1 /* 2 * Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 * 19 * This file is part of mbed TLS (https://tls.mbed.org) 20 */ 21 /* 22 * Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites 23 * Distinguishing features: 24 * - no bignum, no PK, no X509 25 * - fully modern and secure (provided the pre-shared keys have high entropy) 26 * - very low record overhead with CCM-8 27 * - optimized for low RAM usage 28 * 29 * See README.txt for usage instructions. 30 */ 31 #ifndef MBEDTLS_CONFIG_H 32 #define MBEDTLS_CONFIG_H 33 34 /* System support */ 35 //#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */ 36 /* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */ 37 //#define MBEDTLS_NO_PLATFORM_ENTROPY 38 //#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES 39 //#define MBEDTLS_TEST_NULL_ENTROPY 40 //#define MBEDTLS_HAVEGE_C 41 //#define MBEDTLS_DEBUG_C 42 #define MBEDTLS_PLATFORM_C 43 #define MBEDTLS_PLATFORM_MEMORY 44 #define MBEDTLS_TIMING_C 45 46 /* mbed TLS feature support */ 47 #define MBEDTLS_CIPHER_MODE_CBC 48 #define MBEDTLS_PKCS1_V15 49 #define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED 50 //#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED 51 #define MBEDTLS_SSL_PROTO_TLS1_2 52 #define MBEDTLS_SSL_PROTO_DTLS /*alicoap dtls need, psk can close */ 53 #define MBEDTLS_SSL_DTLS_HELLO_VERIFY /*alicoap dtls need, psk can close */ 54 55 // /* AES */ 56 // #define MBEDTLS_AES_ALT 57 // #define CONFIG_TEE_AES 58 59 // /* SHA256 */ 60 // #define MBEDTLS_SHA256_ALT 61 // #define CONFIG_TEE_SHA256 62 63 // /* RSA */ 64 // #define MBEDTLS_RSA_ALT 65 // #define CONFIG_TEE_RSA 66 67 #ifdef MBEDTLS_RSA_ALT 68 #define MBEDTLS_RSA_NO_CRT 69 #endif 70 71 /* mbed TLS modules */ 72 #define MBEDTLS_AES_C 73 #define MBEDTLS_ASN1_PARSE_C 74 #define MBEDTLS_BIGNUM_C 75 // #define MBEDTLS_CCM_C 76 // #define MBEDTLS_GCM_C 77 #define MBEDTLS_CIPHER_C 78 //#define MBEDTLS_CTR_DRBG_C 79 //#define MBEDTLS_ENTROPY_C 80 81 #define MBEDTLS_MD_C 82 #define MBEDTLS_MD5_C 83 //#define MBEDTLS_MD5_WRAP 84 85 //#define MBEDTLS_NET_C 86 #define MBEDTLS_OID_C 87 #define MBEDTLS_SHA1_C 88 #define MBEDTLS_SHA256_C 89 //#define MBEDTLS_SHA512_C 90 #define MBEDTLS_PK_C 91 #define MBEDTLS_PK_PARSE_C 92 #define MBEDTLS_RSA_C 93 #define MBEDTLS_SSL_CLI_C 94 #define MBEDTLS_SSL_COOKIE_C /*alicoap dtls need, psk can close */ 95 //#define MBEDTLS_SSL_SRV_C 96 97 #define MBEDTLS_SSL_TLS_C 98 #define MBEDTLS_X509_CRT_PARSE_C 99 #define MBEDTLS_X509_USE_C 100 #define MBEDTLS_BASE64_C 101 #define MBEDTLS_CERTS_C 102 #define MBEDTLS_PEM_PARSE_C 103 104 //#define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR 105 106 /* Save RAM at the expense of ROM */ 107 // #define MBEDTLS_AES_ROM_TABLES 108 109 /* Save some RAM by adjusting to your exact needs */ 110 #define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */ 111 112 /* 113 * You should adjust this to the exact number of sources you're using: default 114 * is the "platform_entropy_poll" source, but you may want to add other ones 115 * Minimum is 2 for the entropy test suite. 116 */ 117 //#define MBEDTLS_ENTROPY_MAX_SOURCES 128 118 119 /* 120 * Use only CCM_8 ciphersuites, and 121 * save ROM and a few bytes of RAM by specifying our own ciphersuite list 122 */ 123 #define MBEDTLS_SSL_CIPHERSUITES \ 124 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA 125 126 /* 127 * Save RAM at the expense of interoperability: do this only if you control 128 * both ends of the connection! (See comments in "mbedtls/ssl.h".) 129 * The optimal size here depends on the typical size of records. 130 */ 131 //#define MBEDTLS_SSL_MAX_CONTENT_LEN (1 * 1024) /*alicoap 1K*/ 132 133 #if !defined (MBEDTLS_DEBUG_C) 134 /*reduce readonly date size*/ 135 #define CK_REMOVE_UNUSED_FUNCTION_AND_DATA 136 #endif 137 138 /* save cert in flash, save about 3.7K ram use*/ 139 //#define CK_SAVE_MEM_L2 140 141 #ifdef CK_SAVE_MEM_L2 142 143 #error "comment this line and set CK_FLASH_BLOCK_START,CK_FLAHS_BLOCK_NUM" 144 145 /* CK_FLASH_BLOCK_START flash start address where certificates in*/ 146 /* CK_FLAHS_BLOCK_NUM flash size, this MUSH larger than all certificates total size*/ 147 148 /*examples for hobbit, 0x10030000 ~ 0x10031400 */ 149 //#define CK_FLASH_BLOCK_START (384) 150 //#define CK_FLAHS_BLOCK_NUM 10 151 152 /*examples for phobos, 0x1002fc00 ~ 0x1003100*/ 153 //#define CK_FLASH_BLOCK_START (382) 154 //#define CK_FLAHS_BLOCK_NUM 10 155 156 #define ck_alloc(a) ck_cert_flash_alloc(a) 157 #define ck_memcpy(d,s,l) ck_cert_flash_copy((uint32_t)d,s,l) 158 159 #endif 160 161 /*disable rsa private key check,save about 5k rom use*/ 162 #define CK_SAVE_MEM_L3 163 164 /* reduce ram use in certificate handshake message*/ 165 #ifdef MBEDTLS_SSL_PROTO_DTLS 166 #define CK_SAVE_MEM_L4 /*alicoap can open*/ 167 #endif 168 169 #include "mbedtls/check_config.h" 170 171 #endif /* MBEDTLS_CONFIG_H */ 172