mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-04-23 11:42:31 +00:00
crypto_config: Migrated PSA core selection options.
Moved configuration entries in-line with the design proposal. https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
This commit is contained in:
Minos Galanakis
parent
14489499e7
commit
626439ae50
@ -131,20 +131,6 @@
|
|||||||
*/
|
*/
|
||||||
//#define MBEDTLS_TIMING_ALT
|
//#define MBEDTLS_TIMING_ALT
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_ENTROPY_HARDWARE_ALT
|
|
||||||
*
|
|
||||||
* Uncomment this macro to let Mbed TLS use your own implementation of a
|
|
||||||
* hardware entropy collector.
|
|
||||||
*
|
|
||||||
* Your function must be called \c mbedtls_hardware_poll(), have the same
|
|
||||||
* prototype as declared in library/entropy_poll.h, and accept NULL as first
|
|
||||||
* argument.
|
|
||||||
*
|
|
||||||
* Uncomment to use your own hardware entropy collector.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_ENTROPY_HARDWARE_ALT
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_AES_ROM_TABLES
|
* \def MBEDTLS_AES_ROM_TABLES
|
||||||
*
|
*
|
||||||
@ -696,85 +682,6 @@
|
|||||||
*/
|
*/
|
||||||
#define MBEDTLS_GENPRIME
|
#define MBEDTLS_GENPRIME
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
|
||||||
*
|
|
||||||
* Do not add default entropy sources in mbedtls_entropy_init().
|
|
||||||
*
|
|
||||||
* This is useful to have more control over the added entropy sources in an
|
|
||||||
* application.
|
|
||||||
*
|
|
||||||
* Uncomment this macro to prevent loading of default entropy functions.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_NO_PLATFORM_ENTROPY
|
|
||||||
*
|
|
||||||
* Do not use built-in platform entropy functions.
|
|
||||||
* This is useful if your platform does not support
|
|
||||||
* standards like the /dev/urandom or Windows CryptoAPI.
|
|
||||||
*
|
|
||||||
* Uncomment this macro to disable the built-in platform entropy functions.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_NO_PLATFORM_ENTROPY
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_ENTROPY_FORCE_SHA256
|
|
||||||
*
|
|
||||||
* Force the entropy accumulator to use a SHA-256 accumulator instead of the
|
|
||||||
* default SHA-512 based one (if both are available).
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_SHA256_C
|
|
||||||
*
|
|
||||||
* On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
|
|
||||||
* if you have performance concerns.
|
|
||||||
*
|
|
||||||
* This option is only useful if both MBEDTLS_SHA256_C and
|
|
||||||
* MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_ENTROPY_FORCE_SHA256
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_ENTROPY_NV_SEED
|
|
||||||
*
|
|
||||||
* Enable the non-volatile (NV) seed file-based entropy source.
|
|
||||||
* (Also enables the NV seed read/write functions in the platform layer)
|
|
||||||
*
|
|
||||||
* This is crucial (if not required) on systems that do not have a
|
|
||||||
* cryptographic entropy source (in hardware or kernel) available.
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
|
|
||||||
*
|
|
||||||
* \note The read/write functions that are used by the entropy source are
|
|
||||||
* determined in the platform layer, and can be modified at runtime and/or
|
|
||||||
* compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
|
|
||||||
*
|
|
||||||
* \note If you use the default implementation functions that read a seedfile
|
|
||||||
* with regular fopen(), please make sure you make a seedfile with the
|
|
||||||
* proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
|
|
||||||
* least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
|
|
||||||
* and written to or you will get an entropy source error! The default
|
|
||||||
* implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
|
|
||||||
* bytes from the file.
|
|
||||||
*
|
|
||||||
* \note The entropy collector will write to the seed file before entropy is
|
|
||||||
* given to an external source, to update it.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_ENTROPY_NV_SEED
|
|
||||||
|
|
||||||
/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
|
|
||||||
*
|
|
||||||
* Enable key identifiers that encode a key owner identifier.
|
|
||||||
*
|
|
||||||
* The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t
|
|
||||||
* which is currently hard-coded to be int32_t.
|
|
||||||
*
|
|
||||||
* Note that this option is meant for internal use only and may be removed
|
|
||||||
* without notice.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_PKCS1_V15
|
* \def MBEDTLS_PKCS1_V15
|
||||||
*
|
*
|
||||||
@ -800,97 +707,6 @@
|
|||||||
*/
|
*/
|
||||||
#define MBEDTLS_PKCS1_V21
|
#define MBEDTLS_PKCS1_V21
|
||||||
|
|
||||||
/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
|
|
||||||
*
|
|
||||||
* Enable support for platform built-in keys. If you enable this feature,
|
|
||||||
* you must implement the function mbedtls_psa_platform_get_builtin_key().
|
|
||||||
* See the documentation of that function for more information.
|
|
||||||
*
|
|
||||||
* Built-in keys are typically derived from a hardware unique key or
|
|
||||||
* stored in a secure element.
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_PSA_CRYPTO_C.
|
|
||||||
*
|
|
||||||
* \warning This interface is experimental and may change or be removed
|
|
||||||
* without notice.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
|
|
||||||
|
|
||||||
/** \def MBEDTLS_PSA_CRYPTO_CLIENT
|
|
||||||
*
|
|
||||||
* Enable support for PSA crypto client.
|
|
||||||
*
|
|
||||||
* \note This option allows to include the code necessary for a PSA
|
|
||||||
* crypto client when the PSA crypto implementation is not included in
|
|
||||||
* the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the
|
|
||||||
* code to set and get PSA key attributes.
|
|
||||||
* The development of PSA drivers partially relying on the library to
|
|
||||||
* fulfill the hardware gaps is another possible usage of this option.
|
|
||||||
*
|
|
||||||
* \warning This interface is experimental and may change or be removed
|
|
||||||
* without notice.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_CLIENT
|
|
||||||
|
|
||||||
/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
|
|
||||||
*
|
|
||||||
* Make the PSA Crypto module use an external random generator provided
|
|
||||||
* by a driver, instead of Mbed TLS's entropy and DRBG modules.
|
|
||||||
*
|
|
||||||
* \note This random generator must deliver random numbers with cryptographic
|
|
||||||
* quality and high performance. It must supply unpredictable numbers
|
|
||||||
* with a uniform distribution. The implementation of this function
|
|
||||||
* is responsible for ensuring that the random generator is seeded
|
|
||||||
* with sufficient entropy. If you have a hardware TRNG which is slow
|
|
||||||
* or delivers non-uniform output, declare it as an entropy source
|
|
||||||
* with mbedtls_entropy_add_source() instead of enabling this option.
|
|
||||||
*
|
|
||||||
* If you enable this option, you must configure the type
|
|
||||||
* ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h
|
|
||||||
* and define a function called mbedtls_psa_external_get_random()
|
|
||||||
* with the following prototype:
|
|
||||||
* ```
|
|
||||||
* psa_status_t mbedtls_psa_external_get_random(
|
|
||||||
* mbedtls_psa_external_random_context_t *context,
|
|
||||||
* uint8_t *output, size_t output_size, size_t *output_length);
|
|
||||||
* );
|
|
||||||
* ```
|
|
||||||
* The \c context value is initialized to 0 before the first call.
|
|
||||||
* The function must fill the \c output buffer with \c output_size bytes
|
|
||||||
* of random data and set \c *output_length to \c output_size.
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_PSA_CRYPTO_C
|
|
||||||
*
|
|
||||||
* \warning If you enable this option, code that uses the PSA cryptography
|
|
||||||
* interface will not use any of the entropy sources set up for
|
|
||||||
* the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED
|
|
||||||
* enables.
|
|
||||||
*
|
|
||||||
* \note This option is experimental and may be removed without notice.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_CRYPTO_SPM
|
|
||||||
*
|
|
||||||
* When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure
|
|
||||||
* Partition Manager) integration which separates the code into two parts: a
|
|
||||||
* NSPE (Non-Secure Process Environment) and an SPE (Secure Process
|
|
||||||
* Environment).
|
|
||||||
*
|
|
||||||
* If you enable this option, your build environment must include a header
|
|
||||||
* file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS
|
|
||||||
* header files, or in another directory on the compiler's include search
|
|
||||||
* path). Alternatively, your platform may customize the header
|
|
||||||
* `psa/crypto_platform.h`, in which case it can skip or replace the
|
|
||||||
* inclusion of `"crypto_spe.h"`.
|
|
||||||
*
|
|
||||||
* Module: library/psa_crypto.c
|
|
||||||
* Requires: MBEDTLS_PSA_CRYPTO_C
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_SPM
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_PSA_KEY_STORE_DYNAMIC
|
* \def MBEDTLS_PSA_KEY_STORE_DYNAMIC
|
||||||
*
|
*
|
||||||
@ -946,39 +762,6 @@
|
|||||||
*/
|
*/
|
||||||
//#define MBEDTLS_PSA_P256M_DRIVER_ENABLED
|
//#define MBEDTLS_PSA_P256M_DRIVER_ENABLED
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_INJECT_ENTROPY
|
|
||||||
*
|
|
||||||
* Enable support for entropy injection at first boot. This feature is
|
|
||||||
* required on systems that do not have a built-in entropy source (TRNG).
|
|
||||||
* This feature is currently not supported on systems that have a built-in
|
|
||||||
* entropy source.
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_INJECT_ENTROPY
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
|
|
||||||
*
|
|
||||||
* Assume all buffers passed to PSA functions are owned exclusively by the
|
|
||||||
* PSA function and are not stored in shared memory.
|
|
||||||
*
|
|
||||||
* This option may be enabled if all buffers passed to any PSA function reside
|
|
||||||
* in memory that is accessible only to the PSA function during its execution.
|
|
||||||
*
|
|
||||||
* This option MUST be disabled whenever buffer arguments are in memory shared
|
|
||||||
* with an untrusted party, for example where arguments to PSA calls are passed
|
|
||||||
* across a trust boundary.
|
|
||||||
*
|
|
||||||
* \note Enabling this option reduces memory usage and code size.
|
|
||||||
*
|
|
||||||
* \note Enabling this option causes overlap of input and output buffers
|
|
||||||
* not to be supported by PSA functions.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_RSA_NO_CRT
|
* \def MBEDTLS_RSA_NO_CRT
|
||||||
*
|
*
|
||||||
@ -2103,20 +1886,6 @@
|
|||||||
*/
|
*/
|
||||||
#define MBEDTLS_ECP_C
|
#define MBEDTLS_ECP_C
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_ENTROPY_C
|
|
||||||
*
|
|
||||||
* Enable the platform-specific entropy code.
|
|
||||||
*
|
|
||||||
* Module: library/entropy.c
|
|
||||||
* Caller:
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
|
|
||||||
*
|
|
||||||
* This module provides a generic entropy pool
|
|
||||||
*/
|
|
||||||
#define MBEDTLS_ENTROPY_C
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_ERROR_C
|
* \def MBEDTLS_ERROR_C
|
||||||
*
|
*
|
||||||
@ -2271,22 +2040,6 @@
|
|||||||
*/
|
*/
|
||||||
#define MBEDTLS_POLY1305_C
|
#define MBEDTLS_POLY1305_C
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_CRYPTO_C
|
|
||||||
*
|
|
||||||
* Enable the Platform Security Architecture cryptography API.
|
|
||||||
*
|
|
||||||
* Module: library/psa_crypto.c
|
|
||||||
*
|
|
||||||
* Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C,
|
|
||||||
* or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C,
|
|
||||||
* or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
|
|
||||||
* Auto-enables: MBEDTLS_CIPHER_C if any unauthenticated (ie, non-AEAD) cipher
|
|
||||||
* is enabled in PSA (unless it's fully accelerated, see
|
|
||||||
* docs/driver-only-builds.md about that).
|
|
||||||
*/
|
|
||||||
#define MBEDTLS_PSA_CRYPTO_C
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_PSA_CRYPTO_SE_C
|
* \def MBEDTLS_PSA_CRYPTO_SE_C
|
||||||
*
|
*
|
||||||
@ -2306,31 +2059,6 @@
|
|||||||
*/
|
*/
|
||||||
//#define MBEDTLS_PSA_CRYPTO_SE_C
|
//#define MBEDTLS_PSA_CRYPTO_SE_C
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_CRYPTO_STORAGE_C
|
|
||||||
*
|
|
||||||
* Enable the Platform Security Architecture persistent key storage.
|
|
||||||
*
|
|
||||||
* Module: library/psa_crypto_storage.c
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_PSA_CRYPTO_C,
|
|
||||||
* either MBEDTLS_PSA_ITS_FILE_C or a native implementation of
|
|
||||||
* the PSA ITS interface
|
|
||||||
*/
|
|
||||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_ITS_FILE_C
|
|
||||||
*
|
|
||||||
* Enable the emulation of the Platform Security Architecture
|
|
||||||
* Internal Trusted Storage (PSA ITS) over files.
|
|
||||||
*
|
|
||||||
* Module: library/psa_its_file.c
|
|
||||||
*
|
|
||||||
* Requires: MBEDTLS_FS_IO
|
|
||||||
*/
|
|
||||||
#define MBEDTLS_PSA_ITS_FILE_C
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_PSA_STATIC_KEY_SLOTS
|
* \def MBEDTLS_PSA_STATIC_KEY_SLOTS
|
||||||
*
|
*
|
||||||
@ -2879,53 +2607,6 @@
|
|||||||
*/
|
*/
|
||||||
//#define MBEDTLS_USER_CONFIG_FILE "/dev/null"
|
//#define MBEDTLS_USER_CONFIG_FILE "/dev/null"
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_CRYPTO_PLATFORM_FILE
|
|
||||||
*
|
|
||||||
* If defined, this is a header which will be included instead of
|
|
||||||
* `"psa/crypto_platform.h"`. This file should declare the same identifiers
|
|
||||||
* as the one in Mbed TLS, but with definitions adapted to the platform on
|
|
||||||
* which the library code will run.
|
|
||||||
*
|
|
||||||
* \note The required content of this header can vary from one version of
|
|
||||||
* Mbed TLS to the next. Integrators who provide an alternative file
|
|
||||||
* should review the changes in the original file whenever they
|
|
||||||
* upgrade Mbed TLS.
|
|
||||||
*
|
|
||||||
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
|
||||||
* non-standard feature of the C language, so this feature is only available
|
|
||||||
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
|
||||||
*
|
|
||||||
* The value of this symbol is typically a path in double quotes, either
|
|
||||||
* absolute or relative to a directory on the include search path.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE "psa/crypto_platform_alt.h"
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \def MBEDTLS_PSA_CRYPTO_STRUCT_FILE
|
|
||||||
*
|
|
||||||
* If defined, this is a header which will be included instead of
|
|
||||||
* `"psa/crypto_struct.h"`. This file should declare the same identifiers
|
|
||||||
* as the one in Mbed TLS, but with definitions adapted to the environment
|
|
||||||
* in which the library code will run. The typical use for this feature
|
|
||||||
* is to provide alternative type definitions on the client side in
|
|
||||||
* client-server integrations of PSA crypto, where operation structures
|
|
||||||
* contain handles instead of cryptographic data.
|
|
||||||
*
|
|
||||||
* \note The required content of this header can vary from one version of
|
|
||||||
* Mbed TLS to the next. Integrators who provide an alternative file
|
|
||||||
* should review the changes in the original file whenever they
|
|
||||||
* upgrade Mbed TLS.
|
|
||||||
*
|
|
||||||
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
|
||||||
* non-standard feature of the C language, so this feature is only available
|
|
||||||
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
|
||||||
*
|
|
||||||
* The value of this symbol is typically a path in double quotes, either
|
|
||||||
* absolute or relative to a directory on the include search path.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_CRYPTO_STRUCT_FILE "psa/crypto_struct_alt.h"
|
|
||||||
|
|
||||||
/** \} name SECTION: General configuration options */
|
/** \} name SECTION: General configuration options */
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -2955,31 +2636,6 @@
|
|||||||
//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */
|
//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */
|
||||||
//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
|
//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
|
||||||
|
|
||||||
/* Entropy options */
|
|
||||||
//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
|
|
||||||
//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
|
|
||||||
//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */
|
|
||||||
|
|
||||||
/** \def MBEDTLS_PSA_KEY_SLOT_COUNT
|
|
||||||
*
|
|
||||||
* When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is disabled,
|
|
||||||
* the maximum amount of PSA keys simultaneously in memory. This counts all
|
|
||||||
* volatile keys, plus loaded persistent keys.
|
|
||||||
*
|
|
||||||
* When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is enabled,
|
|
||||||
* the maximum number of loaded persistent keys.
|
|
||||||
*
|
|
||||||
* Currently, persistent keys do not need to be loaded all the time while
|
|
||||||
* a multipart operation is in progress, only while the operation is being
|
|
||||||
* set up. This may change in future versions of the library.
|
|
||||||
*
|
|
||||||
* Currently, the library traverses of the whole table on each access to a
|
|
||||||
* persistent key. Therefore large values may cause poor performance.
|
|
||||||
*
|
|
||||||
* This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled.
|
|
||||||
*/
|
|
||||||
//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE
|
* \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE
|
||||||
*
|
*
|
||||||
|
|||||||
@ -962,4 +962,357 @@
|
|||||||
|
|
||||||
/** \} name SECTION: Data format support */
|
/** \} name SECTION: Data format support */
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \name SECTION: PSA core
|
||||||
|
*
|
||||||
|
* This section sets PSA specific settings.
|
||||||
|
* \{
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_ENTROPY_C
|
||||||
|
*
|
||||||
|
* Enable the platform-specific entropy code.
|
||||||
|
*
|
||||||
|
* Module: library/entropy.c
|
||||||
|
* Caller:
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
|
||||||
|
*
|
||||||
|
* This module provides a generic entropy pool
|
||||||
|
*/
|
||||||
|
#define MBEDTLS_ENTROPY_C
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_ENTROPY_FORCE_SHA256
|
||||||
|
*
|
||||||
|
* Force the entropy accumulator to use a SHA-256 accumulator instead of the
|
||||||
|
* default SHA-512 based one (if both are available).
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_SHA256_C
|
||||||
|
*
|
||||||
|
* On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
|
||||||
|
* if you have performance concerns.
|
||||||
|
*
|
||||||
|
* This option is only useful if both MBEDTLS_SHA256_C and
|
||||||
|
* MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_ENTROPY_FORCE_SHA256
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_ENTROPY_HARDWARE_ALT
|
||||||
|
*
|
||||||
|
* Uncomment this macro to let Mbed TLS use your own implementation of a
|
||||||
|
* hardware entropy collector.
|
||||||
|
*
|
||||||
|
* Your function must be called \c mbedtls_hardware_poll(), have the same
|
||||||
|
* prototype as declared in library/entropy_poll.h, and accept NULL as first
|
||||||
|
* argument.
|
||||||
|
*
|
||||||
|
* Uncomment to use your own hardware entropy collector.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_ENTROPY_HARDWARE_ALT
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_ENTROPY_NV_SEED
|
||||||
|
*
|
||||||
|
* Enable the non-volatile (NV) seed file-based entropy source.
|
||||||
|
* (Also enables the NV seed read/write functions in the platform layer)
|
||||||
|
*
|
||||||
|
* This is crucial (if not required) on systems that do not have a
|
||||||
|
* cryptographic entropy source (in hardware or kernel) available.
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
|
||||||
|
*
|
||||||
|
* \note The read/write functions that are used by the entropy source are
|
||||||
|
* determined in the platform layer, and can be modified at runtime and/or
|
||||||
|
* compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
|
||||||
|
*
|
||||||
|
* \note If you use the default implementation functions that read a seedfile
|
||||||
|
* with regular fopen(), please make sure you make a seedfile with the
|
||||||
|
* proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
|
||||||
|
* least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
|
||||||
|
* and written to or you will get an entropy source error! The default
|
||||||
|
* implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
|
||||||
|
* bytes from the file.
|
||||||
|
*
|
||||||
|
* \note The entropy collector will write to the seed file before entropy is
|
||||||
|
* given to an external source, to update it.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_ENTROPY_NV_SEED
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
||||||
|
*
|
||||||
|
* Do not add default entropy sources in mbedtls_entropy_init().
|
||||||
|
*
|
||||||
|
* This is useful to have more control over the added entropy sources in an
|
||||||
|
* application.
|
||||||
|
*
|
||||||
|
* Uncomment this macro to prevent loading of default entropy functions.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_NO_PLATFORM_ENTROPY
|
||||||
|
*
|
||||||
|
* Do not use built-in platform entropy functions.
|
||||||
|
* This is useful if your platform does not support
|
||||||
|
* standards like the /dev/urandom or Windows CryptoAPI.
|
||||||
|
*
|
||||||
|
* Uncomment this macro to disable the built-in platform entropy functions.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_NO_PLATFORM_ENTROPY
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_CRYPTO_C
|
||||||
|
*
|
||||||
|
* Enable the Platform Security Architecture cryptography API.
|
||||||
|
*
|
||||||
|
* Module: library/psa_crypto.c
|
||||||
|
*
|
||||||
|
* Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C,
|
||||||
|
* or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C,
|
||||||
|
* or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
|
||||||
|
* Auto-enables: MBEDTLS_CIPHER_C if any unauthenticated (ie, non-AEAD) cipher
|
||||||
|
* is enabled in PSA (unless it's fully accelerated, see
|
||||||
|
* docs/driver-only-builds.md about that).
|
||||||
|
*/
|
||||||
|
#define MBEDTLS_PSA_CRYPTO_C
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
|
||||||
|
*
|
||||||
|
* Assume all buffers passed to PSA functions are owned exclusively by the
|
||||||
|
* PSA function and are not stored in shared memory.
|
||||||
|
*
|
||||||
|
* This option may be enabled if all buffers passed to any PSA function reside
|
||||||
|
* in memory that is accessible only to the PSA function during its execution.
|
||||||
|
*
|
||||||
|
* This option MUST be disabled whenever buffer arguments are in memory shared
|
||||||
|
* with an untrusted party, for example where arguments to PSA calls are passed
|
||||||
|
* across a trust boundary.
|
||||||
|
*
|
||||||
|
* \note Enabling this option reduces memory usage and code size.
|
||||||
|
*
|
||||||
|
* \note Enabling this option causes overlap of input and output buffers
|
||||||
|
* not to be supported by PSA functions.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
|
||||||
|
|
||||||
|
/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
|
||||||
|
*
|
||||||
|
* Enable support for platform built-in keys. If you enable this feature,
|
||||||
|
* you must implement the function mbedtls_psa_platform_get_builtin_key().
|
||||||
|
* See the documentation of that function for more information.
|
||||||
|
*
|
||||||
|
* Built-in keys are typically derived from a hardware unique key or
|
||||||
|
* stored in a secure element.
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_PSA_CRYPTO_C.
|
||||||
|
*
|
||||||
|
* \warning This interface is experimental and may change or be removed
|
||||||
|
* without notice.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
|
||||||
|
|
||||||
|
/** \def MBEDTLS_PSA_CRYPTO_CLIENT
|
||||||
|
*
|
||||||
|
* Enable support for PSA crypto client.
|
||||||
|
*
|
||||||
|
* \note This option allows to include the code necessary for a PSA
|
||||||
|
* crypto client when the PSA crypto implementation is not included in
|
||||||
|
* the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the
|
||||||
|
* code to set and get PSA key attributes.
|
||||||
|
* The development of PSA drivers partially relying on the library to
|
||||||
|
* fulfill the hardware gaps is another possible usage of this option.
|
||||||
|
*
|
||||||
|
* \warning This interface is experimental and may change or be removed
|
||||||
|
* without notice.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_CLIENT
|
||||||
|
|
||||||
|
/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
|
||||||
|
*
|
||||||
|
* Make the PSA Crypto module use an external random generator provided
|
||||||
|
* by a driver, instead of Mbed TLS's entropy and DRBG modules.
|
||||||
|
*
|
||||||
|
* \note This random generator must deliver random numbers with cryptographic
|
||||||
|
* quality and high performance. It must supply unpredictable numbers
|
||||||
|
* with a uniform distribution. The implementation of this function
|
||||||
|
* is responsible for ensuring that the random generator is seeded
|
||||||
|
* with sufficient entropy. If you have a hardware TRNG which is slow
|
||||||
|
* or delivers non-uniform output, declare it as an entropy source
|
||||||
|
* with mbedtls_entropy_add_source() instead of enabling this option.
|
||||||
|
*
|
||||||
|
* If you enable this option, you must configure the type
|
||||||
|
* ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h
|
||||||
|
* and define a function called mbedtls_psa_external_get_random()
|
||||||
|
* with the following prototype:
|
||||||
|
* ```
|
||||||
|
* psa_status_t mbedtls_psa_external_get_random(
|
||||||
|
* mbedtls_psa_external_random_context_t *context,
|
||||||
|
* uint8_t *output, size_t output_size, size_t *output_length);
|
||||||
|
* );
|
||||||
|
* ```
|
||||||
|
* The \c context value is initialized to 0 before the first call.
|
||||||
|
* The function must fill the \c output buffer with \c output_size bytes
|
||||||
|
* of random data and set \c *output_length to \c output_size.
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_PSA_CRYPTO_C
|
||||||
|
*
|
||||||
|
* \warning If you enable this option, code that uses the PSA cryptography
|
||||||
|
* interface will not use any of the entropy sources set up for
|
||||||
|
* the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED
|
||||||
|
* enables.
|
||||||
|
*
|
||||||
|
* \note This option is experimental and may be removed without notice.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
|
||||||
|
|
||||||
|
/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
|
||||||
|
*
|
||||||
|
* Enable key identifiers that encode a key owner identifier.
|
||||||
|
*
|
||||||
|
* The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t
|
||||||
|
* which is currently hard-coded to be int32_t.
|
||||||
|
*
|
||||||
|
* Note that this option is meant for internal use only and may be removed
|
||||||
|
* without notice.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_CRYPTO_SPM
|
||||||
|
*
|
||||||
|
* When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure
|
||||||
|
* Partition Manager) integration which separates the code into two parts: a
|
||||||
|
* NSPE (Non-Secure Process Environment) and an SPE (Secure Process
|
||||||
|
* Environment).
|
||||||
|
*
|
||||||
|
* If you enable this option, your build environment must include a header
|
||||||
|
* file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS
|
||||||
|
* header files, or in another directory on the compiler's include search
|
||||||
|
* path). Alternatively, your platform may customize the header
|
||||||
|
* `psa/crypto_platform.h`, in which case it can skip or replace the
|
||||||
|
* inclusion of `"crypto_spe.h"`.
|
||||||
|
*
|
||||||
|
* Module: library/psa_crypto.c
|
||||||
|
* Requires: MBEDTLS_PSA_CRYPTO_C
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_SPM
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||||
|
*
|
||||||
|
* Enable the Platform Security Architecture persistent key storage.
|
||||||
|
*
|
||||||
|
* Module: library/psa_crypto_storage.c
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_PSA_CRYPTO_C,
|
||||||
|
* either MBEDTLS_PSA_ITS_FILE_C or a native implementation of
|
||||||
|
* the PSA ITS interface
|
||||||
|
*/
|
||||||
|
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_INJECT_ENTROPY
|
||||||
|
*
|
||||||
|
* Enable support for entropy injection at first boot. This feature is
|
||||||
|
* required on systems that do not have a built-in entropy source (TRNG).
|
||||||
|
* This feature is currently not supported on systems that have a built-in
|
||||||
|
* entropy source.
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_INJECT_ENTROPY
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_ITS_FILE_C
|
||||||
|
*
|
||||||
|
* Enable the emulation of the Platform Security Architecture
|
||||||
|
* Internal Trusted Storage (PSA ITS) over files.
|
||||||
|
*
|
||||||
|
* Module: library/psa_its_file.c
|
||||||
|
*
|
||||||
|
* Requires: MBEDTLS_FS_IO
|
||||||
|
*/
|
||||||
|
#define MBEDTLS_PSA_ITS_FILE_C
|
||||||
|
|
||||||
|
/* Entropy options */
|
||||||
|
//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
|
||||||
|
//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
|
||||||
|
//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_CRYPTO_PLATFORM_FILE
|
||||||
|
*
|
||||||
|
* If defined, this is a header which will be included instead of
|
||||||
|
* `"psa/crypto_platform.h"`. This file should declare the same identifiers
|
||||||
|
* as the one in Mbed TLS, but with definitions adapted to the platform on
|
||||||
|
* which the library code will run.
|
||||||
|
*
|
||||||
|
* \note The required content of this header can vary from one version of
|
||||||
|
* Mbed TLS to the next. Integrators who provide an alternative file
|
||||||
|
* should review the changes in the original file whenever they
|
||||||
|
* upgrade Mbed TLS.
|
||||||
|
*
|
||||||
|
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
||||||
|
* non-standard feature of the C language, so this feature is only available
|
||||||
|
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
||||||
|
*
|
||||||
|
* The value of this symbol is typically a path in double quotes, either
|
||||||
|
* absolute or relative to a directory on the include search path.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE "psa/crypto_platform_alt.h"
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \def MBEDTLS_PSA_CRYPTO_STRUCT_FILE
|
||||||
|
*
|
||||||
|
* If defined, this is a header which will be included instead of
|
||||||
|
* `"psa/crypto_struct.h"`. This file should declare the same identifiers
|
||||||
|
* as the one in Mbed TLS, but with definitions adapted to the environment
|
||||||
|
* in which the library code will run. The typical use for this feature
|
||||||
|
* is to provide alternative type definitions on the client side in
|
||||||
|
* client-server integrations of PSA crypto, where operation structures
|
||||||
|
* contain handles instead of cryptographic data.
|
||||||
|
*
|
||||||
|
* \note The required content of this header can vary from one version of
|
||||||
|
* Mbed TLS to the next. Integrators who provide an alternative file
|
||||||
|
* should review the changes in the original file whenever they
|
||||||
|
* upgrade Mbed TLS.
|
||||||
|
*
|
||||||
|
* This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
|
||||||
|
* non-standard feature of the C language, so this feature is only available
|
||||||
|
* with compilers that perform macro expansion on an <tt>\#include</tt> line.
|
||||||
|
*
|
||||||
|
* The value of this symbol is typically a path in double quotes, either
|
||||||
|
* absolute or relative to a directory on the include search path.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_CRYPTO_STRUCT_FILE "psa/crypto_struct_alt.h"
|
||||||
|
|
||||||
|
/** \def MBEDTLS_PSA_KEY_SLOT_COUNT
|
||||||
|
*
|
||||||
|
* When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is disabled,
|
||||||
|
* the maximum amount of PSA keys simultaneously in memory. This counts all
|
||||||
|
* volatile keys, plus loaded persistent keys.
|
||||||
|
*
|
||||||
|
* When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is enabled,
|
||||||
|
* the maximum number of loaded persistent keys.
|
||||||
|
*
|
||||||
|
* Currently, persistent keys do not need to be loaded all the time while
|
||||||
|
* a multipart operation is in progress, only while the operation is being
|
||||||
|
* set up. This may change in future versions of the library.
|
||||||
|
*
|
||||||
|
* Currently, the library traverses of the whole table on each access to a
|
||||||
|
* persistent key. Therefore large values may cause poor performance.
|
||||||
|
*
|
||||||
|
* This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled.
|
||||||
|
*/
|
||||||
|
//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32
|
||||||
|
|
||||||
|
/** \} name SECTION: PSA core */
|
||||||
|
|
||||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user