blob: e8e0f676314598ce110495203d19363b03e3a580 [file] [log] [blame]
# Kconfig.tls - TLS/DTLS related options
# Copyright (c) 2018 Intel Corporation
# Copyright (c) 2018 Nordic Semiconductor ASA
# SPDX-License-Identifier: Apache-2.0
menu "TLS configuration"
menu "Supported TLS version"
config MBEDTLS_TLS_VERSION_1_0
bool "Enable support for TLS 1.0"
select MBEDTLS_MAC_MD5_ENABLED
select MBEDTLS_MAC_SHA1_ENABLED
config MBEDTLS_TLS_VERSION_1_1
bool "Enable support for TLS 1.1 (DTLS 1.0)"
select MBEDTLS_MAC_MD5_ENABLED
select MBEDTLS_MAC_SHA1_ENABLED
config MBEDTLS_TLS_VERSION_1_2
bool "Enable support for TLS 1.2 (DTLS 1.2)"
default y
config MBEDTLS_DTLS
bool "Enable support for DTLS"
depends on MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
config MBEDTLS_SSL_EXPORT_KEYS
bool "Enable support for exporting SSL key block and master secret"
depends on MBEDTLS_TLS_VERSION_1_0 || MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2
endmenu
menu "Ciphersuite configuration"
comment "Supported key exchange modes"
config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
bool "Enable all available ciphersuite modes"
select MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
config MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
bool "Enable the PSK based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
bool "Enable the DHE-PSK based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
bool "Enable the ECDHE-PSK based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
bool "Enable the RSA-PSK based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
bool "Enable the RSA-only based ciphersuite modes"
default y if !NET_L2_OPENTHREAD
config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
bool "Enable the DHE-RSA based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
bool "Enable the ECDHE-RSA based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
bool "Enable the ECDHE-ECDSA based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
bool "Enable the ECDH-ECDSA based ciphersuite modes"
config MBEDTLS_ECDSA_DETERMINISTIC
bool "Enable deterministic ECDSA (RFC 6979)"
config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
bool "Enable the ECDH-RSA based ciphersuite modes"
config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
bool "Enable the ECJPAKE based ciphersuite modes"
if MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \
MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || \
MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || \
MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED || \
MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || \
MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
comment "Supported elliptic curves"
config MBEDTLS_ECP_ALL_ENABLED
bool "Enable all available elliptic curves"
select MBEDTLS_ECP_DP_SECP192R1_ENABLED
select MBEDTLS_ECP_DP_SECP192R1_ENABLED
select MBEDTLS_ECP_DP_SECP224R1_ENABLED
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
select MBEDTLS_ECP_DP_SECP384R1_ENABLED
select MBEDTLS_ECP_DP_SECP521R1_ENABLED
select MBEDTLS_ECP_DP_SECP192K1_ENABLED
select MBEDTLS_ECP_DP_SECP224K1_ENABLED
select MBEDTLS_ECP_DP_SECP256K1_ENABLED
select MBEDTLS_ECP_DP_BP256R1_ENABLED
select MBEDTLS_ECP_DP_BP384R1_ENABLED
select MBEDTLS_ECP_DP_BP512R1_ENABLED
select MBEDTLS_ECP_DP_CURVE25519_ENABLED
select MBEDTLS_ECP_DP_CURVE448_ENABLED
select MBEDTLS_ECP_NIST_OPTIM
config MBEDTLS_ECP_DP_SECP192R1_ENABLED
bool "Enable SECP192R1 elliptic curve"
config MBEDTLS_ECP_DP_SECP224R1_ENABLED
bool "Enable SECP224R1 elliptic curve"
config MBEDTLS_ECP_DP_SECP256R1_ENABLED
bool "Enable SECP256R1 elliptic curve"
config MBEDTLS_ECP_DP_SECP384R1_ENABLED
bool "Enable SECP384R1 elliptic curve"
config MBEDTLS_ECP_DP_SECP521R1_ENABLED
bool "Enable SECP521R1 elliptic curve"
config MBEDTLS_ECP_DP_SECP192K1_ENABLED
bool "Enable SECP192K1 elliptic curve"
config MBEDTLS_ECP_DP_SECP224K1_ENABLED
bool "Enable SECP224K1 elliptic curve"
config MBEDTLS_ECP_DP_SECP256K1_ENABLED
bool "Enable SECP256K1 elliptic curve"
config MBEDTLS_ECP_DP_BP256R1_ENABLED
bool "Enable BP256R1 elliptic curve"
config MBEDTLS_ECP_DP_BP384R1_ENABLED
bool "Enable BP384R1 elliptic curve"
config MBEDTLS_ECP_DP_BP512R1_ENABLED
bool "Enable BP512R1 elliptic curve"
config MBEDTLS_ECP_DP_CURVE25519_ENABLED
bool "Enable CURVE25519 elliptic curve"
config MBEDTLS_ECP_DP_CURVE448_ENABLED
bool "Enable CURVE448 elliptic curve"
config MBEDTLS_ECP_NIST_OPTIM
bool "Enable NSIT curves optimization"
endif
comment "Supported cipher modes"
config MBEDTLS_CIPHER_ALL_ENABLED
bool "Enable all available ciphers"
select MBEDTLS_CIPHER_AES_ENABLED
select MBEDTLS_CIPHER_CAMELLIA_ENABLED
select MBEDTLS_CIPHER_DES_ENABLED
select MBEDTLS_CIPHER_ARC4_ENABLED
select MBEDTLS_CIPHER_CHACHA20_ENABLED
select MBEDTLS_CIPHER_BLOWFISH_ENABLED
select MBEDTLS_CIPHER_CCM_ENABLED
select MBEDTLS_CIPHER_MODE_XTS_ENABLED
select MBEDTLS_CIPHER_MODE_GCM_ENABLED
select MBEDTLS_CIPHER_CBC_ENABLED
select MBEDTLS_CHACHAPOLY_AEAD_ENABLED
config MBEDTLS_CIPHER_AES_ENABLED
bool "Enable the AES block cipher"
default y
config MBEDTLS_AES_ROM_TABLES
depends on MBEDTLS_CIPHER_AES_ENABLED
bool "Use precomputed AES tables stored in ROM."
default y
config MBEDTLS_CIPHER_CAMELLIA_ENABLED
bool "Enable the Camellia block cipher"
config MBEDTLS_CIPHER_DES_ENABLED
bool "Enable the DES block cipher"
default y if !NET_L2_OPENTHREAD
config MBEDTLS_CIPHER_ARC4_ENABLED
bool "Enable the ARC4 stream cipher"
config MBEDTLS_CIPHER_CHACHA20_ENABLED
bool "Enable the ChaCha20 stream cipher"
config MBEDTLS_CIPHER_BLOWFISH_ENABLED
bool "Enable the Blowfish block cipher"
config MBEDTLS_CIPHER_CCM_ENABLED
bool "Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher"
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_CAMELLIA_ENABLED
config MBEDTLS_CIPHER_MODE_XTS_ENABLED
bool "Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES"
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_CAMELLIA_ENABLED
config MBEDTLS_CIPHER_MODE_GCM_ENABLED
bool "Enable the Galois/Counter Mode (GCM) for AES"
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_CAMELLIA_ENABLED
config MBEDTLS_CIPHER_CBC_ENABLED
bool "Enable Cipher Block Chaining mode (CBC) for symmetric ciphers"
default y if !NET_L2_OPENTHREAD
config MBEDTLS_CHACHAPOLY_AEAD_ENABLED
bool "Enable the ChaCha20-Poly1305 AEAD algorithm"
depends on MBEDTLS_CIPHER_CHACHA20_ENABLED || MBEDTLS_MAC_POLY1305_ENABLED
comment "Supported message authentication methods"
config MBEDTLS_MAC_ALL_ENABLED
bool "Enable all available MAC methods"
select MBEDTLS_MAC_MD4_ENABLED
select MBEDTLS_MAC_MD5_ENABLED
select MBEDTLS_MAC_SHA1_ENABLED
select MBEDTLS_MAC_SHA256_ENABLED
select MBEDTLS_MAC_SHA512_ENABLED
select MBEDTLS_MAC_POLY1305_ENABLED
select MBEDTLS_MAC_CMAC_ENABLED
config MBEDTLS_MAC_MD4_ENABLED
bool "Enable the MD4 hash algorithm"
config MBEDTLS_MAC_MD5_ENABLED
bool "Enable the MD5 hash algorithm"
default y if !NET_L2_OPENTHREAD
config MBEDTLS_MAC_SHA1_ENABLED
bool "Enable the SHA1 hash algorithm"
default y if !NET_L2_OPENTHREAD
config MBEDTLS_MAC_SHA256_ENABLED
bool "Enable the SHA-224 and SHA-256 hash algorithms"
default y
config MBEDTLS_SHA256_SMALLER
bool "Enable smaller SHA-256 implementation"
depends on MBEDTLS_MAC_SHA256_ENABLED
default y
help
Enable an implementation of SHA-256 that has lower ROM footprint but also
lower performance
config MBEDTLS_MAC_SHA512_ENABLED
bool "Enable the SHA-384 and SHA-512 hash algorithms"
config MBEDTLS_MAC_POLY1305_ENABLED
bool "Enable the Poly1305 MAC algorithm"
config MBEDTLS_MAC_CMAC_ENABLED
bool "Enable the CMAC (Cipher-based Message Authentication Code) mode for block ciphers."
depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_DES_ENABLED
endmenu
comment "Random number generators"
config MBEDTLS_CTR_DRBG_ENABLED
bool "Enable the CTR_DRBG AES-256-based random generator"
depends on MBEDTLS_CIPHER_AES_ENABLED
default y
config MBEDTLS_HMAC_DRBG_ENABLED
bool "Enable the HMAC_DRBG random generator"
comment "Other configurations"
config MBEDTLS_GENPRIME_ENABLED
bool "Enable the prime-number generation code."
config MBEDTLS_PEM_CERTIFICATE_FORMAT
bool "Enable support for PEM certificate format"
help
By default only DER (binary) format of certificates is supported. Enable
this option to enable support for PEM format.
config MBEDTLS_HAVE_ASM
bool "Enable use of assembly code"
default y if !ARM
help
Enable use of assembly code in mbedTLS. This improves the performances
of asymmetric cryptography, however this might have an impact on the
code size.
config MBEDTLS_ENTROPY_ENABLED
bool "Enable mbedTLS generic entropy pool"
depends on MBEDTLS_MAC_SHA256_ENABLED || MBEDTLS_MAC_SHA512_ENABLED
config MBEDTLS_OPENTHREAD_OPTIMIZATIONS_ENABLED
bool "Enable mbedTLS optimizations for OpenThread"
depends on NET_L2_OPENTHREAD
default y if !NET_SOCKETS_SOCKOPT_TLS
help
Enable some OpenThread specific mbedTLS optimizations that allows to
save some RAM/ROM when OpenThread is used. Note, that when application
aims to use other mbedTLS services on top of OpenThread (e.g. secure
sockets), it's advised to disable this option.
config MBEDTLS_USER_CONFIG_ENABLE
bool "Enable user mbedTLS config file"
help
Enable user mbedTLS config file that will be included at the end of
the generic config file.
config MBEDTLS_USER_CONFIG_FILE
string "User configuration file for mbedTLS"
depends on MBEDTLS_USER_CONFIG_ENABLE
help
User config file that can contain mbedTLS configs that were not
covered by the generic config file.
endmenu