michaelh/zephyr
1
0
Fork 0
Code Releases Activity
zephyr/modules/mbedtls/Kconfig.tls-generic

501 lines
14 KiB
Plaintext
Raw Permalink Normal View History

kconfig: Clean up header comments and make them consistent Use this short header style in all Kconfig files: # <description> # <copyright> # <license> ... Also change all <description>s from # Kconfig[.extension] - Foo-related options to just # Foo-related options It's clear enough that it's about Kconfig. The <description> cleanup was done with this command, along with some manual cleanup (big letter at the start, etc.) git ls-files '*Kconfig*' | \ xargs sed -i -E '1 s/#\s*Kconfig[\w.-]*\s*-\s*/# /' Signed-off-by: Ulf Magnusson <Ulf.Magnusson@nordicsemi.no>
2019-11-01 13:45:29 +01:00
# TLS/DTLS related options
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
# Copyright (c) 2018 Intel Corporation
# Copyright (c) 2018 Nordic Semiconductor ASA
# SPDX-License-Identifier: Apache-2.0
menu "TLS configuration"
kconfig: Replace non-defconfig single-symbol 'if's with 'depends on' Same deal as in commit eddd98f811 ("kconfig: Replace some single-symbol 'if's with 'depends on'"), for the remaining cases outside defconfig files. See that commit for an explanation. Will do the defconfigs separately in case there are any complaints there. Signed-off-by: Ulf Magnusson <Ulf.Magnusson@nordicsemi.no>
2020-02-09 22:26:07 +01:00
depends on MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
menu "Supported TLS version"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_TLS_VERSION_1_0
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for TLS 1.0"
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
select MBEDTLS_CIPHER
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
select MBEDTLS_MD5
select MBEDTLS_SHA1
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
select MBEDTLS_MD
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_TLS_VERSION_1_1
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for TLS 1.1 (DTLS 1.0)"
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
select MBEDTLS_CIPHER
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
select MBEDTLS_MD5
select MBEDTLS_SHA1
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
select MBEDTLS_MD
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_TLS_VERSION_1_2
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for TLS 1.2 (DTLS 1.2)"
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
default y if !NET_L2_OPENTHREAD
select MBEDTLS_CIPHER
select MBEDTLS_MD
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_DTLS
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for DTLS"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
depends on MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
config MBEDTLS_SSL_EXPORT_KEYS
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for exporting SSL key block and master secret"
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
depends on MBEDTLS_TLS_VERSION_1_0 || MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
net: lib: sockets: added ALPN extension option to TLS Adds the socket option TLS_ALPN_LIST for SOL_TLS sockets Passes the configured alpn list to the mbedtls config on mbedtls init Signed-off-by: Emil Hammarstrom <emil.hammarstrom@assaabloy.com>
2020-10-19 16:53:44 +02:00
config MBEDTLS_SSL_ALPN
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for setting the supported Application Layer Protocols"
net: lib: sockets: added ALPN extension option to TLS Adds the socket option TLS_ALPN_LIST for SOL_TLS sockets Passes the configured alpn list to the mbedtls config on mbedtls init Signed-off-by: Emil Hammarstrom <emil.hammarstrom@assaabloy.com>
2020-10-19 16:53:44 +02:00
depends on MBEDTLS_TLS_VERSION_1_0 || MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
endmenu
menu "Ciphersuite configuration"
comment "Supported key exchange modes"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "All available ciphersuite modes"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
select MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
config MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "PSK based ciphersuite modes"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "DHE-PSK based ciphersuite modes"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ECDHE-PSK based ciphersuite modes"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECDH_C
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "RSA-PSK based ciphersuite modes"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
mbedtls: support configuration of PSK maximum length via Kconfig So far maximum PSK length was configured by mbedTLS as 32 bytes. Introduce Kconfig option that will configure it instead of relying on default value from mbedTLS library, so that user can easily adjust that value to application needs. Signed-off-by: Marcin Niestroj <m.niestroj@emb.dev>
2021-11-08 13:45:28 +01:00
config MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
bool
default y if MBEDTLS_KEY_EXCHANGE_PSK_ENABLED || \
MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || \
MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \
MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
config MBEDTLS_PSK_MAX_LEN
int "Max size of TLS pre-shared keys"
default 32
depends on MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
help
Max size of TLS pre-shared keys, in bytes.
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "RSA-only based ciphersuite modes"
net: openthread: Use Zephyr's mbedTLS instead of compiling own So far OpenThread compiled it's own, internal copy of mbedTLS library. This commit changes this behavior by using Zephyr's mbedTLS instance appropriately configured for OpenThread needs. Generic mbedTLS config file was used in this case, so that application can still configure remaining parts of mbedTLS for it's own needs. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-01-28 14:15:26 +01:00
default y if !NET_L2_OPENTHREAD
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "DHE-RSA based ciphersuite modes"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ECDHE-RSA based ciphersuite modes"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECDH_C
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ECDHE-ECDSA based ciphersuite modes"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ECDH-ECDSA based ciphersuite modes"
bluetooth: mesh: update BT_MESH_USES_MBEDTLS_PSA selected symbols Instead of selecting legacy MBEDTLS symbols, use corresponding PSA_WANT ones when possible (note: some legacy symbols do not have a PSA correspondance). Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-05-15 08:28:24 +02:00
depends on (MBEDTLS_ECDH_C && MBEDTLS_ECDSA_C) || (PSA_WANT_ALG_ECDH && PSA_WANT_ALG_ECDSA)
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: Kconfig.tls-generic: Add CONFIG_MBEDTLS_ECDSA_DETERMINISTIC From mbedTLS's description: Enable deterministic ECDSA (RFC 6979). Standard ECDSA is "fragile" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant. Signed-off-by: Paul Sokolovsky <paul.sokolovsky@linaro.org>
2019-08-28 11:31:55 +02:00
config MBEDTLS_ECDSA_DETERMINISTIC
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Deterministic ECDSA (RFC 6979)"
modules: Kconfig.tls-generic: Add CONFIG_MBEDTLS_ECDSA_DETERMINISTIC From mbedTLS's description: Enable deterministic ECDSA (RFC 6979). Standard ECDSA is "fragile" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant. Signed-off-by: Paul Sokolovsky <paul.sokolovsky@linaro.org>
2019-08-28 11:31:55 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ECDH-RSA based ciphersuite modes"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECDH_C
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ECJPAKE based ciphersuite modes"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECJPAKE_C
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: option for `MBEDTLS_HKDF_C` Add kconfig option to enabled `MBEDTLS_HKDF_C`, HMAC-based Extract-and-Expand Key Derivation Function. Signed-off-by: Jordan Yates <jordan@embeint.com>
2024-04-02 06:20:22 +02:00
config MBEDTLS_HKDF_C
bool "HMAC-based Extract-and-Expand Key Derivation Function"
modules: mbedtls: Add separate configs for EC algorithms Instead of relying on selected ciphesuite to enable mbed TLS EC configs, add separate config entries to enable them. This allows to use EC functionality w/o TLS/DTLS enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 12:07:55 +02:00
comment "Elliptic curve libraries"
config MBEDTLS_ECDH_C
bool "Elliptic curve Diffie-Hellman library"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECP_C
modules: mbedtls: Add separate configs for EC algorithms Instead of relying on selected ciphesuite to enable mbed TLS EC configs, add separate config entries to enable them. This allows to use EC functionality w/o TLS/DTLS enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 12:07:55 +02:00
config MBEDTLS_ECDSA_C
bool "Elliptic curve DSA library"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECP_C
modules: mbedtls: Add separate configs for EC algorithms Instead of relying on selected ciphesuite to enable mbed TLS EC configs, add separate config entries to enable them. This allows to use EC functionality w/o TLS/DTLS enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 12:07:55 +02:00
config MBEDTLS_ECJPAKE_C
bool "Elliptic curve J-PAKE library"
modules: mbedtls: Replace select statement with depends on for EC Instead of using "select" on certain EC configurations, which is considered unsafe for various reasons, use a "depends on" and rely on the user to set a proper configuration in the config file. Update the respective project configurations to comply with the new configuration scheme. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-10-05 15:00:42 +02:00
depends on MBEDTLS_ECP_C
modules: mbedtls: Add separate configs for EC algorithms Instead of relying on selected ciphesuite to enable mbed TLS EC configs, add separate config entries to enable them. This allows to use EC functionality w/o TLS/DTLS enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 12:07:55 +02:00
config MBEDTLS_ECP_C
bool "Elliptic curve over GF(p) library"
modules: mbedtls: Update Kconfig defaults for OSCORE/EDHOC Set proper Kconfig defaults for mbed TLS if OSCORE/EDHOC is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 14:09:21 +02:00
default y if UOSCORE || UEDHOC
modules: mbedtls: Add separate configs for EC algorithms Instead of relying on selected ciphesuite to enable mbed TLS EC configs, add separate config entries to enable them. This allows to use EC functionality w/o TLS/DTLS enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 12:07:55 +02:00
if MBEDTLS_ECP_C
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
comment "Supported elliptic curves"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_ALL_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "All available elliptic curves"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
select MBEDTLS_ECP_DP_SECP192R1_ENABLED
select MBEDTLS_ECP_DP_SECP192R1_ENABLED
select MBEDTLS_ECP_DP_SECP224R1_ENABLED
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
select MBEDTLS_ECP_DP_SECP384R1_ENABLED
select MBEDTLS_ECP_DP_SECP521R1_ENABLED
select MBEDTLS_ECP_DP_SECP192K1_ENABLED
select MBEDTLS_ECP_DP_SECP224K1_ENABLED
select MBEDTLS_ECP_DP_SECP256K1_ENABLED
select MBEDTLS_ECP_DP_BP256R1_ENABLED
select MBEDTLS_ECP_DP_BP384R1_ENABLED
select MBEDTLS_ECP_DP_BP512R1_ENABLED
select MBEDTLS_ECP_DP_CURVE25519_ENABLED
select MBEDTLS_ECP_DP_CURVE448_ENABLED
select MBEDTLS_ECP_NIST_OPTIM
config MBEDTLS_ECP_DP_SECP192R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP192R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP224R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP224R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP256R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP256R1 elliptic curve"
modules: mbedtls: Update Kconfig defaults for OSCORE/EDHOC Set proper Kconfig defaults for mbed TLS if OSCORE/EDHOC is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 14:09:21 +02:00
default y if UOSCORE || UEDHOC
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP384R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP384R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP521R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP521R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP192K1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP192K1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP224K1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP224K1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_SECP256K1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "SECP256K1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_BP256R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "BP256R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_BP384R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "BP384R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_BP512R1_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "BP512R1 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_CURVE25519_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "CURVE25519 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_DP_CURVE448_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "CURVE448 elliptic curve"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_ECP_NIST_OPTIM
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "NSIT curves optimization"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
endif
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
comment "Supported ciphers and cipher modes"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_ALL_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "All available ciphers"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
select MBEDTLS_CIPHER_AES_ENABLED
select MBEDTLS_CIPHER_CAMELLIA_ENABLED
select MBEDTLS_CIPHER_DES_ENABLED
select MBEDTLS_CIPHER_ARC4_ENABLED
select MBEDTLS_CIPHER_CHACHA20_ENABLED
select MBEDTLS_CIPHER_BLOWFISH_ENABLED
select MBEDTLS_CIPHER_CCM_ENABLED
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
select MBEDTLS_CIPHER_GCM_ENABLED
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
select MBEDTLS_CIPHER_MODE_XTS_ENABLED
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
select MBEDTLS_CIPHER_MODE_CBC_ENABLED
select MBEDTLS_CIPHER_MODE_CTR_ENABLED
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
select MBEDTLS_CHACHAPOLY_AEAD_ENABLED
config MBEDTLS_CIPHER_AES_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "AES block cipher"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
default y
ext: lib: crypto: Extend generic mbedTLS config Extend generic mbedTLS configuration file with MBEDTLS_AES_ROM_TABLES option. This allows to save some RAM (~8kB) in favour of ROM and performance. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-01-21 16:11:32 +01:00
config MBEDTLS_AES_ROM_TABLES
depends on MBEDTLS_CIPHER_AES_ENABLED
bool "Use precomputed AES tables stored in ROM."
default y
mbedtls: add `MBEDTLS_AES_FEWER_TABLES` control Add a kconfig symbol to control the mbedtls option `MBEDTLS_AES_FEWER_TABLES`. 6KiB is a not insignificant ROM/RAM savings, and the extra arthmetic is quite reasonable. Signed-off-by: Jordan Yates <jordan.yates@data61.csiro.au>
2023-07-23 10:19:49 +02:00
config MBEDTLS_AES_FEWER_TABLES
depends on MBEDTLS_CIPHER_AES_ENABLED
bool "Reduce the size of precomputed AES tables by ~6kB"
help
Reduce the size of the AES tables at a tradeoff of more
arithmetic operations at runtime. Specifically 4 table
lookups are converted to 1 table lookup, 3 additions
and 6 bit shifts.
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_CAMELLIA_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "Camellia block cipher"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_DES_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "DES block cipher"
net: openthread: Use Zephyr's mbedTLS instead of compiling own So far OpenThread compiled it's own, internal copy of mbedTLS library. This commit changes this behavior by using Zephyr's mbedTLS instance appropriately configured for OpenThread needs. Generic mbedTLS config file was used in this case, so that application can still configure remaining parts of mbedTLS for it's own needs. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-01-28 14:15:26 +01:00
default y if !NET_L2_OPENTHREAD
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_ARC4_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ARC4 stream cipher"
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_CHACHA20_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ChaCha20 stream cipher"
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_BLOWFISH_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "Blowfish block cipher"
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CIPHER_CCM_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "Counter with CBC-MAC (CCM) mode for 128-bit block cipher"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_CAMELLIA_ENABLED
modules: mbedtls: Update Kconfig defaults for OSCORE/EDHOC Set proper Kconfig defaults for mbed TLS if OSCORE/EDHOC is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 14:09:21 +02:00
default y if UOSCORE || UEDHOC
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
config MBEDTLS_CIPHER_GCM_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "Galois/Counter Mode (GCM) for AES"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_CAMELLIA_ENABLED
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
config MBEDTLS_CIPHER_MODE_XTS_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_CAMELLIA_ENABLED
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
config MBEDTLS_CIPHER_MODE_CBC_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Cipher Block Chaining mode (CBC) for symmetric ciphers"
net: openthread: Use Zephyr's mbedTLS instead of compiling own So far OpenThread compiled it's own, internal copy of mbedTLS library. This commit changes this behavior by using Zephyr's mbedTLS instance appropriately configured for OpenThread needs. Generic mbedTLS config file was used in this case, so that application can still configure remaining parts of mbedTLS for it's own needs. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-01-28 14:15:26 +01:00
default y if !NET_L2_OPENTHREAD
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
config MBEDTLS_CIPHER_MODE_CTR_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Counter Block Cipher mode (CTR) for symmetric ciphers."
modules: mbedtls: Update mbedTLS commit and apply fixes Update mbedTLS commit along with the following fixes: * Fix naming inconsistencies in some cipher modes, to match core mbedTLS configs * Add Kconfig to enable CTR cipher mode Fixes #22421 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-02-05 15:42:11 +01:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CHACHAPOLY_AEAD_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "ChaCha20-Poly1305 AEAD algorithm"
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
depends on MBEDTLS_CIPHER_CHACHA20_ENABLED && MBEDTLS_POLY1305
config MBEDTLS_CMAC
bool "CMAC (Cipher-based Message Authentication Code) mode for block ciphers."
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_DES_ENABLED
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
comment "Supported hash algorithms"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_HASH_ALL_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "All available MAC methods"
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
select MBEDTLS_MD4
select MBEDTLS_MD5
select MBEDTLS_SHA1
select MBEDTLS_SHA224
select MBEDTLS_SHA256
select MBEDTLS_SHA384
select MBEDTLS_SHA512
select MBEDTLS_POLY1305
config MBEDTLS_MD4
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "MD4 hash algorithm"
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_MD5
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "MD5 hash algorithm"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_SHA1
bool "SHA-1 hash algorithm"
config MBEDTLS_SHA224
bool "SHA-224 hash algorithm"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_SHA256
bool "SHA-256 hash algorithm"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
default y
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
config MBEDTLS_SHA256_SMALLER
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Smaller SHA-256 implementation"
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
depends on MBEDTLS_SHA256
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
default y
help
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
Enable an implementation of SHA-256 that has a
smaller ROM footprint but also lower performance.
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_SHA384
modules: mbedtls: bring back SHA384 support Before mbedTLS 3.0 there was just SHA512 option, which enabled both SHA384 and SHA512 support. mbedTLS 3.0 introduced SHA384 specific option, which means that SHA384 got unsupported after merging commit 4e6cfb67f91a ("modules: mbedTLS: Bump mbedTLS to 3.0"). Introduce SHA384 Kconfig options, so that support for it can be selected in project configuration if needed. Since SHA384 still depends on SHA512 to be selected, add such dependency in Kconfig. Select SHA384 support in non-generic (not configured by Kconfig) mbedTLS config headers, so that previous (before mbedTLS 3.0 was merged) behavior is regained. Fixes: 4e6cfb67f91a ("modules: mbedTLS: Bump mbedTLS to 3.0") Signed-off-by: Marcin Niestroj <m.niestroj@emb.dev>
2022-06-12 23:49:32 +02:00
bool "SHA-384 hash algorithm"
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_SHA512
modules: mbedtls: bring back SHA384 support Before mbedTLS 3.0 there was just SHA512 option, which enabled both SHA384 and SHA512 support. mbedTLS 3.0 introduced SHA384 specific option, which means that SHA384 got unsupported after merging commit 4e6cfb67f91a ("modules: mbedTLS: Bump mbedTLS to 3.0"). Introduce SHA384 Kconfig options, so that support for it can be selected in project configuration if needed. Since SHA384 still depends on SHA512 to be selected, add such dependency in Kconfig. Select SHA384 support in non-generic (not configured by Kconfig) mbedTLS config headers, so that previous (before mbedTLS 3.0 was merged) behavior is regained. Fixes: 4e6cfb67f91a ("modules: mbedTLS: Bump mbedTLS to 3.0") Signed-off-by: Marcin Niestroj <m.niestroj@emb.dev>
2022-06-12 23:49:32 +02:00
bool "SHA-512 hash algorithm"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
config MBEDTLS_POLY1305
bool "Poly1305 hash family"
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
endmenu
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
comment "Random number generators"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_CTR_DRBG_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "CTR_DRBG AES-256-based random generator"
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
depends on MBEDTLS_CIPHER_AES_ENABLED
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
default y
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_HMAC_DRBG_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "HMAC_DRBG random generator"
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
select MBEDTLS_MD
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
comment "Other configurations"
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
config MBEDTLS_CIPHER
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "generic cipher layer."
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
config MBEDTLS_MD
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "generic message digest layer."
modules: mbedtls: Add Kconfig entry for MBEDTLS_MD and MBEDTLS_CIPHER Due to new checks in mbedTLS config sanitizer, TLS option can no longer be left enabled, when TLS is not used. OpenThread needs MBEDTLS_MD_C and MBEDTLS_CIPHER_C even without TLS being used, so we need an option to enable them manually. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2020-05-28 15:37:00 +02:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_GENPRIME_ENABLED
kconfig: tweak Kconfig prompts Tweak some Kconfig prompts after the removal of "Enable...". Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:31:16 +01:00
bool "prime-number generation code."
ext: mbedtls: Extend generic config file Extend generic mbedTLS config file with additional algorithms. Add separate RNG section. Add switches to enable all algorithms in specific group. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 09:47:27 +01:00
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_PEM_CERTIFICATE_FORMAT
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for PEM certificate format"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
help
By default only DER (binary) format of certificates is supported. Enable
this option to enable support for PEM format.
ext: lib: crypto: Extend generic mbedTLS config with HAVE_ASM Extend generic mbedTLS configuration file with MBEDTLS_HAVE_ASM option, to allow the use of assembly code. This improves the performances of asymetric cryptography, however depending on the architecture and the CPU, this might have an impact on the code size. Set the default value ot the previous non-configurable value, ie enable it by default except on ARM. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2019-01-21 22:21:39 +01:00
config MBEDTLS_HAVE_ASM
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Use of assembly code"
ext: lib: crypto: Extend generic mbedTLS config with HAVE_ASM Extend generic mbedTLS configuration file with MBEDTLS_HAVE_ASM option, to allow the use of assembly code. This improves the performances of asymetric cryptography, however depending on the architecture and the CPU, this might have an impact on the code size. Set the default value ot the previous non-configurable value, ie enable it by default except on ARM. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2019-01-21 22:21:39 +01:00
default y if !ARM
help
Enable use of assembly code in mbedTLS. This improves the performances
doc: fix misspellings in Kconfig files Fix misspellings in Kconfig files missed during regular reviews. Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
2019-10-29 00:17:17 +01:00
of asymmetric cryptography, however this might have an impact on the
ext: lib: crypto: Extend generic mbedTLS config with HAVE_ASM Extend generic mbedTLS configuration file with MBEDTLS_HAVE_ASM option, to allow the use of assembly code. This improves the performances of asymetric cryptography, however depending on the architecture and the CPU, this might have an impact on the code size. Set the default value ot the previous non-configurable value, ie enable it by default except on ARM. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2019-01-21 22:21:39 +01:00
code size.
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
config MBEDTLS_ENTROPY_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "MbedTLS generic entropy pool"
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
depends on MBEDTLS_SHA256 || MBEDTLS_SHA384 || MBEDTLS_SHA512
modules: mbedtls: Update Kconfig defaults for OSCORE/EDHOC Set proper Kconfig defaults for mbed TLS if OSCORE/EDHOC is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 14:09:21 +02:00
default y if MBEDTLS_ZEPHYR_ENTROPY
ext: lib: crypto: Extend mbedTLS generic config Extend generic mbedTLS config with entries needed by OpenThread: * MBEDTLS_CMAC_C * MBEDTLS_ENTROPY_C * MBEDTLS_SSL_EXPORT_KEYS * MBEDTLS_SHA256_SMALLER Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 13:04:22 +01:00
modules: mbedtls: Allow to enable OpenThread optimizations OpenThread tweaks some specific mbedTLS configs for it's own need, that allows to save some RAM/ROM. Allow to set these in generic config file if OpenThread is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 09:39:32 +01:00
config MBEDTLS_OPENTHREAD_OPTIMIZATIONS_ENABLED
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "MbedTLS optimizations for OpenThread"
modules: mbedtls: Allow to enable OpenThread optimizations OpenThread tweaks some specific mbedTLS configs for it's own need, that allows to save some RAM/ROM. Allow to set these in generic config file if OpenThread is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2019-02-14 09:39:32 +01:00
depends on NET_L2_OPENTHREAD
default y if !NET_SOCKETS_SOCKOPT_TLS
help
Enable some OpenThread specific mbedTLS optimizations that allows to
save some RAM/ROM when OpenThread is used. Note, that when application
aims to use other mbedTLS services on top of OpenThread (e.g. secure
sockets), it's advised to disable this option.
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_USER_CONFIG_ENABLE
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "User mbedTLS config file"
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
help
Enable user mbedTLS config file that will be included at the end of
the generic config file.
ext: mbedtls: Unify mbedTLS Kconfig prefixes Currently there is a mixed approach in prefixes from mbedTLS configuration (MBEDTLS_ and TLS_). The latter was used in generic config file and could bring up confusion that it can only be used with TLS subsystem. Hence unify the approach to MBEDTLS_ prefix to avoid such confusion. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-12-14 12:14:04 +01:00
config MBEDTLS_USER_CONFIG_FILE
mbedtls: kconfig: MBEDTLS_USER_CONFIG_FILE default without a prompt This commit removes the prompt from MBEDTLS_USER_CONFIG_FILE unless MBEDTLS_USER_CONFIG_ENABLE is true. This fixes issues where other parts would specify a default value for MBEDTLS_USER_CONFIG_FILE that would become stuck and not updated if user re-configured the system using menuconfig. Disabling the prompt ensures that only when a user specifically enables MBEDTLS_USER_CONFIG_ENABLE and specify a custom user value in MBEDTLS_USER_CONFIG_FILE the setting will be fixed. Also updates the manifest with related change in the mbedtls project. Signed-off-by: Torsten Rasmussen <Torsten.Rasmussen@nordicsemi.no> Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
2021-04-27 10:07:15 +02:00
string "User configuration file for mbed TLS" if MBEDTLS_USER_CONFIG_ENABLE
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
help
User config file that can contain mbedTLS configs that were not
covered by the generic config file.
modules: mbedtls: Allow to enable server name indication option Allow user to enable RFC 6066 server name indication (SNI) in SSL. Fixes #27783 Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
2020-09-01 12:14:17 +02:00
config MBEDTLS_SERVER_NAME_INDICATION
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Support for RFC 6066 server name indication (SNI) in SSL"
modules: mbedtls: Allow to enable server name indication option Allow user to enable RFC 6066 server name indication (SNI) in SSL. Fixes #27783 Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
2020-09-01 12:14:17 +02:00
help
Enable this to support RFC 6066 server name indication (SNI) in SSL.
This requires that MBEDTLS_X509_CRT_PARSE_C is also set.
crypto: mbedtls: add enablers for public key layer Kconfig support for `MBEDTLS_PK_WRITE_C`. Signed-off-by: Eduardo Montoya <eduardo.montoya@nordicsemi.no>
2021-03-11 10:21:43 +01:00
config MBEDTLS_PK_WRITE_C
everywhere: fix typos Fix a lot of typos Signed-off-by: Nazar Kazakov <nazar.kazakov.work@gmail.com>
2022-03-16 22:07:43 +01:00
bool "The generic public (asymmetric) key writer"
modules: mbedtls: Fix dependencies with PSA crypto enabled After an update to mbed TLS 3.3.0, dependencies with CONFIG_MBEDTLS_PSA_CRYPTO_C enabled got affected. mbed TLS in its build_info.h file, enables MBEDTLS_PK_WRITE_C config under the hood. MBEDTLS_PK_WRITE_C has a dependency to MBEDTLS_ASN1_WRITE_C which wasn't reflected anywhere. Therefore, update Kconfig.tls-generic to enable CONFIG_MBEDTLS_PK_WRITE_C automatically, when PSA crypto is enabled, to reflect mbed TLS configuration pattern. Additionally, enable MBEDTLS_ASN1_WRITE_C automatically, when PK write is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2023-07-25 14:48:33 +02:00
default y if MBEDTLS_PSA_CRYPTO_C
crypto: mbedtls: add enablers for public key layer Kconfig support for `MBEDTLS_PK_WRITE_C`. Signed-off-by: Eduardo Montoya <eduardo.montoya@nordicsemi.no>
2021-03-11 10:21:43 +01:00
help
Enable generic public key write functions.
modules: mbedTLS: Add separate Kconfig entry for MBEDTLS_HAVE_TIME_DATE Currently the MBEDTLS_HAVE_TIME_DATE mbedTLS option is enabled based on the CONFIG_POSIX_API option. This doesn't seem right, since the enabling the POSIX API does not guarantee that there is a valid time source in the system. This was the case for the qemu_x86 platform, where enabling POSIX_API caused TLS handshake failures due to certificate validation errors caused by no valid time avaialble in the system. Fix this by adding a specific KConfig entry for date/time configuration in mbedTLS. Applications that need to enforce date verification in mbedTLS should enable it explicitly instead of relying on the non-obvious implicit configuration. Fixes #35401 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2021-05-19 16:35:18 +02:00
config MBEDTLS_HAVE_TIME_DATE
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Date/time validation in mbed TLS"
modules: mbedTLS: Add separate Kconfig entry for MBEDTLS_HAVE_TIME_DATE Currently the MBEDTLS_HAVE_TIME_DATE mbedTLS option is enabled based on the CONFIG_POSIX_API option. This doesn't seem right, since the enabling the POSIX API does not guarantee that there is a valid time source in the system. This was the case for the qemu_x86 platform, where enabling POSIX_API caused TLS handshake failures due to certificate validation errors caused by no valid time avaialble in the system. Fix this by adding a specific KConfig entry for date/time configuration in mbedTLS. Applications that need to enforce date verification in mbedTLS should enable it explicitly instead of relying on the non-obvious implicit configuration. Fixes #35401 Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2021-05-19 16:35:18 +02:00
help
System has time.h, time(), and an implementation for gmtime_r().
There also need to be a valid time source in the system, as mbedTLS
expects a valid date/time for certificate validation."
modules/mbedtls: add the PKCS5 enabler Kconfig support to `MBEDTLS_PKCS5_C` feature Signed-off-by: Sam Chen <sam.chen@iota.org>
2021-11-05 07:24:06 +01:00
config MBEDTLS_PKCS5_C
kconfig: remove Enable from boolean prompts According to Kconfig guidelines, boolean prompts must not start with "Enable...". The following command has been used to automate the changes in this patch: sed -i "s/bool \"[Ee]nables\? \(\w\)/bool \"\U\1/g" **/Kconfig* Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-03-09 12:05:12 +01:00
bool "Password-based encryption functions"
modules/mbedtls: add the PKCS5 enabler Kconfig support to `MBEDTLS_PKCS5_C` feature Signed-off-by: Sam Chen <sam.chen@iota.org>
2021-11-05 07:24:06 +01:00
select MBEDTLS_MD
help
Enable PKCS5 functions
modules: mbedtls: Extend generic config with SSL cache Add Kconfig configuration options which allow to configure session caching in mbed TLS. Note, that mbed TLS only takes care of server-side caching, the application (socket layer) needs to implement a session storage for client. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-03-09 12:43:59 +01:00
config MBEDTLS_SSL_CACHE_C
bool "SSL session cache support"
help
"This option enables simple SSL cache implementation (server side)."
config MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT
int "Default timeout for SSL cache entires"
depends on MBEDTLS_SSL_CACHE_C
default 86400
config MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES
int "Maximum number of SSL cache entires"
depends on MBEDTLS_SSL_CACHE_C
default 5
modules: mbedtls: Add Kconfig option to enable Extended Master Secret Add Kconfig option for `config-tls-generic.h` to enable the Extended Master Secret extension. Signed-off-by: Pete Skeggs <peter.skeggs@nordicsemi.no>
2022-02-07 22:32:46 +01:00
config MBEDTLS_SSL_EXTENDED_MASTER_SECRET
bool "(D)TLS Extended Master Secret extension"
depends on MBEDTLS_TLS_VERSION_1_2
help
Enable support for the (D)TLS Extended Master Secret extension
which ensures that master secrets are different for every
connection and every session.
mbedtls: add option to use CSPRNG as random source for PSA_CRYPTO_C Add a choice to select between legacy modules (i.e. ENTROPY + CTR_DRBG/HMAC_DRBG) and CSPRNG as random generators for PSA_CRYPTO_C. Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-04-24 16:22:31 +02:00
choice MBEDTLS_PSA_CRYPTO_RND_SOURCE
prompt "Select random source for built-in PSA crypto"
mbedtls: fix entropy module enablement - Do not set CONFIG_MBEDTLS_ZEPHYR_ENTROPY in tests/crypto/mbedtls because this can cause test failure on real devices in which test thread do not have access to drivers. - make MBEDTLS_PSA_CRYPTO_RND_SOURCE depending on MBEDTLS_PSA_CRYPTO_C because it only makes sense when the latter is defined Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-05-14 16:15:45 +02:00
depends on MBEDTLS_PSA_CRYPTO_C
mbedtls: add option to use CSPRNG as random source for PSA_CRYPTO_C Add a choice to select between legacy modules (i.e. ENTROPY + CTR_DRBG/HMAC_DRBG) and CSPRNG as random generators for PSA_CRYPTO_C. Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-04-24 16:22:31 +02:00
default MBEDTLS_PSA_CRYPTO_LEGACY_RNG
config MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
bool "Use a cryptographically secure driver as random source"
depends on CSPRNG_ENABLED
help
Use cryptographically secure random generator to provide random data
instead of legacy MbedTLS modules (ENTROPY + CTR_DRBG/HMAC_DRBG).
config MBEDTLS_PSA_CRYPTO_LEGACY_RNG
bool "Use legacy modules to generate random data"
select MBEDTLS_ENTROPY_ENABLED
select MBEDTLS_CTR_DRBG_ENABLED if !MBEDTLS_HMAC_DRBG_ENABLED
help
Use legacy MbedTLS modules (ENTROPY + CTR_DRBG/HMAC_DRBG) as random
source generators.
endchoice
modules: mbedtls: Add Kconfig entry for PSA API Add Kconfig option to enable PSA API in mbed TLS. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-27 15:24:00 +02:00
config MBEDTLS_PSA_CRYPTO_C
bool "Platform Security Architecture cryptography API"
modules: mbedtls: Update Kconfig defaults for OSCORE/EDHOC Set proper Kconfig defaults for mbed TLS if OSCORE/EDHOC is enabled. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-29 14:09:21 +02:00
default y if UOSCORE || UEDHOC
modules: mbedtls: Add Kconfig entry for PSA API Add Kconfig option to enable PSA API in mbed TLS. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2022-04-27 15:24:00 +02:00
mbedtls: add specific Kconfig option for MBEDTLS_USE_PSA_CRYPTO MBEDTLS_PSA_CRYPTO_C and MBEDTLS_USE_PSA_CRYPTO are 2 different things and the former should not automatically enable the latter. The reson is that the user might want the MbedTLS PSA crypto toolbox to be built, but at the same time he/she does not want TLS/DTLS (and other intermediate modules such as PK, MD and Cipher) to use PSA APIs. For this reason this commit introduces a new Kconfig option named CONFIG_MBEDTLS_USE_PSA_CRYPTO to enable the corresponding build symbol. By default USE_PSA_CRYPTO is disabled. It is only explicilty enabled in tests/samples that were previously setting CRYPTO_C (since in those cases USE_PSA was set). Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-05-02 15:54:56 +02:00
config MBEDTLS_USE_PSA_CRYPTO
bool "Use PSA APIs instead of legacy MbedTLS when possible"
mbedtls: default enable USE_PSA_CRYPTO when CRYPTO_C Now that support for all PSA_WANT symbols is in place, we can enable MBEDTLS_USE_PSA_CRYPTO when MBEDTLS_PSA_CRYPTO_C is enabled as well. Note: this commit also moves USE_PSA_CRYPTO out of CRYPTO_C dependency in config-tls-generic.h because TLS/DTLS/X509 modules of MbedTLS can rely on *any* implementation of PSA crypto APIs not only the MbedTLS one. TFM is for example an alternative to this. Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-05-13 10:16:42 +02:00
default y if MBEDTLS_PSA_CRYPTO_CLIENT
mbedtls: add specific Kconfig option for MBEDTLS_USE_PSA_CRYPTO MBEDTLS_PSA_CRYPTO_C and MBEDTLS_USE_PSA_CRYPTO are 2 different things and the former should not automatically enable the latter. The reson is that the user might want the MbedTLS PSA crypto toolbox to be built, but at the same time he/she does not want TLS/DTLS (and other intermediate modules such as PK, MD and Cipher) to use PSA APIs. For this reason this commit introduces a new Kconfig option named CONFIG_MBEDTLS_USE_PSA_CRYPTO to enable the corresponding build symbol. By default USE_PSA_CRYPTO is disabled. It is only explicilty enabled in tests/samples that were previously setting CRYPTO_C (since in those cases USE_PSA was set). Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-05-02 15:54:56 +02:00
help
Use PSA APIs instead of legacy MbedTLS functions in TLS/DTLS and other
"intermediate" modules such as PK, MD and Cipher.
mbedtls: add new PSA_CRYPTO_CLIENT config Using MBEDTLS_PSA_CRYPTO_CLIENT to guard all PSA_WANT symbols is not completely correct because: 1. the prefix MBEDTLS suggests that it's something related to MbedTLS, while actually PSA APIs can be provided also by other implementations (ex: TFM) 2. there might applications which are willing to use PSA APIs without using MbedTLS at all. For example computing an hash can be as simple as writing psa_hash_compute() and, if the PSA function is provided thorugh TFM, then MbedTLS is not required at all Therefore this commit: - moves MBEDTLS_PSA_CRYPTO_CLIENT to Kconfig.tls-generic since that symbol belongs to MbedTLS - adds a new symbol named PSA_CRYPTO_CLIENT as a generic way to state that there is "some" PSA crypto API provider - let MBEDTLS_PSA_CRYPTO_CLIENT automatically select PSA_CRYPTO_CLIENT, since the former is an implementation of the latter. Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2024-05-13 14:35:37 +02:00
config MBEDTLS_PSA_CRYPTO_CLIENT
bool
default y
depends on BUILD_WITH_TFM || MBEDTLS_PSA_CRYPTO_C
select PSA_CRYPTO_CLIENT
modules: mbedtls: Allow for enabling LMS algorithms Allow for enabling LMS algorithm support via KConfig Signed-off-by: Moritz Fischer <moritzf@google.com>
2022-11-10 22:43:58 +01:00
config MBEDTLS_LMS
bool "Support LMS signature schemes"
mbedtls: introduce PSA-specific Kconfig file It is meant specifically for configuration of the PSA crypto library. The underlying PSA configuration items are guarded by the condition that a PSA crypto provider must be present, which is the case when either TF-M is in use or MbedTLS's PSA core is built as part of the application image. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-03 10:40:01 +02:00
depends on MBEDTLS_PSA_CRYPTO_CLIENT
modules: mbedtls: rename CONFIG_MBEDTLS_MAC_*_ENABLED and rm duplicates Remove the `_MAC` part because those Kconfig options enable only hash algorithms, nothing MAC-related, and the `_ENABLED` part to align the naming to the Mbed TLS defines (plus we don't need such a part). As a bonus, enabling SHA-256 does not automatically enable SHA-224 anymore. See the migration guide entries for more details on the practical changes. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-24 14:09:02 +02:00
depends on MBEDTLS_SHA256
mbedtls: introduce PSA-specific Kconfig file It is meant specifically for configuration of the PSA crypto library. The underlying PSA configuration items are guarded by the condition that a PSA crypto provider must be present, which is the case when either TF-M is in use or MbedTLS's PSA core is built as part of the application image. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
2024-05-03 10:40:01 +02:00
select PSA_WANT_ALG_SHA_256
modules: mbedtls: Allow for enabling LMS algorithms Allow for enabling LMS algorithm support via KConfig Signed-off-by: Moritz Fischer <moritzf@google.com>
2022-11-10 22:43:58 +01:00
modules: mbedtls: Add Kconfig option to enable DTLS Connection ID Add Kconfig option for `config-tls-generic.h` to enable DTLS Connection ID extension. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2021-07-01 16:42:35 +02:00
config MBEDTLS_SSL_DTLS_CONNECTION_ID
bool "DTLS Connection ID extension"
depends on MBEDTLS_DTLS
help
Enable support for the DTLS Connection ID extension
which allows to identify DTLS connections across changes
in the underlying transport.
ext: lib: crypto: Add generic mbedTLS config file This commits provides a config file for mbedtls that can be modifed by Kconfig. In result features like supported ciphersuites can be easily adjusted from Kconfig. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
2018-07-10 10:13:08 +02:00
endmenu
Copy permalink