1 /** 2 * \file config.h 3 * 4 * \brief Configuration options (set of defines) 5 * 6 * This set of compile-time options may be used to enable 7 * or disable features selectively, and reduce the global 8 * memory footprint. 9 */ 10 /* 11 * Copyright (C) 2006-2022, ARM Limited, All Rights Reserved 12 * SPDX-License-Identifier: Apache-2.0 13 * 14 * Licensed under the Apache License, Version 2.0 (the "License"); you may 15 * not use this file except in compliance with the License. 16 * You may obtain a copy of the License at 17 * 18 * http://www.apache.org/licenses/LICENSE-2.0 19 * 20 * Unless required by applicable law or agreed to in writing, software 21 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 22 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 23 * See the License for the specific language governing permissions and 24 * limitations under the License. 25 * 26 * This file is part of mbed TLS (https://tls.mbed.org) 27 */ 28 29 #ifndef PROFILE_L_MBEDTLS_CONFIG_H 30 #define PROFILE_L_MBEDTLS_CONFIG_H 31 32 #include "config_tfm.h" 33 34 #if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) 35 #define _CRT_SECURE_NO_DEPRECATE 1 36 #endif 37 38 /** 39 * \name SECTION: System support 40 * 41 * This section sets system specific settings. 42 * \{ 43 */ 44 45 /** 46 * \def MBEDTLS_HAVE_ASM 47 * 48 * The compiler has support for asm(). 49 * 50 * Requires support for asm() in compiler. 51 * 52 * Used in: 53 * library/aria.c 54 * library/timing.c 55 * include/mbedtls/bn_mul.h 56 * 57 * Required by: 58 * MBEDTLS_AESNI_C 59 * MBEDTLS_PADLOCK_C 60 * 61 * Comment to disable the use of assembly code. 62 */ 63 #define MBEDTLS_HAVE_ASM 64 65 /** 66 * \def MBEDTLS_PLATFORM_MEMORY 67 * 68 * Enable the memory allocation layer. 69 * 70 * By default mbed TLS uses the system-provided calloc() and free(). 71 * This allows different allocators (self-implemented or provided) to be 72 * provided to the platform abstraction layer. 73 * 74 * Enabling MBEDTLS_PLATFORM_MEMORY without the 75 * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide 76 * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and 77 * free() function pointer at runtime. 78 * 79 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying 80 * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the 81 * alternate function at compile time. 82 * 83 * Requires: MBEDTLS_PLATFORM_C 84 * 85 * Enable this layer to allow use of alternative memory allocators. 86 */ 87 #define MBEDTLS_PLATFORM_MEMORY 88 89 /* \} name SECTION: System support */ 90 91 /** 92 * \name SECTION: mbed TLS feature support 93 * 94 * This section sets support for features that are or are not needed 95 * within the modules that are enabled. 96 * \{ 97 */ 98 99 /** 100 * \def MBEDTLS_AES_ROM_TABLES 101 * 102 * Use precomputed AES tables stored in ROM. 103 * 104 * Uncomment this macro to use precomputed AES tables stored in ROM. 105 * Comment this macro to generate AES tables in RAM at runtime. 106 * 107 * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb 108 * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the 109 * initialization time before the first AES operation can be performed. 110 * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c 111 * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded 112 * performance if ROM access is slower than RAM access. 113 * 114 * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. 115 * 116 */ 117 #define MBEDTLS_AES_ROM_TABLES 118 119 /** 120 * \def MBEDTLS_AES_FEWER_TABLES 121 * 122 * Use less ROM/RAM for AES tables. 123 * 124 * Uncommenting this macro omits 75% of the AES tables from 125 * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) 126 * by computing their values on the fly during operations 127 * (the tables are entry-wise rotations of one another). 128 * 129 * Tradeoff: Uncommenting this reduces the RAM / ROM footprint 130 * by ~6kb but at the cost of more arithmetic operations during 131 * runtime. Specifically, one has to compare 4 accesses within 132 * different tables to 4 accesses with additional arithmetic 133 * operations within the same table. The performance gain/loss 134 * depends on the system and memory details. 135 * 136 * This option is independent of \c MBEDTLS_AES_ROM_TABLES. 137 * 138 */ 139 #define MBEDTLS_AES_FEWER_TABLES 140 141 /** 142 * \def MBEDTLS_ECP_NIST_OPTIM 143 * 144 * Enable specific 'modulo p' routines for each NIST prime. 145 * Depending on the prime and architecture, makes operations 4 to 8 times 146 * faster on the corresponding curve. 147 * 148 * Comment this macro to disable NIST curves optimisation. 149 */ 150 #define MBEDTLS_ECP_NIST_OPTIM 151 152 /** 153 * \def MBEDTLS_PK_PARSE_EC_EXTENDED 154 * 155 * Enhance support for reading EC keys using variants of SEC1 not allowed by 156 * RFC 5915 and RFC 5480. 157 * 158 * Currently this means parsing the SpecifiedECDomain choice of EC 159 * parameters (only known groups are supported, not arbitrary domains, to 160 * avoid validation issues). 161 * 162 * Disable if you only need to support RFC 5915 + 5480 key formats. 163 */ 164 #define MBEDTLS_PK_PARSE_EC_EXTENDED 165 166 /** 167 * \def MBEDTLS_NO_PLATFORM_ENTROPY 168 * 169 * Do not use built-in platform entropy functions. 170 * This is useful if your platform does not support 171 * standards like the /dev/urandom or Windows CryptoAPI. 172 * 173 * Uncomment this macro to disable the built-in platform entropy functions. 174 */ 175 #define MBEDTLS_NO_PLATFORM_ENTROPY 176 177 /** 178 * \def MBEDTLS_ENTROPY_NV_SEED 179 * 180 * Enable the non-volatile (NV) seed file-based entropy source. 181 * (Also enables the NV seed read/write functions in the platform layer) 182 * 183 * This is crucial (if not required) on systems that do not have a 184 * cryptographic entropy source (in hardware or kernel) available. 185 * 186 * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C 187 * 188 * \note The read/write functions that are used by the entropy source are 189 * determined in the platform layer, and can be modified at runtime and/or 190 * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. 191 * 192 * \note If you use the default implementation functions that read a seedfile 193 * with regular fopen(), please make sure you make a seedfile with the 194 * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at 195 * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from 196 * and written to or you will get an entropy source error! The default 197 * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE 198 * bytes from the file. 199 * 200 * \note The entropy collector will write to the seed file before entropy is 201 * given to an external source, to update it. 202 */ 203 #define MBEDTLS_ENTROPY_NV_SEED 204 205 /** 206 * \def MBEDTLS_PK_RSA_ALT_SUPPORT 207 * 208 * Support external private RSA keys (eg from a HSM) in the PK layer. 209 * 210 * Comment this macro to disable support for external private RSA keys. 211 */ 212 #define MBEDTLS_PK_RSA_ALT_SUPPORT 213 214 /** 215 * \def MBEDTLS_PSA_CRYPTO_SPM 216 * 217 * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure 218 * Partition Manager) integration which separates the code into two parts: a 219 * NSPE (Non-Secure Process Environment) and an SPE (Secure Process 220 * Environment). 221 * 222 * Module: library/psa_crypto.c 223 * Requires: MBEDTLS_PSA_CRYPTO_C 224 * 225 */ 226 #define MBEDTLS_PSA_CRYPTO_SPM 227 228 /** 229 * \def MBEDTLS_PSA_CRYPTO_CONFIG 230 * 231 * This setting allows support for cryptographic mechanisms through the PSA 232 * API to be configured separately from support through the mbedtls API. 233 * 234 * When this option is disabled, the PSA API exposes the cryptographic 235 * mechanisms that can be implemented on top of the `mbedtls_xxx` API 236 * configured with `MBEDTLS_XXX` symbols. 237 * 238 * When this option is enabled, the PSA API exposes the cryptographic 239 * mechanisms requested by the `PSA_WANT_XXX` symbols defined in 240 * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are 241 * automatically enabled if required (i.e. if no PSA driver provides the 242 * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols 243 * in mbedtls_config.h. 244 * 245 * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies 246 * an alternative header to include instead of include/psa/crypto_config.h. 247 * 248 * This feature is still experimental and is not ready for production since 249 * it is not completed. 250 */ 251 #define MBEDTLS_PSA_CRYPTO_CONFIG 252 253 /* \} name SECTION: mbed TLS feature support */ 254 255 /** 256 * \name SECTION: mbed TLS modules 257 * 258 * This section enables or disables entire modules in mbed TLS 259 * \{ 260 */ 261 262 /** 263 * \def MBEDTLS_AES_C 264 * 265 * Enable the AES block cipher. 266 * 267 * Module: library/aes.c 268 * Caller: library/cipher.c 269 * library/pem.c 270 * library/ctr_drbg.c 271 * 272 * This module is required to support the TLS ciphersuites that use the AES 273 * cipher. 274 * 275 * PEM_PARSE uses AES for decrypting encrypted keys. 276 */ 277 #define MBEDTLS_AES_C 278 279 /** 280 * \def MBEDTLS_CIPHER_C 281 * 282 * Enable the generic cipher layer. 283 * 284 * Module: library/cipher.c 285 * 286 * Uncomment to enable generic cipher wrappers. 287 */ 288 #define MBEDTLS_CIPHER_C 289 290 /** 291 * \def MBEDTLS_CTR_DRBG_C 292 * 293 * Enable the CTR_DRBG AES-based random generator. 294 * The CTR_DRBG generator uses AES-256 by default. 295 * To use AES-128 instead, enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY below. 296 * 297 * Module: library/ctr_drbg.c 298 * Caller: 299 * 300 * Requires: MBEDTLS_AES_C 301 * 302 * This module provides the CTR_DRBG AES random number generator. 303 */ 304 //#define MBEDTLS_CTR_DRBG_C 305 306 /** 307 * \def MBEDTLS_ENTROPY_C 308 * 309 * Enable the platform-specific entropy code. 310 * 311 * Module: library/entropy.c 312 * Caller: 313 * 314 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C 315 * 316 * This module provides a generic entropy pool 317 */ 318 #define MBEDTLS_ENTROPY_C 319 320 /** 321 * \def MBEDTLS_HKDF_C 322 * 323 * Enable the HKDF algorithm (RFC 5869). 324 * 325 * Module: library/hkdf.c 326 * Caller: 327 * 328 * Requires: MBEDTLS_MD_C 329 * 330 * This module adds support for the Hashed Message Authentication Code 331 * (HMAC)-based key derivation function (HKDF). 332 */ 333 //#define MBEDTLS_HKDF_C /* Used for HUK deriviation */ 334 335 /** 336 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C 337 * 338 * Enable the buffer allocator implementation that makes use of a (stack) 339 * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() 340 * calls) 341 * 342 * Module: library/memory_buffer_alloc.c 343 * 344 * Requires: MBEDTLS_PLATFORM_C 345 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) 346 * 347 * Enable this module to enable the buffer memory allocator. 348 */ 349 #define MBEDTLS_MEMORY_BUFFER_ALLOC_C 350 351 /** 352 * \def MBEDTLS_PLATFORM_C 353 * 354 * Enable the platform abstraction layer that allows you to re-assign 355 * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). 356 * 357 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT 358 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned 359 * above to be specified at runtime or compile time respectively. 360 * 361 * \note This abstraction layer must be enabled on Windows (including MSYS2) 362 * as other module rely on it for a fixed snprintf implementation. 363 * 364 * Module: library/platform.c 365 * Caller: Most other .c files 366 * 367 * This module enables abstraction of common (libc) functions. 368 */ 369 #define MBEDTLS_PLATFORM_C 370 371 #define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS 372 #define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> 373 374 #include <stdio.h> 375 376 #define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf 377 #define MBEDTLS_PLATFORM_PRINTF_ALT 378 #define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS 379 #define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE 380 381 /** 382 * \def MBEDTLS_PSA_CRYPTO_C 383 * 384 * Enable the Platform Security Architecture cryptography API. 385 * 386 * Module: library/psa_crypto.c 387 * 388 * Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C 389 * 390 */ 391 #define MBEDTLS_PSA_CRYPTO_C 392 393 /** 394 * \def MBEDTLS_PSA_CRYPTO_STORAGE_C 395 * 396 * Enable the Platform Security Architecture persistent key storage. 397 * 398 * Module: library/psa_crypto_storage.c 399 * 400 * Requires: MBEDTLS_PSA_CRYPTO_C, 401 * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of 402 * the PSA ITS interface 403 */ 404 #define MBEDTLS_PSA_CRYPTO_STORAGE_C 405 406 /* \} name SECTION: mbed TLS modules */ 407 408 /** 409 * \name SECTION: General configuration options 410 * 411 * This section contains Mbed TLS build settings that are not associated 412 * with a particular module. 413 * 414 * \{ 415 */ 416 417 /** 418 * \def MBEDTLS_CONFIG_FILE 419 * 420 * If defined, this is a header which will be included instead of 421 * `"mbedtls/mbedtls_config.h"`. 422 * This header file specifies the compile-time configuration of Mbed TLS. 423 * Unlike other configuration options, this one must be defined on the 424 * compiler command line: a definition in `mbedtls_config.h` would have 425 * no effect. 426 * 427 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 428 * non-standard feature of the C language, so this feature is only available 429 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 430 * 431 * The value of this symbol is typically a path in double quotes, either 432 * absolute or relative to a directory on the include search path. 433 */ 434 //#define MBEDTLS_CONFIG_FILE "mbedtls/mbedtls_config.h" 435 436 /** 437 * \def MBEDTLS_USER_CONFIG_FILE 438 * 439 * If defined, this is a header which will be included after 440 * `"mbedtls/mbedtls_config.h"` or #MBEDTLS_CONFIG_FILE. 441 * This allows you to modify the default configuration, including the ability 442 * to undefine options that are enabled by default. 443 * 444 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 445 * non-standard feature of the C language, so this feature is only available 446 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 447 * 448 * The value of this symbol is typically a path in double quotes, either 449 * absolute or relative to a directory on the include search path. 450 */ 451 //#define MBEDTLS_USER_CONFIG_FILE "/dev/null" 452 453 /** 454 * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE 455 * 456 * If defined, this is a header which will be included instead of 457 * `"psa/crypto_config.h"`. 458 * This header file specifies which cryptographic mechanisms are available 459 * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and 460 * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled. 461 * 462 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 463 * non-standard feature of the C language, so this feature is only available 464 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 465 * 466 * The value of this symbol is typically a path in double quotes, either 467 * absolute or relative to a directory on the include search path. 468 */ 469 //#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" 470 471 /** 472 * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE 473 * 474 * If defined, this is a header which will be included after 475 * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE. 476 * This allows you to modify the default configuration, including the ability 477 * to undefine options that are enabled by default. 478 * 479 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 480 * non-standard feature of the C language, so this feature is only available 481 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 482 * 483 * The value of this symbol is typically a path in double quotes, either 484 * absolute or relative to a directory on the include search path. 485 */ 486 //#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" 487 488 /** \} name SECTION: General configuration options */ 489 490 /** 491 * \name SECTION: Module configuration options 492 * 493 * This section allows for the setting of module specific sizes and 494 * configuration options. The default values are already present in the 495 * relevant header files and should suffice for the regular use cases. 496 * 497 * Our advice is to enable options and change their values here 498 * only if you have a good reason and know the consequences. 499 * 500 * Please check the respective header file for documentation on these 501 * parameters (to prevent duplicate documentation). 502 * \{ 503 */ 504 505 /* ECP options */ 506 #define MBEDTLS_ECP_FIXED_POINT_OPTIM 0 /**< Disable fixed-point speed-up */ 507 508 /* \} name SECTION: Customisation configuration options */ 509 510 #if CRYPTO_NV_SEED 511 #include "tfm_mbedcrypto_config_extra_nv_seed.h" 512 #endif /* CRYPTO_NV_SEED */ 513 514 #if !defined(CRYPTO_HW_ACCELERATOR) && defined(MBEDTLS_ENTROPY_NV_SEED) 515 #include "mbedtls_entropy_nv_seed_config.h" 516 #endif 517 518 #ifdef CRYPTO_HW_ACCELERATOR 519 #include "mbedtls_accelerator_config.h" 520 #endif 521 522 #endif /* PROFILE_L_MBEDTLS_CONFIG_H */ 523
