MBEDTLS: a light-weight open source cryptographic and SSL/TLS library written in C. Using available RNG SW or your own implementation will impact perfomances Default value: HW RNG when RNG IP is available activated You can choose between available SW RNG or your own implementation. If available RNG IP should be activated to improve performances Default value: SW RNG You can choose between available SW RNG or your own implementation TCP/IP stack activation Default value: LWIP stack when LWIP and FreeRTOS activated When set to “LWIP”, the LwIP init function is generated in net_socket.c within mbedtls_net_init() function. Up to user to call it. TCP/IP stack activation Default value: None The platform lacks support for double-width integer division (64-bit division on a 32-bit platform, 128-bit division on a 64-bit platform). Used in: - include/mbedtls/bignum.h - library/bignum.c The bignum code uses double-width division to speed up some operations. Double-width division is often implemented in software that needs to be linked with the program. The presence of a double-width integer type is usually detected automatically through preprocessor macros, but the automatic detection cannot know whether the code needs to and can be linked with an implementation of division for that type. By default division is assumed to be usable if the type is present. Uncomment this option to prevent the use of double-width division. Note that division for the native integer type is always required. Furthermore, a 64-bit type is always required even on a 32-bit platform, but it need not support multiplication or division. In some cases it is also desirable to disable some double-width operations. For example, if double-width division is implemented in software, disabling it can reduce code size in some embedded targets. Default value: Not Defined(//#define) The platform lacks support for 32x32 -> 64-bit multiplication. Used in: library/poly1305.c Some parts of the library may use multiplication of two unsigned 32-bit operands with a 64-bit result in order to speed up computations. On some platforms, this is not available in hardware and has to be implemented in software, usually in a library provided by the toolchain. Sometimes it is not desirable to have to link to that library. This option removes the dependency of that library on platforms that lack a hardware 64-bit multiplier by embedding a software implementation in Mbed TLS. Note that depending on the compiler, this may decrease performance compared to using the library function provided by the toolchain. Default value: Not Defined(//#define) The platform lacks support for double-width integer division (64-bit division on a 32-bit platform, 128-bit division on a 64-bit platform). Used in: - include/mbedtls/bignum.h - library/bignum.c The bignum code uses double-width division to speed up some operations. Double-width division is often implemented in software that needs to be linked with the program. The presence of a double-width integer type is usually detected automatically through preprocessor macros, but the automatic detection cannot know whether the code needs to and can be linked with an implementation of division for that type. By default division is assumed to be usable if the type is present. Uncomment this option to prevent the use of double-width division. Note that division for the native integer type is always required. Furthermore, a 64-bit type is always required even on a 32-bit platform, but it need not support multiplication or division. In some cases it is also desirable to disable some double-width operations. For example, if double-width division is implemented in software, disabling it can reduce code size in some embedded targets. Default value: Not Defined(//#define) CPU supports SSE2 instruction set Default value: Not defined(//#define) System has time.h and time(). The time does not need to be correct, only time differences are used, by contrast with MBEDTLS_HAVE_TIME_DATE Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME. Default value: Defined(#define) System has time.h and time(), gmtime() and the clock is correct. The time needs to be correct (not necesarily very accurate, but at least the date should be correct). This is used to verify the validity period of X.509 certificates. Default value: Defined(#define) System has time.h and time(), gmtime() and the clock is correct. The time needs to be correct (not necesarily very accurate, but at least the date should be correct). This is used to verify the validity period of X.509 certificates. Default value: Not Defined(//#define) Enable the memory allocation layer. By default mbed TLS uses the system-provided calloc() and free(). This allows different allocators (self-implemented or provided) to be provided to the platform abstraction layer. Enabling MBEDTLS_PLATFORM_MEMORY without the MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide ""mbedtls_platform_set_calloc_free()"" allowing you to set an alternative calloc() and free() function pointer at runtime. Enabling MBEDTLS_PLATFORM_MEMORY and specifying MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the alternate function at compile time. Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C Enable the memory allocation layer. By default mbed TLS uses the system-provided calloc() and free(). This allows different allocators (self-implemented or provided) to be provided to the platform abstraction layer. Enabling MBEDTLS_PLATFORM_MEMORY without the MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide ""mbedtls_platform_set_calloc_free()"" allowing you to set an alternative calloc() and free() function pointer at runtime. Enabling MBEDTLS_PLATFORM_MEMORY and specifying MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the alternate function at compile time. Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C Do not assign standard functions in the platform layer (e.g. calloc() to MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) This makes sure there are no linking errors on platforms that do not support these functions. You will HAVE to provide alternatives, either at runtime via the platform_set_xxx() functions or at compile time by setting the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a MBEDTLS_PLATFORM_XXX_MACRO. Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C Do not assign standard functions in the platform layer (e.g. calloc() to MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) This makes sure there are no linking errors on platforms that do not support these functions. You will HAVE to provide alternatives, either at runtime via the platform_set_xxx() functions or at compile time by setting the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a MBEDTLS_PLATFORM_XXX_MACRO. Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C Default value: Not Defined(//#define) mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C mbed TLS supports the function in the platform abstraction layer. WARNING! MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as MBEDTLS_PLATFORM_XXX_MACRO! Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C Mark deprecated functions so that they generate a warning if used. Functions deprecated in one version will usually be removed in the next version. You can enable this to help you prepare the transition to a new major version by making sure your code is not using these functions. This only works with GCC and Clang. With other compilers, you may want to use MBEDTLS_DEPRECATED_REMOVED Default value: Not Defined(//#define) Remove deprecated functions so that they generate an error if used. Functions deprecated in one version will usually be removed in the next version. You can enable this to help you prepare the transition to a new major version by making sure your code is not using these functions. Default value: Not Defined(//#define) This configuration option controls whether the library validates more of the parameters passed to it When this flag is not defined, the library only attempts to validate an input parameter if: (1) they may come from the outside world (such as the network, the filesystem, etc.) or (2) not validating them could result in internal memory errors such as overflowing a buffer controlled by the library. On the other hand, it doesn't attempt to validate parameters whose values are fully controlled by the application (such as pointers). When this flag is defined, the library additionally attempts to validate parameters that are fully controlled by the application, and should always be valid if the application code is fully correct and trusted. For example, when a function accepts as input a pointer to a buffer that may contain untrusted data, and its documentation mentions that this pointer must not be NULL: - the pointer is checked to be non-NULL only if this option is enabled - the content of the buffer is always validated When this flag is defined, if a library function receives a parameter that is invalid, it will: - invoke the macro MBEDTLS_PARAM_FAILED() which by default expands to a call to the function mbedtls_param_failed() - immediately return (with a specific error code unless the function returns void and can't communicate an error). When defining this flag, you also need to: - either provide a definition of the function mbedtls_param_failed() in your application (see platform_util.h for its prototype) as the library calls that function, but does not provide a default definition for it, - or provide a different definition of the macro MBEDTLS_PARAM_FAILED() below if the above mechanism is not flexible enough to suit your needs. See the documentation of this macro later in this file. Uncomment to enable validation of application-controlled parameters. Default value: Not Defined(//#define) Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() Only works if you have MBEDTLS_TIMING_C enabled. You will need to provide a header ""timing_alt.h"" and an implementation at compile time. Default value: Not Defined(//#define) Require: MBEDTLS_TIMING_C Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() Only works if you have MBEDTLS_TIMING_C enabled. You will need to provide a header ""timing_alt.h"" and an implementation at compile time. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their use constitutes a security risk. If possible, we recommend avoiding dependencies on them, and considering stronger message digests and ciphers instead. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of this module (e.g. platform specific assembly optimized implementations). Keep in mind that the function prototypes should remain the same. This replaces the whole module. If you only want to replace one of the functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. When replacing the elliptic curve module, pleace consider, that it is implemented with two .c files: -ecp.c - ecp_curves.c You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT macros as described above. The only difference is that you have to make sure that you provide functionality for both .c files. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use constitutes a security risk. If possible, we recommend avoiding dependencies on them, and considering stronger message digests and ciphers instead. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Use your alternate core implementation of symmetric crypto or hash function. Keep in mind that function prototypes should remain the same. This replaces only one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. Note: if you use the AES_xxx_ALT macros, then is is recommended to also set MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES tables. Default value: Not Defined(//#define) Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Expose a part of the internal interface of the Elliptic Curve Point module. Support for Weierstrass curves with Jacobi representation MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind that function prototypes should remain the same. This partially replaces one function. The header file from mbed TLS is still used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation is still present and it is used for group structures not supported by the alternative. Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT and implementing the following functions: unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ) int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) void mbedtls_internal_ecp_deinit( const mbedtls_ecp_group *grp ) The mbedtls_internal_ecp_grp_capable function should return 1 if the replacement functions implement arithmetic for the given group and 0 otherwise. The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_deinit are called before and after each point operation and provide an opportunity to implement optimized set up and tear down instructions. Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac function, but will use your mbedtls_internal_ecp_double_jac if the group is supported (your mbedtls_internal_ecp_grp_capable function returns 1 when receives it as an argument). If the group is not supported then the original implementation is used. The other functions and the definition of mbedtls_ecp_group and mbedtls_ecp_point will not change, so your implementation of mbedtls_internal_ecp_double_jac and mbedtls_internal_ecp_grp_capable must be compatible with this definition. Default value: Not Defined(//#define) Require: MBEDTLS_ECP_INTERNAL_ALT Enables testing and use of mbed TLS without any configured entropy sources. This permits use of the library on platforms before an entropy source has been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the MBEDTLS_ENTROPY_NV_SEED switches). WARNING! This switch MUST be disabled in production builds, and is suitable only for development. Enabling the switch negates any security provided by the library. Default value: Not Defined(//#define) Require: MBEDTLS_ENTROPY_C & MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES Enables testing and use of mbed TLS without any configured entropy sources. This permits use of the library on platforms before an entropy source has been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the MBEDTLS_ENTROPY_NV_SEED switches). WARNING! This switch MUST be disabled in production builds, and is suitable only for development. Enabling the switch negates any security provided by the library. Default value: Not Defined(//#define) Require: MBEDTLS_ENTROPY_C & MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES Your own implementation of a hardware entropy collector. Your function must be called \c mbedtls_hardware_poll(), have the same prototype as declared in entropy_poll.h, and accept NULL as first argument. Default value: Not Defined(//#define) Your own implementation of a hardware entropy collector. Your function must be called \c mbedtls_hardware_poll(), have the same prototype as declared in entropy_poll.h, and accept NULL as first argument. Default value: Not Defined(//#define) Use less ROM/RAM for AES tables. Uncommenting this macro omits 75% of the AES tables from ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) by computing their values on the fly during operations (the tables are entry-wise rotations of one another). Tradeoff: Uncommenting this reduces the RAM / ROM footprint by ~6kb but at the cost of more arithmetic operations during runtime. Specifically, one has to compare 4 accesses within different tables to 4 accesses with additional arithmetic operations within the same table. The performance gain/loss depends on the system and memory details. This option is independent of \c MBEDTLS_AES_ROM_TABLES. Default value: Not Defined(//#define) Store the AES tables in ROM Default value: Not Defined(//#define) Store the AES tables in ROM Default value: Defined(#define) Use less ROM for the Camellia implementation (saves about 768 bytes). Default value: Not Defined(//#define) Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. Default value: Defined(#define) Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. Default value: Not Defined(//#define) Enable Cipher Feedback mode (CFB) for symmetric ciphers Default value: Defined(#define) Enable Cipher Feedback mode (CFB) for symmetric ciphers Default value: Not Defined(//#define) Enable Counter Block Cipher mode (CTR) for symmetric ciphers Default value: Defined(#define) Enable Counter Block Cipher mode (CTR) for symmetric ciphers Default value: Not Defined(//#define) Enable Output Feedback mode (OFB) for symmetric ciphers. Default value: Defined(#define) Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. Default value: Defined(#define) Enable NULL cipher. WARNING!: Only do so when you know what you are doing. This allows for encryption or channels without any security! Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable the following ciphersuites: MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA MBEDTLS_TLS_RSA_WITH_NULL_SHA256 MBEDTLS_TLS_RSA_WITH_NULL_SHA MBEDTLS_TLS_RSA_WITH_NULL_MD5 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA MBEDTLS_TLS_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_PSK_WITH_NULL_SHA Default value: Not Defined(//#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Enable padding modes in the cipher layer. Default value: Defined(#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Enable padding modes in the cipher layer. Default value: Not Defined(//#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Default value: Defined(#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Default value: Not Defined(//#define) Uncomment or comment macros to add support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Enable padding modes in the cipher layer. Default value: Defined(#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Default value: Not Defined(//#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Default value: Defined(#define) MBEDTLS_CIPHER_PADDING_XXX: support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC) If you disable all padding modes, only full blocks can be used with CBC. Default value: Not Defined(//#define) Enable weak ciphersuites in SSL / TLS WARNING!: Only do so when you know what you are doing. This allows for channels with virtually no security at all! This enables the following ciphersuites: MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA \warning DES is considered a weak cipher and its use constitutes a security risk. We recommend considering stronger ciphers instead. Default value: Not Defined(//#define) Remove RC4 ciphersuites by default in SSL / TLS. This flag removes the ciphersuites based on RC4 from the default list as returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them explicitly. Default value: Defined(#define) Remove RC4 ciphersuites by default in SSL / TLS. This flag removes the ciphersuites based on RC4 from the default list as returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them explicitly. Default value: Not Defined(//#define) Remove 3DES ciphersuites by default in SSL / TLS. This flag removes the ciphersuites based on 3DES from the default list as returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them explicitly. A man-in-the-browser attacker can recover authentication tokens sent through a TLS connection using a 3DES based cipher suite (see "On the Practical(In-)Security of 64-bit Block Ciphers" by Karthikeyan Bhargavan and Gaëtan Leurent, see https://sweet32.info/SWEET32_CCS16.pdf). If this attack falls in your threat model or you are unsure, then you should keep this option enabled to remove 3DES based cipher suites. Comment this macro to keep 3DES in the default ciphersuite list. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enables this specific curve within the Elliptic Curve module. Default value: Not Defined(//#define) Enables this specific curve within the Elliptic Curve module. Default value: Defined(#define) Enable specific 'modulo p' routines for each NIST prime. Depending on the prime and architecture, makes operations 4 to 8 times faster on the corresponding curve. Default value: Defined(#define) Enable "non-blocking" ECC operations that can return early and be resumed. This allows various functions to pause by returning #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module, #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in order to further progress and eventually complete their operation. This is controlled through mbedtls_ecp_set_max_ops() which limits the maximum number of ECC operations a function may perform before pausing; see mbedtls_ecp_set_max_ops() for more information. This is useful in non-threaded environments if you want to avoid blocking for too long on ECC (and, hence, X.509 or SSL/TLS) operations. Uncomment this macro to enable restartable ECC computations. note: This option only works with the default software implementation of elliptic curve functionality. It is incompatible with MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT and MBEDTLS_ECDSA_XXX_ALT. Default value: Not Defined(//#define) Enable deterministic ECDSA (RFC 6979). Standard ECDSA is ""fragile"" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant. Default value: Defined(#define) Require: MBEDTLS_HMAC_DRBG_C Enable deterministic ECDSA (RFC 6979). Standard ECDSA is ""fragile"" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant. Default value: Not Defined(//#define) Require: MBEDTLS_HMAC_DRBG_C Enable deterministic ECDSA (RFC 6979). Standard ECDSA is ""fragile"" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant. Default value: Defined(#define) Require: MBEDTLS_HMAC_DRBG_C Enable deterministic ECDSA (RFC 6979). Standard ECDSA is ""fragile"" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant. Default value: Not Defined(//#define) Require: MBEDTLS_HMAC_DRBG_C Enable the PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA Default value: Defined(#define) Enable the PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA Default value: Not Defined(//#define) Enable the DHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details. Default value: Defined(#define) Require: MBEDTLS_DHM_C Enable the DHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details. Default value: Defined(#define) Require: MBEDTLS_DHM_C Enable the DHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details. Default value: Defined(#define) Require: MBEDTLS_DHM_C Enable the DHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details. Default value: Defined(#define) Require: MBEDTLS_DHM_C Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256vMBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA Default value: Defined(#define) Require: MBEDTLS_ECDH_C Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256vMBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256vMBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA Default value: Defined(#define) Require: MBEDTLS_ECDH_C Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256vMBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C Enable the RSA-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA Default value: Defined(#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-PSK based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-PSK based ciphersuite modes in SSL / TLS. Default value: Defined(#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-PSK based ciphersuite modes in SSL / TLS. Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-only based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 Default value: Defined(#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-only based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-only based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 Default value: Enabled(#define Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the RSA-only based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the DHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.Default value: Defined(#define) Require: MBEDTLS_DHM_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the DHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.Default value: Defined(#define) Require: MBEDTLS_DHM_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the DHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.Default value: Defined(#define) Require: MBEDTLS_DHM_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the DHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.Default value: Defined(#define) Require: MBEDTLS_DHM_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_RSA_C & MBEDTLS_PKCS1_V15 & MBEDTLS_X509_CRT_PARSE_C Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_ECDSA_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_ECDSA_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Defined(#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 Default value: Not Defined(//#define) Require: MBEDTLS_ECDH_C & MBEDTLS_X509_CRT_PARSE_C Enable the ECJPAKE based ciphersuite modes in SSL / TLS. WARNING! This is currently experimental. EC J-PAKE support is based on the Thread v1.0.0 specification; incompatible changes to the specification might still happen. For this reason, this is disabled by default. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 Default value: Not Defined(//#define) Require: MBEDTLS_ECJPAKE_C & MBEDTLS_SHA256_C & MBEDTLS_ECP_DP_SECP256R1_ENABLED Enable the ECJPAKE based ciphersuite modes in SSL / TLS. WARNING! This is currently experimental. EC J-PAKE support is based on the Thread v1.0.0 specification; incompatible changes to the specification might still happen. For this reason, this is disabled by default. This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 Default value: Not Defined(//#define) Require: MBEDTLS_ECJPAKE_C & MBEDTLS_SHA256_C & MBEDTLS_ECP_DP_SECP256R1_ENABLED Enhance support for reading EC keys using variants of SEC1 not allowed by RFC 5915 and RFC 5480. Currently this means parsing the SpecifiedECDomain choice of EC parameters (only known groups are supported, not arbitrary domains, to avoid validation issues). Disable if you only need to support RFC 5915 + 5480 key formats. Default value: Defined(#define) Enhance support for reading EC keys using variants of SEC1 not allowed by RFC 5915 and RFC 5480. Currently this means parsing the SpecifiedECDomain choice of EC parameters (only known groups are supported, not arbitrary domains, to avoid validation issues). Disable if you only need to support RFC 5915 + 5480 key formats. Default value: Not Defined(//#define) Enable a dummy error function to make use of mbedtls_strerror() in third party libraries easier when MBEDTLS_ERROR_C is disabled (no effect when MBEDTLS_ERROR_C is enabled). You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're not using mbedtls_strerror() or error_strerror() in your application. Disable if you run into name conflicts and want to really remove the mbedtls_strerror() Default value: Defined(#define) Enable a dummy error function to make use of mbedtls_strerror() in third party libraries easier when MBEDTLS_ERROR_C is disabled (no effect when MBEDTLS_ERROR_C is enabled). You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're not using mbedtls_strerror() or error_strerror() in your application. Disable if you run into name conflicts and want to really remove the mbedtls_strerror() Default value: Not Defined(//#define) Enable the prime-number generation code. Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C Enable the prime-number generation code. Default value: Not Defined(//#define) Require: MBEDTLS_BIGNUM_C Enable the prime-number generation code. Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C Enable the prime-number generation code. Default value: Not Defined(//#define) Require: MBEDTLS_BIGNUM_C Enable functions that use the filesystem. Default value: Not Defined(//#define) Do not add default entropy sources. These are the platform specific, mbedtls_timing_hardclock and HAVEGE based poll functions. This is useful to have more control over the added entropy sources in an application. Default value: Defined(#define) when RNG is not activated It can be set to disabled, but this means that the mbedtls library will be built either: - without any random number generator, which will make the application vulnerable - with a pure SW random number generator, if the flag “MBEDTLS_HAVEGE_C” is set, but this will be costly in term of CPU and SIZE. Do not add default entropy sources. These are the platform specific, mbedtls_timing_hardclock and HAVEGE based poll functions. This is useful to have more control over the added entropy sources in an application. Default value: Not Defined(//#define) Do not use built-in platform entropy functions. This is useful if your platform does not support standards like the /dev/urandom or Windows CryptoAPI. Default value: Defined(#define) Force the entropy accumulator to use a SHA-256 accumulator instead of the default SHA-512 based one (if both are available). On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option if you have performance concerns. This option is only useful if both MBEDTLS_SHA256_C and MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. Default value: Not Defined(//#define) Require: MBEDTLS_SHA256_C Force the entropy accumulator to use a SHA-256 accumulator instead of the default SHA-512 based one (if both are available). On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option if you have performance concerns. This option is only useful if both MBEDTLS_SHA256_C and MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. Default value: Not Defined(//#define) Require: MBEDTLS_SHA256_C Enable the non-volatile (NV) seed file-based entropy source. (Also enables the NV seed read/write functions in the platform layer). This is crucial (if not required) on systems that do not have a cryptographic entropy source (in hardware or kernel) available. Note: The read/write functions that are used by the entropy source are determined in the platform layer, and can be modified at runtime and/or compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. Note: If you use the default implementation functions that read a seedfile with regular fopen(), please make sure you make a seedfile with the proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from and written to or you will get an entropy source error! The default implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE bytes from the file. Note: The entropy collector will write to the seed file before entropy is given to an external source, to update it. Default value: Not Defined(//#define) Require: MBEDTLS_ENTROPY_C & MBEDTLS_PLATFORM_C Enable the non-volatile (NV) seed file-based entropy source. (Also enables the NV seed read/write functions in the platform layer). This is crucial (if not required) on systems that do not have a cryptographic entropy source (in hardware or kernel) available. Note: The read/write functions that are used by the entropy source are determined in the platform layer, and can be modified at runtime and/or compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. Note: If you use the default implementation functions that read a seedfile with regular fopen(), please make sure you make a seedfile with the proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from and written to or you will get an entropy source error! The default implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE bytes from the file. Note: The entropy collector will write to the seed file before entropy is given to an external source, to update it. Default value: Not Defined(//#define) Require: MBEDTLS_ENTROPY_C & MBEDTLS_PLATFORM_C Enable debugging of buffer allocator memory issues. Automatically prints (to stderr) all (fatal) messages on memory allocation issues. Enables function for 'debug output' of allocated memory. Default value: Not Defined(//#define) Require: MBEDTLS_MEMORY_BUFFER_ALLOC_C Enable debugging of buffer allocator memory issues. Automatically prints (to stderr) all (fatal) messages on memory allocation issues. Enables function for 'debug output' of allocated memory. Default value: Not Defined(//#define) Require: MBEDTLS_MEMORY_BUFFER_ALLOC_C Include backtrace information with each allocated block. Require GLIBC-compatible backtrace and backtrace_symbols() support Default value: Not Defined(//#define) Require: MBEDTLS_MEMORY_BUFFER_ALLOC_C Include backtrace information with each allocated block. Require GLIBC-compatible backtrace and backtrace_symbols() support Default value: Not Defined(//#define) Require: MBEDTLS_MEMORY_BUFFER_ALLOC_C Support external private RSA keys (eg from a HSM) in the PK layer. Default value: Defined(#define) Support external private RSA keys (eg from a HSM) in the PK layer. Default value: Not Defined(//#define) Enable support for PKCS#1 v1.5 encoding. Default value: Defined(#define) Require: MBEDTLS_RSA_C (This enables support for PKCS#1 v1.5 operations.) Enable support for PKCS#1 v1.5 encoding. Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C (This enables support for PKCS#1 v1.5 operations. Enable support for PKCS#1 v1.5 encoding. Default value: Defined(#define) Require: MBEDTLS_RSA_C This enables support for PKCS#1 v1.5 operations. Enable support for PKCS#1 v1.5 encoding. Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C This enables support for PKCS#1 v1.5 operations. Enable support for PKCS#1 v2.1 encoding. Default value: Defined(#define) Require: MBEDTLS_MD_C & MBEDTLS_RSA_C (This enables support for RSAES-OAEP and RSASSA-PSS operations.) Enable support for PKCS#1 v2.1 encoding. Default value: Not Defined(//#define) Require: MBEDTLS_MD_C & MBEDTLS_RSA_C (This enables support for RSAES-OAEP and RSASSA-PSS operations.) Enable support for PKCS#1 v2.1 encoding. Default value: Defined(#define) Require: MBEDTLS_MD_C & MBEDTLS_RSA_C (This enables support for RSAES-OAEP and RSASSA-PSS operations.) Enable support for PKCS#1 v2.1 encoding. Default value: Not Defined(//#define) Require: MBEDTLS_MD_C & MBEDTLS_RSA_C (This enables support for RSAES-OAEP and RSASSA-PSS operations.) Do not use the Chinese Remainder Theorem for the RSA private operation. Default value: Not Defined(//#define) Enable the checkup functions (*_self_test). Default value: Defined(#define) Enable the checkup functions (*_self_test). Default value: Not Defined(//#define) Enable an implementation of SHA-256 that has lower ROM footprint but also lower performance. The default implementation is meant to be a reasonnable compromise between performance and size. This version optimizes more aggressively for size at the expense of performance. Eg on Cortex-M4 it reduces the size of mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about 30%. Default value: Not Defined(//#define) Enable sending of alert messages in case of encountered errors as per RFC. If you choose not to send the alert messages, mbed TLS can still communicate with other servers, only debugging of failures is harder. The advantage of not sending alert messages, is that no information is given about reasons for failures thus preventing adversaries of gaining intel. Enable sending of all alert messages Default value: Defined(#define) Enable sending of alert messages in case of encountered errors as per RFC. If you choose not to send the alert messages, mbed TLS can still communicate with other servers, only debugging of failures is harder. The advantage of not sending alert messages, is that no information is given about reasons for failures thus preventing adversaries of gaining intel. Enable sending of all alert messages Default value: Defined(#define) Enable sending of alert messages in case of encountered errors as per RFC. If you choose not to send the alert messages, mbed TLS can still communicate with other servers, only debugging of failures is harder. The advantage of not sending alert messages, is that no information is given about reasons for failures thus preventing adversaries of gaining intel. Enable sending of all alert messages Default value: Not Defined(//#define) Enable asynchronous external private key operations in SSL. This allows you to configure an SSL connection to call an external cryptographic module to perform private key operations instead of performing the operation inside the library. Default value: Not Defined(//#define) Enable asynchronous external private key operations in SSL. This allows you to configure an SSL connection to call an external cryptographic module to perform private key operations instead of performing the operation inside the library. Default value: Not Defined(//#define) Enable the debug messages in SSL module for all issues. Debug messages have been disabled in some places to prevent timing attacks due to (unbalanced) debugging function calls. If you need all error reporting(debug messages on errors introducing a timing side-channel) you should enable this during debugging, but remove this for production servers that should log as well. Default value: Not Defined(//#define) Enable the debug messages in SSL module for all issues. Debug messages have been disabled in some places to prevent timing attacks due to (unbalanced) debugging function calls. If you need all error reporting(debug messages on errors introducing a timing side-channel) you should enable this during debugging, but remove this for production servers that should log as well. Default value: Not Defined(//#define) Enable support for Encrypt-then-MAC, RFC 7366. This allows peers that both support it to use a more robust protection for ciphersuites using CBC, providing deep resistance against timing attacks on the padding or underlying cipher. This only affects CBC ciphersuites, and is useless if none is defined. Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Encrypt-then-MAC, RFC 7366. This allows peers that both support it to use a more robust protection for ciphersuites using CBC, providing deep resistance against timing attacks on the padding or underlying cipher. This only affects CBC ciphersuites, and is useless if none is defined. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Encrypt-then-MAC, RFC 7366. This allows peers that both support it to use a more robust protection for ciphersuites using CBC, providing deep resistance against timing attacks on the padding or underlying cipher. This only affects CBC ciphersuites, and is useless if none is defined. Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Encrypt-then-MAC, RFC 7366. This allows peers that both support it to use a more robust protection for ciphersuites using CBC, providing deep resistance against timing attacks on the padding or underlying cipher. This only affects CBC ciphersuites, and is useless if none is defined. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Extended Master Secret, aka Session Hash (draft-ietf-tls-session-hash-02). This was introduced as ""the proper fix"" to the Triple Handshake familiy of attacks, but it is recommended to always use it (even if you disable renegotiation), since it actually fixes a more fundamental issue in the original SSL/TLS design, and has implications beyond Triple Handshake. Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Extended Master Secret, aka Session Hash (draft-ietf-tls-session-hash-02). This was introduced as ""the proper fix"" to the Triple Handshake familiy of attacks, but it is recommended to always use it (even if you disable renegotiation), since it actually fixes a more fundamental issue in the original SSL/TLS design, and has implications beyond Triple Handshake. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Extended Master Secret, aka Session Hash (draft-ietf-tls-session-hash-02). This was introduced as ""the proper fix"" to the Triple Handshake familiy of attacks, but it is recommended to always use it (even if you disable renegotiation), since it actually fixes a more fundamental issue in the original SSL/TLS design, and has implications beyond Triple Handshake. Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for Extended Master Secret, aka Session Hash (draft-ietf-tls-session-hash-02). This was introduced as ""the proper fix"" to the Triple Handshake familiy of attacks, but it is recommended to always use it (even if you disable renegotiation), since it actually fixes a more fundamental issue in the original SSL/TLS design, and has implications beyond Triple Handshake. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00). For servers, it is recommended to always enable this, unless you support only one version of TLS, or know for sure that none of your clients implements a fallback strategy. For clients, you only need this if you're using a fallback strategy, which is not recommended in the first place, unless you absolutely need it to interoperate with buggy (version-intolerant) servers. Default value: Defined(#define) Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00). For servers, it is recommended to always enable this, unless you support only one version of TLS, or know for sure that none of your clients implements a fallback strategy. For clients, you only need this if you're using a fallback strategy, which is not recommended in the first place, unless you absolutely need it to interoperate with buggy (version-intolerant) servers. Default value: Defined(#define) Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00). For servers, it is recommended to always enable this, unless you support only one version of TLS, or know for sure that none of your clients implements a fallback strategy. For clients, you only need this if you're using a fallback strategy, which is not recommended in the first place, unless you absolutely need it to interoperate with buggy (version-intolerant) servers. Default value: Not Defined(//#define) Enable hooking functions in SSL module for hardware acceleration of individual records. Default value: Not Defined(//#define) Enable hooking functions in SSL module for hardware acceleration of individual records. Default value: Not Defined(//#define) Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. This is a countermeasure to the BEAST attack, which also minimizes the risk of interoperability issues compared to sending 0-length records. Default value: Defined(#define) Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. This is a countermeasure to the BEAST attack, which also minimizes the risk of interoperability issues compared to sending 0-length records. Default value: Not Defined(//#define) Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. This is a countermeasure to the BEAST attack, which also minimizes the risk of interoperability issues compared to sending 0-length records. Default value: Not Defined(//#define) Disable support for TLS renegotiation. The two main uses of renegotiation are (1) refresh keys on long-lived connections and (2) client authentication after the initial handshake. If you don't need renegotiation, it's probably better to disable it, since it has been associated with security issues in the past and is easy to misuse/misunderstand. \note Even if this option is disabled, both client and server are aware of the Renegotiation Indication Extension (RFC 5746) used to prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). (See \c mbedtls_ssl_conf_legacy_renegotiation for the configuration of this extension). Default value: Defined(#define) Disable support for TLS renegotiation. The two main uses of renegotiation are (1) refresh keys on long-lived connections and (2) client authentication after the initial handshake. If you don't need renegotiation, it's probably better to disable it, since it has been associated with security issues in the past and is easy to misuse/misunderstand. \note Even if this option is disabled, both client and server are aware of the Renegotiation Indication Extension (RFC 5746) used to prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). (See \c mbedtls_ssl_conf_legacy_renegotiation for the configuration of this extension). Default value: Defined(#define) Disable support for TLS renegotiation. The two main uses of renegotiation are (1) refresh keys on long-lived connections and (2) client authentication after the initial handshake. If you don't need renegotiation, it's probably better to disable it, since it has been associated with security issues in the past and is easy to misuse/misunderstand. \note Even if this option is disabled, both client and server are aware of the Renegotiation Indication Extension (RFC 5746) used to prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). (See \c mbedtls_ssl_conf_legacy_renegotiation for the configuration of this extension). Default value: Defined(#define) Enable support for receiving and parsing SSLv2 Client Hello messages for the SSL Server module (MBEDTLS_SSL_SRV_C). Default value: Not Defined(//#define) Enable support for receiving and parsing SSLv2 Client Hello messages for the SSL Server module (MBEDTLS_SSL_SRV_C). Default value: Not Defined(//#define) Pick the ciphersuite according to the client's preferences rather than ours in the SSL Server module (MBEDTLS_SSL_SRV_C). Default value: Not Defined(//#define) Pick the ciphersuite according to the client's preferences rather than ours in the SSL Server module (MBEDTLS_SSL_SRV_C). Default value: Not Defined(//#define) Pick the ciphersuite according to the client's preferences rather than ours in the SSL Server module (MBEDTLS_SSL_SRV_C). Default value: Defined(#define) Enable support for RFC 6066 max_fragment_length extension in SSL. Default value: Not Defined(//#define) Enable support for RFC 6066 max_fragment_length extension in SSL. Default value: Not Defined(//#define) Enable support for SSL 3.0. Default value: Not Defined(//#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for SSL 3.0. Default value: Not Defined(//#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.0. Default value: Defined(#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.0. Default value: Not Defined(//#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.0. Default value: Defined(#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.0. Default value: Not Defined(//#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). Default value: Defined(#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). Default value: Not Defined(//#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). Default value: Defined(#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). Default value: Not Defined(//#define) Require: MBEDTLS_MD5_C & MBEDTLS_SHA1_C Default value: Defined(#define) Require: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C Default value: Defined(#define) Require: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C Enable support for DTLS (all available versions). Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for DTLS (all available versions). Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for DTLS (all available versions). Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for DTLS (all available versions). Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_TLS1_2 Enable support for RFC 7301 Application Layer Protocol Negotiation. Default value: Defined(#define) Enable support for RFC 7301 Application Layer Protocol Negotiation. Default value: Not Defined(//#define) Enable support for RFC 7301 Application Layer Protocol Negotiation. Default value: Not Defined(//#define) Enable support for the anti-replay mechanism in DTLS. Warning! Disabling this is often a security risk! See mbedtls_ssl_conf_dtls_anti_replay() for details. Default value: Defined(#define) Require: MBEDTLS_SSL_TLS_C & MBEDTLS_SSL_PROTO_DTLS Enable support for the anti-replay mechanism in DTLS. Warning! Disabling this is often a security risk! See mbedtls_ssl_conf_dtls_anti_replay() for details. Default value: Disabled(#define) Require: MBEDTLS_SSL_TLS_C & MBEDTLS_SSL_PROTO_DTLS Enable support for the anti-replay mechanism in DTLS. Warning! Disabling this is often a security risk! See mbedtls_ssl_conf_dtls_anti_replay() for details. Default value: Defined(#define) Require: MBEDTLS_SSL_TLS_C & MBEDTLS_SSL_PROTO_DTLS Enable support for the anti-replay mechanism in DTLS. Warning! Disabling this is often a security risk! See mbedtls_ssl_conf_dtls_anti_replay() for details. Default value: Disabled(#define) Require: MBEDTLS_SSL_TLS_C & MBEDTLS_SSL_PROTO_DTLS Enable support for HelloVerifyRequest on DTLS servers. This feature is highly recommended to prevent DTLS servers being used as amplifiers in DoS attacks against other hosts. It should always be enabled unless you know for sure amplification cannot be a problem in the environment in which your server operates. WARNING! Disabling this is often a security risk! Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for HelloVerifyRequest on DTLS servers. This feature is highly recommended to prevent DTLS servers being used as amplifiers in DoS attacks against other hosts. It should always be enabled unless you know for sure amplification cannot be a problem in the environment in which your server operates. WARNING! Disabling this is often a security risk! Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for HelloVerifyRequest on DTLS servers. This feature is highly recommended to prevent DTLS servers being used as amplifiers in DoS attacks against other hosts. It should always be enabled unless you know for sure amplification cannot be a problem in the environment in which your server operates. WARNING! Disabling this is often a security risk! Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for HelloVerifyRequest on DTLS servers. This feature is highly recommended to prevent DTLS servers being used as amplifiers in DoS attacks against other hosts. It should always be enabled unless you know for sure amplification cannot be a problem in the environment in which your server operates. WARNING! Disabling this is often a security risk! Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable server-side support for clients that reconnect from the same port. Some clients unexpectedly close the connection and try to reconnect using the same source port. This needs special support from the server to handle the new connection securely, as described in section 4.2.8 of RFC 6347. This flag enables that support. Default value: Defined(#define) Require: MBEDTLS_SSL_DTLS_HELLO_VERIFY Enable server-side support for clients that reconnect from the same port. Some clients unexpectedly close the connection and try to reconnect using the same source port. This needs special support from the server to handle the new connection securely, as described in section 4.2.8 of RFC 6347. This flag enables that support. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_DTLS_HELLO_VERIFY Enable server-side support for clients that reconnect from the same port. Some clients unexpectedly close the connection and try to reconnect using the same source port. This needs special support from the server to handle the new connection securely, as described in section 4.2.8 of RFC 6347. This flag enables that support. Default value: Defined(#define) Require: MBEDTLS_SSL_DTLS_HELLO_VERIFY Enable server-side support for clients that reconnect from the same port. Some clients unexpectedly close the connection and try to reconnect using the same source port. This needs special support from the server to handle the new connection securely, as described in section 4.2.8 of RFC 6347. This flag enables that support. Default value: Not Defined(//#define) Require: MBEDTLS_SSL_DTLS_HELLO_VERIFY Enable support for a limit of records with bad MAC. See mbedtls_ssl_conf_dtls_badmac_limit(). Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for a limit of records with bad MAC. See mbedtls_ssl_conf_dtls_badmac_limit(). Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for a limit of records with bad MAC. See mbedtls_ssl_conf_dtls_badmac_limit(). Default value: Not Defined(//#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for a limit of records with bad MAC. See mbedtls_ssl_conf_dtls_badmac_limit(). Default value: Defined(#define) Require: MBEDTLS_SSL_PROTO_DTLS Enable support for RFC 5077 session tickets in SSL. Client-side, provides full support for session tickets (maintainance of a session store remains the responsibility of the application, though). Server-side, you also need to provide callbacks for writing and parsing tickets, including authenticated encryption and key management. Example callbacks are provided by MBEDTLS_SSL_TICKET_C. Default value: Defined(#define) Enable support for RFC 5077 session tickets in SSL. Client-side, provides full support for session tickets (maintainance of a session store remains the responsibility of the application, though). Server-side, you also need to provide callbacks for writing and parsing tickets, including authenticated encryption and key management. Example callbacks are provided by MBEDTLS_SSL_TICKET_C. Default value: Not Defined(//#define) Enable support for RFC 5077 session tickets in SSL. Client-side, provides full support for session tickets (maintainance of a session store remains the responsibility of the application, though). Server-side, you also need to provide callbacks for writing and parsing tickets, including authenticated encryption and key management. Example callbacks are provided by MBEDTLS_SSL_TICKET_C. Default value: Not Defined(//#define) Enable support for exporting key block and master secret. This is required for certain users of TLS, e.g. EAP-TLS. Default value: Defined(#define) Enable support for exporting key block and master secret. This is required for certain users of TLS, e.g. EAP-TLS. Default value: Not Defined(//#define) Enable support for exporting key block and master secret. This is required for certain users of TLS, e.g. EAP-TLS. Default value: Not Defined(//#define) Enable support for RFC 6066 server name indication (SNI) in SSL. Default value: Defined(#define) Require: MBEDTLS_X509_CRT_PARSE_C Enable support for RFC 6066 server name indication (SNI) in SSL. Default value: Not Defined(//#define) Require: MBEDTLS_X509_CRT_PARSE_C Enable support for RFC 6066 server name indication (SNI) in SSL. Default value: Defined(#define) Require: MBEDTLS_X509_CRT_PARSE_C Enable support for RFC 6066 server name indication (SNI) in SSL. Default value: Not Defined(//#define) Require: MBEDTLS_X509_CRT_PARSE_C Enable support for RFC 6066 truncated HMAC in SSL. Default value: Defined(#define) Enable support for RFC 6066 truncated HMAC in SSL. Default value: Not Defined(//#define) Enable support for RFC 6066 truncated HMAC in SSL. Default value: Not Defined(//#define) Fallback to old (pre-2.7), non-conforming implementation of the truncated HMAC extension which also truncates the HMAC key. Note that this option is only meant for a transitory upgrade period and is likely to be removed in a future version of the library. \WARNING!: The old implementation is non-compliant and has a security weakness (2^80 brute force attack on the HMAC key used for a single, uninterrupted connection). This should only be enabled temporarily when (1) the use of truncated HMAC is essential in order to save bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use the fixed implementation yet (pre-2.7). \DEPRECATED This option is deprecated and will likely be removed in a future version of Mbed TLS. Uncomment to fallback to old, non-compliant truncated HMAC implementation. Requires: MBEDTLS_SSL_TRUNCATED_HMAC Default value: Not defined(//#define) Fallback to old (pre-2.7), non-conforming implementation of the truncated HMAC extension which also truncates the HMAC key. Note that this option is only meant for a transitory upgrade period and is likely to be removed in a future version of the library. \WARNING!: The old implementation is non-compliant and has a security weakness (2^80 brute force attack on the HMAC key used for a single, uninterrupted connection). This should only be enabled temporarily when (1) the use of truncated HMAC is essential in order to save bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use the fixed implementation yet (pre-2.7). \DEPRECATED This option is deprecated and will likely be removed in a future version of Mbed TLS. Uncomment to fallback to old, non-compliant truncated HMAC implementation. Requires: MBEDTLS_SSL_TRUNCATED_HMAC Default value: Not defined(//#define) Provide your own alternate threading implementation. Default value: Not Defined(//#define) Require: MBEDTLS_THREADING_C Provide your own alternate threading implementation. Default value: Not Defined(//#define) Require: MBEDTLS_THREADING_C Enable the pthread wrapper layer for the threading layer. Default value: Not Defined(//#define) Require: MBEDTLS_THREADING_C Enable the pthread wrapper layer for the threading layer. Default value: Not Defined(//#define) Require: MBEDTLS_THREADING_C Allow run-time checking of compile-time enabled features. Thus allowing users to check at run-time if the library is for instance compiled with threading support via mbedtls_version_check_feature(). Default value: Defined(#define) Require: MBEDTLS_VERSION_C (Disabling it will disable run-time checking and save ROM space) Allow run-time checking of compile-time enabled features. Thus allowing users to check at run-time if the library is for instance compiled with threading support via mbedtls_version_check_feature(). Default value: Not Defined(//#define) Require: MBEDTLS_VERSION_C (Disabling it will disable run-time checking and save ROM space) Allow run-time checking of compile-time enabled features. Thus allowing users to check at run-time if the library is for instance compiled with threading support via mbedtls_version_check_feature(). Default value: Defined(#define) Require: MBEDTLS_VERSION_C (Disabling it will disable run-time checking and save ROM space) Allow run-time checking of compile-time enabled features. Thus allowing users to check at run-time if the library is for instance compiled with threading support via mbedtls_version_check_feature(). Default value: Not Defined(//#define) Require: MBEDTLS_VERSION_C (Disabling it will disable run-time checking and save ROM space) If set, the X509 parser will not break-off when parsing an X509 certificate and encountering an extension in a v1 or v2 certificate. Default value: Not Defined(//#define) If set, the X509 parser will not break-off when parsing an X509 certificate and encountering an unknown critical extension. WARNING! Depending on your PKI use, enabling this can be a security risk! Default value: Not Defined(//#define) Enable verification of the keyUsage extension (CA and leaf certificates). Disabling this avoids problems with mis-issued and/or misused (intermediate) CA and leaf certificates. WARNING! Depending on your PKI use, disabling this can be a security risk! Default value: Defined(#define) Enable verification of the keyUsage extension (CA and leaf certificates). Disabling this avoids problems with mis-issued and/or misused (intermediate) CA and leaf certificates. WARNING! Depending on your PKI use, disabling this can be a security risk! Default value: Not Defined(//#define) Enable verification of the extendedKeyUsage extension (leaf certificates). Disabling this avoids problems with mis-issued and/or isused certificates. WARNING! Depending on your PKI use, disabling this can be a security risk! Default value: Defined(#define) Enable verification of the extendedKeyUsage extension (leaf certificates). Disabling this avoids problems with mis-issued and/or isused certificates. WARNING! Depending on your PKI use, disabling this can be a security risk! Default value: Not Defined(//#define) Enable parsing and verification of X.509 certificates, CRLs and CSRS signed with RSASSA-PSS (aka PKCS#1 v2.1). Default value: Defined(#define) Enable parsing and verification of X.509 certificates, CRLs and CSRS signed with RSASSA-PSS (aka PKCS#1 v2.1). Default value: Not Defined(//#define) If set, the SSL/TLS module uses ZLIB to support compression and decompression of packet data. WARNING! TLS-level compression MAY REDUCE SECURITY! See for example the CRIME attack. Before enabling this option, you should examine with care if CRIME or similar exploits may be a applicable to your use case. Note: Currently compression can't be used with DTLS. \deprecated This feature is deprecated and will be removed in the next major revision of the library. Used in: library/ssl_tls.c library/ssl_cli.c library/ssl_srv.c This feature requires zlib library and headers to be present. Default value: Not Defined(//#define) Enable AES-NI support on x86-64. Module: library/aesni.c Caller: library/aes.c Default value: Defined(#define) Require: MBEDTLS_HAVE_ASM Enable AES-NI support on x86-64. Module: library/aesni.c Caller: library/aes.c Default value: Not Defined(//#define) Require: MBEDTLS_HAVE_ASM Enable AES-NI support on x86-64. Module: library/aesni.c Caller: library/aes.c Default value: Defined(#define) Require: MBEDTLS_HAVE_ASM Enable AES-NI support on x86-64. Module: library/aesni.c Caller: library/aes.c Default value: Not Defined(//#define) Require: MBEDTLS_HAVE_ASM Enable the AES block cipher. Module: library/aes.c Caller: library/ssl_tls.c library/pem.c library/ctr_drbg.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA PEM_PARSE uses AES for decrypting encrypted keys. Default value: Defined(#define) Require: MBEDTLS_HAVE_ASM Enable the ARCFOUR stream cipher Module: library/arc4.c Caller: library/ssl_tls.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA \warning ARC4 is considered a weak cipher and its use constitutes a security risk. If possible, we recommend avoidng dependencies on it, and considering stronger ciphers instead. Default value: Defined(#define) Enable the ARCFOUR stream cipher Module: library/arc4.c Caller: library/ssl_tls.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA \warning ARC4 is considered a weak cipher and its use constitutes a security risk. If possible, we recommend avoidng dependencies on it, and considering stronger ciphers instead. Default value: Defined(#define) Enable the generic ASN1 parser Module: library/asn1.c Caller: library/x509.c library/dhm.c library/pkcs12.c library/pkcs5.c library/pkparse.c Default value: Defined(#define) Enable the generic ASN1 writer Module: library/asn1write.c Caller: library/ecdsa.c library/pkwrite.c library/x509_create.c library/x509write_crt.c library/x509write_csr.c Default value: Defined(#define) Enable the Base64 module Module: library/base64.c Caller: library/pem.c This module is required for PEM support (required by X.509). Default value: Defined(#define) Enable the multi-precision integer library Module: library/bignum.c Caller: library/dhm.c library/ecp.c library/ecdsa.c library/rsa.c library/ssl_tls.c This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. Default value: Defined(#define) Enable the Blowfish block cipher Module: library/blowfish.c Default value: Defined(#define) Enable the Blowfish block cipher Module: library/blowfish.c Default value: Not Defined(//#define) Enable the Camellia block cipher Module: library/camellia.c Caller: library/ssl_tls.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 Default value: Defined(#define) Enable the ARIA block cipher. Module: library/aria.c Caller: library/cipher.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 Default value: Not defined(//#define) Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. Module: library/ccm.c This module enables the AES-CCM ciphersuites, if other requisites areenabled as well. Default value: Defined(#define) Require: MBEDTLS_AES_C | MBEDTLS_CAMELLIA_C Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. Module: library/ccm.c This module enables the AES-CCM ciphersuites, if other requisites areenabled as well. Default value: Not Defined(//#define) Require: MBEDTLS_AES_C | MBEDTLS_CAMELLIA_C Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. Module: library/ccm.c This module enables the AES-CCM ciphersuites, if other requisites areenabled as well. Default value: Defined(#define) Require: MBEDTLS_AES_C | MBEDTLS_CAMELLIA_C Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. Module: library/ccm.c This module enables the AES-CCM ciphersuites, if other requisites areenabled as well. Default value: Not Defined(//#define) Require: MBEDTLS_AES_C | MBEDTLS_CAMELLIA_C Enable the test certificates. Used for testing (ssl_client/server) Module: library/certs.c Default value: Defined(#define) Enable the ChaCha20 stream cipher. Module: library/chacha20.c Default value: Defined(#define) Enable the ChaCha20-Poly1305 AEAD algorithm.. Module: library/chachapoly.c This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C Default value: Defined(#define) Enable the ChaCha20-Poly1305 AEAD algorithm.. Module: library/chachapoly.c This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C Default value: Defined(#define) Enable the generic cipher layer Module: library/cipher.c Caller: library/ssl_tls.c Default value: Defined(#define) Enable the CMAC (Cipher-based Message Authentication Code) mode for block ciphers. Module: library/cmac.c Default value: Not Defined(//#define) Require: MBEDTLS_AES_C | MBEDTLS_DES_C Enable the CMAC (Cipher-based Message Authentication Code) mode for block ciphers. Module: library/cmac.c Default value: Not Defined(//#define) Require: MBEDTLS_AES_C | MBEDTLS_DES_C Enable the CTR_DRBG AES-256-based random generator Module: library/ctr_drbg.c Default value: Defined(#define) Require: MBEDTLS_AES_C Enable the CTR_DRBG AES-256-based random generator Module: library/ctr_drbg.c Default value: Defined(#define) Require: MBEDTLS_AES_C Enable the debug functions Module: library/debug.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c Default value: Not Defined(//#define) Enable the DES block cipher Module: library/des.c Caller: library/pem.c library/ssl_tls.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA PEM_PARSE uses DES/3DES for decrypting encrypted keys. \warning DES is considered a weak cipher and its use constitutes a security risk. We recommend considering stronger ciphers instead. Default value: Defined(#define) Enable the DES block cipher Module: library/des.c Caller: library/pem.c library/ssl_tls.c This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA PEM_PARSE uses DES/3DES for decrypting encrypted keys. \warning DES is considered a weak cipher and its use constitutes a security risk. We recommend considering stronger ciphers instead. Default value: Defined(#define) Enable the Diffie-Hellman-Merkle key exchange Module: library/dhm.c Caller: library/ssl_cli.c library/ssl_srv.c This module is used by the following key exchanges: DHE-RSA, DHE-PSK \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.Default value: Defined(#define) Enable the Diffie-Hellman-Merkle key exchange Module: library/dhm.c Caller: library/ssl_cli.c library/ssl_srv.c This module is used by the following key exchanges: DHE-RSA, DHE-PSK \warning Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.Default value: Defined(#define) Enable the elliptic curve Diffie-Hellman library. Module: library/ecdh.c Caller: library/ssl_cli.c library/ssl_srv.c This module is used by the following key exchanges: ECDHE-ECDSA, ECDHE-RSA, DHE-PSK Default value: Defined(#define) Require: MBEDTLS_ECP_C Enable the elliptic curve Diffie-Hellman library. Module: library/ecdh.c Caller: library/ssl_cli.c library/ssl_srv.c This module is used by the following key exchanges: ECDHE-ECDSA, ECDHE-RSA, DHE-PSK Default value: Enabled(#define Require: MBEDTLS_ECP_C Enable the elliptic curve DSA library. Module: library/ecdsa.c This module is used by the following key exchanges: ECDHE-ECDSA Default value: Defined(#define) Require: MBEDTLS_ECP_C & MBEDTLS_ASN1_WRITE_C & MBEDTLS_ASN1_PARSE_C Enable the elliptic curve DSA library. Module: library/ecdsa.c This module is used by the following key exchanges: ECDHE-ECDSA Default value: Defined(#define) Require: MBEDTLS_ECP_C & MBEDTLS_ASN1_WRITE_C & MBEDTLS_ASN1_PARSE_C Enable the elliptic curve J-PAKE library. WARNING! This is currently experimental. EC J-PAKE support is based on the Thread v1.0.0 specification; incompatible changes to the specification might still happen. For this reason, this is disabled by default. Module: library/ecjpake.c This module is used by the following key exchanges: ECJPAKE Default value: Not Defined(//#define) Require: MBEDTLS_ECP_C & MBEDTLS_MD_C Enable the elliptic curve J-PAKE library. WARNING! This is currently experimental. EC J-PAKE support is based on the Thread v1.0.0 specification; incompatible changes to the specification might still happen. For this reason, this is disabled by default. Module: library/ecjpake.c This module is used by the following key exchanges: ECJPAKE Default value: Not Defined(//#define) Require: MBEDTLS_ECP_C & MBEDTLS_MD_C Enable the elliptic curve over GF(p) library. Module: library/ecp.c Caller: library/ecdh.c library/ecdsa.c library/ecjpake.c Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C & (MBEDTLS_ECP_DP_SECP192R1_ENABLED | MBEDTLS_ECP_DP_SECP224R1_ENABLED | MBEDTLS_ECP_DP_SECP256R1_ENABLED | MBEDTLS_ECP_DP_SECP384R1_ENABLED | MBEDTLS_ECP_DP_SECP521R1_ENABLED | MBEDTLS_ECP_DP_SECP192K1_ENABLED | MBEDTLS_ECP_DP_SECP224K1_ENABLED | MBEDTLS_ECP_DP_SECP256K1_ENABLED | MBEDTLS_ECP_DP_BP256R1_ENABLED | MBEDTLS_ECP_DP_BP384R1_ENABLED | MBEDTLS_ECP_DP_BP512R1_ENABLED | MBEDTLS_ECP_DP_CURVE25519_ENABLED ) Enable the elliptic curve over GF(p) library. Module: library/ecp.c Caller: library/ecdh.c library/ecdsa.c library/ecjpake.c Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C & (MBEDTLS_ECP_DP_SECP192R1_ENABLED | MBEDTLS_ECP_DP_SECP224R1_ENABLED | MBEDTLS_ECP_DP_SECP256R1_ENABLED | MBEDTLS_ECP_DP_SECP384R1_ENABLED | MBEDTLS_ECP_DP_SECP521R1_ENABLED | MBEDTLS_ECP_DP_SECP192K1_ENABLED | MBEDTLS_ECP_DP_SECP224K1_ENABLED | MBEDTLS_ECP_DP_SECP256K1_ENABLED | MBEDTLS_ECP_DP_BP256R1_ENABLED | MBEDTLS_ECP_DP_BP384R1_ENABLED | MBEDTLS_ECP_DP_BP512R1_ENABLED | MBEDTLS_ECP_DP_CURVE25519_ENABLED ) Enable the platform-specific entropy code Module: library/entropy.c Default value: Defined(#define) Require: MBEDTLS_SHA512_C | MBEDTLS_SHA256_C Enable the platform-specific entropy code Module: library/entropy.c Default value: Defined(#define) Require: MBEDTLS_SHA512_C | MBEDTLS_SHA256_C Enable error code to error string conversion Module: library/error.c Default value: Defined(#define) Enable error code to error string conversion Module: library/error.c Default value: Not Defined(//#define) Enable the Galois/Counter Mode (GCM) for AES Module: library/gcm.c This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other requisites are enabled as well. Default value: Defined(#define) Require: MBEDTLS_AES_C | MBEDTLS_CAMELLIA_C Enable the Galois/Counter Mode (GCM) for AES Module: library/gcm.c This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other requisites are enabled as well. Default value: Defined(#define) Require: MBEDTLS_AES_C | MBEDTLS_CAMELLIA_C Enable the HAVEGE random generator WARNING!: the HAVEGE random generator is not suitable for virtualized environments WARNING!: the HAVEGE random generator is dependent on timing and specific processor traits. It is therefore not advised to use HAVEGE as your applications primary random generator or primary entropy pool input. As a secondary input to your entropy pool, it IS able add the (limited) extra entropy it provides. Module: library/havege.c Default value: Not Defined(//#define) Require: MBEDTLS_TIMING_C Enable the HAVEGE random generator WARNING!: the HAVEGE random generator is not suitable for virtualized environments WARNING!: the HAVEGE random generator is dependent on timing and specific processor traits. It is therefore not advised to use HAVEGE as your applications primary random generator or primary entropy pool input. As a secondary input to your entropy pool, it IS able add the (limited) extra entropy it provides. Module: library/havege.c Default value: Not Defined(//#define) Require: MBEDTLS_TIMING_C Enable the HKDF algorithm (RFC 5869). Module: library/hkdf.c * This module adds support for the Hashed Message Authentication Code(HMAC)-based key derivation function (HKDF). Default value: Defined(define) Require: MBEDTLS_MD_C Enable the HKDF algorithm (RFC 5869). Module: library/hkdf.c * This module adds support for the Hashed Message Authentication Code(HMAC)-based key derivation function (HKDF). Default value: Defined(define) Require: MBEDTLS_MD_C Enable the HMAC_DRBG random generator. Module: library/hmac_drbg.c Default value: Defined(#define) Require: MBEDTLS_MD_C Enable the HMAC_DRBG random generator. Module: library/hmac_drbg.c Default value: Not Defined(//#define) Require: MBEDTLS_MD_C Enable the HMAC_DRBG random generator. Module: library/hmac_drbg.c Default value: Defined(#define) Require: MBEDTLS_MD_C Enable the HMAC_DRBG random generator. Module: library/hmac_drbg.c Default value: Not Defined(//#define) Require: MBEDTLS_MD_C Enable the Key Wrapping mode for 128-bit block ciphers, as defined in NIST SP 800-38F. Only KW and KWP modes are supported. At the moment, only AES is approved by NIST. Module: library/nist_kw.c Default value: Not Defined(//#define) Enable the Key Wrapping mode for 128-bit block ciphers, as defined in NIST SP 800-38F. Only KW and KWP modes are supported. At the moment, only AES is approved by NIST. Module: library/nist_kw.c Default value: Not Defined(//#define) Enable the generic message digest layer Module: library/md.c Default value: Defined(#define) Enable the MD2 hash algorithm Module: library/md2.c \warning MD2 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Not Defined(//#define) Enable the MD4 hash algorithm Module: library/md4.c \warning MD4 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Not Defined(//#define) Enable the MD5 hash algorithm Module: library/md5.c Caller: library/md.c library/pem.c library/ssl_tls.c This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 depending on the handshake parameters. Further, it is used for checking MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded encrypted keys. \warning MD5 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Defined(#define) Enable the MD5 hash algorithm Module: library/md5.c Caller: library/md.c library/pem.c library/ssl_tls.c This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 depending on the handshake parameters. Further, it is used for checking MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded encrypted keys. \warning MD5 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Defined(#define) Enable the buffer allocator implementation that makes use of a (stack) based buffer to 'allocate' dynamic memory. (replaces calloc() and free() calls) Module: library/memory_buffer_alloc.c Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C & MBEDTLS_PLATFORM_MEMORY Enable the buffer allocator implementation that makes use of a (stack) based buffer to 'allocate' dynamic memory. (replaces calloc() and free() calls) Module: library/memory_buffer_alloc.c Default value: Not Defined(//#define) Require: MBEDTLS_PLATFORM_C & MBEDTLS_PLATFORM_MEMORY Enable the TCP and UDP over IPv6/IPv4 networking routines. Note: This module only works on POSIX/Unix (including Linux, BSD and OS X) and Windows. For other platforms, you'll want to disable it, and write your own networking callbacks to be passed to \c mbedtls_ssl_set_bio().Note: See also our Knowledge Base article about porting to a new environment: https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS Default value: Defined(#define) Enable the TCP and UDP over IPv6/IPv4 networking routines. Note: This module only works on POSIX/Unix (including Linux, BSD and OS X) and Windows. For other platforms, you'll want to disable it, and write your own networking callbacks to be passed to \c mbedtls_ssl_set_bio().Note: See also our Knowledge Base article about porting to a new environment: https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS Default value: Not Defined(//#define) Enable the OID database. Module: library/oid.c Caller: library/asn1write.c library/pkcs5.c library/pkparse.c library/pkwrite.c library/rsa.c library/x509.c library/x509_create.c library/x509_crl.c library/x509_crt.c library/x509_csr.c library/x509write_crt.c library/x509write_csr.c Default value: Defined(#define) Enable VIA Padlock support on x86. Module: library/padlock.c Caller: library/aes.c Default value: Defined(#define) Require: MBEDTLS_HAVE_ASM Enable VIA Padlock support on x86. Module: library/padlock.c Caller: library/aes.c Default value: Not Defined(//#define) Require: MBEDTLS_HAVE_ASM Enable VIA Padlock support on x86. Module: library/padlock.c Caller: library/aes.c Default value: Defined(#define) Require: MBEDTLS_HAVE_ASM Enable VIA Padlock support on x86. Module: library/padlock.c Caller: library/aes.c Default value: Not Defined(//#define) Require: MBEDTLS_HAVE_ASM Enable PEM decoding / parsing. Module: library/pem.c Caller: library/dhm.c library/pkparse.c library/x509_crl.c library/x509_crt.c library/x509_csr.c Default value: Defined(#define) Require: MBEDTLS_BASE64_C Enable PEM decoding / parsing. Module: library/pem.c Caller: library/dhm.c library/pkparse.c library/x509_crl.c library/x509_crt.c library/x509_csr.c Default value: Not Defined(//#define) Require: MBEDTLS_BASE64_C Enable PEM encoding / writing Module: library/pem.c Caller: library/pkwrite.c library/x509write_crt.c library/x509write_csr.c Default value: Defined(#define) Require: MBEDTLS_BASE64_C Enable PEM encoding / writing Module: library/pem.c Caller: library/pkwrite.c library/x509write_crt.c library/x509write_csr.c Default value: Not Defined(//#define) Require: MBEDTLS_BASE64_C Enable PEM encoding / writing Module: library/pem.c Caller: library/pkwrite.c library/x509write_crt.c library/x509write_csr.c Default value: Defined(#define) Require: MBEDTLS_BASE64_C Enable PEM encoding / writing Module: library/pem.c Caller: library/pkwrite.c library/x509write_crt.c library/x509write_csr.c Default value: Not Defined(//#define) Require: MBEDTLS_BASE64_C Enable the generic public (asymetric) key layer. Module: library/pk.c Caller: library/ssl_tls.c library/ssl_cli.c library/ssl_srv.c Default value: Defined(#define) Require: MBEDTLS_RSA_C | MBEDTLS_ECP_C Enable the generic public (asymetric) key layer. Module: library/pk.c Caller: library/ssl_tls.c library/ssl_cli.c library/ssl_srv.c Default value: Not Defined(//#define) Require: MBEDTLS_RSA_C | MBEDTLS_ECP_C Enable the generic public (asymetric) key parser. Module: library/pkparse.c Caller: library/x509_crt.c library/x509_csr.c Default value: Defined(#define) Require: MBEDTLS_PK_C Enable the generic public (asymetric) key parser. Module: library/pkparse.c Caller: library/x509_crt.c library/x509_csr.c Default value: Not Defined(//#define) Require: MBEDTLS_PK_C Enable the generic public (asymetric) key writer. Module: library/pkwrite.c Caller: library/x509write.c Default value: Defined(#define) Require: MBEDTLS_PK_C Enable the generic public (asymetric) key writer. Module: library/pkwrite.c Caller: library/x509write.c Default value: Not Defined(//#define) Require: MBEDTLS_PK_C Enable the generic public (asymetric) key writer. Module: library/pkwrite.c Caller: library/x509write.c Default value: Defined(#define) Require: MBEDTLS_PK_C Enable the generic public (asymetric) key writer. Module: library/pkwrite.c Caller: library/x509write.c Default value: Not Defined(//#define) Require: MBEDTLS_PK_C Enable PKCS#5 functions Module: library/pkcs5.c Default value: Defined(#define) Require: MBEDTLS_MD_C Enable PKCS#5 functions Module: library/pkcs5.c Default value: Not Defined(//#define) Require: MBEDTLS_MD_C Enable PKCS#5 functions Module: library/pkcs5.c Default value: Defined(#define) Require: MBEDTLS_MD_C Enable PKCS#5 functions Module: library/pkcs5.c Default value: Not Defined(//#define) Require: MBEDTLS_MD_C Enable wrapper for PKCS#11 smartcard support * Module: library/pkcs11.c Caller: library/pk.c This module enables SSL/TLS PKCS #11 smartcard support. Requires the presence of the PKCS#11 helper library (libpkcs11-helper) Default value: Not Defined(//#define) Require: MBEDTLS_PK_C Enable wrapper for PKCS#11 smartcard support * Module: library/pkcs11.c Caller: library/pk.c This module enables SSL/TLS PKCS #11 smartcard support. Requires the presence of the PKCS#11 helper library (libpkcs11-helper) Default value: Not Defined(//#define) Require: MBEDTLS_PK_C Enable PKCS#12 PBE functions. Adds algorithms for parsing PKCS#8 encrypted private keys Module: library/pkcs12.c Caller: library/pkparse.c Can use: MBEDTLS_ARC4_C This module enables PKCS#12 functions. Default value: Defined(#define) Require: MBEDTLS_ASN1_PARSE_C & MBEDTLS_CIPHER_C & MBEDTLS_MD_C Enable PKCS#12 PBE functions. Adds algorithms for parsing PKCS#8 encrypted private keys Module: library/pkcs12.c Caller: library/pkparse.c Can use: MBEDTLS_ARC4_C This module enables PKCS#12 functions. Default value: Not Defined(//#define) Require: MBEDTLS_ASN1_PARSE_C & MBEDTLS_CIPHER_C & MBEDTLS_MD_C Enable PKCS#12 PBE functions. Adds algorithms for parsing PKCS#8 encrypted private keys Module: library/pkcs12.c Caller: library/pkparse.c Can use: MBEDTLS_ARC4_C This module enables PKCS#12 functions. Default value: Defined(#define) Require: MBEDTLS_ASN1_PARSE_C & MBEDTLS_CIPHER_C & MBEDTLS_MD_C Enable PKCS#12 PBE functions. Adds algorithms for parsing PKCS#8 encrypted private keys Module: library/pkcs12.c Caller: library/pkparse.c Can use: MBEDTLS_ARC4_C This module enables PKCS#12 functions. Default value: Not Defined(//#define) Require: MBEDTLS_ASN1_PARSE_C & MBEDTLS_CIPHER_C & MBEDTLS_MD_C Enable the platform abstraction layer that allows you to re-assign functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned above to be specified at runtime or compile time respectively. Note: This abstraction layer must be enabled on Windows (including MSYS2) as other module rely on it for a fixed snprintf implementation.Module: library/platform.c Caller: Most other .c files Default value: Defined(#define) Enable the Poly1305 MAC algorithm.. Module: library/poly1305.c Caller: library/chachapoly.c Default value: Defined(#define) Enable the RIPEMD-160 hash algorithm. Module: library/ripemd160.c Caller: library/md.c Default value: Defined(#define) Enable the RIPEMD-160 hash algorithm. Module: library/ripemd160.c Caller: library/md.c Default value: Not Defined(//#define) Enable the RSA public-key cryptosystem Module: library/rsa.c library/rsa_internal.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509.c This module is used by the following key exchanges: RSA, DHE-RSA, ECDHE-RSA, RSA-PSK Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C Enable the RSA public-key cryptosystem Module: library/rsa.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509.c This module is used by the following key exchanges: RSA, DHE-RSA, ECDHE-RSA, RSA-PSK Default value: Not Defined(//#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C Enable the RSA public-key cryptosystem Module: library/rsa.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509.c This module is used by the following key exchanges: RSA, DHE-RSA, ECDHE-RSA, RSA-PSK Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C Enable the RSA public-key cryptosystem Module: library/rsa.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509.c This module is used by the following key exchanges: RSA, DHE-RSA, ECDHE-RSA, RSA-PSK Default value: Not Defined(//#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C Enable the SHA1 cryptographic hash algorithm Module: library/sha1.c Caller: library/md.c library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509write_crt.c This module is required for SSL/TLS up to version 1.1, for TLS 1.2 depending on the handshake parameters, and for SHA1-signed certificates. \warning SHA-1 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Defined(#define) Enable the SHA1 cryptographic hash algorithm Module: library/sha1.c Caller: library/md.c library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509write_crt.c This module is required for SSL/TLS up to version 1.1, for TLS 1.2 depending on the handshake parameters, and for SHA1-signed certificates. \warning SHA-1 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Defined(#define) Enable the SHA-224 and SHA-256 cryptographic hash algorithms Module: library/sha256.c Caller: library/entropy.c library/md.clibrary/ssl_cli.c library/ssl_srv.c library/ssl_tls.c This module adds support for SHA-224 and SHA-256. This module is required for the SSL/TLS 1.2 PRF function. Default value: Defined(#define) Enable the SHA-384 and SHA-512 cryptographic hash algorithms Module: library/sha512.c Caller: library/entropy.c library/md.c library/ssl_cli.c library/ssl_srv.c This module adds support for SHA-384 and SHA-512. Default value: Defined(#define) Enable simple SSL cache implementation Module: library/ssl_cache.c Default value: Defined(#define) Enable simple SSL cache implementation Module: library/ssl_cache.c Default value: Not Defined(//#define) Enable simple SSL cache implementation Module: library/ssl_cache.c Default value: Not Defined(//#define) Enable basic implementation of DTLS cookies for hello verification. Module: library/ssl_cookie.c Default value: Defined(#define) Enable basic implementation of DTLS cookies for hello verification. Module: library/ssl_cookie.c Default value: Not Defined(//#define) Enable basic implementation of DTLS cookies for hello verification. Module: library/ssl_cookie.c Default value: Not Defined(//#define) Enable an implementation of TLS server-side callbacks for session tickets. Module: library/ssl_ticket.c Default value: Defined(#define) Require: MBEDTLS_CIPHER_C Enable an implementation of TLS server-side callbacks for session tickets. Module: library/ssl_ticket.c Default value: Not Defined(//#define) Require: MBEDTLS_CIPHER_C Enable an implementation of TLS server-side callbacks for session tickets. Module: library/ssl_ticket.c Default value: Defined(#define) Require: MBEDTLS_CIPHER_C Enable an implementation of TLS server-side callbacks for session tickets. Module: library/ssl_ticket.c Default value: Not Defined(//#define) Require: MBEDTLS_CIPHER_C Enable the SSL/TLS client code Module: library/ssl_cli.c Default value: Not Defined(//#define) Require: MBEDTLS_SSL_TLS_C Enable the SSL/TLS client code Module: library/ssl_cli.c Default value: Defined(#define) Require: MBEDTLS_SSL_TLS_C Enable the SSL/TLS client code Module: library/ssl_cli.c Default value: Defined(#define) Require: MBEDTLS_SSL_TLS_C Enable the SSL/TLS server code Module: library/ssl_srv.c Default value: Not Defined(//#define) Require: MBEDTLS_SSL_TLS_C Enable the SSL/TLS server code Module: library/ssl_srv.c Default value: Defined(#define) Require: MBEDTLS_SSL_TLS_C Enable the SSL/TLS server code Module: library/ssl_srv.c Default value: Defined(#define) Require: MBEDTLS_SSL_TLS_C Enable the generic SSL/TLS code Module: library/ssl_tls.c Caller: library/ssl_cli.c library/ssl_srv.c Default value: Defined(#define) Require: MBEDTLS_CIPHER_C & MBEDTLS_MD_C & (MBEDTLS_SSL_PROTO_SSL3 | MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_DTLS) Enable the generic SSL/TLS code Module: library/ssl_tls.c Caller: library/ssl_cli.c library/ssl_srv.c Default value: Defined(#define) Require: MBEDTLS_CIPHER_C & MBEDTLS_MD_C & (MBEDTLS_SSL_PROTO_SSL3 | MBEDTLS_SSL_PROTO_TLS1 | MBEDTLS_SSL_PROTO_TLS1_1 | MBEDTLS_SSL_PROTO_DTLS) Enable the threading abstraction layer. By default mbed TLS assumes it is used in a non-threaded environment or that contexts are not shared between threads. If you do intend to use contexts between threads, you will need to enable this layer to prevent race conditions.See also our Knowledge Base article about threading: https://tls.mbed.org/kb/development/thread-safety-and-multi-threading Module: library/threading.c This allows different threading implementations (self-implemented or provided). You will have to enable either MBEDTLS_THREADING_ALT or MBEDTLS_THREADING_PTHREAD. Default value: Not Defined(//#define) Enable the portable timing interface Note:The provided implementation only works on POSIX/Unix (including Linux,BSD and OS X) and Windows. On other platforms, you can either disable thatodule and provide your own implementations of the callbacks needed by \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide your own implementation of the whole module by setting \c MBEDTLS_TIMING_ALT in the current file. Note: See also our Knowledge Base article about porting to a new environment: https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS Module: library/timing.c Caller: library/havege.c Default value: Not Defined(//#define) Enable run-time version information Module: library/version.c Default value: Defined(#define) Enable run-time version information Module: library/version.c Default value: Not Defined(//#define) Enable X.509 core for using certificates. Module: library/x509.c Caller: library/x509_crl.c library/x509_crt.c library/x509_csr.c Default value: Defined(#define) Require: MBEDTLS_ASN1_PARSE_C & MBEDTLS_BIGNUM_C & MBEDTLS_OID_C & MBEDTLS_PK_PARSE_C Enable X.509 core for using certificates. Module: library/x509.c Caller: library/x509_crl.c library/x509_crt.c library/x509_csr.c Default value: Defined(#define) Require: MBEDTLS_ASN1_PARSE_C & MBEDTLS_BIGNUM_C & MBEDTLS_OID_C & MBEDTLS_PK_PARSE_C Enable X.509 certificate parsing. Module: library/x509_crt.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c Default value: Defined(#define) Require: MBEDTLS_X509_USE_C Enable X.509 certificate parsing. Module: library/x509_crt.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c Default value: Defined(#define) Require: MBEDTLS_X509_USE_C Enable X.509 CRL parsing. Module: library/x509_crl.c Caller: library/x509_crt.c Default value: Defined(#define) Require: MBEDTLS_X509_USE_C Enable X.509 CRL parsing. Module: library/x509_crl.c Caller: library/x509_crt.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_USE_C Enable X.509 CRL parsing. Module: library/x509_crl.c Caller: library/x509_crt.c Default value: Defined(#define) Require: MBEDTLS_X509_USE_C Enable X.509 CRL parsing. Module: library/x509_crl.c Caller: library/x509_crt.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_USE_C Enable X.509 Certificate Signing Request (CSR) parsing. Module: library/x509_csr.c Caller: library/x509_crt_write.c Default value: Defined(#define) Require: MBEDTLS_X509_USE_C Enable X.509 Certificate Signing Request (CSR) parsing. Module: library/x509_csr.c Caller: library/x509_crt_write.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_USE_C Enable X.509 Certificate Signing Request (CSR) parsing. Module: library/x509_csr.c Caller: library/x509_crt_write.c Default value: Defined(#define) Require: MBEDTLS_X509_USE_C Enable X.509 Certificate Signing Request (CSR) parsing. Module: library/x509_csr.c Caller: library/x509_crt_write.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_USE_C Enable X.509 core for creating certificates. Module: library/x509_create.c Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C & MBEDTLS_PK_WRITE_C Enable X.509 core for creating certificates. Module: library/x509_create.c Default value: Not Defined(//#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C & MBEDTLS_PK_WRITE_C Enable X.509 core for creating certificates. Module: library/x509_create.c Default value: Defined(#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C & MBEDTLS_PK_WRITE_C Enable X.509 core for creating certificates. Module: library/x509_create.c Default value: Not Defined(//#define) Require: MBEDTLS_BIGNUM_C & MBEDTLS_OID_C & MBEDTLS_PK_WRITE_C Enable creating X.509 certificates. Module: library/x509_crt_write.c Default value: Defined(#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 certificates. Module: library/x509_crt_write.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 certificates. Module: library/x509_crt_write.c Default value: Defined(#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 certificates. Module: library/x509_crt_write.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 Certificate Signing Requests (CSR). Module: library/x509_csr_write.c Default value: Defined(#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 Certificate Signing Requests (CSR). Module: library/x509_csr_write.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 Certificate Signing Requests (CSR). Module: library/x509_csr_write.c Default value: Defined(#define) Require: MBEDTLS_X509_CREATE_C Enable creating X.509 Certificate Signing Requests (CSR). Module: library/x509_csr_write.c Default value: Not Defined(//#define) Require: MBEDTLS_X509_CREATE_C Enable the XTEA block cipher Module: library/xtea.c Default value: Defined(#define) Enable the XTEA block cipher Module: library/xtea.c Default value: Not Defined(//#define) Enable MBEDTLS_MPI_WINDOW_SIZE options configuration Default value: Disabled Require: MBEDTLS_BIGNUM_C Enable MBEDTLS_MPI_WINDOW_SIZE options configuration Default value: Disabled Require: MBEDTLS_BIGNUM_C Maximum windows size used Default value: 6 Maximum windows size used Default value: 6 Enable MBEDTLS_MPI_MAX_SIZE options configuration Default value: Disabled Require: MBEDTLS_BIGNUM_C Enable MBEDTLS_MPI_MAX_SIZE options configuration Default value: Enabled Require: MBEDTLS_BIGNUM_C Enable MBEDTLS_MPI_MAX_SIZE options configuration Default value: Disabled Require: MBEDTLS_BIGNUM_C Maximum number of bytes for usable MPIs Default value: 1024 Maximum number of bytes for usable MPIs Default value: 48 Maximum number of bytes for usable MPIs Default value: 1024 Enable MBEDTLS_CTR_DRBG_ENTROPY_LEN options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Enable MBEDTLS_CTR_DRBG_ENTROPY_LEN options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) Default value: 48 Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) Default value: 48 Enable MBEDTLS_CTR_DRBG_RESEED_INTERVAL options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Enable MBEDTLS_CTR_DRBG_RESEED_INTERVAL options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Interval before reseed is performed by default Default value: 1000 Interval before reseed is performed by default Default value: 1000 Enable MBEDTLS_CTR_DRBG_MAX_INPUT options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Enable MBEDTLS_CTR_DRBG_MAX_INPUT options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Maximum number of additional input bytes Default value: 256 Maximum number of additional input bytes Default value: 256 Enable MBEDTLS_CTR_DRBG_MAX_REQUEST options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Enable MBEDTLS_CTR_DRBG_MAX_REQUEST options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Maximum number of requested bytes per call Default value: 1024 Maximum number of requested bytes per call Default value: 1024 Enable MBEDTLS_CTR_DRBG_MAX_SEED_INPUT options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Enable MBEDTLS_CTR_DRBG_MAX_SEED_INPUT options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Maximum size of (re)seed buffer Default value: 384 Maximum size of (re)seed buffer Default value: 384 Enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY options configuration Default value: Disabled Require: MBEDTLS_CTR_DRBG_C Use 128-bit key for CTR_DRBG - may reduce security (see ctr_drbg.h) Use 128-bit key for CTR_DRBG - may reduce security (see ctr_drbg.h) Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Interval before reseed is performed by default Default value: 10000 Interval before reseed is performed by default Default value: 10000 Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Maximum number of additional input bytes Default value: 256 Maximum number of additional input bytes Default value: 256 Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Maximum number of requested bytes per call Default value: 1024 Maximum number of requested bytes per call Default value: 1024 Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Enable HMAC_DRBG options configuration Default value: Disabled Require: MBEDTLS_HMAC_DRBG_C Maximum size of (re)seed buffer Default value: 384 Maximum size of (re)seed buffer Default value: 384 Enable MBEDTLS_ECP_MAX_BITS options configuration Default value: Disabled Require: MBEDTLS_ECP_C Enable MBEDTLS_ECP_MAX_BITS options configuration Default value: Enabled Require: MBEDTLS_ECP_C Enable MBEDTLS_ECP_MAX_BITS options configuration Default value: Disabled Require: MBEDTLS_ECP_C Maximum bit size of groups Default value: 521 Maximum bit size of groups Default value: 384 Maximum bit size of groups Default value: 521 Enable MBEDTLS_ECP_WINDOW_SIZE options configuration Default value: Disabled Require: MBEDTLS_ECP_C Enable MBEDTLS_ECP_WINDOW_SIZE options configuration Default value: Enabled Require: MBEDTLS_ECP_C Enable MBEDTLS_ECP_WINDOW_SIZE options configuration Default value: Disabled Require: MBEDTLS_ECP_C Maximum window size used Default value: 6 Maximum window size used Default value: 2 Maximum window size used Default value: 6 Enable MBEDTLS_ECP_FIXED_POINT_OPTIM options configuration Default value: Disabled Require: MBEDTLS_ECP_C Enable MBEDTLS_ECP_FIXED_POINT_OPTIM options configuration Default value: Enabled Require: MBEDTLS_ECP_C Enable MBEDTLS_ECP_FIXED_POINT_OPTIM options configuration Default value: Disabled Require: MBEDTLS_ECP_C Enable fixed-point speed-up Default value: 1 Enable fixed-point speed-up Default value: 0 Enable fixed-point speed-up Default value: 0 Enable MBEDTLS_ENTROPY_MAX_SOURCES options configuration Default value: Disabled Require: MBEDTLS_ENTROPY_C Enable MBEDTLS_ENTROPY_MAX_SOURCES options configuration Default value: Enabled Require: MBEDTLS_ENTROPY_C Enable MBEDTLS_ENTROPY_MAX_SOURCES options configuration Default value: Disabled Require: MBEDTLS_ENTROPY_C Maximum number of sources supported Default value: 20 Maximum number of sources supported Default value: 2 Maximum number of sources supported Default value: 20 Enable MBEDTLS_ENTROPY_MAX_GATHER options configuration Default value: Disabled Require: MBEDTLS_ENTROPY_C Enable MBEDTLS_ENTROPY_MAX_GATHER options configuration Default value: Disabled Require: MBEDTLS_ENTROPY_C Maximum amount requested from entropy sources Default value: 128 Maximum amount requested from entropy sources Default value: 128 Enable MBEDTLS_ENTROPY_MIN_HARDWARE options configuration Default value: Disabled Require: MBEDTLS_ENTROPY_C Enable MBEDTLS_ENTROPY_MIN_HARDWARE options configuration Default value: Disabled Require: MBEDTLS_ENTROPY_C Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released Default value: 32 Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released Default value: 32 Enable MBEDTLS_MEMORY_ALIGN_MULTIPLE options configuration Default value: Disabled Require: MBEDTLS_MEMORY_BUFFER_ALLOC_C Enable MBEDTLS_MEMORY_ALIGN_MULTIPLE options configuration Default value: Disabled Require: MBEDTLS_MEMORY_BUFFER_ALLOC_C Align on multiples of this value Default value: 4 Align on multiples of this value Default value: 4 Enable MBEDTLS_PLATFORM_STD_MEM_HDR options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_PLATFORM_NO_STD_FUNCTIONS Enable MBEDTLS_PLATFORM_STD_MEM_HDR options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_PLATFORM_NO_STD_FUNCTIONS Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. Default value: stdlib.h Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. Default value: stdlib.h Enable MBEDTLS_PLATFORM_STD_CALLOC options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_CALLOC options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default allocator to use, can be undefined Default value: calloc Default allocator to use, can be undefined Default value: calloc Enable MBEDTLS_PLATFORM_STD_FREE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_FREE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default free to use, can be undefined Default value: free Default free to use, can be undefined Default value: free Enable MBEDTLS_PLATFORM_STD_EXIT options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_EXIT options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default exit to use, can be undefined Default value: exit Default exit to use, can be undefined Default value: exit Enable MBEDTLS_PLATFORM_STD_TIME options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C &MBEDTLS_HAVE_TIME Enable MBEDTLS_PLATFORM_STD_TIME options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C &MBEDTLS_HAVE_TIME Default time to use, can be undefined Default value: time Default time to use, can be undefined Default value: time Enable MBEDTLS_PLATFORM_STD_FPRINTF options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_FPRINTF options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default fprintf to use, can be undefined Default value: fprintf Default fprintf to use, can be undefined Default value: fprintf Enable MBEDTLS_PLATFORM_STD_PRINTF options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_PRINTF options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default printf to use, can be undefined Default value: printf Default printf to use, can be undefined Default value: printf Enable MBEDTLS_PLATFORM_STD_SNPRINTF options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_SNPRINTF options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default snprintf to use, can be undefined Default value: snprintf Default snprintf to use, can be undefined Default value: snprintf Enable MBEDTLS_PLATFORM_STD_EXIT_SUCCESS options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_EXIT_SUCCESS options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default exit value to use, can be undefined Default value: 0 Default exit value to use, can be undefined Default value: 0) Enable MBEDTLS_PLATFORM_STD_EXIT_FAILURE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_EXIT_FAILURE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default exit value to use, can be undefined Default value: 0 Default exit value to use, can be undefined Default value: 0 Enable MBEDTLS_PLATFORM_STD_NV_SEED_READ options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_NV_SEED_READ options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default nv_seed_read function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_read Default nv_seed_read function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_read Enable MBEDTLS_PLATFORM_STD_NV_SEED_WRITE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_NV_SEED_WRITE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default nv_seed_write function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_write Default nv_seed_write function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_write Enable MBEDTLS_PLATFORM_STD_NV_SEED_FILE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_STD_NV_SEED_FILE options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Seed file to read/write with default implementation Default value: seedfile Seed file to read/write with default implementation Default value: seedfile Enable MBEDTLS_PLATFORM_CALLOC_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_CALLOC_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default allocator macro to use, can be undefined Default value: calloc Default allocator macro to use, can be undefined Default value: calloc Enable MBEDTLS_PLATFORM_FREE_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_FREE_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default free macro to use, can be undefined Default value: free Default free macro to use, can be undefined Default value: free Enable MBEDTLS_PLATFORM_EXIT_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & !MBEDTLS_PLATFORM_EXIT_ALT Enable MBEDTLS_PLATFORM_EXIT_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & !MBEDTLS_PLATFORM_EXIT_ALT Default exit macro to use, can be undefined Default value: exit Default exit macro to use, can be undefined Default value: exit Enable MBEDTLS_PLATFORM_TIME_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_TIME_ALT Enable MBEDTLS_PLATFORM_TIME_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_TIME_ALT Default time macro to use, can be undefined Default value: time Default time macro to use, can be undefined Default value: time Enable MBEDTLS_PLATFORM_TIME_TYPE_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME Enable MBEDTLS_PLATFORM_TIME_TYPE_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME Default time macro to use, can be undefined Default value: time_t Default time macro to use, can be undefined Default value: time_t Enable MBEDTLS_PLATFORM_FPRINTF_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_FPRINTF_ALT Enable MBEDTLS_PLATFORM_FPRINTF_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_FPRINTF_ALT Default fprintf macro to use, can be undefined Default value: fprintf Default fprintf macro to use, can be undefined Default value: fprintf Enable MBEDTLS_PLATFORM_PRINTF_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_PRINTF_ALT Enable MBEDTLS_PLATFORM_PRINTF_MACRO options configuration Default value: Enabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_PRINTF_ALT Enable MBEDTLS_PLATFORM_PRINTF_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME &!MBEDTLS_PLATFORM_PRINTF_ALT Default printf macro to use, can be undefined Default value: printf Default printf macro to use, can be undefined Default value: printf Default printf macro to use, can be undefined Default value: printf Enable MBEDTLS_PLATFORM_SNPRINTF_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_SNPRINTF_ALT Enable MBEDTLS_PLATFORM_SNPRINTF_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C & MBEDTLS_HAVE_TIME & !MBEDTLS_PLATFORM_SNPRINTF_ALT Default snprintf macro to use, can be undefined Default value: snprintf Default snprintf macro to use, can be undefined Default value: snprintf Enable MBEDTLS_PLATFORM_NV_SEED_READ_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_NV_SEED_READ_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default nv_seed_read function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_read Default nv_seed_read function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_read Enable MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Enable MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO options configuration Default value: Disabled Require: MBEDTLS_PLATFORM_C Default nv_seed_write function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_write Default nv_seed_write function to use, can be undefined Default value: mbedtls_platform_std_nv_seed_write Enable MBEDTLS_PARAM_FAILED options configuration Default value: Disabled This macro is invoked by the library when an invalid parameter is detected that is only checked with MBEDTLS_CHECK_PARAMS (see the documentation of that option for context). When you leave this undefined here, a default definition is provided that invokes the function mbedtls_param_failed(), which is declared in platform_util.h for the benefit of the library, but that you need to define in your application. When you define this here, this replaces the default definition in platform_util.h (which no longer declares the function mbedtls_param_failed()) and it is your responsibility to make sure this macro expands to something suitable (in particular, that all the necessary declarations are visible from within the library - you can ensure that by providing them in this file next to the macro definition). Note that you may define this macro to expand to nothing, in which case you don't have to worry about declarations or definitions. However, you will then be notified about invalid parameters only in non-void functions, and void function will just silently return early on invalid parameters, which partially negates the benefits of enabling #MBEDTLS_CHECK_PARAMS in the first place, so is discouraged. Default value: cond Default nv_seed_write function to use, can be undefined Default value: cond Enable MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT options configuration Default value: Disabled Require: MBEDTLS_SSL_CACHE_C Enable MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT options configuration Default value: Disabled Require: MBEDTLS_SSL_CACHE_C 1 day Default value: 86400 1 day Default value: 86400 Enable MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES options configuration Default value: Disabled Require: MBEDTLS_SSL_CACHE_C Enable MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES options configuration Default value: Disabled Require: MBEDTLS_SSL_CACHE_C Maximum entries in cache Default value: 50 Maximum entries in cache Default value: 50 Enable MBEDTLS_SSL_MAX_CONTENT_LEN options configuration Default value: Enabled Maximum fragment length in bytes, determines the size of each of the two internal I/O buffers Default value: 2048 Maximum fragment length in bytes, determines the size of each of the two internal I/O buffers Default value: 16384 Enable MBEDTLS_SSL_IN_CONTENT_LEN options configuration Default value: Disabled Maximum incoming fragment length in bytes. Default value: Disabled Enable MBEDTLS_SSL_OUT_CONTENT_LEN options configuration Default value: Disabled Maximum outgoing fragment length in bytes. Uncomment to set the size of the outward TLS buffer independently of the inward buffer. It is possible to save RAM by setting a smaller outward buffer, while keeping the default inward 16384 byte buffer to conform to the TLS specification. The minimum required outward buffer size is determined by the handshake protocol's usage. Handshaking will fail if the outward buffer is too small. The specific size requirement depends on the configured ciphers and any certificate data which is sent during the handshake. For absolute minimum RAM usage, it's best to enable MBEDTLS_SSL_MAX_FRAGMENT_LENGTH and reduce MBEDTLS_SSL_MAX_CONTENT_LEN. This reduces both incoming and outgoing buffer sizes. However this is only guaranteed if the other end of the connection also supports the TLS max_fragment_len extension. Otherwise the connection may fail. Default value: Disabled Enable MBEDTLS_SSL_DTLS_MAX_BUFFERING options configuration Default value: Disabled Maximum number of heap-allocated bytes for the purpose of DTLS handshake message reassembly and future message buffering. This should be at least 9/8 * MBEDTLSSL_IN_CONTENT_LEN to account for a reassembled handshake message of maximum size, together with its reassembly bitmap. A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) should be sufficient for all practical situations as it allows to reassembly a large handshake message (such as a certificate)while buffering multiple smaller handshake messages. Default value: Disabled Enable MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME options configuration Default value: Disabled Lifetime of session tickets (if enabled) Default value: 86400 Lifetime of session tickets (if enabled) Default value: 86400 Enable MBEDTLS_PSK_MAX_LEN options configuration Default value: Disabled Max size of TLS pre-shared keys, in bytes (default 256 bits) Default value: 32 Max size of TLS pre-shared keys, in bytes (default 256 bits) Default value: 32 Enable MBEDTLS_SSL_COOKIE_TIMEOUT options configuration Default value: Disabled Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued Default value: 60 Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued Default value: 60 Enable MBEDTLS_SSL_CIPHERSUITES options configuration Default value: Disabled Enable MBEDTLS_SSL_CIPHERSUITES options configuration Default value: Disabled No dependency checking is done on that field! This option can only be used to restrict the set of available ciphersuites. It is your responsibility to make sure the needed modules are active. Use this to save a few hundred bytes of ROM (default ordering of all available ciphersuites) and a few to a few hundred bytes of RAM. Default value: MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 No dependency checking is done on that field! This option can only be used to restrict the set of available ciphersuites. It is your responsibility to make sure the needed modules are active. Use this to save a few hundred bytes of ROM (default ordering of all available ciphersuites) and a few to a few hundred bytes of RAM. Default value: MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 Enable MBEDTLS_X509_MAX_INTERMEDIATE_CA options configuration Default value: Disabled Require: MBEDTLS_X509_USE_C Enable MBEDTLS_X509_MAX_INTERMEDIATE_CA options configuration Default value: Disabled Require: MBEDTLS_X509_USE_C Maximum number of intermediate CAs in a verification chain. Default value: 8 Maximum number of intermediate CAs in a verification chain. Default value: 8 Enable MBEDTLS_X509_MAX_FILE_PATH_LEN options configuration Default value: Disabled Require: MBEDTLS_X509_USE_C Enable MBEDTLS_X509_MAX_FILE_PATH_LEN options configuration Default value: Disabled Require: MBEDTLS_X509_USE_C Maximum length of a path/filename string in bytes including the null terminator character ('\0'). Default value: 512 Maximum length of a path/filename string in bytes including the null terminator character ('\0'). Default value: 512 Allow SHA-1 in the default TLS configuration for certificate signing. Without this build-time option, SHA-1 support must be activated explicitly through mbedtls_ssl_conf_cert_profile. Turning on this option is not recommended because of it is possible to generate SHA-1 collisions, however this may be safe for legacy infrastructure where additional controls apply. \warning SHA-1 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead. Default value: Disabled Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake signature and ciphersuite selection. Without this build-time option, SHA-1 support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. The use of SHA-1 in TLS version 1.1 or below and in HMAC-SHA-1 is always allowed by default. At the time of writing, there is no practical attack on the use of SHA-1 in handshake signatures, hence this option is turned on by default for compatibility with existing peers. Default value: Disabled * Uncomment the macro to let mbed TLS use your alternate implementation of mbedtls_platform_zeroize(). This replaces the default implementation in platform_util.c. mbedtls_platform_zeroize() is a widely used function across the library to zero a block of memory. The implementation is expected to be secure in the sense that it has been written to prevent the compiler from removing calls to mbedtls_platform_zeroize() as part of redundant code elimination optimizations. However, it is difficult to guarantee that calls to mbedtls_platform_zeroize() will not be optimized by the compiler as older versions of the C language standards do not provide a secure implementation of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to configure their own implementation of mbedtls_platform_zeroize(), for example by using directives specific to their compiler, features from newer C standards (e.g using memset_s() in C11) or calling a secure memset() from their system (e.g explicit_bzero() in BSD). Default value: Disabled * Uncomment the macro to let mbed TLS use your alternate implementation of gmtime() is not a thread-safe function as defined in the C standard. The library will try to use safer implementations of this function, such as gmtime_r() when available. However, if Mbed TLS cannot identify the target system, the implementation of mbedtls_platform_gmtime_r() will default to using the standard gmtime(). In this case, calls from the library to gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the library are also guarded with this mutex to avoid race conditions. However, if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will unconditionally use the implementation for mbedtls_platform_gmtime_r() supplied at compile time. . Default value: Disabled Enable YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE options configuration Default value: Disabled Target and application specific configurations Allow user to override any previous default. Use two macro names for that, as: - with yotta the prefix YOTTA_CFG_ is forced - without yotta is looks weird to have a YOTTA prefix. Default value: mbedtls/target_config.h Target and application specific configurations Allow user to override any previous default. Use two macro names for that, as: - with yotta the prefix YOTTA_CFG_ is forced - without yotta is looks weird to have a YOTTA prefix. Default value: mbedtls/target_config.h MBEDTLS_ENABLE_Init S_MBEDTLS