1 /* 2 * Copyright (c) 2023-2025, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 /** 8 * This set of compile-time options may be used to enable 9 * or disable features selectively, and reduce the global 10 * memory footprint. 11 */ 12 13 /* 14 * This file is compatible with versions >= 3.6.4 15 */ 16 #define MBEDTLS_CONFIG_VERSION 0x03060400 17 18 /* 19 * Key algorithms currently supported on mbed TLS libraries 20 */ 21 #define TF_MBEDTLS_RSA 1 22 #define TF_MBEDTLS_ECDSA 2 23 #define TF_MBEDTLS_RSA_AND_ECDSA 3 24 25 #define TF_MBEDTLS_USE_RSA (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA \ 26 || TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA) 27 #define TF_MBEDTLS_USE_ECDSA (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA \ 28 || TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA) 29 30 /* 31 * Hash algorithms currently supported on mbed TLS libraries 32 */ 33 #define TF_MBEDTLS_SHA256 1 34 #define TF_MBEDTLS_SHA384 2 35 #define TF_MBEDTLS_SHA512 3 36 37 /* 38 * Configuration file to build mbed TLS with the required features for 39 * Trusted Boot 40 */ 41 42 #define MBEDTLS_PLATFORM_MEMORY 43 #define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS 44 /* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */ 45 #define MBEDTLS_PLATFORM_SNPRINTF_ALT 46 47 #define MBEDTLS_PKCS1_V21 48 49 #define MBEDTLS_ASN1_PARSE_C 50 #define MBEDTLS_ASN1_WRITE_C 51 52 #define MBEDTLS_BASE64_C 53 #define MBEDTLS_BIGNUM_C 54 55 #define MBEDTLS_ERROR_C 56 #define MBEDTLS_MD_C 57 58 #define MBEDTLS_MEMORY_BUFFER_ALLOC_C 59 #define MBEDTLS_OID_C 60 61 #define MBEDTLS_PK_C 62 #define MBEDTLS_PK_PARSE_C 63 #define MBEDTLS_PK_WRITE_C 64 65 #define MBEDTLS_PLATFORM_C 66 67 #if TF_MBEDTLS_USE_ECDSA 68 #define MBEDTLS_ECDSA_C 69 #define MBEDTLS_ECP_C 70 #if TF_MBEDTLS_KEY_SIZE == 384 71 #define MBEDTLS_ECP_DP_SECP384R1_ENABLED 72 #else 73 #define MBEDTLS_ECP_DP_SECP256R1_ENABLED 74 #endif 75 #endif 76 #if TF_MBEDTLS_USE_RSA 77 #define MBEDTLS_RSA_C 78 #define MBEDTLS_X509_RSASSA_PSS_SUPPORT 79 #endif 80 81 /* Enable hash algorithms based on TBB or Measured Boot */ 82 #if (TF_MBEDTLS_HASH_ALG_ID == TF_MBEDTLS_SHA256) || defined(TF_MBEDTLS_MBOOT_USE_SHA256) 83 #define MBEDTLS_SHA256_C 84 #endif 85 86 #if (TF_MBEDTLS_HASH_ALG_ID == TF_MBEDTLS_SHA384) || defined(TF_MBEDTLS_MBOOT_USE_SHA384) 87 #define MBEDTLS_SHA384_C 88 #endif 89 90 #if (TF_MBEDTLS_HASH_ALG_ID == TF_MBEDTLS_SHA512) || defined(TF_MBEDTLS_MBOOT_USE_SHA512) 91 #define MBEDTLS_SHA512_C 92 #endif 93 94 #define MBEDTLS_VERSION_C 95 96 #define MBEDTLS_X509_USE_C 97 #define MBEDTLS_X509_CRT_PARSE_C 98 99 #if TF_MBEDTLS_USE_AES_GCM 100 #define MBEDTLS_AES_C 101 #define MBEDTLS_CIPHER_C 102 #define MBEDTLS_GCM_C 103 #endif 104 105 /* MPI / BIGNUM options */ 106 107 /* Note: Lower numbers trade longer execution time for less RAM allocation */ 108 #define MBEDTLS_MPI_WINDOW_SIZE 1 109 110 #if TF_MBEDTLS_USE_RSA 111 #if TF_MBEDTLS_KEY_SIZE <= 2048 112 #define MBEDTLS_MPI_MAX_SIZE 256 113 #else 114 #define MBEDTLS_MPI_MAX_SIZE 512 115 #endif 116 #else 117 #define MBEDTLS_MPI_MAX_SIZE 256 118 #endif 119 120 /* Memory buffer allocator options */ 121 #define MBEDTLS_MEMORY_ALIGN_MULTIPLE 8 122 123 /* 124 * Prevent the use of 128-bit division which 125 * creates dependency on external libraries. 126 */ 127 #define MBEDTLS_NO_UDBL_DIVISION 128 129 #ifndef __ASSEMBLER__ 130 /* System headers required to build mbed TLS with the current configuration */ 131 #include <stdlib.h> 132 #endif 133 134 /* 135 * Determine Mbed TLS heap size. 136 */ 137 #if TF_MBEDTLS_USE_ECDSA 138 #define TF_MBEDTLS_HEAP_SIZE U(13 * 1024) 139 #elif TF_MBEDTLS_USE_RSA 140 #if TF_MBEDTLS_KEY_SIZE <= 2048 141 #define TF_MBEDTLS_HEAP_SIZE U(7 * 1024) 142 #else 143 #define TF_MBEDTLS_HEAP_SIZE U(11 * 1024) 144 #endif 145 #endif 146 147 /* 148 * Warn if errors from certain functions are ignored. 149 * 150 * The warnings are always enabled (where supported) for critical functions 151 * where ignoring the return value is almost always a bug. This macro extends 152 * the warnings to more functions. 153 */ 154 #define MBEDTLS_CHECK_RETURN_WARNING 155 156 /* 157 * Use an implementation of SHA-256 with a smaller memory footprint but reduced 158 * speed. 159 */ 160 #define MBEDTLS_SHA256_SMALLER 161