1 /* 2 * Copyright The TrustedFirmware-M Contributors 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 */ 7 /** 8 * \file config.h 9 * 10 * \brief Configuration options (set of defines) 11 * 12 * This set of compile-time options may be used to enable 13 * or disable features selectively, and reduce the global 14 * memory footprint. 15 */ 16 17 #ifndef PROFILE_S_MBEDTLS_CONFIG_H 18 #define PROFILE_S_MBEDTLS_CONFIG_H 19 20 #include "config_tfm.h" 21 22 #if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) 23 #define _CRT_SECURE_NO_DEPRECATE 1 24 #endif 25 26 /** 27 * \name SECTION: System support 28 * 29 * This section sets system specific settings. 30 * \{ 31 */ 32 33 /** 34 * \def MBEDTLS_HAVE_ASM 35 * 36 * The compiler has support for asm(). 37 * 38 * Requires support for asm() in compiler. 39 * 40 * Used in: 41 * library/aria.c 42 * library/timing.c 43 * include/mbedtls/bn_mul.h 44 * 45 * Required by: 46 * MBEDTLS_AESNI_C 47 * MBEDTLS_PADLOCK_C 48 * 49 * Comment to disable the use of assembly code. 50 */ 51 #define MBEDTLS_HAVE_ASM 52 53 /** 54 * \def MBEDTLS_PLATFORM_MEMORY 55 * 56 * Enable the memory allocation layer. 57 * 58 * By default mbed TLS uses the system-provided calloc() and free(). 59 * This allows different allocators (self-implemented or provided) to be 60 * provided to the platform abstraction layer. 61 * 62 * Enabling MBEDTLS_PLATFORM_MEMORY without the 63 * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide 64 * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and 65 * free() function pointer at runtime. 66 * 67 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying 68 * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the 69 * alternate function at compile time. 70 * 71 * Requires: MBEDTLS_PLATFORM_C 72 * 73 * Enable this layer to allow use of alternative memory allocators. 74 */ 75 #define MBEDTLS_PLATFORM_MEMORY 76 77 /* \} name SECTION: System support */ 78 79 /** 80 * \name SECTION: mbed TLS feature support 81 * 82 * This section sets support for features that are or are not needed 83 * within the modules that are enabled. 84 * \{ 85 */ 86 87 /** 88 * \def MBEDTLS_AES_ROM_TABLES 89 * 90 * Use precomputed AES tables stored in ROM. 91 * 92 * Uncomment this macro to use precomputed AES tables stored in ROM. 93 * Comment this macro to generate AES tables in RAM at runtime. 94 * 95 * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb 96 * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the 97 * initialization time before the first AES operation can be performed. 98 * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c 99 * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded 100 * performance if ROM access is slower than RAM access. 101 * 102 * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. 103 * 104 */ 105 #define MBEDTLS_AES_ROM_TABLES 106 107 /** 108 * \def MBEDTLS_AES_FEWER_TABLES 109 * 110 * Use less ROM/RAM for AES tables. 111 * 112 * Uncommenting this macro omits 75% of the AES tables from 113 * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) 114 * by computing their values on the fly during operations 115 * (the tables are entry-wise rotations of one another). 116 * 117 * Tradeoff: Uncommenting this reduces the RAM / ROM footprint 118 * by ~6kb but at the cost of more arithmetic operations during 119 * runtime. Specifically, one has to compare 4 accesses within 120 * different tables to 4 accesses with additional arithmetic 121 * operations within the same table. The performance gain/loss 122 * depends on the system and memory details. 123 * 124 * This option is independent of \c MBEDTLS_AES_ROM_TABLES. 125 * 126 */ 127 #define MBEDTLS_AES_FEWER_TABLES 128 129 /** 130 * \def MBEDTLS_NO_PLATFORM_ENTROPY 131 * 132 * Do not use built-in platform entropy functions. 133 * This is useful if your platform does not support 134 * standards like the /dev/urandom or Windows CryptoAPI. 135 * 136 * Uncomment this macro to disable the built-in platform entropy functions. 137 */ 138 #define MBEDTLS_NO_PLATFORM_ENTROPY 139 140 /** 141 * \def MBEDTLS_ENTROPY_NV_SEED 142 * 143 * Enable the non-volatile (NV) seed file-based entropy source. 144 * (Also enables the NV seed read/write functions in the platform layer) 145 * 146 * This is crucial (if not required) on systems that do not have a 147 * cryptographic entropy source (in hardware or kernel) available. 148 * 149 * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C 150 * 151 * \note The read/write functions that are used by the entropy source are 152 * determined in the platform layer, and can be modified at runtime and/or 153 * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. 154 * 155 * \note If you use the default implementation functions that read a seedfile 156 * with regular fopen(), please make sure you make a seedfile with the 157 * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at 158 * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from 159 * and written to or you will get an entropy source error! The default 160 * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE 161 * bytes from the file. 162 * 163 * \note The entropy collector will write to the seed file before entropy is 164 * given to an external source, to update it. 165 */ 166 //#define MBEDTLS_ENTROPY_NV_SEED 167 168 /** 169 * \def MBEDTLS_SHA256_SMALLER 170 * 171 * Enable an implementation of SHA-256 that has lower ROM footprint but also 172 * lower performance. 173 * 174 * The default implementation is meant to be a reasonnable compromise between 175 * performance and size. This version optimizes more aggressively for size at 176 * the expense of performance. Eg on Cortex-M4 it reduces the size of 177 * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about 178 * 30%. 179 * 180 * Uncomment to enable the smaller implementation of SHA256. 181 */ 182 #define MBEDTLS_SHA256_SMALLER 183 184 /** \def MBEDTLS_PSA_CRYPTO_CLIENT 185 * 186 * Enable support for PSA crypto client. 187 * 188 * \note This option allows to include the code necessary for a PSA 189 * crypto client when the PSA crypto implementation is not included in 190 * the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the 191 * code to set and get PSA key attributes. 192 * The development of PSA drivers partially relying on the library to 193 * fulfill the hardware gaps is another possible usage of this option. 194 * 195 * \warning This interface is experimental and may change or be removed 196 * without notice. 197 */ 198 #define MBEDTLS_PSA_CRYPTO_CLIENT 199 200 /** 201 * \def MBEDTLS_PSA_CRYPTO_CONFIG 202 * 203 * This setting allows support for cryptographic mechanisms through the PSA 204 * API to be configured separately from support through the mbedtls API. 205 * 206 * When this option is disabled, the PSA API exposes the cryptographic 207 * mechanisms that can be implemented on top of the `mbedtls_xxx` API 208 * configured with `MBEDTLS_XXX` symbols. 209 * 210 * When this option is enabled, the PSA API exposes the cryptographic 211 * mechanisms requested by the `PSA_WANT_XXX` symbols defined in 212 * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are 213 * automatically enabled if required (i.e. if no PSA driver provides the 214 * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols 215 * in mbedtls_config.h. 216 * 217 * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies 218 * an alternative header to include instead of include/psa/crypto_config.h. 219 * 220 * This feature is still experimental and is not ready for production since 221 * it is not completed. 222 */ 223 #define MBEDTLS_PSA_CRYPTO_CONFIG 224 225 /* \} name SECTION: mbed TLS feature support */ 226 227 /** 228 * \name SECTION: mbed TLS modules 229 * 230 * This section enables or disables entire modules in mbed TLS 231 * \{ 232 */ 233 234 /** 235 * \def MBEDTLS_AES_C 236 * 237 * Enable the AES block cipher. 238 * 239 * Module: library/aes.c 240 * Caller: library/cipher.c 241 * library/pem.c 242 * library/ctr_drbg.c 243 * 244 * This module is required to support the TLS ciphersuites that use the AES 245 * cipher. 246 * 247 * PEM_PARSE uses AES for decrypting encrypted keys. 248 */ 249 #define MBEDTLS_AES_C 250 251 /** 252 * \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH 253 * 254 * Use only 128-bit keys in AES operations to save ROM. 255 * 256 * Uncomment this macro to remove support for AES operations that use 192- 257 * or 256-bit keys. 258 * 259 * Uncommenting this macro reduces the size of AES code by ~300 bytes 260 * on v8-M/Thumb2. 261 * 262 * Module: library/aes.c 263 * 264 * Requires: MBEDTLS_AES_C 265 */ 266 #define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH 267 268 /** 269 * \def MBEDTLS_CIPHER_C 270 * 271 * Enable the generic cipher layer. 272 * 273 * Module: library/cipher.c 274 * 275 * Uncomment to enable generic cipher wrappers. 276 */ 277 #define MBEDTLS_CIPHER_C 278 279 /** 280 * \def MBEDTLS_CTR_DRBG_C 281 * 282 * Enable the CTR_DRBG AES-based random generator. 283 * The CTR_DRBG generator uses AES-256 by default. 284 * To use AES-128 instead, enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY below. 285 * 286 * Module: library/ctr_drbg.c 287 * Caller: 288 * 289 * Requires: MBEDTLS_AES_C 290 * 291 * This module provides the CTR_DRBG AES random number generator. 292 */ 293 #define MBEDTLS_CTR_DRBG_C 294 295 /** 296 * \def MBEDTLS_ENTROPY_C 297 * 298 * Enable the platform-specific entropy code. 299 * 300 * Module: library/entropy.c 301 * Caller: 302 * 303 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C 304 * 305 * This module provides a generic entropy pool 306 */ 307 //#define MBEDTLS_ENTROPY_C 308 309 /** 310 * \def MBEDTLS_HKDF_C 311 * 312 * Enable the HKDF algorithm (RFC 5869). 313 * 314 * Module: library/hkdf.c 315 * Caller: 316 * 317 * Requires: MBEDTLS_MD_C 318 * 319 * This module adds support for the Hashed Message Authentication Code 320 * (HMAC)-based key derivation function (HKDF). 321 */ 322 //#define MBEDTLS_HKDF_C /* Used for HUK deriviation */ 323 324 /** 325 * \def MBEDTLS_MD_C 326 * 327 * Enable the generic message digest layer. 328 * 329 * Module: library/md.c 330 * Caller: 331 * 332 * Uncomment to enable generic message digest wrappers. 333 */ 334 //#define MBEDTLS_MD_C 335 336 /** 337 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C 338 * 339 * Enable the buffer allocator implementation that makes use of a (stack) 340 * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() 341 * calls) 342 * 343 * Module: library/memory_buffer_alloc.c 344 * 345 * Requires: MBEDTLS_PLATFORM_C 346 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) 347 * 348 * Enable this module to enable the buffer memory allocator. 349 */ 350 #define MBEDTLS_MEMORY_BUFFER_ALLOC_C 351 352 /** 353 * \def MBEDTLS_PLATFORM_C 354 * 355 * Enable the platform abstraction layer that allows you to re-assign 356 * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). 357 * 358 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT 359 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned 360 * above to be specified at runtime or compile time respectively. 361 * 362 * \note This abstraction layer must be enabled on Windows (including MSYS2) 363 * as other module rely on it for a fixed snprintf implementation. 364 * 365 * Module: library/platform.c 366 * Caller: Most other .c files 367 * 368 * This module enables abstraction of common (libc) functions. 369 */ 370 #define MBEDTLS_PLATFORM_C 371 372 #define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS 373 #define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> 374 375 #include <stdio.h> 376 377 #define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf 378 #define MBEDTLS_PLATFORM_PRINTF_ALT 379 #define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS 380 #define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE 381 382 /** 383 * \def MBEDTLS_PSA_CRYPTO_C 384 * 385 * Enable the Platform Security Architecture cryptography API. 386 * 387 * Module: library/psa_crypto.c 388 * 389 * Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C 390 * 391 */ 392 //#define MBEDTLS_PSA_CRYPTO_C 393 394 /** 395 * \def MBEDTLS_PSA_CRYPTO_STORAGE_C 396 * 397 * Enable the Platform Security Architecture persistent key storage. 398 * 399 * Module: library/psa_crypto_storage.c 400 * 401 * Requires: MBEDTLS_PSA_CRYPTO_C, 402 * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of 403 * the PSA ITS interface 404 */ 405 //#define MBEDTLS_PSA_CRYPTO_STORAGE_C 406 407 /* \} name SECTION: mbed TLS modules */ 408 409 /** 410 * \name SECTION: General configuration options 411 * 412 * This section contains Mbed TLS build settings that are not associated 413 * with a particular module. 414 * 415 * \{ 416 */ 417 418 /** 419 * \def MBEDTLS_CONFIG_FILE 420 * 421 * If defined, this is a header which will be included instead of 422 * `"mbedtls/mbedtls_config.h"`. 423 * This header file specifies the compile-time configuration of Mbed TLS. 424 * Unlike other configuration options, this one must be defined on the 425 * compiler command line: a definition in `mbedtls_config.h` would have 426 * no effect. 427 * 428 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 429 * non-standard feature of the C language, so this feature is only available 430 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 431 * 432 * The value of this symbol is typically a path in double quotes, either 433 * absolute or relative to a directory on the include search path. 434 */ 435 //#define MBEDTLS_CONFIG_FILE "mbedtls/mbedtls_config.h" 436 437 /** 438 * \def MBEDTLS_USER_CONFIG_FILE 439 * 440 * If defined, this is a header which will be included after 441 * `"mbedtls/mbedtls_config.h"` or #MBEDTLS_CONFIG_FILE. 442 * This allows you to modify the default configuration, including the ability 443 * to undefine options that are enabled by default. 444 * 445 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 446 * non-standard feature of the C language, so this feature is only available 447 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 448 * 449 * The value of this symbol is typically a path in double quotes, either 450 * absolute or relative to a directory on the include search path. 451 */ 452 //#define MBEDTLS_USER_CONFIG_FILE "/dev/null" 453 454 /** 455 * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE 456 * 457 * If defined, this is a header which will be included instead of 458 * `"psa/crypto_config.h"`. 459 * This header file specifies which cryptographic mechanisms are available 460 * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and 461 * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled. 462 * 463 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 464 * non-standard feature of the C language, so this feature is only available 465 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 466 * 467 * The value of this symbol is typically a path in double quotes, either 468 * absolute or relative to a directory on the include search path. 469 */ 470 //#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" 471 472 /** 473 * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE 474 * 475 * If defined, this is a header which will be included after 476 * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE. 477 * This allows you to modify the default configuration, including the ability 478 * to undefine options that are enabled by default. 479 * 480 * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but 481 * non-standard feature of the C language, so this feature is only available 482 * with compilers that perform macro expansion on an <tt>\#include</tt> line. 483 * 484 * The value of this symbol is typically a path in double quotes, either 485 * absolute or relative to a directory on the include search path. 486 */ 487 //#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" 488 489 /** \} name SECTION: General configuration options */ 490 491 #endif /* PROFILE_S_MBEDTLS_CONFIG_H */ 492
