blob: 80e50f2446805d56c00d53604b3eda52033ca960 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/**
2 * \file config.h
3 *
Paul Bakker37ca75d2011-01-06 12:28:03 +00004 * \brief Configuration options (set of defines)
5 *
Manuel Pégourié-Gonnarda658a402015-01-23 09:45:19 +00006 * Copyright (C) 2006-2014, ARM Limited, All Rights Reserved
Paul Bakkerb96f1542010-07-18 20:36:00 +00007 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +00008 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakkere0ccd0a2009-01-04 16:27:10 +00009 *
Paul Bakkere0ccd0a2009-01-04 16:27:10 +000010 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, write to the Free Software Foundation, Inc.,
22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 *
Paul Bakker5121ce52009-01-03 21:22:43 +000024 * This set of compile-time options may be used to enable
25 * or disable features selectively, and reduce the global
26 * memory footprint.
27 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#ifndef MBEDTLS_CONFIG_H
29#define MBEDTLS_CONFIG_H
Paul Bakker5121ce52009-01-03 21:22:43 +000030
Paul Bakkercce9d772011-11-18 14:26:47 +000031#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
Paul Bakker5121ce52009-01-03 21:22:43 +000032#define _CRT_SECURE_NO_DEPRECATE 1
33#endif
34
Paul Bakkerf3b86c12011-01-27 15:24:17 +000035/**
Paul Bakker0a62cd12011-01-21 11:00:08 +000036 * \name SECTION: System support
37 *
38 * This section sets system specific settings.
39 * \{
40 */
41
Paul Bakkerf3b86c12011-01-27 15:24:17 +000042/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020043 * \def MBEDTLS_HAVE_LONGLONG
Paul Bakker5121ce52009-01-03 21:22:43 +000044 *
Paul Bakker62261d62012-10-02 12:19:31 +000045 * The compiler supports the 'long long' type.
46 * (Only used on 32-bit platforms)
Paul Bakker5121ce52009-01-03 21:22:43 +000047 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020048#define MBEDTLS_HAVE_LONGLONG
Paul Bakker5121ce52009-01-03 21:22:43 +000049
Paul Bakkerf3b86c12011-01-27 15:24:17 +000050/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020051 * \def MBEDTLS_HAVE_ASM
Paul Bakkerf3b86c12011-01-27 15:24:17 +000052 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +020053 * The compiler has support for asm().
Paul Bakker68041ec2009-04-19 21:17:55 +000054 *
55 * Requires support for asm() in compiler.
56 *
57 * Used in:
58 * library/timing.c
59 * library/padlock.c
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000060 * include/mbedtls/bn_mul.h
Paul Bakker68041ec2009-04-19 21:17:55 +000061 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +020062 * Comment to disable the use of assembly code.
Paul Bakker5121ce52009-01-03 21:22:43 +000063 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020064#define MBEDTLS_HAVE_ASM
Paul Bakker5121ce52009-01-03 21:22:43 +000065
Paul Bakkerf3b86c12011-01-27 15:24:17 +000066/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020067 * \def MBEDTLS_HAVE_SSE2
Paul Bakkerf3b86c12011-01-27 15:24:17 +000068 *
Paul Bakkere23c3152012-10-01 14:42:47 +000069 * CPU supports SSE2 instruction set.
Paul Bakkerf3b86c12011-01-27 15:24:17 +000070 *
Paul Bakker5121ce52009-01-03 21:22:43 +000071 * Uncomment if the CPU supports SSE2 (IA-32 specific).
Paul Bakker5121ce52009-01-03 21:22:43 +000072 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073//#define MBEDTLS_HAVE_SSE2
Paul Bakkerfa9b1002013-07-03 15:31:03 +020074
75/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020076 * \def MBEDTLS_HAVE_TIME
Paul Bakkerfa9b1002013-07-03 15:31:03 +020077 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +020078 * System has time.h and time() / localtime() / gettimeofday().
Paul Bakkerfa9b1002013-07-03 15:31:03 +020079 *
80 * Comment if your system does not support time functions
81 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020082#define MBEDTLS_HAVE_TIME
Manuel Pégourié-Gonnard10934de2013-12-13 12:54:09 +010083
84/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020085 * \def MBEDTLS_PLATFORM_MEMORY
Paul Bakkerdefc0ca2014-02-04 17:30:24 +010086 *
87 * Enable the memory allocation layer.
88 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +000089 * By default mbed TLS uses the system-provided malloc() and free().
Paul Bakkerdefc0ca2014-02-04 17:30:24 +010090 * This allows different allocators (self-implemented or provided) to be
91 * provided to the platform abstraction layer.
92 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020093 * Enabling MBEDTLS_PLATFORM_MEMORY without the
94 * MBEDTLS_PLATFORM_{FREE,MALLOC}_MACROs will provide
95 * "mbedtls_platform_set_malloc_free()" allowing you to set an alternative malloc() and
Rich Evans16f8cd82015-02-06 16:14:34 +000096 * free() function pointer at runtime.
97 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098 * Enabling MBEDTLS_PLATFORM_MEMORY and specifying
99 * MBEDTLS_PLATFORM_{MALLOC,FREE}_MACROs will allow you to specify the
Rich Evans16f8cd82015-02-06 16:14:34 +0000100 * alternate function at compile time.
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100101 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200102 * Requires: MBEDTLS_PLATFORM_C
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100103 *
104 * Enable this layer to allow use of alternative memory allocators.
105 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200106//#define MBEDTLS_PLATFORM_MEMORY
Paul Bakkerdefc0ca2014-02-04 17:30:24 +0100107
108/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200109 * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
Paul Bakker088c5c52014-04-25 11:11:10 +0200110 *
111 * Do not assign standard functions in the platform layer (e.g. malloc() to
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200112 * MBEDTLS_PLATFORM_STD_MALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
Paul Bakker088c5c52014-04-25 11:11:10 +0200113 *
114 * This makes sure there are no linking errors on platforms that do not support
115 * these functions. You will HAVE to provide alternatives, either at runtime
116 * via the platform_set_xxx() functions or at compile time by setting
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200117 * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a
118 * MBEDTLS_PLATFORM_XXX_MACRO.
Paul Bakker088c5c52014-04-25 11:11:10 +0200119 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200120 * Requires: MBEDTLS_PLATFORM_C
Paul Bakker088c5c52014-04-25 11:11:10 +0200121 *
122 * Uncomment to prevent default assignment of standard functions in the
123 * platform layer.
124 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
Paul Bakker088c5c52014-04-25 11:11:10 +0200126
127/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128 * \def MBEDTLS_PLATFORM_XXX_ALT
Paul Bakker747a83a2014-02-01 22:50:07 +0100129 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +0000130 * Uncomment a macro to let mbed TLS support the function in the platform
Paul Bakker747a83a2014-02-01 22:50:07 +0100131 * abstraction layer.
132 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200133 * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will
134 * provide a function "mbedtls_platform_set_printf()" that allows you to set an
Paul Bakker747a83a2014-02-01 22:50:07 +0100135 * alternative printf function pointer.
136 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200137 * All these define require MBEDTLS_PLATFORM_C to be defined!
Paul Bakker747a83a2014-02-01 22:50:07 +0100138 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200139 * WARNING: MBEDTLS_PLATFORM_SNPRINTF_ALT is not available on Windows
Rich Evans46b0a8d2015-01-30 10:47:32 +0000140 * for compatibility reasons.
141 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200142 * WARNING: MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as
143 * MBEDTLS_PLATFORM_XXX_MACRO!
Rich Evans16f8cd82015-02-06 16:14:34 +0000144 *
Paul Bakker747a83a2014-02-01 22:50:07 +0100145 * Uncomment a macro to enable alternate implementation of specific base
146 * platform function
147 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200148//#define MBEDTLS_PLATFORM_EXIT_ALT
149//#define MBEDTLS_PLATFORM_FPRINTF_ALT
150//#define MBEDTLS_PLATFORM_PRINTF_ALT
151//#define MBEDTLS_PLATFORM_SNPRINTF_ALT
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100152
153/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200154 * \def MBEDTLS_DEPRECATED_WARNING
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100155 *
156 * Mark deprecated functions so that they generate a warning if used.
157 * Functions deprecated in one version will usually be removed in the next
158 * version. You can enable this to help you prepare the transition to a new
159 * major version by making sure your code is not using these functions.
160 *
161 * This only works with GCC and Clang. With other compilers, you may want to
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 * use MBEDTLS_DEPRECATED_REMOVED
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100163 *
164 * Uncomment to get warnings on using deprecated functions.
165 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200166//#define MBEDTLS_DEPRECATED_WARNING
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100167
168/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200169 * \def MBEDTLS_DEPRECATED_REMOVED
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100170 *
171 * Remove deprecated functions so that they generate an error if used.
172 * Functions deprecated in one version will usually be removed in the next
173 * version. You can enable this to help you prepare the transition to a new
174 * major version by making sure your code is not using these functions.
175 *
176 * Uncomment to get errors on using deprecated functions.
177 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200178//#define MBEDTLS_DEPRECATED_REMOVED
Manuel Pégourié-Gonnardc70581c2015-03-23 13:58:27 +0100179
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200180/* \} name SECTION: System support */
Paul Bakker0a62cd12011-01-21 11:00:08 +0000181
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000182/**
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +0000183 * \name SECTION: mbed TLS feature support
Paul Bakker0a62cd12011-01-21 11:00:08 +0000184 *
185 * This section sets support for features that are or are not needed
186 * within the modules that are enabled.
187 * \{
188 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000189
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000190/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200191 * \def MBEDTLS_TIMING_ALT
Paul Bakkerf2561b32014-02-06 15:11:55 +0100192 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200193 * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(),
194 * mbedtls_timing_get_timer(), mbedtls_set_alarm() and mbedtls_timing_m_sleep().
Paul Bakkerf2561b32014-02-06 15:11:55 +0100195 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200196 * Only works if you have MBEDTLS_TIMING_C enabled.
Paul Bakkerf2561b32014-02-06 15:11:55 +0100197 *
198 * You will need to provide a header "timing_alt.h" and an implementation at
199 * compile time.
200 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200201//#define MBEDTLS_TIMING_ALT
Paul Bakkerf2561b32014-02-06 15:11:55 +0100202
203/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204 * \def MBEDTLS__MODULE_NAME__ALT
Paul Bakker90995b52013-06-24 19:20:35 +0200205 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +0000206 * Uncomment a macro to let mbed TLS use your alternate core implementation of
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200207 * a symmetric or hash module (e.g. platform specific assembly optimized
Paul Bakker90995b52013-06-24 19:20:35 +0200208 * implementations). Keep in mind that the function prototypes should remain
209 * the same.
210 *
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200211 * This replaces the whole module. If you only want to replace one of the
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200212 * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags.
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200213 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200214 * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer
215 * provide the "struct mbedtls_aes_context" definition and omit the base function
Paul Bakker90995b52013-06-24 19:20:35 +0200216 * declarations and implementations. "aes_alt.h" will be included from
217 * "aes.h" to include the new function definitions.
218 *
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200219 * Uncomment a macro to enable alternate implementation of the corresponding
220 * module.
Paul Bakker90995b52013-06-24 19:20:35 +0200221 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200222//#define MBEDTLS_AES_ALT
223//#define MBEDTLS_ARC4_ALT
224//#define MBEDTLS_BLOWFISH_ALT
225//#define MBEDTLS_CAMELLIA_ALT
226//#define MBEDTLS_DES_ALT
227//#define MBEDTLS_XTEA_ALT
228//#define MBEDTLS_MD2_ALT
229//#define MBEDTLS_MD4_ALT
230//#define MBEDTLS_MD5_ALT
231//#define MBEDTLS_RIPEMD160_ALT
232//#define MBEDTLS_SHA1_ALT
233//#define MBEDTLS_SHA256_ALT
234//#define MBEDTLS_SHA512_ALT
Paul Bakker90995b52013-06-24 19:20:35 +0200235
236/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200237 * \def MBEDTLS__FUNCTION_NAME__ALT
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200238 *
239 * Uncomment a macro to let mbed TLS use you alternate core implementation of
240 * symmetric of hash function. Keep in mind that function prototypes should
241 * remain the same.
242 *
243 * This replaces only one function. The header file from mbed TLS is still
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244 * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200245 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200246 * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will
247 * no longer provide the mbedtls_sha1_process() function, but it will still provide
248 * the other function (using your mbedtls_sha1_process() function) and the definition
249 * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200250 * with this definition.
251 *
252 *
253 * Uncomment a macro to enable alternate implementation of the corresponding
254 * function.
255 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200256//#define MBEDTLS_MD2_PROCESS_ALT
257//#define MBEDTLS_MD4_PROCESS_ALT
258//#define MBEDTLS_MD5_PROCESS_ALT
259//#define MBEDTLS_RIPEMD160_PROCESS_ALT
260//#define MBEDTLS_SHA1_PROCESS_ALT
261//#define MBEDTLS_SHA256_PROCESS_ALT
262//#define MBEDTLS_SHA512_PROCESS_ALT
Manuel Pégourié-Gonnard427b6722015-03-31 18:32:50 +0200263
264/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200265 * \def MBEDTLS_AES_ROM_TABLES
Paul Bakker15566e42011-04-24 21:19:15 +0000266 *
267 * Store the AES tables in ROM.
268 *
269 * Uncomment this macro to store the AES tables in ROM.
Paul Bakker15566e42011-04-24 21:19:15 +0000270 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200271//#define MBEDTLS_AES_ROM_TABLES
Paul Bakker15566e42011-04-24 21:19:15 +0000272
273/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200274 * \def MBEDTLS_CAMELLIA_SMALL_MEMORY
Manuel Pégourié-Gonnard62edcc82015-04-03 16:28:19 +0200275 *
276 * Use less ROM for the Camellia implementation (saves about 768 bytes).
277 *
278 * Uncomment this macro to use less memory for Camellia.
279 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200280//#define MBEDTLS_CAMELLIA_SMALL_MEMORY
Manuel Pégourié-Gonnard62edcc82015-04-03 16:28:19 +0200281
282/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200283 * \def MBEDTLS_CIPHER_MODE_CBC
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +0200284 *
285 * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
286 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200287#define MBEDTLS_CIPHER_MODE_CBC
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +0200288
289/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200290 * \def MBEDTLS_CIPHER_MODE_CFB
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000291 *
292 * Enable Cipher Feedback mode (CFB) for symmetric ciphers.
293 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200294#define MBEDTLS_CIPHER_MODE_CFB
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000295
296/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200297 * \def MBEDTLS_CIPHER_MODE_CTR
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000298 *
299 * Enable Counter Block Cipher mode (CTR) for symmetric ciphers.
300 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200301#define MBEDTLS_CIPHER_MODE_CTR
Paul Bakkerb6ecaf52011-04-19 14:29:23 +0000302
303/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200304 * \def MBEDTLS_CIPHER_NULL_CIPHER
Paul Bakkerfab5c822012-02-06 16:45:10 +0000305 *
306 * Enable NULL cipher.
307 * Warning: Only do so when you know what you are doing. This allows for
308 * encryption or channels without any security!
309 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200310 * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable
Paul Bakkerfab5c822012-02-06 16:45:10 +0000311 * the following ciphersuites:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200312 * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA
313 * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA
314 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA
315 * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA
316 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384
317 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256
318 * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA
319 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384
320 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256
321 * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA
322 * MBEDTLS_TLS_RSA_WITH_NULL_SHA256
323 * MBEDTLS_TLS_RSA_WITH_NULL_SHA
324 * MBEDTLS_TLS_RSA_WITH_NULL_MD5
325 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384
326 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256
327 * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA
328 * MBEDTLS_TLS_PSK_WITH_NULL_SHA384
329 * MBEDTLS_TLS_PSK_WITH_NULL_SHA256
330 * MBEDTLS_TLS_PSK_WITH_NULL_SHA
Paul Bakkerfab5c822012-02-06 16:45:10 +0000331 *
332 * Uncomment this macro to enable the NULL cipher and ciphersuites
Paul Bakkerfab5c822012-02-06 16:45:10 +0000333 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200334//#define MBEDTLS_CIPHER_NULL_CIPHER
Paul Bakkerfab5c822012-02-06 16:45:10 +0000335
336/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200337 * \def MBEDTLS_CIPHER_PADDING_XXX
Paul Bakker48e93c82013-08-14 12:21:18 +0200338 *
339 * Uncomment or comment macros to add support for specific padding modes
340 * in the cipher layer with cipher modes that support padding (e.g. CBC)
341 *
342 * If you disable all padding modes, only full blocks can be used with CBC.
343 *
344 * Enable padding modes in the cipher layer.
345 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200346#define MBEDTLS_CIPHER_PADDING_PKCS7
347#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
348#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
349#define MBEDTLS_CIPHER_PADDING_ZEROS
Paul Bakker48e93c82013-08-14 12:21:18 +0200350
351/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES
Paul Bakkerfab5c822012-02-06 16:45:10 +0000353 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200354 * Enable weak ciphersuites in SSL / TLS.
Paul Bakkerfab5c822012-02-06 16:45:10 +0000355 * Warning: Only do so when you know what you are doing. This allows for
Paul Bakker9a736322012-11-14 12:39:52 +0000356 * channels with virtually no security at all!
Paul Bakkerfab5c822012-02-06 16:45:10 +0000357 *
358 * This enables the following ciphersuites:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA
360 * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA
Paul Bakkerfab5c822012-02-06 16:45:10 +0000361 *
362 * Uncomment this macro to enable weak ciphersuites
Paul Bakkerfab5c822012-02-06 16:45:10 +0000363 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200364//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES
Paul Bakkerfab5c822012-02-06 16:45:10 +0000365
366/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200367 * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES
Manuel Pégourié-Gonnard01edb102014-06-24 22:42:34 +0200368 *
369 * Remove RC4 ciphersuites by default in SSL / TLS.
370 * This flag removes the ciphersuites based on RC4 from the default list as
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200371 * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to
372 * enable (some of) them with mbedtls_ssl_set_ciphersuites() by including them
Manuel Pégourié-Gonnard01edb102014-06-24 22:42:34 +0200373 * explicitly.
374 *
375 * Uncomment this macro to remove RC4 ciphersuites by default.
376 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200377#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
Manuel Pégourié-Gonnard01edb102014-06-24 22:42:34 +0200378
379/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200380 * \def MBEDTLS_ECP_XXXX_ENABLED
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200381 *
382 * Enables specific curves within the Elliptic Curve module.
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +0200383 * By default all supported curves are enabled.
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200384 *
385 * Comment macros to disable the curve and functions for it
386 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200387#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
388#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
389#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
390#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
391#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
392#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
393#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
394#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
395#define MBEDTLS_ECP_DP_BP256R1_ENABLED
396#define MBEDTLS_ECP_DP_BP384R1_ENABLED
397#define MBEDTLS_ECP_DP_BP512R1_ENABLED
398//#define MBEDTLS_ECP_DP_M221_ENABLED // Not implemented yet!
399#define MBEDTLS_ECP_DP_M255_ENABLED
400//#define MBEDTLS_ECP_DP_M383_ENABLED // Not implemented yet!
401//#define MBEDTLS_ECP_DP_M511_ENABLED // Not implemented yet!
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200402
403/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200404 * \def MBEDTLS_ECP_NIST_OPTIM
Manuel Pégourié-Gonnardc04c5302013-10-23 16:11:52 +0200405 *
406 * Enable specific 'modulo p' routines for each NIST prime.
407 * Depending on the prime and architecture, makes operations 4 to 8 times
408 * faster on the corresponding curve.
409 *
410 * Comment this macro to disable NIST curves optimisation.
411 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200412#define MBEDTLS_ECP_NIST_OPTIM
Manuel Pégourié-Gonnardc04c5302013-10-23 16:11:52 +0200413
414/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 * \def MBEDTLS_ECDSA_DETERMINISTIC
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100416 *
417 * Enable deterministic ECDSA (RFC 6979).
418 * Standard ECDSA is "fragile" in the sense that lack of entropy when signing
419 * may result in a compromise of the long-term signing key. This is avoided by
420 * the deterministic variant.
421 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422 * Requires: MBEDTLS_HMAC_DRBG_C
Manuel Pégourié-Gonnard5b1a5732014-01-07 16:46:17 +0100423 *
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100424 * Comment this macro to disable deterministic ECDSA.
425 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200426#define MBEDTLS_ECDSA_DETERMINISTIC
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +0100427
428/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200429 * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200430 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200431 * Enable the PSK based ciphersuite modes in SSL / TLS.
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200432 *
Paul Bakkere07f41d2013-04-19 09:08:57 +0200433 * This enables the following ciphersuites (if other requisites are
434 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200435 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
436 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
437 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
438 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
439 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
440 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
441 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
442 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
443 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
444 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
445 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
446 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200447 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200448#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200449
450/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200451 * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200452 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200453 * Enable the DHE-PSK based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200454 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200455 * Requires: MBEDTLS_DHM_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200456 *
457 * This enables the following ciphersuites (if other requisites are
458 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
460 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
461 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
462 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
463 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
464 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
465 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
466 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
467 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
468 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
469 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
470 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200471 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200472#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200473
474/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200475 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200476 *
477 * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.
478 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479 * Requires: MBEDTLS_ECDH_C
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200480 *
481 * This enables the following ciphersuites (if other requisites are
482 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200483 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
484 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
485 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
486 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
487 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
488 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
489 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
490 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200491 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200492#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +0200493
494/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200495 * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200496 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200497 * Enable the RSA-PSK based ciphersuite modes in SSL / TLS.
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +0200498 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200499 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
500 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200501 *
502 * This enables the following ciphersuites (if other requisites are
503 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200504 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
505 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
506 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
507 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
508 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
509 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
510 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
511 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
512 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
513 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
514 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
515 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200516 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200517#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200518
519/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200520 * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200521 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200522 * Enable the RSA-only based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200523 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
525 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200526 *
527 * This enables the following ciphersuites (if other requisites are
528 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200529 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
530 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
531 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
532 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
533 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
534 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
535 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
536 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
537 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
538 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
539 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
540 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
541 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
542 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
543 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
Paul Bakkere07f41d2013-04-19 09:08:57 +0200544 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200545#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200546
547/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548 * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200549 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200550 * Enable the DHE-RSA based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200551 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200552 * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
553 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200554 *
555 * This enables the following ciphersuites (if other requisites are
556 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200557 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
558 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
559 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
560 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
561 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
562 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
563 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
564 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
565 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
566 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
567 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
568 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
569 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200570 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200571#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200572
573/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200574 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200575 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200576 * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.
Paul Bakkere07f41d2013-04-19 09:08:57 +0200577 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200578 * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
579 * MBEDTLS_X509_CRT_PARSE_C
Paul Bakkere07f41d2013-04-19 09:08:57 +0200580 *
581 * This enables the following ciphersuites (if other requisites are
582 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200583 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
584 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
585 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
586 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
587 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
588 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
589 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
590 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
591 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
592 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
593 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
594 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
Paul Bakkere07f41d2013-04-19 09:08:57 +0200595 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
Paul Bakkere07f41d2013-04-19 09:08:57 +0200597
598/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599 * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200600 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200601 * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200602 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200603 * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C,
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200604 *
605 * This enables the following ciphersuites (if other requisites are
606 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
608 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
609 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
610 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
611 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
612 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
613 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
614 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
615 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
616 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
617 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
618 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200619 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200620#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +0200621
622/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623 * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100624 *
625 * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
626 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200627 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100628 *
629 * This enables the following ciphersuites (if other requisites are
630 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200631 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
632 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
633 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
634 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
635 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
636 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
637 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
638 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
639 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
640 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
641 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
642 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100643 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200644#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100645
646/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200647 * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100648 *
649 * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
650 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651 * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100652 *
653 * This enables the following ciphersuites (if other requisites are
654 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
656 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
657 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
658 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
659 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
660 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
661 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
662 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
663 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
664 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
665 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
666 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100667 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200668#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
Manuel Pégourié-Gonnard25781b22013-12-11 16:17:10 +0100669
670/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200671 * \def MBEDTLS_PK_PARSE_EC_EXTENDED
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100672 *
673 * Enhance support for reading EC keys using variants of SEC1 not allowed by
674 * RFC 5915 and RFC 5480.
675 *
676 * Currently this means parsing the SpecifiedECDomain choice of EC
677 * parameters (only known groups are supported, not arbitrary domains, to
678 * avoid validation issues).
679 *
680 * Disable if you only need to support RFC 5915 + 5480 key formats.
681 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200682#define MBEDTLS_PK_PARSE_EC_EXTENDED
Manuel Pégourié-Gonnard6fac3512014-03-19 16:39:52 +0100683
684/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685 * \def MBEDTLS_ERROR_STRERROR_DUMMY
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100686 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200687 * Enable a dummy error function to make use of mbedtls_strerror() in
688 * third party libraries easier when MBEDTLS_ERROR_C is disabled
689 * (no effect when MBEDTLS_ERROR_C is enabled).
Manuel Pégourié-Gonnarddc16aa72014-06-25 12:55:12 +0200690 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200691 * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're
692 * not using mbedtls_strerror() or error_strerror() in your application.
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100693 *
694 * Disable if you run into name conflicts and want to really remove the
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200695 * mbedtls_strerror()
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100696 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200697#define MBEDTLS_ERROR_STRERROR_DUMMY
Paul Bakker8fe40dc2013-02-02 12:43:08 +0100698
699/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200700 * \def MBEDTLS_GENPRIME
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000701 *
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +0200702 * Enable the prime-number generation code.
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200703 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200704 * Requires: MBEDTLS_BIGNUM_C
Paul Bakker5121ce52009-01-03 21:22:43 +0000705 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200706#define MBEDTLS_GENPRIME
Paul Bakker5121ce52009-01-03 21:22:43 +0000707
Paul Bakkerf3b86c12011-01-27 15:24:17 +0000708/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200709 * \def MBEDTLS_FS_IO
Paul Bakker335db3f2011-04-25 15:28:35 +0000710 *
711 * Enable functions that use the filesystem.
712 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200713#define MBEDTLS_FS_IO
Paul Bakker335db3f2011-04-25 15:28:35 +0000714
715/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200716 * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
Paul Bakker43655f42011-12-15 20:11:16 +0000717 *
718 * Do not add default entropy sources. These are the platform specific,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200719 * mbedtls_timing_hardclock and HAVEGE based poll functions.
Paul Bakker43655f42011-12-15 20:11:16 +0000720 *
Shuo Chen95a0d112014-04-04 21:04:40 -0700721 * This is useful to have more control over the added entropy sources in an
Paul Bakker43655f42011-12-15 20:11:16 +0000722 * application.
723 *
724 * Uncomment this macro to prevent loading of default entropy functions.
Paul Bakker43655f42011-12-15 20:11:16 +0000725 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200726//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
Paul Bakker43655f42011-12-15 20:11:16 +0000727
728/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200729 * \def MBEDTLS_NO_PLATFORM_ENTROPY
Paul Bakker6083fd22011-12-03 21:45:14 +0000730 *
731 * Do not use built-in platform entropy functions.
732 * This is useful if your platform does not support
733 * standards like the /dev/urandom or Windows CryptoAPI.
734 *
735 * Uncomment this macro to disable the built-in platform entropy functions.
Paul Bakker6083fd22011-12-03 21:45:14 +0000736 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737//#define MBEDTLS_NO_PLATFORM_ENTROPY
Paul Bakker6083fd22011-12-03 21:45:14 +0000738
739/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200740 * \def MBEDTLS_ENTROPY_FORCE_SHA256
Paul Bakker2ceda572014-02-06 15:55:25 +0100741 *
742 * Force the entropy accumulator to use a SHA-256 accumulator instead of the
743 * default SHA-512 based one (if both are available).
744 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200745 * Requires: MBEDTLS_SHA256_C
Paul Bakker2ceda572014-02-06 15:55:25 +0100746 *
747 * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
748 * if you have performance concerns.
749 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200750 * This option is only useful if both MBEDTLS_SHA256_C and
751 * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
Paul Bakker2ceda572014-02-06 15:55:25 +0100752 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200753//#define MBEDTLS_ENTROPY_FORCE_SHA256
Paul Bakker2ceda572014-02-06 15:55:25 +0100754
755/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200756 * \def MBEDTLS_MEMORY_DEBUG
Paul Bakker6e339b52013-07-03 13:37:05 +0200757 *
758 * Enable debugging of buffer allocator memory issues. Automatically prints
759 * (to stderr) all (fatal) messages on memory allocation issues. Enables
760 * function for 'debug output' of allocated memory.
761 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200762 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
Paul Bakker6e339b52013-07-03 13:37:05 +0200763 *
764 * Uncomment this macro to let the buffer allocator print out error messages.
Paul Bakkera7ea6a52013-10-15 11:55:10 +0200765 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766//#define MBEDTLS_MEMORY_DEBUG
Paul Bakker6e339b52013-07-03 13:37:05 +0200767
768/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200769 * \def MBEDTLS_MEMORY_BACKTRACE
Paul Bakker6e339b52013-07-03 13:37:05 +0200770 *
771 * Include backtrace information with each allocated block.
772 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200773 * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
Paul Bakker6e339b52013-07-03 13:37:05 +0200774 * GLIBC-compatible backtrace() an backtrace_symbols() support
775 *
776 * Uncomment this macro to include backtrace information
Paul Bakker6e339b52013-07-03 13:37:05 +0200777 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200778//#define MBEDTLS_MEMORY_BACKTRACE
Paul Bakker6e339b52013-07-03 13:37:05 +0200779
780/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781 * \def MBEDTLS_PK_RSA_ALT_SUPPORT
Manuel Pégourié-Gonnard348bcb32015-03-31 14:01:33 +0200782 *
783 * Support external private RSA keys (eg from a HSM) in the PK layer.
784 *
785 * Comment this macro to disable support for external private RSA keys.
786 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200787#define MBEDTLS_PK_RSA_ALT_SUPPORT
Manuel Pégourié-Gonnard348bcb32015-03-31 14:01:33 +0200788
789/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200790 * \def MBEDTLS_PKCS1_V15
Paul Bakker48377d92013-08-30 12:06:24 +0200791 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200792 * Enable support for PKCS#1 v1.5 encoding.
793 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200794 * Requires: MBEDTLS_RSA_C
Paul Bakker48377d92013-08-30 12:06:24 +0200795 *
Paul Bakker48377d92013-08-30 12:06:24 +0200796 * This enables support for PKCS#1 v1.5 operations.
797 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200798#define MBEDTLS_PKCS1_V15
Paul Bakker48377d92013-08-30 12:06:24 +0200799
800/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200801 * \def MBEDTLS_PKCS1_V21
Paul Bakker9dcc3222011-03-08 14:16:06 +0000802 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200803 * Enable support for PKCS#1 v2.1 encoding.
804 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200805 * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C
Paul Bakker5690efc2011-05-26 13:16:06 +0000806 *
Paul Bakker9dcc3222011-03-08 14:16:06 +0000807 * This enables support for RSAES-OAEP and RSASSA-PSS operations.
808 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200809#define MBEDTLS_PKCS1_V21
Paul Bakker9dcc3222011-03-08 14:16:06 +0000810
811/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200812 * \def MBEDTLS_RSA_NO_CRT
Paul Bakker0216cc12011-03-26 13:40:23 +0000813 *
814 * Do not use the Chinese Remainder Theorem for the RSA private operation.
815 *
816 * Uncomment this macro to disable the use of CRT in RSA.
817 *
Paul Bakker0216cc12011-03-26 13:40:23 +0000818 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200819//#define MBEDTLS_RSA_NO_CRT
Paul Bakker15566e42011-04-24 21:19:15 +0000820
821/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200822 * \def MBEDTLS_SELF_TEST
Paul Bakker15566e42011-04-24 21:19:15 +0000823 *
824 * Enable the checkup functions (*_self_test).
825 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200826#define MBEDTLS_SELF_TEST
Paul Bakker5c721f92011-07-27 16:51:09 +0000827
828/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200829 * \def MBEDTLS_SSL_AEAD_RANDOM_IV
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +0100830 *
831 * Generate a random IV rather than using the record sequence number as a
832 * nonce for ciphersuites using and AEAD algorithm (GCM or CCM).
833 *
834 * Using the sequence number is generally recommended.
835 *
836 * Uncomment this macro to always use random IVs with AEAD ciphersuites.
837 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200838//#define MBEDTLS_SSL_AEAD_RANDOM_IV
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +0100839
840/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200841 * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
Paul Bakker40865c82013-01-31 17:13:13 +0100842 *
843 * Enable sending of alert messages in case of encountered errors as per RFC.
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +0000844 * If you choose not to send the alert messages, mbed TLS can still communicate
Paul Bakker40865c82013-01-31 17:13:13 +0100845 * with other servers, only debugging of failures is harder.
846 *
847 * The advantage of not sending alert messages, is that no information is given
848 * about reasons for failures thus preventing adversaries of gaining intel.
849 *
850 * Enable sending of all alert messages
851 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200852#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
Paul Bakker40865c82013-01-31 17:13:13 +0100853
854/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855 * \def MBEDTLS_SSL_DEBUG_ALL
Paul Bakkerd66f0702013-01-31 16:57:45 +0100856 *
857 * Enable the debug messages in SSL module for all issues.
858 * Debug messages have been disabled in some places to prevent timing
859 * attacks due to (unbalanced) debugging function calls.
860 *
861 * If you need all error reporting you should enable this during debugging,
862 * but remove this for production servers that should log as well.
863 *
864 * Uncomment this macro to report all debug messages on errors introducing
865 * a timing side-channel.
866 *
Paul Bakkerd66f0702013-01-31 16:57:45 +0100867 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200868//#define MBEDTLS_SSL_DEBUG_ALL
Paul Bakkerd66f0702013-01-31 16:57:45 +0100869
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200870/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100871 *
872 * Enable support for Encrypt-then-MAC, RFC 7366.
873 *
874 * This allows peers that both support it to use a more robust protection for
875 * ciphersuites using CBC, providing deep resistance against timing attacks
876 * on the padding or underlying cipher.
877 *
878 * This only affects CBC ciphersuites, and is useless if none is defined.
879 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200880 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
881 * MBEDTLS_SSL_PROTO_TLS1_1 or
882 * MBEDTLS_SSL_PROTO_TLS1_2
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100883 *
884 * Comment this macro to disable support for Encrypt-then-MAC
885 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200886#define MBEDTLS_SSL_ENCRYPT_THEN_MAC
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200888/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200889 *
890 * Enable support for Extended Master Secret, aka Session Hash
891 * (draft-ietf-tls-session-hash-02).
892 *
893 * This was introduced as "the proper fix" to the Triple Handshake familiy of
894 * attacks, but it is recommended to always use it (even if you disable
895 * renegotiation), since it actually fixes a more fundamental issue in the
896 * original SSL/TLS design, and has implications beyond Triple Handshake.
897 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200898 * Requires: MBEDTLS_SSL_PROTO_TLS1 or
899 * MBEDTLS_SSL_PROTO_TLS1_1 or
900 * MBEDTLS_SSL_PROTO_TLS1_2
Manuel Pégourié-Gonnard769c6b62014-10-28 14:13:55 +0100901 *
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200902 * Comment this macro to disable support for Extended Master Secret.
903 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200904#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200905
Paul Bakkerd66f0702013-01-31 16:57:45 +0100906/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200907 * \def MBEDTLS_SSL_FALLBACK_SCSV
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200908 *
909 * Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00).
910 *
911 * For servers, it is recommended to always enable this, unless you support
912 * only one version of TLS, or know for sure that none of your clients
913 * implements a fallback strategy.
914 *
915 * For clients, you only need this if you're using a fallback strategy, which
916 * is not recommended in the first place, unless you absolutely need it to
917 * interoperate with buggy (version-intolerant) servers.
918 *
919 * Comment this macro to disable support for FALLBACK_SCSV
920 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200921#define MBEDTLS_SSL_FALLBACK_SCSV
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200922
923/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200924 * \def MBEDTLS_SSL_HW_RECORD_ACCEL
Paul Bakker05ef8352012-05-08 09:17:57 +0000925 *
926 * Enable hooking functions in SSL module for hardware acceleration of
927 * individual records.
928 *
929 * Uncomment this macro to enable hooking functions.
Paul Bakker05ef8352012-05-08 09:17:57 +0000930 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931//#define MBEDTLS_SSL_HW_RECORD_ACCEL
Paul Bakker05ef8352012-05-08 09:17:57 +0000932
933/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200934 * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +0100935 *
936 * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
937 *
938 * This is a countermeasure to the BEAST attack, which also minimizes the risk
939 * of interoperability issues compared to sending 0-length records.
940 *
941 * Comment this macro to disable 1/n-1 record splitting.
942 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200943#define MBEDTLS_SSL_CBC_RECORD_SPLITTING
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +0100944
945/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200946 * \def MBEDTLS_SSL_RENEGOTIATION
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100947 *
Manuel Pégourié-Gonnard03717042014-11-04 19:52:10 +0100948 * Disable support for TLS renegotiation.
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100949 *
950 * The two main uses of renegotiation are (1) refresh keys on long-lived
951 * connections and (2) client authentication after the initial handshake.
952 * If you don't need renegotiation, it's probably better to disable it, since
953 * it has been associated with security issues in the past and is easy to
954 * misuse/misunderstand.
Manuel Pégourié-Gonnard03717042014-11-04 19:52:10 +0100955 *
Manuel Pégourié-Gonnard55f968b2015-03-09 16:23:15 +0000956 * Comment this to disable support for renegotiation.
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100957 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200958#define MBEDTLS_SSL_RENEGOTIATION
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100959
960/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200961 * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
Paul Bakker78a8c712013-03-06 17:01:52 +0100962 *
963 * Enable support for receiving and parsing SSLv2 Client Hello messages for the
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200964 * SSL Server module (MBEDTLS_SSL_SRV_C).
Paul Bakker78a8c712013-03-06 17:01:52 +0100965 *
Manuel Pégourié-Gonnard265dd5c2015-03-10 13:48:34 +0000966 * Uncomment this macro to enable support for SSLv2 Client Hello messages.
Paul Bakker78a8c712013-03-06 17:01:52 +0100967 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200968//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
Paul Bakker78a8c712013-03-06 17:01:52 +0100969
970/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200971 * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100972 *
973 * Pick the ciphersuite according to the client's preferences rather than ours
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200974 * in the SSL Server module (MBEDTLS_SSL_SRV_C).
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100975 *
976 * Uncomment this macro to respect client's ciphersuite order
977 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200978//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100979
980/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200981 * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
Paul Bakker05decb22013-08-15 13:33:48 +0200982 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200983 * Enable support for RFC 6066 max_fragment_length extension in SSL.
Paul Bakker05decb22013-08-15 13:33:48 +0200984 *
985 * Comment this macro to disable support for the max_fragment_length extension
986 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200987#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
Paul Bakker05decb22013-08-15 13:33:48 +0200988
989/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200990 * \def MBEDTLS_SSL_PROTO_SSL3
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200991 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +0200992 * Enable support for SSL 3.0.
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200993 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200994 * Requires: MBEDTLS_MD5_C
995 * MBEDTLS_SHA1_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200996 *
997 * Comment this macro to disable support for SSL 3.0
998 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200999#define MBEDTLS_SSL_PROTO_SSL3
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001000
1001/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001002 * \def MBEDTLS_SSL_PROTO_TLS1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001003 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001004 * Enable support for TLS 1.0.
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001005 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001006 * Requires: MBEDTLS_MD5_C
1007 * MBEDTLS_SHA1_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001008 *
1009 * Comment this macro to disable support for TLS 1.0
1010 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001011#define MBEDTLS_SSL_PROTO_TLS1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001012
1013/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001014 * \def MBEDTLS_SSL_PROTO_TLS1_1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001015 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001016 * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001017 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001018 * Requires: MBEDTLS_MD5_C
1019 * MBEDTLS_SHA1_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001020 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001021 * Comment this macro to disable support for TLS 1.1 / DTLS 1.0
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001022 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001023#define MBEDTLS_SSL_PROTO_TLS1_1
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001024
1025/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001026 * \def MBEDTLS_SSL_PROTO_TLS1_2
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001027 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001028 * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001029 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001030 * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001031 * (Depends on ciphersuites)
1032 *
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001033 * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001034 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001035#define MBEDTLS_SSL_PROTO_TLS1_2
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001036
1037/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038 * \def MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001039 *
1040 * Enable support for DTLS (all available versions).
1041 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042 * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0,
1043 * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001044 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001045 * Requires: MBEDTLS_SSL_PROTO_TLS1_1
1046 * or MBEDTLS_SSL_PROTO_TLS1_2
1047 * MBEDTLS_TIMING_C
Manuel Pégourié-Gonnard8e704f02014-10-14 20:03:35 +02001048 *
1049 * \note Dependency on TIMING_C may be replaced by something more flexible
1050 * (callbacks or abstraction layer in the next major version). Please contact
1051 * us if you're having issues with this dependency.
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001052 *
1053 * Comment this macro to disable support for DTLS
1054 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001055#define MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001056
1057/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058 * \def MBEDTLS_SSL_ALPN
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001059 *
Manuel Pégourié-Gonnard6b298e62014-11-20 18:28:50 +01001060 * Enable support for RFC 7301 Application Layer Protocol Negotiation.
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001061 *
Paul Bakker27e36d32014-04-08 12:33:37 +02001062 * Comment this macro to disable support for ALPN.
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001063 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001064#define MBEDTLS_SSL_ALPN
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001065
1066/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067 * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001068 *
1069 * Enable support for the anti-replay mechanism in DTLS.
1070 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071 * Requires: MBEDTLS_SSL_TLS_C
1072 * MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001073 *
Manuel Pégourié-Gonnarda6fcffe2014-10-13 18:15:52 +02001074 * \warning Disabling this is often a security risk!
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001075 * See mbedtls_ssl_set_dtls_anti_replay() for details.
Manuel Pégourié-Gonnarda6fcffe2014-10-13 18:15:52 +02001076 *
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001077 * Comment this to disable anti-replay in DTLS.
1078 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001079#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
Manuel Pégourié-Gonnard8464a462014-09-24 14:05:32 +02001080
1081/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001082 * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001083 *
1084 * Enable support for HelloVerifyRequest on DTLS servers.
1085 *
1086 * This feature is highly recommended to prevent DTLS servers being used as
1087 * amplifiers in DoS attacks against other hosts. It should always be enabled
1088 * unless you know for sure amplification cannot be a problem in the
1089 * environment in which your server operates.
1090 *
Manuel Pégourié-Gonnarda6fcffe2014-10-13 18:15:52 +02001091 * \warning Disabling this can ba a security risk! (see above)
1092 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001093 * Requires: MBEDTLS_SSL_SRV_C
1094 * MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001095 *
1096 * Comment this to disable support for HelloVerifyRequest.
1097 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001098#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001099
1100/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001101 * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001102 *
1103 * Enable support for a limit of records with bad MAC.
1104 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 * See mbedtls_ssl_set_dtls_badmac_limit().
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001106 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001107 * Requires: MBEDTLS_SSL_PROTO_DTLS
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001108 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001109#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001110
1111/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001112 * \def MBEDTLS_SSL_SESSION_TICKETS
Paul Bakkera503a632013-08-14 13:48:06 +02001113 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001114 * Enable support for RFC 5077 session tickets in SSL.
Paul Bakkera503a632013-08-14 13:48:06 +02001115 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001116 * Requires: MBEDTLS_AES_C
1117 * MBEDTLS_SHA256_C
1118 * MBEDTLS_CIPHER_MODE_CBC
Paul Bakkera503a632013-08-14 13:48:06 +02001119 *
1120 * Comment this macro to disable support for SSL session tickets
1121 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001122#define MBEDTLS_SSL_SESSION_TICKETS
Paul Bakkera503a632013-08-14 13:48:06 +02001123
1124/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001125 * \def MBEDTLS_SSL_SERVER_NAME_INDICATION
Paul Bakker0be444a2013-08-27 21:55:01 +02001126 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001127 * Enable support for RFC 6066 server name indication (SNI) in SSL.
Paul Bakker0be444a2013-08-27 21:55:01 +02001128 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001129 * Requires: MBEDTLS_X509_CRT_PARSE_C
Manuel Pégourié-Gonnardbbbb3cf2015-01-28 16:44:37 +00001130 *
Paul Bakker0be444a2013-08-27 21:55:01 +02001131 * Comment this macro to disable support for server name indication in SSL
1132 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001133#define MBEDTLS_SSL_SERVER_NAME_INDICATION
Paul Bakker0be444a2013-08-27 21:55:01 +02001134
1135/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001136 * \def MBEDTLS_SSL_TRUNCATED_HMAC
Paul Bakker1f2bc622013-08-15 13:45:55 +02001137 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001138 * Enable support for RFC 6066 truncated HMAC in SSL.
Paul Bakker1f2bc622013-08-15 13:45:55 +02001139 *
1140 * Comment this macro to disable support for truncated HMAC in SSL
1141 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001142#define MBEDTLS_SSL_TRUNCATED_HMAC
Paul Bakker1f2bc622013-08-15 13:45:55 +02001143
1144/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001145 * \def MBEDTLS_SSL_SET_CURVES
Manuel Pégourié-Gonnard5de25802014-02-03 15:56:49 +01001146 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001147 * Enable mbedtls_ssl_set_curves().
Manuel Pégourié-Gonnard5de25802014-02-03 15:56:49 +01001148 *
1149 * This is disabled by default since it breaks binary compatibility with the
1150 * 1.3.x line. If you choose to enable it, you will need to rebuild your
1151 * application against the new header files, relinking will not be enough.
1152 * It will be enabled by default, or no longer an option, in the 1.4 branch.
1153 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001154 * Uncomment to make mbedtls_ssl_set_curves() available.
Manuel Pégourié-Gonnard5de25802014-02-03 15:56:49 +01001155 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001156//#define MBEDTLS_SSL_SET_CURVES
Manuel Pégourié-Gonnard5de25802014-02-03 15:56:49 +01001157
1158/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001159 * \def MBEDTLS_THREADING_ALT
Paul Bakker2466d932013-09-28 14:40:38 +02001160 *
1161 * Provide your own alternate threading implementation.
1162 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001163 * Requires: MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02001164 *
1165 * Uncomment this to allow your own alternate threading implementation.
Paul Bakker2466d932013-09-28 14:40:38 +02001166 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001167//#define MBEDTLS_THREADING_ALT
Paul Bakker2466d932013-09-28 14:40:38 +02001168
1169/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001170 * \def MBEDTLS_THREADING_PTHREAD
Paul Bakker2466d932013-09-28 14:40:38 +02001171 *
1172 * Enable the pthread wrapper layer for the threading layer.
1173 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001174 * Requires: MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02001175 *
1176 * Uncomment this to enable pthread mutexes.
Paul Bakker2466d932013-09-28 14:40:38 +02001177 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001178//#define MBEDTLS_THREADING_PTHREAD
Paul Bakker2466d932013-09-28 14:40:38 +02001179
1180/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001181 * \def MBEDTLS_VERSION_FEATURES
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001182 *
1183 * Allow run-time checking of compile-time enabled features. Thus allowing users
1184 * to check at run-time if the library is for instance compiled with threading
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001185 * support via mbedtls_version_check_feature().
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001186 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001187 * Requires: MBEDTLS_VERSION_C
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001188 *
1189 * Comment this to disable run-time checking and save ROM space
1190 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001191#define MBEDTLS_VERSION_FEATURES
Paul Bakker0f90d7d2014-04-30 11:49:44 +02001192
1193/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001194 * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
Paul Bakkerc27c4e22013-09-23 15:01:36 +02001195 *
1196 * If set, the X509 parser will not break-off when parsing an X509 certificate
1197 * and encountering an extension in a v1 or v2 certificate.
1198 *
1199 * Uncomment to prevent an error.
Paul Bakkerc27c4e22013-09-23 15:01:36 +02001200 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001201//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
Paul Bakkerc27c4e22013-09-23 15:01:36 +02001202
1203/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204 * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
Paul Bakker5c721f92011-07-27 16:51:09 +00001205 *
1206 * If set, the X509 parser will not break-off when parsing an X509 certificate
1207 * and encountering an unknown critical extension.
1208 *
1209 * Uncomment to prevent an error.
Paul Bakker5c721f92011-07-27 16:51:09 +00001210 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001211//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
Paul Bakker2770fbd2012-07-03 13:30:23 +00001212
1213/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001214 * \def MBEDTLS_X509_CHECK_KEY_USAGE
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001215 *
1216 * Enable verification of the keyUsage extension (CA and leaf certificates).
1217 *
1218 * Disabling this avoids problems with mis-issued and/or misused
1219 * (intermediate) CA and leaf certificates.
1220 *
1221 * \warning Depending on your PKI use, disabling this can be a security risk!
1222 *
1223 * Comment to skip keyUsage checking for both CA and leaf certificates.
1224 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001225#define MBEDTLS_X509_CHECK_KEY_USAGE
Manuel Pégourié-Gonnard603116c2014-04-09 09:50:03 +02001226
1227/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001228 * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001229 *
1230 * Enable verification of the extendedKeyUsage extension (leaf certificates).
1231 *
1232 * Disabling this avoids problems with mis-issued and/or misused certificates.
1233 *
1234 * \warning Depending on your PKI use, disabling this can be a security risk!
1235 *
1236 * Comment to skip extendedKeyUsage checking for certificates.
1237 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001238#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
Manuel Pégourié-Gonnard7afb8a02014-04-10 17:53:56 +02001239
1240/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001241 * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
Manuel Pégourié-Gonnardd1539b12014-06-06 16:42:37 +02001242 *
1243 * Enable parsing and verification of X.509 certificates, CRLs and CSRS
1244 * signed with RSASSA-PSS (aka PKCS#1 v2.1).
1245 *
1246 * Comment this macro to disallow using RSASSA-PSS in certificates.
1247 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001248#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
Manuel Pégourié-Gonnardd1539b12014-06-06 16:42:37 +02001249
1250/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001251 * \def MBEDTLS_ZLIB_SUPPORT
Paul Bakker2770fbd2012-07-03 13:30:23 +00001252 *
1253 * If set, the SSL/TLS module uses ZLIB to support compression and
1254 * decompression of packet data.
1255 *
Manuel Pégourié-Gonnardbb4dd372014-03-11 10:30:38 +01001256 * \warning TLS-level compression MAY REDUCE SECURITY! See for example the
1257 * CRIME attack. Before enabling this option, you should examine with care if
1258 * CRIME or similar exploits may be a applicable to your use case.
1259 *
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001260 * \note Currently compression can't bu used with DTLS.
1261 *
Paul Bakker2770fbd2012-07-03 13:30:23 +00001262 * Used in: library/ssl_tls.c
1263 * library/ssl_cli.c
1264 * library/ssl_srv.c
1265 *
1266 * This feature requires zlib library and headers to be present.
1267 *
1268 * Uncomment to enable use of ZLIB
Paul Bakker2770fbd2012-07-03 13:30:23 +00001269 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001270//#define MBEDTLS_ZLIB_SUPPORT
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001271/* \} name SECTION: mbed TLS feature support */
Paul Bakker0a62cd12011-01-21 11:00:08 +00001272
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001273/**
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001274 * \name SECTION: mbed TLS modules
Paul Bakker0a62cd12011-01-21 11:00:08 +00001275 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00001276 * This section enables or disables entire modules in mbed TLS
Paul Bakker0a62cd12011-01-21 11:00:08 +00001277 * \{
1278 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001279
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001280/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001281 * \def MBEDTLS_AESNI_C
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001282 *
1283 * Enable AES-NI support on x86-64.
1284 *
1285 * Module: library/aesni.c
1286 * Caller: library/aes.c
1287 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001288 * Requires: MBEDTLS_HAVE_ASM
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001289 *
1290 * This modules adds support for the AES-NI instructions on x86-64
1291 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001292#define MBEDTLS_AESNI_C
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001293
1294/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001295 * \def MBEDTLS_AES_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001296 *
1297 * Enable the AES block cipher.
1298 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001299 * Module: library/aes.c
1300 * Caller: library/ssl_tls.c
Paul Bakker96743fc2011-02-12 14:30:57 +00001301 * library/pem.c
Paul Bakker6083fd22011-12-03 21:45:14 +00001302 * library/ctr_drbg.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001303 *
Paul Bakker645ce3a2012-10-31 12:32:41 +00001304 * This module enables the following ciphersuites (if other requisites are
1305 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001306 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
1307 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
1308 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
1309 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
1310 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
1311 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
1312 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
1313 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
1314 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
1315 * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
1316 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
1317 * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
1318 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1319 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1320 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
1321 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
1322 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
1323 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
1324 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1325 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1326 * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1327 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1328 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1329 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
1330 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
1331 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
1332 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
1333 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1334 * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1335 * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1336 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
1337 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
1338 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
1339 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
1340 * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
1341 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
1342 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
1343 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
1344 * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
1345 * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
1346 * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
1347 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
1348 * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
1349 * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
1350 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
1351 * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
1352 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
1353 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
1354 * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
1355 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
1356 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
1357 * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
1358 * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
1359 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
1360 * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
1361 * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
1362 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
1363 * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
Paul Bakker6deb37e2013-02-19 13:17:08 +01001364 *
Paul Bakkercff68422013-09-15 20:43:33 +02001365 * PEM_PARSE uses AES for decrypting encrypted keys.
Paul Bakker5121ce52009-01-03 21:22:43 +00001366 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001367#define MBEDTLS_AES_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001368
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001369/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001370 * \def MBEDTLS_ARC4_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001371 *
1372 * Enable the ARCFOUR stream cipher.
1373 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001374 * Module: library/arc4.c
1375 * Caller: library/ssl_tls.c
1376 *
Paul Bakker41c83d32013-03-20 14:39:14 +01001377 * This module enables the following ciphersuites (if other requisites are
1378 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001379 * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
1380 * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA
1381 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
1382 * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA
1383 * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
1384 * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA
1385 * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
1386 * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5
1387 * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
1388 * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA
Paul Bakker5121ce52009-01-03 21:22:43 +00001389 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001390#define MBEDTLS_ARC4_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001391
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001392/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001393 * \def MBEDTLS_ASN1_PARSE_C
Paul Bakkerefc30292011-11-10 14:43:23 +00001394 *
1395 * Enable the generic ASN1 parser.
1396 *
1397 * Module: library/asn1.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001398 * Caller: library/x509.c
1399 * library/dhm.c
1400 * library/pkcs12.c
1401 * library/pkcs5.c
1402 * library/pkparse.c
Paul Bakkerefc30292011-11-10 14:43:23 +00001403 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001404#define MBEDTLS_ASN1_PARSE_C
Paul Bakkerefc30292011-11-10 14:43:23 +00001405
1406/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001407 * \def MBEDTLS_ASN1_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001408 *
1409 * Enable the generic ASN1 writer.
1410 *
1411 * Module: library/asn1write.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001412 * Caller: library/ecdsa.c
1413 * library/pkwrite.c
1414 * library/x509_create.c
1415 * library/x509write_crt.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001416 * library/mbedtls_x509write_csr.c
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001417 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001418#define MBEDTLS_ASN1_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001419
1420/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001421 * \def MBEDTLS_BASE64_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001422 *
1423 * Enable the Base64 module.
1424 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001425 * Module: library/base64.c
Paul Bakker5690efc2011-05-26 13:16:06 +00001426 * Caller: library/pem.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001427 *
Paul Bakker5690efc2011-05-26 13:16:06 +00001428 * This module is required for PEM support (required by X.509).
Paul Bakker5121ce52009-01-03 21:22:43 +00001429 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001430#define MBEDTLS_BASE64_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001431
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001432/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001433 * \def MBEDTLS_BIGNUM_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001434 *
Paul Bakker9a736322012-11-14 12:39:52 +00001435 * Enable the multi-precision integer library.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001436 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001437 * Module: library/bignum.c
1438 * Caller: library/dhm.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001439 * library/ecp.c
Manuel Pégourié-Gonnardbf319772014-06-25 13:00:17 +02001440 * library/ecdsa.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001441 * library/rsa.c
1442 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001443 *
Manuel Pégourié-Gonnardbf319772014-06-25 13:00:17 +02001444 * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support.
Paul Bakker5121ce52009-01-03 21:22:43 +00001445 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001446#define MBEDTLS_BIGNUM_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001447
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001448/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001449 * \def MBEDTLS_BLOWFISH_C
Paul Bakkera9379c02012-07-04 11:02:11 +00001450 *
1451 * Enable the Blowfish block cipher.
1452 *
1453 * Module: library/blowfish.c
1454 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001455#define MBEDTLS_BLOWFISH_C
Paul Bakkera9379c02012-07-04 11:02:11 +00001456
1457/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001458 * \def MBEDTLS_CAMELLIA_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001459 *
1460 * Enable the Camellia block cipher.
1461 *
Paul Bakker38119b12009-01-10 23:31:23 +00001462 * Module: library/camellia.c
Paul Bakker13e2dfe2009-07-28 07:18:38 +00001463 * Caller: library/ssl_tls.c
Paul Bakker38119b12009-01-10 23:31:23 +00001464 *
Paul Bakker645ce3a2012-10-31 12:32:41 +00001465 * This module enables the following ciphersuites (if other requisites are
1466 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001467 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1468 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1469 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
1470 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
1471 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1472 * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1473 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
1474 * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
1475 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
1476 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1477 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
1478 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
1479 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
1480 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
1481 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
1482 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
1483 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1484 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
1485 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
1486 * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1487 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1488 * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
1489 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
1490 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1491 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
1492 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
1493 * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1494 * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
1495 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
1496 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
1497 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
1498 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
1499 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
1500 * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
1501 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
1502 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
1503 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
1504 * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
1505 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
1506 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
1507 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
1508 * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
Paul Bakker38119b12009-01-10 23:31:23 +00001509 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001510#define MBEDTLS_CAMELLIA_C
Paul Bakker38119b12009-01-10 23:31:23 +00001511
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001512/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001513 * \def MBEDTLS_CCM_C
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001514 *
1515 * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
1516 *
1517 * Module: library/ccm.c
1518 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001519 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001520 *
1521 * This module enables the AES-CCM ciphersuites, if other requisites are
1522 * enabled as well.
1523 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001524#define MBEDTLS_CCM_C
Manuel Pégourié-Gonnarda6916fa2014-05-02 15:17:29 +02001525
1526/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001527 * \def MBEDTLS_CERTS_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001528 *
1529 * Enable the test certificates.
1530 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001531 * Module: library/certs.c
1532 * Caller:
1533 *
1534 * This module is used for testing (ssl_client/server).
1535 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001536#define MBEDTLS_CERTS_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001537
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001538/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001539 * \def MBEDTLS_CIPHER_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001540 *
1541 * Enable the generic cipher layer.
1542 *
Paul Bakker8123e9d2011-01-06 15:37:30 +00001543 * Module: library/cipher.c
Paul Bakker04784f52013-08-19 13:30:57 +02001544 * Caller: library/ssl_tls.c
Paul Bakker8123e9d2011-01-06 15:37:30 +00001545 *
1546 * Uncomment to enable generic cipher wrappers.
1547 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001548#define MBEDTLS_CIPHER_C
Paul Bakker8123e9d2011-01-06 15:37:30 +00001549
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001550/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001551 * \def MBEDTLS_CTR_DRBG_C
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001552 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001553 * Enable the CTR_DRBG AES-256-based random generator.
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001554 *
1555 * Module: library/ctr_drbg.c
1556 * Caller:
1557 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001558 * Requires: MBEDTLS_AES_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001559 *
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001560 * This module provides the CTR_DRBG AES-256 random number generator.
1561 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001562#define MBEDTLS_CTR_DRBG_C
Paul Bakker0e04d0e2011-11-27 14:46:59 +00001563
1564/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001565 * \def MBEDTLS_DEBUG_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001566 *
1567 * Enable the debug functions.
1568 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001569 * Module: library/debug.c
1570 * Caller: library/ssl_cli.c
1571 * library/ssl_srv.c
1572 * library/ssl_tls.c
1573 *
1574 * This module provides debugging functions.
1575 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001576#define MBEDTLS_DEBUG_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001577
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001578/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001579 * \def MBEDTLS_DES_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001580 *
1581 * Enable the DES block cipher.
1582 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001583 * Module: library/des.c
Paul Bakker6deb37e2013-02-19 13:17:08 +01001584 * Caller: library/pem.c
1585 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001586 *
Paul Bakker645ce3a2012-10-31 12:32:41 +00001587 * This module enables the following ciphersuites (if other requisites are
1588 * enabled as well):
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001589 * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
1590 * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
1591 * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
1592 * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
1593 * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
1594 * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
1595 * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA
1596 * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
1597 * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
1598 * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA
Paul Bakker6deb37e2013-02-19 13:17:08 +01001599 *
Paul Bakkercff68422013-09-15 20:43:33 +02001600 * PEM_PARSE uses DES/3DES for decrypting encrypted keys.
Paul Bakker5121ce52009-01-03 21:22:43 +00001601 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001602#define MBEDTLS_DES_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001603
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001604/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001605 * \def MBEDTLS_DHM_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001606 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001607 * Enable the Diffie-Hellman-Merkle module.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001608 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001609 * Module: library/dhm.c
1610 * Caller: library/ssl_cli.c
1611 * library/ssl_srv.c
1612 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001613 * This module is used by the following key exchanges:
1614 * DHE-RSA, DHE-PSK
Paul Bakker5121ce52009-01-03 21:22:43 +00001615 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001616#define MBEDTLS_DHM_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001617
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001618/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001619 * \def MBEDTLS_ECDH_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001620 *
1621 * Enable the elliptic curve Diffie-Hellman library.
1622 *
1623 * Module: library/ecdh.c
Paul Bakker41c83d32013-03-20 14:39:14 +01001624 * Caller: library/ssl_cli.c
1625 * library/ssl_srv.c
1626 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001627 * This module is used by the following key exchanges:
1628 * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001629 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001630 * Requires: MBEDTLS_ECP_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001631 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001632#define MBEDTLS_ECDH_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001633
1634/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001635 * \def MBEDTLS_ECDSA_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001636 *
1637 * Enable the elliptic curve DSA library.
1638 *
1639 * Module: library/ecdsa.c
1640 * Caller:
1641 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001642 * This module is used by the following key exchanges:
1643 * ECDHE-ECDSA
1644 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001645 * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001646 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647#define MBEDTLS_ECDSA_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001648
1649/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001650 * \def MBEDTLS_ECP_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001651 *
1652 * Enable the elliptic curve over GF(p) library.
1653 *
1654 * Module: library/ecp.c
1655 * Caller: library/ecdh.c
1656 * library/ecdsa.c
1657 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001658 * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001659 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001660#define MBEDTLS_ECP_C
Paul Bakkerd589a0d2013-03-13 16:30:17 +01001661
1662/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001663 * \def MBEDTLS_ENTROPY_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001664 *
1665 * Enable the platform-specific entropy code.
1666 *
1667 * Module: library/entropy.c
1668 * Caller:
1669 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001670 * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001671 *
1672 * This module provides a generic entropy pool
1673 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001674#define MBEDTLS_ENTROPY_C
Paul Bakker6083fd22011-12-03 21:45:14 +00001675
1676/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001677 * \def MBEDTLS_ERROR_C
Paul Bakker9d781402011-05-09 16:17:09 +00001678 *
1679 * Enable error code to error string conversion.
1680 *
1681 * Module: library/error.c
1682 * Caller:
1683 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001684 * This module enables mbedtls_strerror().
Paul Bakker9d781402011-05-09 16:17:09 +00001685 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001686#define MBEDTLS_ERROR_C
Paul Bakker9d781402011-05-09 16:17:09 +00001687
1688/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689 * \def MBEDTLS_GCM_C
Paul Bakker89e80c92012-03-20 13:50:09 +00001690 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001691 * Enable the Galois/Counter Mode (GCM) for AES.
Paul Bakker89e80c92012-03-20 13:50:09 +00001692 *
1693 * Module: library/gcm.c
1694 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001695 * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C
Paul Bakker645ce3a2012-10-31 12:32:41 +00001696 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02001697 * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other
1698 * requisites are enabled as well.
Paul Bakker89e80c92012-03-20 13:50:09 +00001699 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001700#define MBEDTLS_GCM_C
Paul Bakker89e80c92012-03-20 13:50:09 +00001701
1702/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001703 * \def MBEDTLS_HAVEGE_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001704 *
1705 * Enable the HAVEGE random generator.
1706 *
Paul Bakker2a844242013-06-24 13:01:53 +02001707 * Warning: the HAVEGE random generator is not suitable for virtualized
1708 * environments
1709 *
1710 * Warning: the HAVEGE random generator is dependent on timing and specific
1711 * processor traits. It is therefore not advised to use HAVEGE as
1712 * your applications primary random generator or primary entropy pool
1713 * input. As a secondary input to your entropy pool, it IS able add
1714 * the (limited) extra entropy it provides.
1715 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001716 * Module: library/havege.c
1717 * Caller:
1718 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001719 * Requires: MBEDTLS_TIMING_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001720 *
Paul Bakker2a844242013-06-24 13:01:53 +02001721 * Uncomment to enable the HAVEGE random generator.
Paul Bakker2a844242013-06-24 13:01:53 +02001722 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001723//#define MBEDTLS_HAVEGE_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001724
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001725/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001726 * \def MBEDTLS_HMAC_DRBG_C
Manuel Pégourié-Gonnard490bdf32014-01-27 14:03:10 +01001727 *
1728 * Enable the HMAC_DRBG random generator.
1729 *
1730 * Module: library/hmac_drbg.c
1731 * Caller:
1732 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733 * Requires: MBEDTLS_MD_C
Manuel Pégourié-Gonnard490bdf32014-01-27 14:03:10 +01001734 *
1735 * Uncomment to enable the HMAC_DRBG random number geerator.
1736 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001737#define MBEDTLS_HMAC_DRBG_C
Manuel Pégourié-Gonnard490bdf32014-01-27 14:03:10 +01001738
1739/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001740 * \def MBEDTLS_MD_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001741 *
1742 * Enable the generic message digest layer.
1743 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001744 * Module: library/mbedtls_md.c
Paul Bakker17373852011-01-06 14:20:01 +00001745 * Caller:
1746 *
1747 * Uncomment to enable generic message digest wrappers.
1748 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001749#define MBEDTLS_MD_C
Paul Bakker17373852011-01-06 14:20:01 +00001750
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001751/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001752 * \def MBEDTLS_MD2_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001753 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001754 * Enable the MD2 hash algorithm.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001755 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001756 * Module: library/mbedtls_md2.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001757 * Caller:
Paul Bakker5121ce52009-01-03 21:22:43 +00001758 *
1759 * Uncomment to enable support for (rare) MD2-signed X.509 certs.
Paul Bakker6506aff2009-07-28 20:52:02 +00001760 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761//#define MBEDTLS_MD2_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001762
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001763/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001764 * \def MBEDTLS_MD4_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001765 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001766 * Enable the MD4 hash algorithm.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001767 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001768 * Module: library/mbedtls_md4.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001769 * Caller:
Paul Bakker5121ce52009-01-03 21:22:43 +00001770 *
1771 * Uncomment to enable support for (rare) MD4-signed X.509 certs.
Paul Bakker6506aff2009-07-28 20:52:02 +00001772 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001773//#define MBEDTLS_MD4_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001774
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001775/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001776 * \def MBEDTLS_MD5_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001777 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001778 * Enable the MD5 hash algorithm.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001779 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001780 * Module: library/mbedtls_md5.c
1781 * Caller: library/mbedtls_md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001782 * library/pem.c
Paul Bakker6deb37e2013-02-19 13:17:08 +01001783 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001784 *
1785 * This module is required for SSL/TLS and X.509.
Paul Bakkercff68422013-09-15 20:43:33 +02001786 * PEM_PARSE uses MD5 for decrypting encrypted keys.
Paul Bakker5121ce52009-01-03 21:22:43 +00001787 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001788#define MBEDTLS_MD5_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001789
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001790/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001791 * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001792 *
1793 * Enable the buffer allocator implementation that makes use of a (stack)
1794 * based buffer to 'allocate' dynamic memory. (replaces malloc() and free()
1795 * calls)
Paul Bakker6e339b52013-07-03 13:37:05 +02001796 *
1797 * Module: library/memory_buffer_alloc.c
1798 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001799 * Requires: MBEDTLS_PLATFORM_C
1800 * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS)
Paul Bakker6e339b52013-07-03 13:37:05 +02001801 *
1802 * Enable this module to enable the buffer memory allocator.
Paul Bakker6e339b52013-07-03 13:37:05 +02001803 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001804//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
Paul Bakker6e339b52013-07-03 13:37:05 +02001805
1806/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001807 * \def MBEDTLS_NET_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001808 *
1809 * Enable the TCP/IP networking routines.
1810 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001811 * Module: library/net.c
Paul Bakker5121ce52009-01-03 21:22:43 +00001812 *
1813 * This module provides TCP/IP networking routines.
1814 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815#define MBEDTLS_NET_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001816
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001817/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001818 * \def MBEDTLS_OID_C
Paul Bakkerc70b9822013-04-07 22:00:46 +02001819 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001820 * Enable the OID database.
Paul Bakkerc70b9822013-04-07 22:00:46 +02001821 *
1822 * Module: library/oid.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001823 * Caller: library/asn1write.c
1824 * library/pkcs5.c
1825 * library/pkparse.c
1826 * library/pkwrite.c
1827 * library/rsa.c
1828 * library/x509.c
1829 * library/x509_create.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001830 * library/mbedtls_x509_crl.c
1831 * library/mbedtls_x509_crt.c
1832 * library/mbedtls_x509_csr.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001833 * library/x509write_crt.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001834 * library/mbedtls_x509write_csr.c
Paul Bakkerc70b9822013-04-07 22:00:46 +02001835 *
1836 * This modules translates between OIDs and internal values.
1837 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001838#define MBEDTLS_OID_C
Paul Bakkerc70b9822013-04-07 22:00:46 +02001839
1840/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001841 * \def MBEDTLS_PADLOCK_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001842 *
1843 * Enable VIA Padlock support on x86.
1844 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001845 * Module: library/padlock.c
1846 * Caller: library/aes.c
1847 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001848 * Requires: MBEDTLS_HAVE_ASM
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01001849 *
Paul Bakker5121ce52009-01-03 21:22:43 +00001850 * This modules adds support for the VIA PadLock on x86.
1851 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001852#define MBEDTLS_PADLOCK_C
Paul Bakker5121ce52009-01-03 21:22:43 +00001853
Paul Bakkerf3b86c12011-01-27 15:24:17 +00001854/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001855 * \def MBEDTLS_PEM_PARSE_C
Paul Bakker96743fc2011-02-12 14:30:57 +00001856 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001857 * Enable PEM decoding / parsing.
Paul Bakker96743fc2011-02-12 14:30:57 +00001858 *
1859 * Module: library/pem.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001860 * Caller: library/dhm.c
Paul Bakkercff68422013-09-15 20:43:33 +02001861 * library/pkparse.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001862 * library/mbedtls_x509_crl.c
1863 * library/mbedtls_x509_crt.c
1864 * library/mbedtls_x509_csr.c
Paul Bakker96743fc2011-02-12 14:30:57 +00001865 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001866 * Requires: MBEDTLS_BASE64_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001867 *
Paul Bakkercff68422013-09-15 20:43:33 +02001868 * This modules adds support for decoding / parsing PEM files.
Paul Bakker96743fc2011-02-12 14:30:57 +00001869 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001870#define MBEDTLS_PEM_PARSE_C
Paul Bakkercff68422013-09-15 20:43:33 +02001871
1872/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001873 * \def MBEDTLS_PEM_WRITE_C
Paul Bakkercff68422013-09-15 20:43:33 +02001874 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001875 * Enable PEM encoding / writing.
Paul Bakkercff68422013-09-15 20:43:33 +02001876 *
1877 * Module: library/pem.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001878 * Caller: library/pkwrite.c
1879 * library/x509write_crt.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001880 * library/mbedtls_x509write_csr.c
Paul Bakkercff68422013-09-15 20:43:33 +02001881 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001882 * Requires: MBEDTLS_BASE64_C
Paul Bakkercff68422013-09-15 20:43:33 +02001883 *
1884 * This modules adds support for encoding / writing PEM files.
1885 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001886#define MBEDTLS_PEM_WRITE_C
Paul Bakker96743fc2011-02-12 14:30:57 +00001887
1888/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001889 * \def MBEDTLS_PK_C
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02001890 *
1891 * Enable the generic public (asymetric) key layer.
1892 *
1893 * Module: library/pk.c
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02001894 * Caller: library/ssl_tls.c
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02001895 * library/ssl_cli.c
1896 * library/ssl_srv.c
1897 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001898 * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02001899 *
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02001900 * Uncomment to enable generic public key wrappers.
1901 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001902#define MBEDTLS_PK_C
Manuel Pégourié-Gonnardc40b4c32013-08-22 13:29:31 +02001903
1904/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001905 * \def MBEDTLS_PK_PARSE_C
Paul Bakker4606c732013-09-15 17:04:23 +02001906 *
1907 * Enable the generic public (asymetric) key parser.
1908 *
1909 * Module: library/pkparse.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001910 * Caller: library/mbedtls_x509_crt.c
1911 * library/mbedtls_x509_csr.c
Paul Bakker4606c732013-09-15 17:04:23 +02001912 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001913 * Requires: MBEDTLS_PK_C
Paul Bakker4606c732013-09-15 17:04:23 +02001914 *
1915 * Uncomment to enable generic public key parse functions.
1916 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001917#define MBEDTLS_PK_PARSE_C
Paul Bakker4606c732013-09-15 17:04:23 +02001918
1919/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001920 * \def MBEDTLS_PK_WRITE_C
Paul Bakker4606c732013-09-15 17:04:23 +02001921 *
Paul Bakkerf20ba4b2013-09-16 22:46:20 +02001922 * Enable the generic public (asymetric) key writer.
Paul Bakker4606c732013-09-15 17:04:23 +02001923 *
1924 * Module: library/pkwrite.c
1925 * Caller: library/x509write.c
1926 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001927 * Requires: MBEDTLS_PK_C
Paul Bakker4606c732013-09-15 17:04:23 +02001928 *
1929 * Uncomment to enable generic public key write functions.
1930 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001931#define MBEDTLS_PK_WRITE_C
Paul Bakker4606c732013-09-15 17:04:23 +02001932
1933/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001934 * \def MBEDTLS_PKCS5_C
Paul Bakkerb0c19a42013-06-24 19:26:38 +02001935 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001936 * Enable PKCS#5 functions.
Paul Bakkerb0c19a42013-06-24 19:26:38 +02001937 *
1938 * Module: library/pkcs5.c
1939 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001940 * Requires: MBEDTLS_MD_C
Paul Bakkerb0c19a42013-06-24 19:26:38 +02001941 *
1942 * This module adds support for the PKCS#5 functions.
1943 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001944#define MBEDTLS_PKCS5_C
Paul Bakkerb0c19a42013-06-24 19:26:38 +02001945
1946/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001947 * \def MBEDTLS_PKCS11_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001948 *
Paul Bakkereb2c6582012-09-27 19:15:01 +00001949 * Enable wrapper for PKCS#11 smartcard support.
Paul Bakker5690efc2011-05-26 13:16:06 +00001950 *
Manuel Pégourié-Gonnard51be5592013-08-22 13:35:53 +02001951 * Module: library/pkcs11.c
1952 * Caller: library/pk.c
Paul Bakker5690efc2011-05-26 13:16:06 +00001953 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001954 * Requires: MBEDTLS_PK_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001955 *
Paul Bakkereb2c6582012-09-27 19:15:01 +00001956 * This module enables SSL/TLS PKCS #11 smartcard support.
Paul Bakker5690efc2011-05-26 13:16:06 +00001957 * Requires the presence of the PKCS#11 helper library (libpkcs11-helper)
Paul Bakker5690efc2011-05-26 13:16:06 +00001958 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001959//#define MBEDTLS_PKCS11_C
Paul Bakker5690efc2011-05-26 13:16:06 +00001960
1961/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001962 * \def MBEDTLS_PKCS12_C
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02001963 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02001964 * Enable PKCS#12 PBE functions.
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02001965 * Adds algorithms for parsing PKCS#8 encrypted private keys
1966 *
1967 * Module: library/pkcs12.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02001968 * Caller: library/pkparse.c
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02001969 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001970 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C
1971 * Can use: MBEDTLS_ARC4_C
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02001972 *
1973 * This module enables PKCS#12 functions.
1974 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001975#define MBEDTLS_PKCS12_C
Paul Bakkerf1f21fe2013-06-24 19:17:19 +02001976
1977/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001978 * \def MBEDTLS_PLATFORM_C
Paul Bakker747a83a2014-02-01 22:50:07 +01001979 *
1980 * Enable the platform abstraction layer that allows you to re-assign
Rich Evansc39cb492015-01-30 12:01:34 +00001981 * functions like malloc(), free(), snprintf(), printf(), fprintf(), exit()
Paul Bakker747a83a2014-02-01 22:50:07 +01001982 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001983 * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
1984 * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
Rich Evans16f8cd82015-02-06 16:14:34 +00001985 * above to be specified at runtime or compile time respectively.
Paul Bakker747a83a2014-02-01 22:50:07 +01001986 *
1987 * Module: library/platform.c
1988 * Caller: Most other .c files
1989 *
1990 * This module enables abstraction of common (libc) functions.
1991 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001992#define MBEDTLS_PLATFORM_C
Paul Bakker747a83a2014-02-01 22:50:07 +01001993
1994/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001995 * \def MBEDTLS_RIPEMD160_C
Manuel Pégourié-Gonnardcab4a882014-01-17 12:42:35 +01001996 *
1997 * Enable the RIPEMD-160 hash algorithm.
1998 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001999 * Module: library/mbedtls_ripemd160.c
2000 * Caller: library/mbedtls_md.c
Manuel Pégourié-Gonnardcab4a882014-01-17 12:42:35 +01002001 *
2002 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002003#define MBEDTLS_RIPEMD160_C
Manuel Pégourié-Gonnardcab4a882014-01-17 12:42:35 +01002004
2005/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002006 * \def MBEDTLS_RSA_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002007 *
2008 * Enable the RSA public-key cryptosystem.
2009 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002010 * Module: library/rsa.c
2011 * Caller: library/ssl_cli.c
2012 * library/ssl_srv.c
2013 * library/ssl_tls.c
2014 * library/x509.c
2015 *
Manuel Pégourié-Gonnard9d703732013-10-25 18:01:50 +02002016 * This module is used by the following key exchanges:
2017 * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK
Paul Bakker5690efc2011-05-26 13:16:06 +00002018 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002019 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002020 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002021#define MBEDTLS_RSA_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002022
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002023/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002024 * \def MBEDTLS_SHA1_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002025 *
2026 * Enable the SHA1 cryptographic hash algorithm.
2027 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002028 * Module: library/mbedtls_sha1.c
2029 * Caller: library/mbedtls_md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002030 * library/ssl_cli.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002031 * library/ssl_srv.c
2032 * library/ssl_tls.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002033 * library/x509write_crt.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002034 *
2035 * This module is required for SSL/TLS and SHA1-signed certificates.
2036 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002037#define MBEDTLS_SHA1_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002038
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002039/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002040 * \def MBEDTLS_SHA256_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002041 *
2042 * Enable the SHA-224 and SHA-256 cryptographic hash algorithms.
2043 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002044 * Module: library/mbedtls_sha256.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002045 * Caller: library/entropy.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002046 * library/mbedtls_md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002047 * library/ssl_cli.c
2048 * library/ssl_srv.c
2049 * library/ssl_tls.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002050 *
2051 * This module adds support for SHA-224 and SHA-256.
Paul Bakker769075d2012-11-24 11:26:46 +01002052 * This module is required for the SSL/TLS 1.2 PRF function.
Paul Bakker5121ce52009-01-03 21:22:43 +00002053 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002054#define MBEDTLS_SHA256_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002055
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002056/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002057 * \def MBEDTLS_SHA512_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002058 *
2059 * Enable the SHA-384 and SHA-512 cryptographic hash algorithms.
2060 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002061 * Module: library/mbedtls_sha512.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002062 * Caller: library/entropy.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002063 * library/mbedtls_md.c
Manuel Pégourié-Gonnardfe286462013-09-20 14:10:14 +02002064 * library/ssl_cli.c
2065 * library/ssl_srv.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002066 *
2067 * This module adds support for SHA-384 and SHA-512.
2068 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002069#define MBEDTLS_SHA512_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002070
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002071/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002072 * \def MBEDTLS_SSL_CACHE_C
Paul Bakker0a597072012-09-25 21:55:46 +00002073 *
2074 * Enable simple SSL cache implementation.
2075 *
2076 * Module: library/ssl_cache.c
2077 * Caller:
2078 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002079 * Requires: MBEDTLS_SSL_CACHE_C
Paul Bakker0a597072012-09-25 21:55:46 +00002080 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002081#define MBEDTLS_SSL_CACHE_C
Paul Bakker0a597072012-09-25 21:55:46 +00002082
2083/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002084 * \def MBEDTLS_SSL_COOKIE_C
Manuel Pégourié-Gonnarda64acd42014-07-23 18:30:45 +02002085 *
2086 * Enable basic implementation of DTLS cookies for hello verification.
2087 *
2088 * Module: library/ssl_cookie.c
2089 * Caller:
2090 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002091 * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY
Manuel Pégourié-Gonnarda64acd42014-07-23 18:30:45 +02002092 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002093#define MBEDTLS_SSL_COOKIE_C
Manuel Pégourié-Gonnarda64acd42014-07-23 18:30:45 +02002094
2095/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002096 * \def MBEDTLS_SSL_CLI_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002097 *
2098 * Enable the SSL/TLS client code.
2099 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002100 * Module: library/ssl_cli.c
2101 * Caller:
2102 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002103 * Requires: MBEDTLS_SSL_TLS_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002104 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002105 * This module is required for SSL/TLS client support.
2106 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002107#define MBEDTLS_SSL_CLI_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002108
Paul Bakker9a736322012-11-14 12:39:52 +00002109/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002110 * \def MBEDTLS_SSL_SRV_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002111 *
2112 * Enable the SSL/TLS server code.
2113 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002114 * Module: library/ssl_srv.c
2115 * Caller:
2116 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002117 * Requires: MBEDTLS_SSL_TLS_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002118 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002119 * This module is required for SSL/TLS server support.
2120 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002121#define MBEDTLS_SSL_SRV_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002122
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002123/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002124 * \def MBEDTLS_SSL_TLS_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002125 *
Paul Bakkere29ab062011-05-18 13:26:54 +00002126 * Enable the generic SSL/TLS code.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002127 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002128 * Module: library/ssl_tls.c
2129 * Caller: library/ssl_cli.c
2130 * library/ssl_srv.c
2131 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002132 * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C
2133 * and at least one of the MBEDTLS_SSL_PROTO_XXX defines
Paul Bakker5690efc2011-05-26 13:16:06 +00002134 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002135 * This module is required for SSL/TLS.
2136 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002137#define MBEDTLS_SSL_TLS_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002138
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002139/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002140 * \def MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02002141 *
2142 * Enable the threading abstraction layer.
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00002143 * By default mbed TLS assumes it is used in a non-threaded environment or that
Paul Bakker2466d932013-09-28 14:40:38 +02002144 * contexts are not shared between threads. If you do intend to use contexts
2145 * between threads, you will need to enable this layer to prevent race
2146 * conditions.
2147 *
2148 * Module: library/threading.c
2149 *
2150 * This allows different threading implementations (self-implemented or
2151 * provided).
2152 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002153 * You will have to enable either MBEDTLS_THREADING_ALT or
2154 * MBEDTLS_THREADING_PTHREAD.
Paul Bakker2466d932013-09-28 14:40:38 +02002155 *
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00002156 * Enable this layer to allow use of mutexes within mbed TLS
Paul Bakker2466d932013-09-28 14:40:38 +02002157 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002158//#define MBEDTLS_THREADING_C
Paul Bakker2466d932013-09-28 14:40:38 +02002159
2160/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002161 * \def MBEDTLS_TIMING_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002162 *
2163 * Enable the portable timing interface.
2164 *
Paul Bakker5121ce52009-01-03 21:22:43 +00002165 * Module: library/timing.c
2166 * Caller: library/havege.c
2167 *
2168 * This module is used by the HAVEGE random number generator.
Paul Bakkerecd54fb2013-07-03 14:48:29 +02002169 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002170#define MBEDTLS_TIMING_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002171
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002172/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002173 * \def MBEDTLS_VERSION_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002174 *
2175 * Enable run-time version information.
2176 *
Paul Bakker0a62cd12011-01-21 11:00:08 +00002177 * Module: library/version.c
2178 *
2179 * This module provides run-time version information.
2180 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002181#define MBEDTLS_VERSION_C
Paul Bakker0a62cd12011-01-21 11:00:08 +00002182
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002183/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002184 * \def MBEDTLS_X509_USE_C
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002185 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002186 * Enable X.509 core for using certificates.
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002187 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002188 * Module: library/x509.c
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002189 * Caller: library/mbedtls_x509_crl.c
2190 * library/mbedtls_x509_crt.c
2191 * library/mbedtls_x509_csr.c
Paul Bakker5121ce52009-01-03 21:22:43 +00002192 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002193 * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C,
2194 * MBEDTLS_PK_PARSE_C
Paul Bakker5690efc2011-05-26 13:16:06 +00002195 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002196 * This module is required for the X.509 parsing modules.
Paul Bakker5121ce52009-01-03 21:22:43 +00002197 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002198#define MBEDTLS_X509_USE_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002199
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002200/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002201 * \def MBEDTLS_X509_CRT_PARSE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002202 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002203 * Enable X.509 certificate parsing.
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002204 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002205 * Module: library/mbedtls_x509_crt.c
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002206 * Caller: library/ssl_cli.c
2207 * library/ssl_srv.c
2208 * library/ssl_tls.c
2209 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002210 * Requires: MBEDTLS_X509_USE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002211 *
2212 * This module is required for X.509 certificate parsing.
2213 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002214#define MBEDTLS_X509_CRT_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002215
2216/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002217 * \def MBEDTLS_X509_CRL_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002218 *
2219 * Enable X.509 CRL parsing.
2220 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002221 * Module: library/mbedtls_x509_crl.c
2222 * Caller: library/mbedtls_x509_crt.c
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002223 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002224 * Requires: MBEDTLS_X509_USE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002225 *
2226 * This module is required for X.509 CRL parsing.
2227 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002228#define MBEDTLS_X509_CRL_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002229
2230/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002231 * \def MBEDTLS_X509_CSR_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002232 *
2233 * Enable X.509 Certificate Signing Request (CSR) parsing.
2234 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002235 * Module: library/mbedtls_x509_csr.c
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002236 * Caller: library/x509_crt_write.c
2237 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002238 * Requires: MBEDTLS_X509_USE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002239 *
2240 * This module is used for reading X.509 certificate request.
2241 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002242#define MBEDTLS_X509_CSR_PARSE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002243
2244/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002245 * \def MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002246 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002247 * Enable X.509 core for creating certificates.
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002248 *
2249 * Module: library/x509_create.c
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002250 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002251 * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002252 *
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002253 * This module is the basis for creating X.509 certificates and CSRs.
2254 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002255#define MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002256
2257/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002258 * \def MBEDTLS_X509_CRT_WRITE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002259 *
2260 * Enable creating X.509 certificates.
2261 *
2262 * Module: library/x509_crt_write.c
2263 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002264 * Requires: MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002265 *
2266 * This module is required for X.509 certificate creation.
2267 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002268#define MBEDTLS_X509_CRT_WRITE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002269
2270/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002271 * \def MBEDTLS_X509_CSR_WRITE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002272 *
Manuel Pégourié-Gonnard09fff7e2013-09-20 13:45:36 +02002273 * Enable creating X.509 Certificate Signing Requests (CSR).
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002274 *
2275 * Module: library/x509_csr_write.c
2276 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002277 * Requires: MBEDTLS_X509_CREATE_C
Paul Bakker7c6b2c32013-09-16 13:49:26 +02002278 *
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002279 * This module is required for X.509 certificate request writing.
2280 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002281#define MBEDTLS_X509_CSR_WRITE_C
Paul Bakkerbdb912d2012-02-13 23:11:30 +00002282
2283/**
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002284 * \def MBEDTLS_XTEA_C
Paul Bakker5121ce52009-01-03 21:22:43 +00002285 *
Paul Bakkerf3b86c12011-01-27 15:24:17 +00002286 * Enable the XTEA block cipher.
2287 *
Paul Bakker7a7c78f2009-01-04 18:15:48 +00002288 * Module: library/xtea.c
2289 * Caller:
2290 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002291#define MBEDTLS_XTEA_C
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01002292
Manuel Pégourié-Gonnardb4fe3cb2015-01-22 16:11:05 +00002293/* \} name SECTION: mbed TLS modules */
Paul Bakker7a7c78f2009-01-04 18:15:48 +00002294
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002295/**
2296 * \name SECTION: Module configuration options
2297 *
2298 * This section allows for the setting of module specific sizes and
2299 * configuration options. The default values are already present in the
2300 * relevant header files and should suffice for the regular use cases.
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002301 *
Paul Bakker088c5c52014-04-25 11:11:10 +02002302 * Our advice is to enable options and change their values here
2303 * only if you have a good reason and know the consequences.
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002304 *
2305 * Please check the respective header file for documentation on these
2306 * parameters (to prevent duplicate documentation).
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002307 * \{
2308 */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002309
Paul Bakker088c5c52014-04-25 11:11:10 +02002310/* MPI / BIGNUM options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002311//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */
2312//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002313
Paul Bakker088c5c52014-04-25 11:11:10 +02002314/* CTR_DRBG options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002315//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */
2316//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2317//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2318//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2319//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002320
Paul Bakker088c5c52014-04-25 11:11:10 +02002321/* HMAC_DRBG options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002322//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
2323//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
2324//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
2325//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002326
Paul Bakker088c5c52014-04-25 11:11:10 +02002327/* ECP options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002328//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */
2329//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */
2330//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
Manuel Pégourié-Gonnard0520b602014-01-30 19:43:46 +01002331
Paul Bakker088c5c52014-04-25 11:11:10 +02002332/* Entropy options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002333//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
2334//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
Paul Bakkere1b665e2013-12-11 16:02:58 +01002335
Paul Bakker088c5c52014-04-25 11:11:10 +02002336/* Memory buffer allocator options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002337//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002338
Paul Bakker088c5c52014-04-25 11:11:10 +02002339/* Platform options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002340//#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
2341//#define MBEDTLS_PLATFORM_STD_MALLOC malloc /**< Default allocator to use, can be undefined */
2342//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */
2343//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
2344//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
2345//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */
2346//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */
Paul Bakker6e339b52013-07-03 13:37:05 +02002347
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002348/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */
2349/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
2350//#define MBEDTLS_PLATFORM_MALLOC_MACRO malloc /**< Default allocator macro to use, can be undefined */
2351//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */
2352//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
2353//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */
2354//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */
2355//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002356
Paul Bakker088c5c52014-04-25 11:11:10 +02002357/* SSL Cache options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */
2359//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002360
Paul Bakker088c5c52014-04-25 11:11:10 +02002361/* SSL options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002362//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output buffer */
2363//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */
2364//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */
2365//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002366
Manuel Pégourié-Gonnarddfc7df02014-06-30 17:59:55 +02002367/**
2368 * Complete list of ciphersuites to use, in order of preference.
2369 *
2370 * \warning No dependency checking is done on that field! This option can only
2371 * be used to restrict the set of available ciphersuites. It is your
2372 * responsibility to make sure the needed modules are active.
2373 *
2374 * Use this to save a few hundred bytes of ROM (default ordering of all
2375 * available ciphersuites) and a few to a few hundred bytes of RAM.
2376 *
2377 * The value below is only an example, not the default.
2378 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002379//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Manuel Pégourié-Gonnarddfc7df02014-06-30 17:59:55 +02002380
Paul Bakkereaebbd52014-04-25 15:04:14 +02002381/* Debug options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002382//#define MBEDTLS_DEBUG_DFL_MODE MBEDTLS_DEBUG_LOG_FULL /**< Default log: Full or Raw */
Paul Bakkereaebbd52014-04-25 15:04:14 +02002383
Manuel Pégourié-Gonnardfd6c85c2014-11-20 16:34:20 +01002384/* X509 options */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002385//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
Manuel Pégourié-Gonnardfd6c85c2014-11-20 16:34:20 +01002386
Paul Bakker0f90d7d2014-04-30 11:49:44 +02002387/* \} name SECTION: Module configuration options */
Paul Bakker9bcf16c2013-06-24 19:31:17 +02002388
Manuel Pégourié-Gonnard14d55952014-04-30 12:35:08 +02002389#include "check_config.h"
Manuel Pégourié-Gonnard92ac76f2013-12-16 17:12:53 +01002390
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002391#endif /* MBEDTLS_CONFIG_H */