1 /* 2 * Copyright The TrustedFirmware-M Contributors 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 */ 7 /** 8 * \file config.h 9 * 10 * \brief Configuration options (set of defines) 11 * 12 * This set of compile-time options may be used to enable 13 * or disable features selectively, and reduce the global 14 * memory footprint. 15 */ 16 17 #ifndef MBEDTLS_CONFIG_H 18 #define MBEDTLS_CONFIG_H 19 20 #include "config_tfm.h" 21 22 #if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) 23 #define _CRT_SECURE_NO_DEPRECATE 1 24 #endif 25 26 /** 27 * \name SECTION: System support 28 * 29 * This section sets system specific settings. 30 * \{ 31 */ 32 33 /** 34 * \def MBEDTLS_HAVE_ASM 35 * 36 * The compiler has support for asm(). 37 * 38 * Requires support for asm() in compiler. 39 * 40 * Used in: 41 * library/aria.c 42 * library/timing.c 43 * include/mbedtls/bn_mul.h 44 * 45 * Required by: 46 * MBEDTLS_AESNI_C 47 * MBEDTLS_PADLOCK_C 48 * 49 * Comment to disable the use of assembly code. 50 */ 51 52 /* Due to an outstanding bug with mbedtls and arm compiler 6, this feature is 53 * disabled temporarily on cortex-m0 and m0-plus. 54 * https://github.com/ARMmbed/mbedtls/issues/1077 55 */ 56 #define MBEDTLS_HAVE_ASM 57 58 /** 59 * \def MBEDTLS_HAVE_TIME 60 * 61 * System has time.h and time(). 62 * The time does not need to be correct, only time differences are used, 63 * by contrast with MBEDTLS_HAVE_TIME_DATE 64 * 65 * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, 66 * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and 67 * MBEDTLS_PLATFORM_STD_TIME. 68 * 69 * Comment if your system does not support time functions 70 */ 71 //#define MBEDTLS_HAVE_TIME 72 73 /** 74 * \def MBEDTLS_HAVE_TIME_DATE 75 * 76 * System has time.h, time(), and an implementation for 77 * mbedtls_platform_gmtime_r() (see below). 78 * The time needs to be correct (not necessarily very accurate, but at least 79 * the date should be correct). This is used to verify the validity period of 80 * X.509 certificates. 81 * 82 * Comment if your system does not have a correct clock. 83 * 84 * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that 85 * behaves similarly to the gmtime_r() function from the C standard. Refer to 86 * the documentation for mbedtls_platform_gmtime_r() for more information. 87 * 88 * \note It is possible to configure an implementation for 89 * mbedtls_platform_gmtime_r() at compile-time by using the macro 90 * MBEDTLS_PLATFORM_GMTIME_R_ALT. 91 */ 92 //#define MBEDTLS_HAVE_TIME_DATE 93 94 /** 95 * \def MBEDTLS_PLATFORM_MEMORY 96 * 97 * Enable the memory allocation layer. 98 * 99 * By default mbed TLS uses the system-provided calloc() and free(). 100 * This allows different allocators (self-implemented or provided) to be 101 * provided to the platform abstraction layer. 102 * 103 * Enabling MBEDTLS_PLATFORM_MEMORY without the 104 * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide 105 * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and 106 * free() function pointer at runtime. 107 * 108 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying 109 * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the 110 * alternate function at compile time. 111 * 112 * Requires: MBEDTLS_PLATFORM_C 113 * 114 * Enable this layer to allow use of alternative memory allocators. 115 */ 116 #define MBEDTLS_PLATFORM_MEMORY 117 118 /* \} name SECTION: System support */ 119 120 /** 121 * \name SECTION: mbed TLS feature support 122 * 123 * This section sets support for features that are or are not needed 124 * within the modules that are enabled. 125 * \{ 126 */ 127 128 /** 129 * \def MBEDTLS_ECP_NIST_OPTIM 130 * 131 * Enable specific 'modulo p' routines for each NIST prime. 132 * Depending on the prime and architecture, makes operations 4 to 8 times 133 * faster on the corresponding curve. 134 * 135 * Comment this macro to disable NIST curves optimisation. 136 */ 137 #define MBEDTLS_ECP_NIST_OPTIM 138 139 /** 140 * \def MBEDTLS_PK_PARSE_EC_EXTENDED 141 * 142 * Enhance support for reading EC keys using variants of SEC1 not allowed by 143 * RFC 5915 and RFC 5480. 144 * 145 * Currently this means parsing the SpecifiedECDomain choice of EC 146 * parameters (only known groups are supported, not arbitrary domains, to 147 * avoid validation issues). 148 * 149 * Disable if you only need to support RFC 5915 + 5480 key formats. 150 */ 151 #define MBEDTLS_PK_PARSE_EC_EXTENDED 152 153 /** 154 * \def MBEDTLS_NO_PLATFORM_ENTROPY 155 * 156 * Do not use built-in platform entropy functions. 157 * This is useful if your platform does not support 158 * standards like the /dev/urandom or Windows CryptoAPI. 159 * 160 * Uncomment this macro to disable the built-in platform entropy functions. 161 */ 162 #define MBEDTLS_NO_PLATFORM_ENTROPY 163 164 /** 165 * \def MBEDTLS_ENTROPY_NV_SEED 166 * 167 * Enable the non-volatile (NV) seed file-based entropy source. 168 * (Also enables the NV seed read/write functions in the platform layer) 169 * 170 * This is crucial (if not required) on systems that do not have a 171 * cryptographic entropy source (in hardware or kernel) available. 172 * 173 * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C 174 * 175 * \note The read/write functions that are used by the entropy source are 176 * determined in the platform layer, and can be modified at runtime and/or 177 * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. 178 * 179 * \note If you use the default implementation functions that read a seedfile 180 * with regular fopen(), please make sure you make a seedfile with the 181 * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at 182 * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from 183 * and written to or you will get an entropy source error! The default 184 * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE 185 * bytes from the file. 186 * 187 * \note The entropy collector will write to the seed file before entropy is 188 * given to an external source, to update it. 189 */ 190 #define MBEDTLS_ENTROPY_NV_SEED 191 192 /** 193 * \def MBEDTLS_PK_RSA_ALT_SUPPORT 194 * 195 * Support external private RSA keys (eg from a HSM) in the PK layer. 196 * 197 * Comment this macro to disable support for external private RSA keys. 198 */ 199 #define MBEDTLS_PK_RSA_ALT_SUPPORT 200 201 /** 202 * \def MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS 203 * 204 * Assume all buffers passed to PSA functions are owned exclusively by the 205 * PSA function and are not stored in shared memory. 206 * 207 * This option may be enabled if all buffers passed to any PSA function reside 208 * in memory that is accessible only to the PSA function during its execution. 209 * 210 * This option MUST be disabled whenever buffer arguments are in memory shared 211 * with an untrusted party, for example where arguments to PSA calls are passed 212 * across a trust boundary. 213 * 214 * \note Enabling this option reduces memory usage and code size. 215 * 216 * \note Enabling this option causes overlap of input and output buffers 217 * not to be supported by PSA functions. 218 */ 219 #define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS 220 221 /** 222 * \def MBEDTLS_PSA_CRYPTO_CONFIG 223 * 224 * This setting allows support for cryptographic mechanisms through the PSA 225 * API to be configured separately from support through the mbedtls API. 226 * 227 * When this option is disabled, the PSA API exposes the cryptographic 228 * mechanisms that can be implemented on top of the `mbedtls_xxx` API 229 * configured with `MBEDTLS_XXX` symbols. 230 * 231 * When this option is enabled, the PSA API exposes the cryptographic 232 * mechanisms requested by the `PSA_WANT_XXX` symbols defined in 233 * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are 234 * automatically enabled if required (i.e. if no PSA driver provides the 235 * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols 236 * in mbedtls_config.h. 237 * 238 * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies 239 * an alternative header to include instead of include/psa/crypto_config.h. 240 * 241 * This feature is still experimental and is not ready for production since 242 * it is not completed. 243 */ 244 #define MBEDTLS_PSA_CRYPTO_CONFIG 245 246 /* \} name SECTION: mbed TLS feature support */ 247 248 /** 249 * \name SECTION: mbed TLS modules 250 * 251 * This section enables or disables entire modules in mbed TLS 252 * \{ 253 */ 254 255 /** 256 * \def MBEDTLS_AES_C 257 * 258 * Enable the AES block cipher. 259 * 260 * Module: library/aes.c 261 * Caller: library/cipher.c 262 * library/pem.c 263 * library/ctr_drbg.c 264 * 265 * This module is required to support the TLS ciphersuites that use the AES 266 * cipher. 267 * 268 * PEM_PARSE uses AES for decrypting encrypted keys. 269 */ 270 #define MBEDTLS_AES_C 271 272 /** 273 * \def MBEDTLS_CIPHER_C 274 * 275 * Enable the generic cipher layer. 276 * 277 * Module: library/cipher.c 278 * 279 * Uncomment to enable generic cipher wrappers. 280 */ 281 #define MBEDTLS_CIPHER_C 282 283 /** 284 * \def MBEDTLS_CTR_DRBG_C 285 * 286 * Enable the CTR_DRBG AES-based random generator. 287 * The CTR_DRBG generator uses AES-256 by default. 288 * To use AES-128 instead, enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY below. 289 * 290 * Module: library/ctr_drbg.c 291 * Caller: 292 * 293 * Requires: MBEDTLS_AES_C 294 * 295 * This module provides the CTR_DRBG AES random number generator. 296 */ 297 //#define MBEDTLS_CTR_DRBG_C 298 299 /** 300 * \def MBEDTLS_ENTROPY_C 301 * 302 * Enable the platform-specific entropy code. 303 * 304 * Module: library/entropy.c 305 * Caller: 306 * 307 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C 308 * 309 * This module provides a generic entropy pool 310 */ 311 #define MBEDTLS_ENTROPY_C 312 313 /** 314 * \def MBEDTLS_HKDF_C 315 * 316 * Enable the HKDF algorithm (RFC 5869). 317 * 318 * Module: library/hkdf.c 319 * Caller: 320 * 321 * Requires: MBEDTLS_MD_C 322 * 323 * This module adds support for the Hashed Message Authentication Code 324 * (HMAC)-based key derivation function (HKDF). 325 */ 326 //#define MBEDTLS_HKDF_C /* Used for HUK deriviation */ 327 328 /** 329 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C 330 * 331 * Enable the buffer allocator implementation that makes use of a (stack) 332 * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() 333 * calls) 334 * 335 * Module: library/memory_buffer_alloc.c 336 * 337 * Requires: MBEDTLS_PLATFORM_C 338 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) 339 * 340 * Enable this module to enable the buffer memory allocator. 341 */ 342 #define MBEDTLS_MEMORY_BUFFER_ALLOC_C 343 344 /** 345 * \def MBEDTLS_PLATFORM_C 346 * 347 * Enable the platform abstraction layer that allows you to re-assign 348 * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). 349 * 350 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT 351 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned 352 * above to be specified at runtime or compile time respectively. 353 * 354 * \note This abstraction layer must be enabled on Windows (including MSYS2) 355 * as other module rely on it for a fixed snprintf implementation. 356 * 357 * Module: library/platform.c 358 * Caller: Most other .c files 359 * 360 * This module enables abstraction of common (libc) functions. 361 */ 362 #define MBEDTLS_PLATFORM_C 363 364 #define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS 365 #define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> 366 367 #include <stdio.h> 368 369 #define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf 370 #define MBEDTLS_PLATFORM_PRINTF_ALT 371 #define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS 372 #define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE 373 374 /** 375 * \def MBEDTLS_PSA_CRYPTO_C 376 * 377 * Enable the Platform Security Architecture cryptography API. 378 * 379 * Module: library/psa_crypto.c 380 * 381 * Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C 382 * 383 */ 384 #define MBEDTLS_PSA_CRYPTO_C 385 386 /** 387 * \def MBEDTLS_PSA_CRYPTO_STORAGE_C 388 * 389 * Enable the Platform Security Architecture persistent key storage. 390 * 391 * Module: library/psa_crypto_storage.c 392 * 393 * Requires: MBEDTLS_PSA_CRYPTO_C, 394 * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of 395 * the PSA ITS interface 396 */ 397 #define MBEDTLS_PSA_CRYPTO_STORAGE_C 398 399 /** 400 * \def MBEDTLS_PSA_CRYPTO_SPM 401 * 402 * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure 403 * Partition Manager) integration which separates the code into two parts: a 404 * NSPE (Non-Secure Process Environment) and an SPE (Secure Process 405 * Environment). 406 * 407 * If you enable this option, your build environment must include a header 408 * file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS 409 * header files, or in another directory on the compiler's include search 410 * path). Alternatively, your platform may customize the header 411 * `psa/crypto_platform.h`, in which case it can skip or replace the 412 * inclusion of `"crypto_spe.h"`. 413 * 414 * Module: library/psa_crypto.c 415 * Requires: MBEDTLS_PSA_CRYPTO_C 416 * 417 */ 418 #define MBEDTLS_PSA_CRYPTO_SPM 419 420 /* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER 421 * 422 * Enable key identifiers that encode a key owner identifier. 423 * 424 * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t 425 * which is currently hard-coded to be int32_t. 426 * 427 * Note that this option is meant for internal use only and may be removed 428 * without notice. 429 */ 430 #define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER 431 432 /** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS 433 * 434 * Enable support for platform built-in keys. If you enable this feature, 435 * you must implement the function mbedtls_psa_platform_get_builtin_key(). 436 * See the documentation of that function for more information. 437 * 438 * Built-in keys are typically derived from a hardware unique key or 439 * stored in a secure element. 440 * 441 * Requires: MBEDTLS_PSA_CRYPTO_C. 442 * 443 * \warning This interface is experimental and may change or be removed 444 * without notice. 445 */ 446 #define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS 447 448 /* \} name SECTION: mbed TLS modules */ 449 450 /** 451 * \name SECTION: General configuration options 452 * 453 * This section contains Mbed TLS build settings that are not associated 454 * with a particular module. 455 * 456 * \{ 457 */ 458 459 /** 460 * \def MBEDTLS_CONFIG_FILE 461 * 462 * If defined, this is a header which will be included instead of 463 * `"mbedtls/mbedtls_config.h"`. 464 * This header file specifies the compile-time configuration of Mbed TLS. 465 * Unlike other configuration options, this one must be defined on the 466 * compiler command line: a definition in `mbedtls_config.h` would have 467 * no effect. 468 * 469 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 470 * non-standard feature of the C language, so this feature is only available 471 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 472 * 473 * The value of this symbol is typically a path in double quotes, either 474 * absolute or relative to a directory on the include search path. 475 */ 476 //#define MBEDTLS_CONFIG_FILE "mbedtls/mbedtls_config.h" 477 478 /** 479 * \def MBEDTLS_USER_CONFIG_FILE 480 * 481 * If defined, this is a header which will be included after 482 * `"mbedtls/mbedtls_config.h"` or #MBEDTLS_CONFIG_FILE. 483 * This allows you to modify the default configuration, including the ability 484 * to undefine options that are enabled by default. 485 * 486 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 487 * non-standard feature of the C language, so this feature is only available 488 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 489 * 490 * The value of this symbol is typically a path in double quotes, either 491 * absolute or relative to a directory on the include search path. 492 */ 493 //#define MBEDTLS_USER_CONFIG_FILE "/dev/null" 494 495 /** 496 * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE 497 * 498 * If defined, this is a header which will be included instead of 499 * `"psa/crypto_config.h"`. 500 * This header file specifies which cryptographic mechanisms are available 501 * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and 502 * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled. 503 * 504 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 505 * non-standard feature of the C language, so this feature is only available 506 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 507 * 508 * The value of this symbol is typically a path in double quotes, either 509 * absolute or relative to a directory on the include search path. 510 */ 511 //#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" 512 513 /** 514 * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE 515 * 516 * If defined, this is a header which will be included after 517 * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE. 518 * This allows you to modify the default configuration, including the ability 519 * to undefine options that are enabled by default. 520 * 521 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 522 * non-standard feature of the C language, so this feature is only available 523 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 524 * 525 * The value of this symbol is typically a path in double quotes, either 526 * absolute or relative to a directory on the include search path. 527 */ 528 //#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" 529 530 /** \} name SECTION: General configuration options */ 531 532 /** 533 * \name SECTION: Module configuration options 534 * 535 * This section allows for the setting of module specific sizes and 536 * configuration options. The default values are already present in the 537 * relevant header files and should suffice for the regular use cases. 538 * 539 * Our advice is to enable options and change their values here 540 * only if you have a good reason and know the consequences. 541 * 542 * Please check the respective header file for documentation on these 543 * parameters (to prevent duplicate documentation). 544 * \{ 545 */ 546 547 /* ECP options */ 548 #define MBEDTLS_ECP_FIXED_POINT_OPTIM 0 /**< Disable fixed-point speed-up */ 549 550 /* \} name SECTION: Customisation configuration options */ 551 552 #if CRYPTO_NV_SEED 553 #include "tfm_mbedcrypto_config_extra_nv_seed.h" 554 #endif /* CRYPTO_NV_SEED */ 555 556 #if !defined(CRYPTO_HW_ACCELERATOR) && defined(MBEDTLS_ENTROPY_NV_SEED) 557 #include "mbedtls_entropy_nv_seed_config.h" 558 #endif 559 560 #ifdef CRYPTO_HW_ACCELERATOR 561 #include "mbedtls_accelerator_config.h" 562 #endif 563 564 #endif /* MBEDTLS_CONFIG_H */ 565
