MBEDTLS_SSL_COOKIE_C
Manuel Pégourié-Gonnarda64acd42014-07-23 18:30:45 +02002353 *
2354 * Enable basic implementation of DTLS cookies for hello verification.
2355 *
2356 * Module: library/ssl_cookie.c
2357 * Caller:
Manuel Pégourié-Gonnarda64acd42014-07-23 18:30:45 +02002358 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002359#define MBEDTLS_SSL_COOKIE_C
Manuel Pégourié-Gonnarda64acd42014-07-23 18:30:45 +02002360
2361/**
Manuel Pégourié-Gonnardfd6d8972015-05-15 12:09:00 +02002362 * \def MBEDTLS_SSL_TICKET_C
2363 *
2364 * Enable an implementation of TLS server-side callbacks for session tickets.
2365 *
2366 * Module: library/ssl_ticket.c
2367 * Caller:
Manuel Pégourié-Gonnard0c0f11f2015-05-20 09:55:50 +02002368 *
Manuel Pégourié-Gonnard4214e3a2015-05-25 19:34:49 +02002369 * Requires: MBEDTLS_CIPHER_C
Manuel Pégourié-Gonnardfd6d8972015-05-15 12:09:00 +02002370 */
2371#define MBEDTLS_SSL_TICKET_C
2372
2373/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002374 * \def MBEDTLS_SSL_CLI_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002375 *
2376 * Enable the SSL/TLS client code.
2377 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002378 * Module: library/ssl_cli.c
2379 * Caller:
2380 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002381 * Requires: MBEDTLS_SSL_TLS_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002382 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002383 * This module is required for SSL/TLS client support.
2384 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002385#define MBEDTLS_SSL_CLI_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002386
Paul Bakker9a736322012-11-14 12:39:52 +00002387/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002388 * \def MBEDTLS_SSL_SRV_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002389 *
2390 * Enable the SSL/TLS server code.
2391 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002392 * Module: library/ssl_srv.c
2393 * Caller:
2394 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002395 * Requires: MBEDTLS_SSL_TLS_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002396 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002397 * This module is required for SSL/TLS server support.
2398 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002399#define MBEDTLS_SSL_SRV_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002400
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002401/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002402 * \def MBEDTLS_SSL_TLS_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002403 *
Paul Bakkere29ab062011-05-18 13:26:54 +00002404 * Enable the generic SSL/TLS code.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002405 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002406 * Module: library/ssl_tls.c
2407 * Caller: library/ssl_cli.c
2408 * library/ssl_srv.c
2409 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002410 * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2411 * and at least one of the MBEDTLS_SSL_PROTO_XXX defines
Paul Bakker5690efc2011-05-26 13:16:06 +00002412 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002413 * This module is required for SSL/TLS.
2414 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002415#define MBEDTLS_SSL_TLS_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002416
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002417/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002418 * \def MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02002419 *
2420 * Enable the threading abstraction layer.
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00002421 * By default mbed TLS assumes it is used in a non-threaded environment or that
Paul Bakker2466d932013-09-28 14:40:38 +02002422 * contexts are not shared between threads. If you do intend to use contexts
2423 * between threads, you will need to enable this layer to prevent race
Manuel Pégourié-Gonnard02049dc2016-02-22 16:42:51 +00002424 * conditions. See also our Knowledge Base article about threading:
2425 * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
Paul Bakker2466d932013-09-28 14:40:38 +02002426 *
2427 * Module: library/threading.c
2428 *
2429 * This allows different threading implementations (self-implemented or
2430 * provided).
2431 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002432 * You will have to enable either MBEDTLS_THREADING_ALT or
2433 * MBEDTLS_THREADING_PTHREAD.
Paul Bakker2466d932013-09-28 14:40:38 +02002434 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00002435 * Enable this layer to allow use of mutexes within mbed TLS
Paul Bakker2466d932013-09-28 14:40:38 +02002436 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002437//#define MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02002438
2439/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002440 * \def MBEDTLS_TIMING_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002441 *
Manuel Pégourié-Gonnard325ce092016-02-22 10:33:34 +01002442 * Enable the semi-portable timing interface.
2443 *
Simon Butcherd567a232016-03-09 20:19:21 +00002444 * \note The provided implementation only works on POSIX/Unix (including Linux,
2445 * BSD and OS X) and Windows. On other platforms, you can either disable that
Manuel Pégourié-Gonnard325ce092016-02-22 10:33:34 +01002446 * module and provide your own implementations of the callbacks needed by
2447 * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide
2448 * your own implementation of the whole module by setting
2449 * \c MBEDTLS_TIMING_ALT in the current file.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002450 *
Manuel Pégourié-Gonnard02049dc2016-02-22 16:42:51 +00002451 * \note See also our Knowledge Base article about porting to a new
2452 * environment:
2453 * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
2454 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002455 * Module: library/timing.c
2456 * Caller: library/havege.c
2457 *
2458 * This module is used by the HAVEGE random number generator.
Paul Bakkerecd54fb2013-07-03 14:48:29 +02002459 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002460#define MBEDTLS_TIMING_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002461
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002462/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002463 * \def MBEDTLS_VERSION_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002464 *
2465 * Enable run-time version information.
2466 *
Paul Bakker0a62cd12011-01-21 11:00:08 +00002467 * Module: library/version.c
2468 *
2469 * This module provides run-time version information.
2470 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002471#define MBEDTLS_VERSION_C
Paul Bakker0a62cd12011-01-21 11:00:08 +00002472
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002473/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002474 * \def MBEDTLS_X509_USE_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002475 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002476 * Enable X.509 core for using certificates.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002477 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002478 * Module: library/x509.c
Simon Butcher2cb47392016-11-04 12:23:11 +00002479 * Caller: library/x509_crl.c
2480 * library/x509_crt.c
2481 * library/x509_csr.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002482 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002483 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C,
2484 * MBEDTLS_PK_PARSE_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002485 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002486 * This module is required for the X.509 parsing modules.
Paul Bakker5121ce52009-01-03 21:22:43 +00002487 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002488#define MBEDTLS_X509_USE_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002489
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002490/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002491 * \def MBEDTLS_X509_CRT_PARSE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002492 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002493 * Enable X.509 certificate parsing.
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002494 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002495 * Module: library/x509_crt.c
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002496 * Caller: library/ssl_cli.c
2497 * library/ssl_srv.c
2498 * library/ssl_tls.c
2499 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002500 * Requires: MBEDTLS_X509_USE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002501 *
2502 * This module is required for X.509 certificate parsing.
2503 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002504#define MBEDTLS_X509_CRT_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002505
2506/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002507 * \def MBEDTLS_X509_CRL_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002508 *
2509 * Enable X.509 CRL parsing.
2510 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002511 * Module: library/x509_crl.c
2512 * Caller: library/x509_crt.c
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002513 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002514 * Requires: MBEDTLS_X509_USE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002515 *
2516 * This module is required for X.509 CRL parsing.
2517 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002518#define MBEDTLS_X509_CRL_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002519
2520/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002521 * \def MBEDTLS_X509_CSR_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002522 *
2523 * Enable X.509 Certificate Signing Request (CSR) parsing.
2524 *
Simon Butcher2cb47392016-11-04 12:23:11 +00002525 * Module: library/x509_csr.c
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002526 * Caller: library/x509_crt_write.c
2527 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002528 * Requires: MBEDTLS_X509_USE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002529 *
2530 * This module is used for reading X.509 certificate request.
2531 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002532#define MBEDTLS_X509_CSR_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002533
2534/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002535 * \def MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002536 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002537 * Enable X.509 core for creating certificates.
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002538 *
2539 * Module: library/x509_create.c
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002540 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002541 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002542 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002543 * This module is the basis for creating X.509 certificates and CSRs.
2544 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002545#define MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002546
2547/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002548 * \def MBEDTLS_X509_CRT_WRITE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002549 *
2550 * Enable creating X.509 certificates.
2551 *
2552 * Module: library/x509_crt_write.c
2553 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002554 * Requires: MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002555 *
2556 * This module is required for X.509 certificate creation.
2557 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002558#define MBEDTLS_X509_CRT_WRITE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002559
2560/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002561 * \def MBEDTLS_X509_CSR_WRITE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002562 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002563 * Enable creating X.509 Certificate Signing Requests (CSR).
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002564 *
2565 * Module: library/x509_csr_write.c
2566 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002567 * Requires: MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002568 *
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002569 * This module is required for X.509 certificate request writing.
2570 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002571#define MBEDTLS_X509_CSR_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002572
2573/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002574 * \def MBEDTLS_XTEA_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002575 *
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002576 * Enable the XTEA block cipher.
2577 *
Paul Bakker7a7c78f2009-01-04 18:15:48 +00002578 * Module: library/xtea.c
2579 * Caller:
2580 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002581#define MBEDTLS_XTEA_C
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01002582
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00002583/* \} name SECTION: mbed TLS modules */
Paul Bakker7a7c78f2009-01-04 18:15:48 +00002584
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002585/**
2586 * \name SECTION: Module configuration options
2587 *
2588 * This section allows for the setting of module specific sizes and
2589 * configuration options. The default values are already present in the
2590 * relevant header files and should suffice for the regular use cases.
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002591 *
Paul Bakker088c5c52014-04-25 11:11:10 +02002592 * Our advice is to enable options and change their values here
2593 * only if you have a good reason and know the consequences.
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002594 *
2595 * Please check the respective header file for documentation on these
2596 * parameters (to prevent duplicate documentation).
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002597 * \{
2598 */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002599
Paul Bakker088c5c52014-04-25 11:11:10 +02002600/* MPI / BIGNUM options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002601//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */
2602//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002603
Paul Bakker088c5c52014-04-25 11:11:10 +02002604/* CTR_DRBG options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002605//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */
2606//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2607//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2608//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2609//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002610
Paul Bakker088c5c52014-04-25 11:11:10 +02002611/* HMAC_DRBG options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002612//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2613//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2614//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2615//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002616
Paul Bakker088c5c52014-04-25 11:11:10 +02002617/* ECP options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002618//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */
2619//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
2620//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
Manuel Pégourié-Gonnard0520b602014-01-30 19:43:46 +01002621
Paul Bakker088c5c52014-04-25 11:11:10 +02002622/* Entropy options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002623//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
2624//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
Andres AG7abc9742016-09-23 17:58:49 +01002625//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */
Paul Bakkere1b665e2013-12-11 16:02:58 +01002626
Paul Bakker088c5c52014-04-25 11:11:10 +02002627/* Memory buffer allocator options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002628//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002629
Paul Bakker088c5c52014-04-25 11:11:10 +02002630/* Platform options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002631//#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +02002632//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002633//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */
2634//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
Andres Amaya Garcia1e4ec662016-07-20 10:16:25 +01002635//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002636//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
2637//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */
Manuel Pégourié-Gonnard6c0c8e02015-06-22 10:23:34 +02002638/* Note: your snprintf must correclty zero-terminate the buffer! */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002639//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */
Janos Follath91947442016-03-18 13:49:27 +00002640//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */
2641//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */
Paul Bakkercf0a9f92016-06-01 11:25:44 +01002642//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
2643//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
2644//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */
Paul Bakker6e339b52013-07-03 13:37:05 +02002645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002646/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */
2647/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
Manuel Pégourié-Gonnardb9ef1182015-05-26 16:15:20 +02002648//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002649//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */
2650//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
Andres Amaya Garcia1e4ec662016-07-20 10:16:25 +01002651//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
2652//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002653//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */
2654//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */
Manuel Pégourié-Gonnard6c0c8e02015-06-22 10:23:34 +02002655/* Note: your snprintf must correclty zero-terminate the buffer! */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002656//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */
Paul Bakkercf0a9f92016-06-01 11:25:44 +01002657//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
2658//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002659
Paul Bakker088c5c52014-04-25 11:11:10 +02002660/* SSL Cache options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002661//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */
2662//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002663
Paul Bakker088c5c52014-04-25 11:11:10 +02002664/* SSL options */
Manuel Pégourié-Gonnardbb838442015-08-31 12:46:01 +02002665//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Maxium fragment length in bytes, determines the size of each of the two internal I/O buffers */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002666//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */
2667//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */
2668//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002669
Manuel Pégourié-Gonnarddfc7df02014-06-30 17:59:55 +02002670/**
2671 * Complete list of ciphersuites to use, in order of preference.
2672 *
2673 * \warning No dependency checking is done on that field! This option can only
2674 * be used to restrict the set of available ciphersuites. It is your
2675 * responsibility to make sure the needed modules are active.
2676 *
2677 * Use this to save a few hundred bytes of ROM (default ordering of all
2678 * available ciphersuites) and a few to a few hundred bytes of RAM.
2679 *
2680 * The value below is only an example, not the default.
2681 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002682//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Manuel Pégourié-Gonnarddfc7df02014-06-30 17:59:55 +02002683
Manuel Pégourié-Gonnardfd6c85c2014-11-20 16:34:20 +01002684/* X509 options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
Andres AGf9113192016-09-02 14:06:04 +01002686//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
Manuel Pégourié-Gonnardfd6c85c2014-11-20 16:34:20 +01002687
Gilles Peskine5e79cb32017-05-04 16:17:21 +02002688/**
Gilles Peskine5d2511c2017-05-12 13:16:40 +02002689 * Allow SHA-1 in the default TLS configuration for certificate signing.
2690 * Without this build-time option, SHA-1 support must be activated explicitly
2691 * through mbedtls_ssl_conf_cert_profile. Turning on this option is not
2692 * recommended because of it is possible to generte SHA-1 collisions, however
2693 * this may be safe for legacy infrastructure where additional controls apply.
Gilles Peskine5e79cb32017-05-04 16:17:21 +02002694 */
Gilles Peskine5d2511c2017-05-12 13:16:40 +02002695// #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES
2696
2697/**
2698 * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake
2699 * signature and ciphersuite selection. Without this build-time option, SHA-1
2700 * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes.
2701 * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by
2702 * default. At the time of writing, there is no practical attack on the use
2703 * of SHA-1 in handshake signatures, hence this option is turned on by default
2704 * for compatibility with existing peers.
2705 */
2706#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE
Gilles Peskine5e79cb32017-05-04 16:17:21 +02002707
Simon Butcher30b5f972016-06-08 19:00:23 +01002708/* \} name SECTION: Customisation configuration options */
Manuel Pégourié-Gonnard43569a92015-07-31 15:37:29 +02002709
Simon Butcherb2c81b12016-06-23 13:56:06 +01002710/* Target and application specific configurations */
Simon Butcher1d46a2d2016-07-11 10:17:03 +01002711//#define YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE "mbedtls/target_config.h"
2712
2713#if defined(TARGET_LIKE_MBED) && defined(YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE)
2714#include YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE
2715#endif
Simon Butcherb2c81b12016-06-23 13:56:06 +01002716
Manuel Pégourié-Gonnard32da9f62015-07-31 15:52:30 +02002717/*
2718 * Allow user to override any previous default.
2719 *
2720 * Use two macro names for that, as:
2721 * - with yotta the prefix YOTTA_CFG_ is forced
2722 * - without yotta is looks weird to have a YOTTA prefix.
2723 */
2724#if defined(YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE)
2725#include YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE
2726#elif defined(MBEDTLS_USER_CONFIG_FILE)
2727#include MBEDTLS_USER_CONFIG_FILE
2728#endif
2729
Manuel Pégourié-Gonnard14d55952014-04-30 12:35:08 +02002730#include "check_config.h"
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01002731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002732#endif /* MBEDTLS_CONFIG_H */