1 /* 2 * Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 * 19 * This file is part of mbed TLS (https://tls.mbed.org) 20 */ 21 /* 22 * Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites 23 * Distinguishing features: 24 * - no bignum, no PK, no X509 25 * - fully modern and secure (provided the pre-shared keys have high entropy) 26 * - very low record overhead with CCM-8 27 * - optimized for low RAM usage 28 * 29 * See README.txt for usage instructions. 30 */ 31 #ifndef MBEDTLS_CONFIG_H 32 #define MBEDTLS_CONFIG_H 33 34 /* System support */ 35 //#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */ 36 /* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */ 37 //#define MBEDTLS_NO_PLATFORM_ENTROPY 38 //#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES 39 //#define MBEDTLS_TEST_NULL_ENTROPY 40 //#define MBEDTLS_HAVEGE_C 41 // #define MBEDTLS_DEBUG_C 42 #define MBEDTLS_PLATFORM_C 43 #define MBEDTLS_PLATFORM_MEMORY 44 #define MBEDTLS_TIMING_C 45 46 /* mbed TLS feature support */ 47 #define MBEDTLS_CIPHER_MODE_CBC 48 #define MBEDTLS_CIPHER_MODE_CFB 49 #define MBEDTLS_PKCS1_V15 50 #define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED 51 //#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED 52 #define MBEDTLS_SSL_PROTO_TLS1_2 53 //#define MBEDTLS_SSL_PROTO_DTLS /*alicoap*/ 54 //#define MBEDTLS_SSL_DTLS_HELLO_VERIFY /*alicoap*/ 55 56 // #define MBEDTLS_SHA1_ALT // FIXME: because of sha1 and sha256 cannot coexist 57 58 59 // /* AES */ 60 // #define MBEDTLS_AES_ALT 61 // #define CONFIG_TEE_AES 62 63 // /* SHA256 */ 64 // #define MBEDTLS_SHA256_ALT 65 // #define CONFIG_TEE_SHA256 66 67 // /* RSA */ 68 // #define MBEDTLS_RSA_ALT 69 // #define CONFIG_TEE_RSA 70 71 72 #ifdef MBEDTLS_RSA_ALT 73 #define MBEDTLS_RSA_NO_CRT 74 #endif 75 76 /* mbed TLS modules */ 77 #define MBEDTLS_AES_C 78 #define MBEDTLS_ASN1_PARSE_C 79 #define MBEDTLS_BIGNUM_C 80 // #define MBEDTLS_CCM_C 81 // #define MBEDTLS_GCM_C 82 #define MBEDTLS_CIPHER_C 83 //#define MBEDTLS_CTR_DRBG_C 84 //#define MBEDTLS_ENTROPY_C 85 86 #define MBEDTLS_MD_C 87 //#define MBEDTLS_MD5_C 88 //#define MBEDTLS_MD5_WRAP 89 90 //#define MBEDTLS_NET_C 91 #define MBEDTLS_OID_C 92 #define MBEDTLS_SHA1_C 93 #define MBEDTLS_SHA256_C 94 //#define MBEDTLS_SHA512_C 95 #define MBEDTLS_PK_C 96 #define MBEDTLS_PK_PARSE_C 97 #define MBEDTLS_RSA_C 98 #define MBEDTLS_SSL_CLI_C 99 //#define MBEDTLS_SSL_COOKIE_C /*alicoap*/ 100 101 #define MBEDTLS_SSL_TLS_C 102 #define MBEDTLS_X509_CRT_PARSE_C 103 #define MBEDTLS_X509_USE_C 104 #define MBEDTLS_BASE64_C 105 #define MBEDTLS_CERTS_C 106 #define MBEDTLS_PEM_PARSE_C /*alimqtt*/ 107 108 //#define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR 109 110 /* Save RAM at the expense of ROM */ 111 // #define MBEDTLS_AES_ROM_TABLES 112 113 /* Save some RAM by adjusting to your exact needs */ 114 #define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */ 115 116 /* 117 * You should adjust this to the exact number of sources you're using: default 118 * is the "platform_entropy_poll" source, but you may want to add other ones 119 * Minimum is 2 for the entropy test suite. 120 */ 121 //#define MBEDTLS_ENTROPY_MAX_SOURCES 128 122 123 /* 124 * Use only CCM_8 ciphersuites, and 125 * save ROM and a few bytes of RAM by specifying our own ciphersuite list 126 */ 127 #define MBEDTLS_SSL_CIPHERSUITES \ 128 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA 129 130 /* 131 * Save RAM at the expense of interoperability: do this only if you control 132 * both ends of the connection! (See comments in "mbedtls/ssl.h".) 133 * The optimal size here depends on the typical size of records. 134 */ 135 //#define MBEDTLS_SSL_MAX_CONTENT_LEN (4 * 1024) /*alicoap 1K*/ 136 137 #if !defined (MBEDTLS_DEBUG_C) 138 /*reduce readonly date size*/ 139 #define CK_REMOVE_UNUSED_FUNCTION_AND_DATA 140 #endif 141 142 /* save cert in flash, save about 3.7K ram use*/ 143 //#define CK_SAVE_MEM_L2 144 145 #ifdef CK_SAVE_MEM_L2 146 147 #error "comment this line and set CK_FLASH_BLOCK_START,CK_FLAHS_BLOCK_NUM" 148 149 /* CK_FLASH_BLOCK_START flash start address where certificates in*/ 150 /* CK_FLAHS_BLOCK_NUM flash size, this MUSH larger than all certificates total size*/ 151 152 /*examples for hobbit, 0x10030000 ~ 0x10031400 */ 153 //#define CK_FLASH_BLOCK_START (384) 154 //#define CK_FLAHS_BLOCK_NUM 10 155 156 /*examples for phobos, 0x1002fc00 ~ 0x1003100*/ 157 //#define CK_FLASH_BLOCK_START (382) 158 //#define CK_FLAHS_BLOCK_NUM 10 159 160 #define ck_alloc(a) ck_cert_flash_alloc(a) 161 #define ck_memcpy(d,s,l) ck_cert_flash_copy((uint32_t)d,s,l) 162 163 #endif 164 165 /*disable rsa private key check,save about 5k rom use*/ 166 #define CK_SAVE_MEM_L3 167 168 /* reduce ram use in certificate handshake message*/ 169 //#define CK_SAVE_MEM_L4 /*alicoap can open*/ 170 171 #include "mbedtls/check_config.h" 172 173 #endif /* MBEDTLS_CONFIG_H */ 174