mirror of
https://github.com/apache/nuttx-apps.git
synced 2026-08-01 20:29:00 +00:00
Update MbedTLS 3.4.0 -> 3.6.2 and set it as default
Even though one could in theory simply set CONFIG_MBEDTLS_VERSION="3.6.2",
this commit is needed for 2 reasons:
1. The patches need to be updated: 0001 works almost as-is (with fuzz 2)
but 0002 hunk #4 fails and needed adjustment. Otherwise, the patches
are identical.
2. mbedtls_config.h needs to be updated: Following the same approach
for the Kconfig this commit updates both Kconfig and mbedtls_config.h
according to the changes:
mbedtls$ git diff v3.4.0...v3.6.2 -- include/mbedtls/mbedtls_config.h
Minor edits also to crypto/controlse to comply with v3.6.2.
Signed-off-by: George Poulios <gpoulios@census-labs.com>
This commit is contained in:
George Poulios
Xiang Xiao
parent
8b253d699c
commit
0b3428942f
6 changed files with 910 additions and 432 deletions
|
|
@ -8,7 +8,7 @@ config CRYPTO_CONTROLSE
|
|||
default n
|
||||
depends on DEV_SE05X
|
||||
depends on CRYPTO_MBEDTLS
|
||||
depends on MBEDTLS_VERSION = "3.4.0"
|
||||
depends on MBEDTLS_VERSION = "3.6.2"
|
||||
select MBEDTLS_ECDSA_C
|
||||
select MBEDTLS_ECP_C
|
||||
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
||||
|
|
|
|||
|
|
@ -89,7 +89,7 @@ public:
|
|||
return result;
|
||||
}
|
||||
|
||||
static int ecdsa_sign_wrap(void *ctx, mbedtls_md_type_t md_alg,
|
||||
static int ecdsa_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
|
||||
const unsigned char *hash, size_t hash_len,
|
||||
unsigned char *sig, size_t sig_size,
|
||||
size_t *sig_len,
|
||||
|
|
@ -97,7 +97,8 @@ public:
|
|||
void *p_rng)
|
||||
{
|
||||
|
||||
mbedtls_ecp_keypair *key = reinterpret_cast<mbedtls_ecp_keypair *>(ctx);
|
||||
mbedtls_ecp_keypair *key =
|
||||
reinterpret_cast<mbedtls_ecp_keypair *>(pk->pk_ctx);
|
||||
auto se05x_ctx = reinterpret_cast<mbedtls_se05x_ctx *>(key->d.p);
|
||||
|
||||
struct se05x_signature_s args
|
||||
|
|
|
|||
|
|
@ -1,22 +1,31 @@
|
|||
From e40fdc9238384ee62013c41d74cb4d47ae8c1aad Mon Sep 17 00:00:00 2001
|
||||
From: makejian <makejian@xiaomi.com>
|
||||
Date: Mon, 11 Sep 2023 19:40:04 +0800
|
||||
Subject: [PATCH] mbedtls/entropy_poll: use 'getrandom' to get the system
|
||||
From b82b0c314d78d44f717a69924e7a60d8d43eb200 Mon Sep 17 00:00:00 2001
|
||||
From: George Poulios <gpoulios@census-labs.com>
|
||||
Date: Fri, 29 Nov 2024 10:32:54 +0200
|
||||
Subject: [PATCH 1/2] mbedtls/entropy_poll: use 'getrandom' to get the system
|
||||
entropy
|
||||
|
||||
VELAPLATFO-16390
|
||||
Original patch:
|
||||
From e40fdc9238384ee62013c41d74cb4d47ae8c1aad Mon Sep 17 00:00:00 2001
|
||||
From: makejian <makejian@xiaomi.com>
|
||||
Date: Mon, 11 Sep 2023 19:40:04 +0800
|
||||
Subject: [PATCH] mbedtls/entropy_poll: use 'getrandom' to get the system
|
||||
entropy
|
||||
|
||||
Change-Id: I885969c441cd174f5eedf8c9ce17b89e501148c8
|
||||
Signed-off-by: makejian <makejian@xiaomi.com>
|
||||
VELAPLATFO-16390
|
||||
|
||||
Change-Id: I885969c441cd174f5eedf8c9ce17b89e501148c8
|
||||
Signed-off-by: makejian <makejian@xiaomi.com>
|
||||
|
||||
Signed-off-by: George Poulios <gpoulios@census-labs.com>
|
||||
---
|
||||
library/entropy_poll.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git mbedtls/library/entropy_poll.c mbedtls/library/entropy_poll.c
|
||||
index b5024c83f..e9431e812 100644
|
||||
--- mbedtls/library/entropy_poll.c
|
||||
+++ mbedtls/library/entropy_poll.c
|
||||
@@ -103,10 +103,11 @@ static int getrandom_wrapper(void *buf, size_t buflen, unsigned int flags)
|
||||
diff --git a/library/entropy_poll.c b/library/entropy_poll.c
|
||||
index 611768cd85..a26e154db1 100644
|
||||
--- a/library/entropy_poll.c
|
||||
+++ b/library/entropy_poll.c
|
||||
@@ -95,10 +95,11 @@ static int getrandom_wrapper(void *buf, size_t buflen, unsigned int flags)
|
||||
#endif /* SYS_getrandom */
|
||||
#endif /* __linux__ || __midipix__ */
|
||||
|
||||
|
|
|
|||
|
|
@ -1,9 +1,17 @@
|
|||
From e9eeb5721637faa451f66bbb2789046b9a7963d5 Mon Sep 17 00:00:00 2001
|
||||
From: makejian <makejian@xiaomi.com>
|
||||
Date: Fri, 18 Aug 2023 15:52:45 +0800
|
||||
Subject: [PATCH 1/2] mbedtls: add mbedtls x509 crt pool
|
||||
From f846c8fb13238a4db1f7d5e1a9ebce459c21faf7 Mon Sep 17 00:00:00 2001
|
||||
From: George Poulios <gpoulios@census-labs.com>
|
||||
Date: Fri, 29 Nov 2024 10:33:57 +0200
|
||||
Subject: [PATCH 2/2] mbedtls: add mbedtls x509 crt pool
|
||||
|
||||
Signed-off-by: makejian <makejian@xiaomi.com>
|
||||
Original patch:
|
||||
From e9eeb5721637faa451f66bbb2789046b9a7963d5 Mon Sep 17 00:00:00 2001
|
||||
From: makejian <makejian@xiaomi.com>
|
||||
Date: Fri, 18 Aug 2023 15:52:45 +0800
|
||||
Subject: [PATCH 1/2] mbedtls: add mbedtls x509 crt pool
|
||||
|
||||
Signed-off-by: makejian <makejian@xiaomi.com>
|
||||
|
||||
Signed-off-by: George Poulios <gpoulios@census-labs.com>
|
||||
---
|
||||
include/mbedtls/threading.h | 4 +
|
||||
library/threading.c | 3 +
|
||||
|
|
@ -14,13 +22,13 @@ Signed-off-by: makejian <makejian@xiaomi.com>
|
|||
create mode 100644 library/x509_crt_pool.c
|
||||
create mode 100644 library/x509_crt_pool.h
|
||||
|
||||
diff --git mbedtls/include/mbedtls/threading.h mbedtls/include/mbedtls/threading.h
|
||||
index 1b9c7ced2..e3986cd67 100644
|
||||
--- mbedtls/include/mbedtls/threading.h
|
||||
+++ mbedtls/include/mbedtls/threading.h
|
||||
@@ -108,6 +108,10 @@ extern mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex;
|
||||
extern mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex;
|
||||
#endif /* MBEDTLS_HAVE_TIME_DATE && !MBEDTLS_PLATFORM_GMTIME_R_ALT */
|
||||
diff --git a/include/mbedtls/threading.h b/include/mbedtls/threading.h
|
||||
index d50d04ead1..9fffe6705d 100644
|
||||
--- a/include/mbedtls/threading.h
|
||||
+++ b/include/mbedtls/threading.h
|
||||
@@ -128,6 +128,10 @@ extern mbedtls_threading_mutex_t mbedtls_threading_psa_globaldata_mutex;
|
||||
extern mbedtls_threading_mutex_t mbedtls_threading_psa_rngdata_mutex;
|
||||
#endif
|
||||
|
||||
+#if defined(MBEDTLS_X509_CRT_POOL)
|
||||
+extern mbedtls_threading_mutex_t mbedtls_threading_x509crtpool_mutex;
|
||||
|
|
@ -29,24 +37,24 @@ index 1b9c7ced2..e3986cd67 100644
|
|||
#endif /* MBEDTLS_THREADING_C */
|
||||
|
||||
#ifdef __cplusplus
|
||||
diff --git mbedtls/library/threading.c mbedtls/library/threading.c
|
||||
index 130c6963d..c91df6f6a 100644
|
||||
--- mbedtls/library/threading.c
|
||||
+++ mbedtls/library/threading.c
|
||||
@@ -189,5 +189,8 @@ mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex MUTEX_INIT;
|
||||
#if defined(THREADING_USE_GMTIME)
|
||||
mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex MUTEX_INIT;
|
||||
diff --git a/library/threading.c b/library/threading.c
|
||||
index 85db243f21..da500193f5 100644
|
||||
--- a/library/threading.c
|
||||
+++ b/library/threading.c
|
||||
@@ -191,5 +191,8 @@ mbedtls_threading_mutex_t mbedtls_threading_key_slot_mutex MUTEX_INIT;
|
||||
mbedtls_threading_mutex_t mbedtls_threading_psa_globaldata_mutex MUTEX_INIT;
|
||||
mbedtls_threading_mutex_t mbedtls_threading_psa_rngdata_mutex MUTEX_INIT;
|
||||
#endif
|
||||
+#if defined(MBEDTLS_X509_CRT_POOL)
|
||||
+mbedtls_threading_mutex_t mbedtls_threading_x509crtpool_mutex MUTEX_INIT;
|
||||
+#endif
|
||||
|
||||
#endif /* MBEDTLS_THREADING_C */
|
||||
diff --git mbedtls/library/x509_crt.c mbedtls/library/x509_crt.c
|
||||
index cf62532f2..8d058a092 100644
|
||||
--- mbedtls/library/x509_crt.c
|
||||
+++ mbedtls/library/x509_crt.c
|
||||
@@ -78,6 +78,10 @@
|
||||
diff --git a/library/x509_crt.c b/library/x509_crt.c
|
||||
index 53cdcf0266..dd3c83a91a 100644
|
||||
--- a/library/x509_crt.c
|
||||
+++ b/library/x509_crt.c
|
||||
@@ -71,6 +71,10 @@
|
||||
#endif /* !_WIN32 || EFIX64 || EFI32 */
|
||||
#endif
|
||||
|
||||
|
|
@ -57,9 +65,9 @@ index cf62532f2..8d058a092 100644
|
|||
/*
|
||||
* Item in a verification chain: cert and flags for it
|
||||
*/
|
||||
@@ -995,6 +999,12 @@ static int x509_crt_parse_der_core(mbedtls_x509_crt *crt,
|
||||
@@ -1113,6 +1117,12 @@ static int x509_crt_parse_der_core(mbedtls_x509_crt *crt,
|
||||
end = crt_end = p + len;
|
||||
crt->raw.len = crt_end - buf;
|
||||
crt->raw.len = (size_t) (crt_end - buf);
|
||||
if (make_copy != 0) {
|
||||
+#if defined(MBEDTLS_X509_CRT_POOL)
|
||||
+ crt->raw.p = p = x509_crt_pool_ref_buf(buf, crt->raw.len);
|
||||
|
|
@ -70,7 +78,7 @@ index cf62532f2..8d058a092 100644
|
|||
/* Create and populate a new buffer for the raw field. */
|
||||
crt->raw.p = p = mbedtls_calloc(1, crt->raw.len);
|
||||
if (crt->raw.p == NULL) {
|
||||
@@ -1002,6 +1012,7 @@ static int x509_crt_parse_der_core(mbedtls_x509_crt *crt,
|
||||
@@ -1120,6 +1130,7 @@ static int x509_crt_parse_der_core(mbedtls_x509_crt *crt,
|
||||
}
|
||||
|
||||
memcpy(crt->raw.p, buf, crt->raw.len);
|
||||
|
|
@ -78,24 +86,23 @@ index cf62532f2..8d058a092 100644
|
|||
crt->own_buffer = 1;
|
||||
|
||||
p += crt->raw.len - len;
|
||||
@@ -2839,8 +2850,12 @@ void mbedtls_x509_crt_free(mbedtls_x509_crt *crt)
|
||||
mbedtls_asn1_sequence_free(cert_cur->certificate_policies.next);
|
||||
@@ -3246,7 +3257,11 @@ void mbedtls_x509_crt_free(mbedtls_x509_crt *crt)
|
||||
mbedtls_asn1_sequence_free(cert_cur->authority_key_id.authorityCertIssuer.next);
|
||||
|
||||
if (cert_cur->raw.p != NULL && cert_cur->own_buffer) {
|
||||
+#if defined(MBEDTLS_X509_CRT_POOL)
|
||||
+ x509_crt_pool_unref_buf(cert_cur->raw.p);
|
||||
+#else
|
||||
mbedtls_platform_zeroize(cert_cur->raw.p, cert_cur->raw.len);
|
||||
mbedtls_free(cert_cur->raw.p);
|
||||
mbedtls_zeroize_and_free(cert_cur->raw.p, cert_cur->raw.len);
|
||||
+#endif
|
||||
}
|
||||
|
||||
cert_prv = cert_cur;
|
||||
diff --git mbedtls/library/x509_crt_pool.c mbedtls/library/x509_crt_pool.c
|
||||
diff --git a/library/x509_crt_pool.c b/library/x509_crt_pool.c
|
||||
new file mode 100644
|
||||
index 000000000..da00c88a8
|
||||
index 0000000000..da00c88a85
|
||||
--- /dev/null
|
||||
+++ mbedtls/library/x509_crt_pool.c
|
||||
+++ b/library/x509_crt_pool.c
|
||||
@@ -0,0 +1,142 @@
|
||||
+/*
|
||||
+ * X.509 certificate pool
|
||||
|
|
@ -239,11 +246,11 @@ index 000000000..da00c88a8
|
|||
+}
|
||||
+
|
||||
+#endif /* MBEDTLS_X509_CRT_POOL */
|
||||
diff --git mbedtls/library/x509_crt_pool.h mbedtls/library/x509_crt_pool.h
|
||||
diff --git a/library/x509_crt_pool.h b/library/x509_crt_pool.h
|
||||
new file mode 100644
|
||||
index 000000000..8592761de
|
||||
index 0000000000..8592761de4
|
||||
--- /dev/null
|
||||
+++ mbedtls/library/x509_crt_pool.h
|
||||
+++ b/library/x509_crt_pool.h
|
||||
@@ -0,0 +1,30 @@
|
||||
+/**
|
||||
+ * \file x509_crt_pool.h
|
||||
|
|
@ -277,4 +284,3 @@ index 000000000..8592761de
|
|||
+#endif /* mbedtls_x509_crt_pool.h */
|
||||
--
|
||||
2.40.0
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ if CRYPTO_MBEDTLS
|
|||
|
||||
config MBEDTLS_VERSION
|
||||
string "Mbed TLS Version"
|
||||
default "3.4.0"
|
||||
default "3.6.2"
|
||||
|
||||
config MBEDTLS_DEBUG_C
|
||||
bool "This module provides debugging functions."
|
||||
|
|
@ -107,7 +107,7 @@ config MBEDTLS_SSL_DTLS_HELLO_VERIFY
|
|||
default y
|
||||
|
||||
config MBEDTLS_SSL_DTLS_CONNECTION_ID
|
||||
bool "Enable the Connection ID extension."
|
||||
bool "Enable support for the DTLS Connection ID (CID) extension."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT
|
||||
|
|
@ -142,6 +142,10 @@ config MBEDTLS_NET_C
|
|||
bool "Enable the TCP and UDP over IPv6/IPv4 networking routines"
|
||||
default LIBC_NETDB
|
||||
|
||||
config MBEDTLS_OID_C
|
||||
bool "Enable the OID database."
|
||||
default y
|
||||
|
||||
config MBEDTLS_ECDSA_C
|
||||
bool "Enable the elliptic curve DSA library."
|
||||
default y
|
||||
|
|
@ -158,8 +162,19 @@ config MBEDTLS_PEM_WRITE_C
|
|||
bool "Enable PEM encoding / writing."
|
||||
default y
|
||||
|
||||
config MBEDTLS_PK_C
|
||||
bool "Enable the generic public (asymmetric) key layer."
|
||||
depends on MBEDTLS_MD_C && MBEDTLS_RSA_C && MBEDTLS_ECP_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_PK_PARSE_C
|
||||
bool "Enable the generic public (asymmetric) key parser"
|
||||
depends on MBEDTLS_ASN1_PARSE_C && MBEDTLS_OID_C && MBEDTLS_PK_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_PK_WRITE_C
|
||||
bool "Enable the generic public (asymmetric) key writer."
|
||||
depends on MBEDTLS_ASN1_WRITE_C && MBEDTLS_OID_C && MBEDTLS_PK_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_X509_CREATE_C
|
||||
|
|
@ -324,6 +339,10 @@ config MBEDTLS_PK_PARSE_EC_EXTENDED
|
|||
bool "Enhance support for reading EC keys using variants of SEC1 not allowed by RFC 5915 and RFC 5480."
|
||||
default y
|
||||
|
||||
config MBEDTLS_PK_PARSE_EC_COMPRESSED
|
||||
bool "Enable the support for parsing public keys of type Short Weierstrass (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX) which are using the compressed point format."
|
||||
default y
|
||||
|
||||
config MBEDTLS_ERROR_STRERROR_DUMMY
|
||||
bool "Enable a dummy error function to make use of mbedtls_strerror()."
|
||||
default y
|
||||
|
|
@ -336,11 +355,24 @@ config MBEDTLS_PK_RSA_ALT_SUPPORT
|
|||
bool "Support external private RSA keys (eg from a HSM) in the PK layer."
|
||||
default y
|
||||
|
||||
config MBEDTLS_PKCS1_V21
|
||||
bool "Enable support for PKCS#1 v2.1 encoding."
|
||||
default y
|
||||
|
||||
config MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
|
||||
bool "Make the PSA Crypto module use an external random generator provided by a driver, instead of Mbed TLS's entropy and DRBG modules."
|
||||
depends on DEV_RANDOM
|
||||
default n
|
||||
|
||||
config MBEDTLS_PSA_KEY_STORE_DYNAMIC
|
||||
bool "Dynamically resize the PSA key store to accommodate any number of volatile keys (until the heap memory is exhausted)."
|
||||
depends on MBEDTLS_PSA_CRYPTO_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
|
||||
bool "Assume all buffers passed to PSA functions are owned exclusively by the PSA function and are not stored in shared memory."
|
||||
default n
|
||||
|
||||
config MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
bool "Enable serialization of the TLS context structures."
|
||||
depends on MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C
|
||||
|
|
@ -362,23 +394,43 @@ config MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
|||
bool "Enable support for RFC 6066 max_fragment_length extension in SSL."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_PROTO_TLS1_2
|
||||
bool "Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled)."
|
||||
depends on (MBEDTLS_USE_PSA_CRYPTO ||\
|
||||
(MBEDTLS_MD_C && (MBEDTLS_SHA256_C || MBEDTLS_SHA384_C)))
|
||||
default y
|
||||
help
|
||||
If MBEDTLS_USE_PSA_CRYPTO is set, then PSA_WANT_ALG_SHA_256 or PSA_WANT_ALG_SHA_384
|
||||
must be defined.
|
||||
|
||||
config MBEDTLS_SSL_PROTO_TLS1_3
|
||||
bool "Enable support for TLS 1.3."
|
||||
depends on MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_PSA_CRYPTO_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
bool "Enable TLS 1.3 middlebox compatibility mode."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
|
||||
bool "Enable TLS 1.3 PSK key exchange mode."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
bool "Enable TLS 1.3 ephemeral key exchange mode."
|
||||
depends on MBEDTLS_ECDH_C
|
||||
depends on MBEDTLS_X509_CRT_PARSE_C && \
|
||||
(MBEDTLS_ECDSA_C || MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_PKCS1_V21)
|
||||
default y
|
||||
help
|
||||
Requires PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH to be defined. Also, if
|
||||
MBEDTLS_USE_PSA_CRYPTO is used to satisfy its dependencies, then PSA_WANT_ALG_ECDSA
|
||||
must also be defined.
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
|
||||
bool "Enable TLS 1.3 PSK ephemeral key exchange mode."
|
||||
depends on MBEDTLS_ECDH_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_MAX_EARLY_DATA_SIZE
|
||||
int "The default maximum amount of 0-RTT data."
|
||||
default 1024
|
||||
help
|
||||
Requires PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH.
|
||||
|
||||
config MBEDTLS_SSL_SESSION_TICKETS
|
||||
bool "Enable support for RFC 5077 session tickets in SSL."
|
||||
|
|
@ -393,6 +445,11 @@ config MBEDTLS_THREADING_PTHREAD
|
|||
depends on MBEDTLS_THREADING_C
|
||||
default n
|
||||
|
||||
config MBEDTLS_USE_PSA_CRYPTO
|
||||
bool "Make the X.509 and TLS library use PSA for cryptographic operations, and enable new APIs for using keys handled by PSA Crypto."
|
||||
depends on MBEDTLS_PSA_CRYPTO_C
|
||||
default n
|
||||
|
||||
config MBEDTLS_VERSION_FEATURES
|
||||
bool "Allow run-time checking of compile-time enabled features."
|
||||
depends on MBEDTLS_VERSION_C
|
||||
|
|
@ -400,11 +457,24 @@ config MBEDTLS_VERSION_FEATURES
|
|||
|
||||
config MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
bool "Enable parsing and verification of X.509 certificates, CRLs and CSRS signed with RSASSA-PSS."
|
||||
depends on MBEDTLS_PKCS1_V21
|
||||
default y
|
||||
|
||||
config MBEDTLS_AESCE_C
|
||||
bool "Enable AES cryptographic extension support on 64-bit Arm."
|
||||
depends on MBEDTLS_HAVE_ASM
|
||||
depends on MBEDTLS_AES_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_AES_C
|
||||
bool "Enable the AES block cipher."
|
||||
default y
|
||||
|
||||
config MBEDTLS_ASN1_PARSE_C
|
||||
bool "Enable the generic ASN1 parser."
|
||||
default y
|
||||
|
||||
config MBEDTLS_ASN1_WRITE_C
|
||||
bool "Enable the generic ASN1 writer."
|
||||
default y
|
||||
|
||||
config MBEDTLS_ARC4_C
|
||||
|
|
@ -483,17 +553,32 @@ config MBEDTLS_NIST_KW_C
|
|||
bool "Enable the Key Wrapping mode for 128-bit block ciphers."
|
||||
default y
|
||||
|
||||
config MBEDTLS_MD_C
|
||||
bool "Enable the generic layer for message digest (hashing) and HMAC."
|
||||
depends on MBEDTLS_MD5_C || MBEDTLS_RIPEMD160_C || MBEDTLS_SHA1_C ||\
|
||||
MBEDTLS_SHA224_C || MBEDTLS_SHA256_C || MBEDTLS_SHA384_C ||\
|
||||
MBEDTLS_SHA512_C || MBEDTLS_PSA_CRYPTO_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_MD5_C
|
||||
bool "Enable the MD5 hash algorithm."
|
||||
default y
|
||||
|
||||
config MBEDTLS_PKCS5_C
|
||||
bool "Enable PKCS#5 functions."
|
||||
select MBEDTLS_MD_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_PKCS7_C
|
||||
bool "Enable PKCS #7 core for using PKCS #7-formatted signatures."
|
||||
depends on MBEDTLS_X509_CRL_PARSE_C
|
||||
depends on MBEDTLS_ASN1_PARSE_C && MBEDTLS_OID_C && MBEDTLS_PK_PARSE_C &&\
|
||||
MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_X509_CRL_PARSE_C &&\
|
||||
MBEDTLS_MD_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_PKCS12_C
|
||||
bool "Enable PKCS#12 PBE functions."
|
||||
depends on MBEDTLS_ASN1_PARSE_C && (MBEDTLS_MD_C || MBEDTLS_PSA_CRYPTO_C)
|
||||
default y
|
||||
|
||||
config MBEDTLS_PLATFORM_C
|
||||
|
|
@ -521,6 +606,23 @@ config MBEDTLS_RIPEMD160_C
|
|||
bool "Enable the RIPEMD-160 hash algorithm."
|
||||
default y
|
||||
|
||||
config MBEDTLS_RSA_C
|
||||
bool "Enable the RSA public-key cryptosystem."
|
||||
depends on MBEDTLS_OID_C
|
||||
default y
|
||||
|
||||
config MBEDTLS_SHA1_C
|
||||
bool "Enable the SHA1 cryptographic hash algorithm."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SHA224_C
|
||||
bool "Enable the SHA-224 cryptographic hash algorithm."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SHA256_C
|
||||
bool "Enable the SHA-256 cryptographic hash algorithm."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SHA384_C
|
||||
bool "Enable the SHA-384 cryptographic hash algorithm."
|
||||
default y
|
||||
|
|
@ -529,6 +631,10 @@ config MBEDTLS_SHA512_C
|
|||
bool "Enable SHA-512 cryptographic hash algorithms."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SHA3_C
|
||||
bool "Enable the SHA3 cryptographic hash algorithm."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_CACHE_C
|
||||
bool "Enable simple SSL cache implementation."
|
||||
default y
|
||||
|
|
@ -547,22 +653,20 @@ config MBEDTLS_VERSION_C
|
|||
bool "Enable run-time version information."
|
||||
default y
|
||||
|
||||
config MBEDTLS_X509_USE_C
|
||||
bool "Enable X.509 core for using certificates."
|
||||
depends on MBEDTLS_ASN1_PARSE_C && MBEDTLS_OID_C && MBEDTLS_PK_PARSE_C &&\
|
||||
(MBEDTLS_MD_C || MBEDTLS_USE_PSA_CRYPTO)
|
||||
default y
|
||||
|
||||
config MBEDTLS_X509_CRT_PARSE_C
|
||||
bool "Enable X.509 certificate parsing."
|
||||
default y
|
||||
|
||||
config MBEDTLS_X509_CRL_PARSE_C
|
||||
bool "Enable X.509 CRL parsing."
|
||||
default y
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE
|
||||
int "Maximum time difference in milliseconds tolerated between the age of a ticket from the server and client point of view."
|
||||
default 6000
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH
|
||||
int "Size in bytes of a ticket nonce."
|
||||
default 32
|
||||
|
||||
config MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS
|
||||
int "Default number of NewSessionTicket messages to be sent by a TLS 1.3 server after handshake completion."
|
||||
default 1
|
||||
|
||||
if CRYPTO_CRYPTODEV
|
||||
|
||||
config MBEDTLS_ALT
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue