config.h File Reference

Configuration options (set of defines) More...

`#include "mbedtls/check_config.h"`
Include dependency graph for config.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

## Macros

SECTION: System support
This section sets system specific settings.
#define | MBEDTLS_HAVE_ASM
#define | MBEDTLS_HAVE_TIME
#define | MBEDTLS_HAVE_TIME_DATE
#define | MBEDTLS_DEPRECATED_WARNING
SECTION: mbed TLS feature support
This section sets support for features that are or are not needed within the modules that are enabled.
#define | MBEDTLS_CIPHER_MODE_CBC
#define | MBEDTLS_CIPHER_MODE_CFB
#define | MBEDTLS_CIPHER_MODE_CTR
#define | MBEDTLS_CIPHER_MODE_OFB
#define | MBEDTLS_CIPHER_MODE_XTS
#define | MBEDTLS_CIPHER_PADDING_PKCS7
#define | MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
#define | MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
#define | MBEDTLS_CIPHER_PADDING_ZEROS
#define | MBEDTLS_REMOVE_ARC4_CIPHERSUITES
#define | MBEDTLS_REMOVE_3DES_CIPHERSUITES
#define | MBEDTLS_ECP_DP_SECP192R1_ENABLED
#define | MBEDTLS_ECP_DP_SECP224R1_ENABLED
#define | MBEDTLS_ECP_DP_SECP256R1_ENABLED
#define | MBEDTLS_ECP_DP_SECP384R1_ENABLED
#define | MBEDTLS_ECP_DP_SECP521R1_ENABLED
#define | MBEDTLS_ECP_DP_SECP192K1_ENABLED
#define | MBEDTLS_ECP_DP_SECP224K1_ENABLED
#define | MBEDTLS_ECP_DP_SECP256K1_ENABLED
#define | MBEDTLS_ECP_DP_BP256R1_ENABLED
#define | MBEDTLS_ECP_DP_BP384R1_ENABLED
#define | MBEDTLS_ECP_DP_BP512R1_ENABLED
#define | MBEDTLS_ECP_DP_CURVE25519_ENABLED
#define | MBEDTLS_ECP_DP_CURVE448_ENABLED
#define | MBEDTLS_ECP_NIST_OPTIM
#define | MBEDTLS_ECDH_LEGACY_CONTEXT
#define | MBEDTLS_ECDSA_DETERMINISTIC
#define | MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
#define | MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
#define | MBEDTLS_PK_PARSE_EC_EXTENDED
#define | MBEDTLS_ERROR_STRERROR_DUMMY
#define | MBEDTLS_GENPRIME
#define | MBEDTLS_FS_IO
#define | MBEDTLS_PK_RSA_ALT_SUPPORT
#define | MBEDTLS_PKCS1_V15
#define | MBEDTLS_PKCS1_V21
#define | MBEDTLS_SELF_TEST
#define | MBEDTLS_SSL_ALL_ALERT_MESSAGES
#define | MBEDTLS_SSL_RECORD_CHECKING
#define | MBEDTLS_SSL_CONTEXT_SERIALIZATION
#define | MBEDTLS_SSL_ENCRYPT_THEN_MAC
#define | MBEDTLS_SSL_EXTENDED_MASTER_SECRET
#define | MBEDTLS_SSL_FALLBACK_SCSV
#define | MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
#define | MBEDTLS_SSL_CBC_RECORD_SPLITTING
#define | MBEDTLS_SSL_RENEGOTIATION
#define | MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
#define | MBEDTLS_SSL_PROTO_TLS1
#define | MBEDTLS_SSL_PROTO_TLS1_1
#define | MBEDTLS_SSL_PROTO_TLS1_2
#define | MBEDTLS_SSL_PROTO_DTLS
#define | MBEDTLS_SSL_ALPN
#define | MBEDTLS_SSL_DTLS_ANTI_REPLAY
#define | MBEDTLS_SSL_DTLS_HELLO_VERIFY
#define | MBEDTLS_SSL_DTLS_SRTP
#define | MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
#define | MBEDTLS_SSL_DTLS_BADMAC_LIMIT
#define | MBEDTLS_SSL_SESSION_TICKETS
#define | MBEDTLS_SSL_EXPORT_KEYS
#define | MBEDTLS_SSL_SERVER_NAME_INDICATION
#define | MBEDTLS_SSL_TRUNCATED_HMAC
#define | MBEDTLS_THREADING_PTHREAD
#define | MBEDTLS_VERSION_FEATURES
#define | MBEDTLS_X509_CHECK_KEY_USAGE
#define | MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#define | MBEDTLS_X509_RSASSA_PSS_SUPPORT
SECTION: mbed TLS modules
This section enables or disables entire modules in mbed TLS
#define | MBEDTLS_AESNI_C
#define | MBEDTLS_AES_C
#define | MBEDTLS_ARC4_C
#define | MBEDTLS_ASN1_PARSE_C
#define | MBEDTLS_ASN1_WRITE_C
#define | MBEDTLS_BASE64_C
#define | MBEDTLS_BIGNUM_C
#define | MBEDTLS_BLOWFISH_C
#define | MBEDTLS_CAMELLIA_C
#define | MBEDTLS_CCM_C
#define | MBEDTLS_CERTS_C
#define | MBEDTLS_CHACHA20_C
#define | MBEDTLS_CHACHAPOLY_C
#define | MBEDTLS_CIPHER_C
#define | MBEDTLS_CMAC_C
#define | MBEDTLS_CTR_DRBG_C
#define | MBEDTLS_DEBUG_C
#define | MBEDTLS_DES_C
#define | MBEDTLS_DHM_C
#define | MBEDTLS_ECDH_C
#define | MBEDTLS_ECDSA_C
#define | MBEDTLS_ECP_C
#define | MBEDTLS_ENTROPY_C
#define | MBEDTLS_ERROR_C
#define | MBEDTLS_GCM_C
#define | MBEDTLS_HAVEGE_C
#define | MBEDTLS_HKDF_C
#define | MBEDTLS_HMAC_DRBG_C
#define | MBEDTLS_MD_C
#define | MBEDTLS_MD2_C
#define | MBEDTLS_MD4_C
#define | MBEDTLS_MD5_C
#define | MBEDTLS_NET_C
#define | MBEDTLS_OID_C
#define | MBEDTLS_PADLOCK_C
#define | MBEDTLS_PEM_PARSE_C
#define | MBEDTLS_PEM_WRITE_C
#define | MBEDTLS_PK_C
#define | MBEDTLS_PK_PARSE_C
#define | MBEDTLS_PK_WRITE_C
#define | MBEDTLS_PKCS5_C
#define | MBEDTLS_PKCS12_C
#define | MBEDTLS_PLATFORM_C
#define | MBEDTLS_POLY1305_C
#define | MBEDTLS_PSA_CRYPTO_C
#define | MBEDTLS_PSA_CRYPTO_STORAGE_C
#define | MBEDTLS_PSA_ITS_FILE_C
#define | MBEDTLS_RIPEMD160_C
#define | MBEDTLS_RSA_C
#define | MBEDTLS_SHA1_C
#define | MBEDTLS_SHA256_C
#define | MBEDTLS_SHA512_C
#define | MBEDTLS_SSL_CACHE_C
#define | MBEDTLS_SSL_COOKIE_C
#define | MBEDTLS_SSL_TICKET_C
#define | MBEDTLS_SSL_CLI_C
#define | MBEDTLS_SSL_SRV_C
#define | MBEDTLS_SSL_TLS_C
#define | MBEDTLS_THREADING_C
#define | MBEDTLS_TIMING_C
#define | MBEDTLS_VERSION_C
#define | MBEDTLS_X509_USE_C
#define | MBEDTLS_X509_CRT_PARSE_C
#define | MBEDTLS_X509_CRL_PARSE_C
#define | MBEDTLS_X509_CSR_PARSE_C
#define | MBEDTLS_X509_CREATE_C
#define | MBEDTLS_X509_CRT_WRITE_C
#define | MBEDTLS_X509_CSR_WRITE_C
#define | MBEDTLS_XTEA_C

## Detailed Description

Configuration options (set of defines)

This set of compile-time options may be used to enable or disable features selectively, and reduce the global memory footprint.

Definition in file config.h.

## Macro Definition Documentation

## MBEDTLS_AES_C

#define MBEDTLS_AES_C

Enable the AES block cipher.

Module: library/aes.c Caller: library/cipher.c library/pem.c library/ctr_drbg.c

This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA

PEM_PARSE uses AES for decrypting encrypted keys.

Definition at line 2388 of file config.h.

## MBEDTLS_AESNI_C

#define MBEDTLS_AESNI_C

Enable AES-NI support on x86-64.

Module: library/aesni.c Caller: library/aes.c

Requires: MBEDTLS_HAVE_ASM

This modules adds support for the AES-NI instructions on x86-64

Definition at line 2313 of file config.h.

## MBEDTLS_ARC4_C

#define MBEDTLS_ARC4_C

Enable the ARCFOUR stream cipher.

Module: library/arc4.c Caller: library/cipher.c

This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA

Warning
  ARC4 is considered a weak cipher and its use constitutes a security risk. If possible, we recommend avoidng dependencies on it, and considering stronger ciphers instead.

Definition at line 2416 of file config.h.

## MBEDTLS_ASN1_PARSE_C

#define MBEDTLS_ASN1_PARSE_C

Enable the generic ASN1 parser.

Module: library/asn1.c Caller: library/x509.c library/dhm.c library/pkcs12.c library/pkcs5.c library/pkparse.c

Definition at line 2430 of file config.h.

## MBEDTLS_ASN1_WRITE_C

#define MBEDTLS_ASN1_WRITE_C

Enable the generic ASN1 writer.

Module: library/asn1write.c Caller: library/ecdsa.c library/pkwrite.c library/x509_create.c library/x509write_crt.c library/x509write_csr.c

Definition at line 2444 of file config.h.

## MBEDTLS_BASE64_C

#define MBEDTLS_BASE64_C

Enable the Base64 module.

Module: library/base64.c Caller: library/pem.c

This module is required for PEM support (required by X.509).

Definition at line 2456 of file config.h.

## MBEDTLS_BIGNUM_C

#define MBEDTLS_BIGNUM_C

Enable the multi-precision integer library.

Module: library/bignum.c Caller: library/dhm.c library/ecp.c library/ecdsa.c library/rsa.c library/rsa_internal.c library/ssl_tls.c

This module is required for RSA, DHM and ECC (ECDH, ECDSA) support.

Definition at line 2473 of file config.h.

## MBEDTLS_BLOWFISH_C

#define MBEDTLS_BLOWFISH_C

Enable the Blowfish block cipher.

Module: library/blowfish.c

Definition at line 2482 of file config.h.

## MBEDTLS_CAMELLIA_C

#define MBEDTLS_CAMELLIA_C

Enable the Camellia block cipher.

Module: library/camellia.c Caller: library/cipher.c

This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256

Definition at line 2537 of file config.h.

## MBEDTLS_CCM_C

#define MBEDTLS_CCM_C

Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.

Module: library/ccm.c

Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C

This module enables the AES-CCM ciphersuites, if other requisites are enabled as well.

Definition at line 2603 of file config.h.

## MBEDTLS_CERTS_C

#define MBEDTLS_CERTS_C

Enable the test certificates.

Module: library/certs.c Caller:

This module is used for testing (ssl_client/server).

Definition at line 2615 of file config.h.

## MBEDTLS_CHACHA20_C

#define MBEDTLS_CHACHA20_C

Enable the ChaCha20 stream cipher.

Module: library/chacha20.c

Definition at line 2624 of file config.h.

## MBEDTLS_CHACHAPOLY_C

#define MBEDTLS_CHACHAPOLY_C

Enable the ChaCha20-Poly1305 AEAD algorithm.

Module: library/chachapoly.c

This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C

Definition at line 2635 of file config.h.

## MBEDTLS_CIPHER_C

#define MBEDTLS_CIPHER_C

Enable the generic cipher layer.

Module: library/cipher.c Caller: library/ssl_tls.c

Uncomment to enable generic cipher wrappers.

Definition at line 2647 of file config.h.

## MBEDTLS_CIPHER_MODE_CBC

#define MBEDTLS_CIPHER_MODE_CBC

Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.

Definition at line 647 of file config.h.

## MBEDTLS_CIPHER_MODE_CFB

#define MBEDTLS_CIPHER_MODE_CFB

Enable Cipher Feedback mode (CFB) for symmetric ciphers.

Definition at line 654 of file config.h.

## MBEDTLS_CIPHER_MODE_CTR

#define MBEDTLS_CIPHER_MODE_CTR

Enable Counter Block Cipher mode (CTR) for symmetric ciphers.

Definition at line 661 of file config.h.

## MBEDTLS_CIPHER_MODE_OFB

#define MBEDTLS_CIPHER_MODE_OFB

Enable Output Feedback mode (OFB) for symmetric ciphers.

Definition at line 668 of file config.h.

## MBEDTLS_CIPHER_MODE_XTS

#define MBEDTLS_CIPHER_MODE_XTS

Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES.

Definition at line 675 of file config.h.

## MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS

#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS

Definition at line 722 of file config.h.

## MBEDTLS_CIPHER_PADDING_PKCS7

#define MBEDTLS_CIPHER_PADDING_PKCS7

MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for specific padding modes in the cipher layer with cipher modes that support padding (e.g. CBC)

If you disable all padding modes, only full blocks can be used with CBC.

Enable padding modes in the cipher layer.

Definition at line 721 of file config.h.

## MBEDTLS_CIPHER_PADDING_ZEROS

#define MBEDTLS_CIPHER_PADDING_ZEROS

Definition at line 724 of file config.h.

## MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN

#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN

Definition at line 723 of file config.h.

## MBEDTLS_CMAC_C

#define MBEDTLS_CMAC_C

Enable the CMAC (Cipher-based Message Authentication Code) mode for block ciphers.

Note
  When #MBEDTLS_CMAC_ALT is active, meaning that the underlying implementation of the CMAC algorithm is provided by an alternate implementation, that alternate implementation may opt to not support AES-192 or 3DES as underlying block ciphers for the CMAC operation.

Module: library/cmac.c

Requires: MBEDTLS_AES_C or MBEDTLS_DES_C

Definition at line 2665 of file config.h.

## MBEDTLS_CTR_DRBG_C

#define MBEDTLS_CTR_DRBG_C

Enable the CTR_DRBG AES-based random generator. The CTR_DRBG generator uses AES-256 by default. To use AES-128 instead, enable `MBEDTLS_CTR_DRBG_USE_128_BIT_KEY` above.

Note
  To achieve a 256-bit security strength with CTR_DRBG, you must use AES-256 and use sufficient entropy. See ctr_drbg.h for more details.

Module: library/ctr_drbg.c Caller:

Requires: MBEDTLS_AES_C

This module provides the CTR_DRBG AES random number generator.

Definition at line 2685 of file config.h.

## MBEDTLS_DEBUG_C

#define MBEDTLS_DEBUG_C

Enable the debug functions.

Module: library/debug.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c

This module provides debugging functions.

Definition at line 2699 of file config.h.

## MBEDTLS_DEPRECATED_WARNING

#define MBEDTLS_DEPRECATED_WARNING

Mark deprecated functions and features so that they generate a warning if used. Functionality deprecated in one version will usually be removed in the next version. You can enable this to help you prepare the transition to a new major version by making sure your code is not using this functionality.

This only works with GCC and Clang. With other compilers, you may want to use MBEDTLS_DEPRECATED_REMOVED

Uncomment to get warnings on using deprecated functions and features.

Definition at line 244 of file config.h.

## MBEDTLS_DES_C

#define MBEDTLS_DES_C

Enable the DES block cipher.

Module: library/des.c Caller: library/pem.c library/cipher.c

This module enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA

PEM_PARSE uses DES/3DES for decrypting encrypted keys.

Warning
  DES is considered a weak cipher and its use constitutes a security risk. We recommend considering stronger ciphers instead.

Definition at line 2728 of file config.h.

## MBEDTLS_DHM_C

#define MBEDTLS_DHM_C

Enable the Diffie-Hellman-Merkle module.

Module: library/dhm.c Caller: library/ssl_cli.c library/ssl_srv.c

This module is used by the following key exchanges: DHE-RSA, DHE-PSK

Warning
  Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.

Definition at line 2749 of file config.h.

## MBEDTLS_ECDH_C

#define MBEDTLS_ECDH_C

Enable the elliptic curve Diffie-Hellman library.

Module: library/ecdh.c Caller: library/ssl_cli.c library/ssl_srv.c

This module is used by the following key exchanges: ECDHE-ECDSA, ECDHE-RSA, DHE-PSK

Requires: MBEDTLS_ECP_C

Definition at line 2765 of file config.h.

## MBEDTLS_ECDH_LEGACY_CONTEXT

#define MBEDTLS_ECDH_LEGACY_CONTEXT

Use a backward compatible ECDH context.

Mbed TLS supports two formats for ECDH contexts (mbedtls_ecdh_context defined in `ecdh.h`). For most applications, the choice of format makes no difference, since all library functions can work with either format, except that the new format is incompatible with MBEDTLS_ECP_RESTARTABLE.

The new format used when this option is disabled is smaller (56 bytes on a 32-bit platform). In future versions of the library, it will support alternative implementations of ECDH operations. The new format is incompatible with applications that access context fields directly and with restartable ECP operations.

Define this macro if you enable MBEDTLS_ECP_RESTARTABLE or if you want to access ECDH context fields directly. Otherwise you should comment out this macro definition.

This option has no effect if MBEDTLS_ECDH_C is not enabled.

Note
  This configuration option is experimental. Future versions of the library may modify the way the ECDH context layout is configured and may modify the layout of the new context type.

Definition at line 892 of file config.h.

## MBEDTLS_ECDSA_C

#define MBEDTLS_ECDSA_C

Enable the elliptic curve DSA library.

Module: library/ecdsa.c Caller:

This module is used by the following key exchanges: ECDHE-ECDSA

Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C, and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a short Weierstrass curve.

Definition at line 2782 of file config.h.

## MBEDTLS_ECDSA_DETERMINISTIC

#define MBEDTLS_ECDSA_DETERMINISTIC

Enable deterministic ECDSA (RFC 6979). Standard ECDSA is "fragile" in the sense that lack of entropy when signing may result in a compromise of the long-term signing key. This is avoided by the deterministic variant.

Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C

Comment this macro to disable deterministic ECDSA.

Definition at line 906 of file config.h.

## MBEDTLS_ECP_C

#define MBEDTLS_ECP_C

Enable the elliptic curve over GF(p) library.

Module: library/ecp.c Caller: library/ecdh.c library/ecdsa.c library/ecjpake.c

Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED

Definition at line 2815 of file config.h.

## MBEDTLS_ECP_DP_BP256R1_ENABLED

#define MBEDTLS_ECP_DP_BP256R1_ENABLED

Definition at line 801 of file config.h.

## MBEDTLS_ECP_DP_BP384R1_ENABLED

#define MBEDTLS_ECP_DP_BP384R1_ENABLED

Definition at line 802 of file config.h.

## MBEDTLS_ECP_DP_BP512R1_ENABLED

#define MBEDTLS_ECP_DP_BP512R1_ENABLED

Definition at line 803 of file config.h.

## MBEDTLS_ECP_DP_CURVE25519_ENABLED

#define MBEDTLS_ECP_DP_CURVE25519_ENABLED

Definition at line 805 of file config.h.

## MBEDTLS_ECP_DP_CURVE448_ENABLED

#define MBEDTLS_ECP_DP_CURVE448_ENABLED

Definition at line 806 of file config.h.

## MBEDTLS_ECP_DP_SECP192K1_ENABLED

#define MBEDTLS_ECP_DP_SECP192K1_ENABLED

Definition at line 798 of file config.h.

## MBEDTLS_ECP_DP_SECP192R1_ENABLED

#define MBEDTLS_ECP_DP_SECP192R1_ENABLED

MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve module. By default all supported curves are enabled.

Comment macros to disable the curve and functions for it

Definition at line 793 of file config.h.

## MBEDTLS_ECP_DP_SECP224K1_ENABLED

#define MBEDTLS_ECP_DP_SECP224K1_ENABLED

Definition at line 799 of file config.h.

## MBEDTLS_ECP_DP_SECP224R1_ENABLED

#define MBEDTLS_ECP_DP_SECP224R1_ENABLED

Definition at line 794 of file config.h.

## MBEDTLS_ECP_DP_SECP256K1_ENABLED

#define MBEDTLS_ECP_DP_SECP256K1_ENABLED

Definition at line 800 of file config.h.

## MBEDTLS_ECP_DP_SECP256R1_ENABLED

#define MBEDTLS_ECP_DP_SECP256R1_ENABLED

Definition at line 795 of file config.h.

## MBEDTLS_ECP_DP_SECP384R1_ENABLED

#define MBEDTLS_ECP_DP_SECP384R1_ENABLED

Definition at line 796 of file config.h.

## MBEDTLS_ECP_DP_SECP521R1_ENABLED

#define MBEDTLS_ECP_DP_SECP521R1_ENABLED

Definition at line 797 of file config.h.

## MBEDTLS_ECP_NIST_OPTIM

#define MBEDTLS_ECP_NIST_OPTIM

Enable specific 'modulo p' routines for each NIST prime. Depending on the prime and architecture, makes operations 4 to 8 times faster on the corresponding curve.

Comment this macro to disable NIST curves optimisation.

Definition at line 817 of file config.h.

## MBEDTLS_ENTROPY_C

#define MBEDTLS_ENTROPY_C

Enable the platform-specific entropy code.

Module: library/entropy.c Caller:

Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C

This module provides a generic entropy pool

Definition at line 2829 of file config.h.

## MBEDTLS_ERROR_C

#define MBEDTLS_ERROR_C

Enable error code to error string conversion.

Module: library/error.c Caller:

This module enables mbedtls_strerror().

Definition at line 2841 of file config.h.

## MBEDTLS_ERROR_STRERROR_DUMMY

#define MBEDTLS_ERROR_STRERROR_DUMMY

Enable a dummy error function to make use of mbedtls_strerror() in third party libraries easier when MBEDTLS_ERROR_C is disabled (no effect when MBEDTLS_ERROR_C is enabled).

You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're not using mbedtls_strerror() or error_strerror() in your application.

Disable if you run into name conflicts and want to really remove the mbedtls_strerror()

Definition at line 1210 of file config.h.

## MBEDTLS_FS_IO

#define MBEDTLS_FS_IO

Enable functions that use the filesystem.

Definition at line 1226 of file config.h.

## MBEDTLS_GCM_C

#define MBEDTLS_GCM_C

Enable the Galois/Counter Mode (GCM).

Module: library/gcm.c

Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or MBEDTLS_ARIA_C

This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other requisites are enabled as well.

Definition at line 2855 of file config.h.

## MBEDTLS_GENPRIME

#define MBEDTLS_GENPRIME

Enable the prime-number generation code.

Requires: MBEDTLS_BIGNUM_C

Definition at line 1219 of file config.h.

## MBEDTLS_HAVE_ASM

#define MBEDTLS_HAVE_ASM

The compiler has support for asm().

Requires support for asm() in compiler.

Used in: library/aria.c library/timing.c include/mbedtls/bn_mul.h

Required by: MBEDTLS_AESNI_C MBEDTLS_PADLOCK_C

Comment to disable the use of assembly code.

Definition at line 59 of file config.h.

## MBEDTLS_HAVE_TIME

#define MBEDTLS_HAVE_TIME

System has time.h and time(). The time does not need to be correct, only time differences are used, by contrast with MBEDTLS_HAVE_TIME_DATE

Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME.

Comment if your system does not support time functions

Definition at line 133 of file config.h.

## MBEDTLS_HAVE_TIME_DATE

#define MBEDTLS_HAVE_TIME_DATE

System has time.h, time(), and an implementation for mbedtls_platform_gmtime_r() (see below). The time needs to be correct (not necessarily very accurate, but at least the date should be correct). This is used to verify the validity period of X.509 certificates.

Comment if your system does not have a correct clock.

Note
  mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that behaves similarly to the gmtime_r() function from the C standard. Refer to the documentation for mbedtls_platform_gmtime_r() for more information.
  It is possible to configure an implementation for mbedtls_platform_gmtime_r() at compile-time by using the macro MBEDTLS_PLATFORM_GMTIME_R_ALT.

Definition at line 154 of file config.h.

## MBEDTLS_HAVEGE_C

#define MBEDTLS_HAVEGE_C

Enable the HAVEGE random generator.

Warning: the HAVEGE random generator is not suitable for virtualized environments

Warning: the HAVEGE random generator is dependent on timing and specific processor traits. It is therefore not advised to use HAVEGE as your applications primary random generator or primary entropy pool input. As a secondary input to your entropy pool, it IS able add the (limited) extra entropy it provides.

Module: library/havege.c Caller:

Requires: MBEDTLS_TIMING_C

Uncomment to enable the HAVEGE random generator.

Definition at line 2878 of file config.h.

## MBEDTLS_HKDF_C

#define MBEDTLS_HKDF_C

Enable the HKDF algorithm (RFC 5869).

Module: library/hkdf.c Caller:

Requires: MBEDTLS_MD_C

This module adds support for the Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF).

Definition at line 2893 of file config.h.

## MBEDTLS_HMAC_DRBG_C

#define MBEDTLS_HMAC_DRBG_C

Enable the HMAC_DRBG random generator.

Module: library/hmac_drbg.c Caller:

Requires: MBEDTLS_MD_C

Uncomment to enable the HMAC_DRBG random number geerator.

Definition at line 2907 of file config.h.

## MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED

#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED

Enable the DHE-PSK based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_DHM_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA

Warning
  Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.

Definition at line 959 of file config.h.

## MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED

Enable the DHE-RSA based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, MBEDTLS_X509_CRT_PARSE_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

Warning
  Using DHE constitutes a security risk as it is not possible to validate custom DH parameters. If possible, it is recommended users should consider preferring other methods of key exchange. See dhm.h for more details.

Definition at line 1065 of file config.h.

## MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED

Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384

Definition at line 1138 of file config.h.

## MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED

Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_X509_CRT_PARSE_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384

Definition at line 1162 of file config.h.

## MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED

Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C,

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA

Definition at line 1114 of file config.h.

## MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED

Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_ECDH_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA

Definition at line 979 of file config.h.

## MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED

Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, MBEDTLS_X509_CRT_PARSE_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA

Definition at line 1090 of file config.h.

## MBEDTLS_KEY_EXCHANGE_PSK_ENABLED

#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED

Enable the PSK based ciphersuite modes in SSL / TLS.

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA

Definition at line 928 of file config.h.

## MBEDTLS_KEY_EXCHANGE_RSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED

Enable the RSA-only based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, MBEDTLS_X509_CRT_PARSE_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_MD5

Definition at line 1032 of file config.h.

## MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED

#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED

Enable the RSA-PSK based ciphersuite modes in SSL / TLS.

Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, MBEDTLS_X509_CRT_PARSE_C

This enables the following ciphersuites (if other requisites are enabled as well): MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA

Definition at line 1004 of file config.h.

## MBEDTLS_MD2_C

#define MBEDTLS_MD2_C

Enable the MD2 hash algorithm.

Module: library/md2.c Caller:

Uncomment to enable support for (rare) MD2-signed X.509 certs.

Warning
  MD2 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead.

Definition at line 2949 of file config.h.

## MBEDTLS_MD4_C

#define MBEDTLS_MD4_C

Enable the MD4 hash algorithm.

Module: library/md4.c Caller:

Uncomment to enable support for (rare) MD4-signed X.509 certs.

Warning
  MD4 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead.

Definition at line 2966 of file config.h.

## MBEDTLS_MD5_C

#define MBEDTLS_MD5_C

Enable the MD5 hash algorithm.

Module: library/md5.c Caller: library/md.c library/pem.c library/ssl_tls.c

This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 depending on the handshake parameters. Further, it is used for checking MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded encrypted keys.

Warning
  MD5 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead.

Definition at line 2988 of file config.h.

## MBEDTLS_MD_C

#define MBEDTLS_MD_C

Enable the generic message digest layer.

Module: library/md.c Caller:

Uncomment to enable generic message digest wrappers.

Definition at line 2932 of file config.h.

## MBEDTLS_NET_C

#define MBEDTLS_NET_C

Enable the TCP and UDP over IPv6/IPv4 networking routines.

Note
  This module only works on POSIX/Unix (including Linux, BSD and OS X) and Windows. For other platforms, you'll want to disable it, and write your own networking callbacks to be passed to `mbedtls_ssl_set_bio()`.
  See also our Knowledge Base article about porting to a new environment: https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS

Module: library/net_sockets.c

This module provides networking routines.

Definition at line 3023 of file config.h.

## MBEDTLS_OID_C

#define MBEDTLS_OID_C

Enable the OID database.

Module: library/oid.c Caller: library/asn1write.c library/pkcs5.c library/pkparse.c library/pkwrite.c library/rsa.c library/x509.c library/x509_create.c library/x509_crl.c library/x509_crt.c library/x509_csr.c library/x509write_crt.c library/x509write_csr.c

This modules translates between OIDs and internal values.

Definition at line 3046 of file config.h.

## MBEDTLS_PADLOCK_C

#define MBEDTLS_PADLOCK_C

Enable VIA Padlock support on x86.

Module: library/padlock.c Caller: library/aes.c

Requires: MBEDTLS_HAVE_ASM

This modules adds support for the VIA PadLock on x86.

Definition at line 3060 of file config.h.

## MBEDTLS_PEM_PARSE_C

#define MBEDTLS_PEM_PARSE_C

Enable PEM decoding / parsing.

Module: library/pem.c Caller: library/dhm.c library/pkparse.c library/x509_crl.c library/x509_crt.c library/x509_csr.c

Requires: MBEDTLS_BASE64_C

This modules adds support for decoding / parsing PEM files.

Definition at line 3078 of file config.h.

## MBEDTLS_PEM_WRITE_C

#define MBEDTLS_PEM_WRITE_C

Enable PEM encoding / writing.

Module: library/pem.c Caller: library/pkwrite.c library/x509write_crt.c library/x509write_csr.c

Requires: MBEDTLS_BASE64_C

This modules adds support for encoding / writing PEM files.

Definition at line 3094 of file config.h.

## MBEDTLS_PK_C

#define MBEDTLS_PK_C

Enable the generic public (asymetric) key layer.

Module: library/pk.c Caller: library/ssl_tls.c library/ssl_cli.c library/ssl_srv.c

Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C

Uncomment to enable generic public key wrappers.

Definition at line 3110 of file config.h.

## MBEDTLS_PK_PARSE_C

#define MBEDTLS_PK_PARSE_C

Enable the generic public (asymetric) key parser.

Module: library/pkparse.c Caller: library/x509_crt.c library/x509_csr.c

Requires: MBEDTLS_PK_C

Uncomment to enable generic public key parse functions.

Definition at line 3125 of file config.h.

## MBEDTLS_PK_PARSE_EC_EXTENDED

#define MBEDTLS_PK_PARSE_EC_EXTENDED

Enhance support for reading EC keys using variants of SEC1 not allowed by RFC 5915 and RFC 5480.

Currently this means parsing the SpecifiedECDomain choice of EC parameters (only known groups are supported, not arbitrary domains, to avoid validation issues).

Disable if you only need to support RFC 5915 + 5480 key formats.

Definition at line 1195 of file config.h.

## MBEDTLS_PK_RSA_ALT_SUPPORT

#define MBEDTLS_PK_RSA_ALT_SUPPORT

Support external private RSA keys (eg from a HSM) in the PK layer.

Comment this macro to disable support for external private RSA keys.

Definition at line 1340 of file config.h.

## MBEDTLS_PK_WRITE_C

#define MBEDTLS_PK_WRITE_C

Enable the generic public (asymetric) key writer.

Module: library/pkwrite.c Caller: library/x509write.c

Requires: MBEDTLS_PK_C

Uncomment to enable generic public key write functions.

Definition at line 3139 of file config.h.

## MBEDTLS_PKCS12_C

#define MBEDTLS_PKCS12_C

Enable PKCS#12 PBE functions. Adds algorithms for parsing PKCS#8 encrypted private keys

Module: library/pkcs12.c Caller: library/pkparse.c

Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C Can use: MBEDTLS_ARC4_C

This module enables PKCS#12 functions.

Definition at line 3186 of file config.h.

## MBEDTLS_PKCS1_V15

#define MBEDTLS_PKCS1_V15

Enable support for PKCS#1 v1.5 encoding.

Requires: MBEDTLS_RSA_C

This enables support for PKCS#1 v1.5 operations.

Definition at line 1351 of file config.h.

## MBEDTLS_PKCS1_V21

#define MBEDTLS_PKCS1_V21

Enable support for PKCS#1 v2.1 encoding.

Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C

This enables support for RSAES-OAEP and RSASSA-PSS operations.

Definition at line 1362 of file config.h.

## MBEDTLS_PKCS5_C

#define MBEDTLS_PKCS5_C

Enable PKCS#5 functions.

Module: library/pkcs5.c

Requires: MBEDTLS_MD_C

This module adds support for the PKCS#5 functions.

Definition at line 3152 of file config.h.

## MBEDTLS_PLATFORM_C

#define MBEDTLS_PLATFORM_C

Enable the platform abstraction layer that allows you to re-assign functions like calloc(), free(), snprintf(), printf(), fprintf(), exit().

Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned above to be specified at runtime or compile time respectively.

Note
  This abstraction layer must be enabled on Windows (including MSYS2) as other module rely on it for a fixed snprintf implementation.

Module: library/platform.c Caller: Most other .c files

This module enables abstraction of common (libc) functions.

Definition at line 3206 of file config.h.

## MBEDTLS_POLY1305_C

#define MBEDTLS_POLY1305_C

Enable the Poly1305 MAC algorithm.

Module: library/poly1305.c Caller: library/chachapoly.c

Definition at line 3216 of file config.h.

## MBEDTLS_PSA_CRYPTO_C

#define MBEDTLS_PSA_CRYPTO_C

Enable the Platform Security Architecture cryptography API.

Module: library/psa_crypto.c

Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C, or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.

Definition at line 3230 of file config.h.

## MBEDTLS_PSA_CRYPTO_STORAGE_C

#define MBEDTLS_PSA_CRYPTO_STORAGE_C

Enable the Platform Security Architecture persistent key storage.

Module: library/psa_crypto_storage.c

Requires: MBEDTLS_PSA_CRYPTO_C, either MBEDTLS_PSA_ITS_FILE_C or a native implementation of the PSA ITS interface

Definition at line 3259 of file config.h.

## MBEDTLS_PSA_ITS_FILE_C

#define MBEDTLS_PSA_ITS_FILE_C

Enable the emulation of the Platform Security Architecture Internal Trusted Storage (PSA ITS) over files.

Module: library/psa_its_file.c

Requires: MBEDTLS_FS_IO

Definition at line 3271 of file config.h.

## MBEDTLS_REMOVE_3DES_CIPHERSUITES

#define MBEDTLS_REMOVE_3DES_CIPHERSUITES

Remove 3DES ciphersuites by default in SSL / TLS. This flag removes the ciphersuites based on 3DES from the default list as returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them explicitly.

A man-in-the-browser attacker can recover authentication tokens sent through a TLS connection using a 3DES based cipher suite (see "On the Practical (In-)Security of 64-bit Block Ciphers" by Karthikeyan Bhargavan and Gaëtan Leurent, see https://sweet32.info/SWEET32_CCS16.pdf). If this attack falls in your threat model or you are unsure, then you should keep this option enabled to remove 3DES based cipher suites.

Comment this macro to keep 3DES in the default ciphersuite list.

Definition at line 782 of file config.h.

## MBEDTLS_REMOVE_ARC4_CIPHERSUITES

#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES

Remove RC4 ciphersuites by default in SSL / TLS. This flag removes the ciphersuites based on RC4 from the default list as returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them explicitly.

Uncomment this macro to remove RC4 ciphersuites by default.

Definition at line 762 of file config.h.

## MBEDTLS_RIPEMD160_C

#define MBEDTLS_RIPEMD160_C

Enable the RIPEMD-160 hash algorithm.

Module: library/ripemd160.c Caller: library/md.c

Definition at line 3282 of file config.h.

## MBEDTLS_RSA_C

#define MBEDTLS_RSA_C

Enable the RSA public-key cryptosystem.

Module: library/rsa.c library/rsa_internal.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509.c

This module is used by the following key exchanges: RSA, DHE-RSA, ECDHE-RSA, RSA-PSK

Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C

Definition at line 3301 of file config.h.

## MBEDTLS_SELF_TEST

#define MBEDTLS_SELF_TEST

Enable the checkup functions (*_self_test).

Definition at line 1488 of file config.h.

## MBEDTLS_SHA1_C

#define MBEDTLS_SHA1_C

Enable the SHA1 cryptographic hash algorithm.

Module: library/sha1.c Caller: library/md.c library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c library/x509write_crt.c

This module is required for SSL/TLS up to version 1.1, for TLS 1.2 depending on the handshake parameters, and for SHA1-signed certificates.

Warning
  SHA-1 is considered a weak message digest and its use constitutes a security risk. If possible, we recommend avoiding dependencies on it, and considering stronger message digests instead.

Definition at line 3323 of file config.h.

## MBEDTLS_SHA256_C

#define MBEDTLS_SHA256_C

Enable the SHA-224 and SHA-256 cryptographic hash algorithms.

Module: library/sha256.c Caller: library/entropy.c library/md.c library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c

This module adds support for SHA-224 and SHA-256. This module is required for the SSL/TLS 1.2 PRF function.

Definition at line 3340 of file config.h.

## MBEDTLS_SHA512_C

#define MBEDTLS_SHA512_C

Enable the SHA-384 and SHA-512 cryptographic hash algorithms.

Module: library/sha512.c Caller: library/entropy.c library/md.c library/ssl_cli.c library/ssl_srv.c

This module adds support for SHA-384 and SHA-512.

Definition at line 3355 of file config.h.

## MBEDTLS_SSL_ALL_ALERT_MESSAGES

#define MBEDTLS_SSL_ALL_ALERT_MESSAGES

Enable sending of alert messages in case of encountered errors as per RFC. If you choose not to send the alert messages, mbed TLS can still communicate with other servers, only debugging of failures is harder.

The advantage of not sending alert messages, is that no information is given about reasons for failures thus preventing adversaries of gaining intel.

Enable sending of all alert messages

Definition at line 1540 of file config.h.

## MBEDTLS_SSL_ALPN

#define MBEDTLS_SSL_ALPN

Enable support for RFC 7301 Application Layer Protocol Negotiation.

Comment this macro to disable support for ALPN.

Definition at line 1885 of file config.h.

## MBEDTLS_SSL_CACHE_C

#define MBEDTLS_SSL_CACHE_C

Enable simple SSL cache implementation.

Module: library/ssl_cache.c Caller:

Requires: MBEDTLS_SSL_CACHE_C

Definition at line 3367 of file config.h.

## MBEDTLS_SSL_CBC_RECORD_SPLITTING

#define MBEDTLS_SSL_CBC_RECORD_SPLITTING

Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.

This is a countermeasure to the BEAST attack, which also minimizes the risk of interoperability issues compared to sending 0-length records.

Comment this macro to disable 1/n-1 record splitting.

Definition at line 1737 of file config.h.

## MBEDTLS_SSL_CLI_C

#define MBEDTLS_SSL_CLI_C

Enable the SSL/TLS client code.

Module: library/ssl_cli.c Caller:

Requires: MBEDTLS_SSL_TLS_C

This module is required for SSL/TLS client support.

Definition at line 3403 of file config.h.

## MBEDTLS_SSL_CONTEXT_SERIALIZATION

#define MBEDTLS_SSL_CONTEXT_SERIALIZATION

Enable serialization of the TLS context structures, through use of the functions mbedtls_ssl_context_save() and mbedtls_ssl_context_load().

This pair of functions allows one side of a connection to serialize the context associated with the connection, then free or re-use that context while the serialized state is persisted elsewhere, and finally deserialize that state to a live context for resuming read/write operations on the connection. From a protocol perspective, the state of the connection is unaffected, in particular this is entirely transparent to the peer.

Note: this is distinct from TLS session resumption, which is part of the protocol and fully visible by the peer. TLS session resumption enables establishing new connections associated to a saved session with shorter, lighter handshakes, while context serialization is a local optimization in handling a single, potentially long-lived connection.

Enabling these APIs makes some SSL structures larger, as 64 extra bytes are saved after the handshake to allow for more efficient serialization, so if you don't need this feature you'll save RAM by disabling it.

Comment to disable the context serialization APIs.

Definition at line 1620 of file config.h.

## MBEDTLS_SSL_COOKIE_C

#define MBEDTLS_SSL_COOKIE_C

Enable basic implementation of DTLS cookies for hello verification.

Module: library/ssl_cookie.c Caller:

Definition at line 3377 of file config.h.

## MBEDTLS_SSL_DTLS_ANTI_REPLAY

#define MBEDTLS_SSL_DTLS_ANTI_REPLAY

Enable support for the anti-replay mechanism in DTLS.

Requires: MBEDTLS_SSL_TLS_C MBEDTLS_SSL_PROTO_DTLS

Warning
  Disabling this is often a security risk! See mbedtls_ssl_conf_dtls_anti_replay() for details.

Comment this to disable anti-replay in DTLS.

Definition at line 1900 of file config.h.

## MBEDTLS_SSL_DTLS_BADMAC_LIMIT

#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT

Enable support for a limit of records with bad MAC.

See mbedtls_ssl_conf_dtls_badmac_limit().

Requires: MBEDTLS_SSL_PROTO_DTLS

Definition at line 1976 of file config.h.

## MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE

#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE

Enable server-side support for clients that reconnect from the same port.

Some clients unexpectedly close the connection and try to reconnect using the same source port. This needs special support from the server to handle the new connection securely, as described in section 4.2.8 of RFC 6347. This flag enables that support.

Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY

Comment this to disable support for clients reusing the source port.

Definition at line 1965 of file config.h.

## MBEDTLS_SSL_DTLS_HELLO_VERIFY

#define MBEDTLS_SSL_DTLS_HELLO_VERIFY

Enable support for HelloVerifyRequest on DTLS servers.

This feature is highly recommended to prevent DTLS servers being used as amplifiers in DoS attacks against other hosts. It should always be enabled unless you know for sure amplification cannot be a problem in the environment in which your server operates.

Warning
  Disabling this can ba a security risk! (see above)

Requires: MBEDTLS_SSL_PROTO_DTLS

Comment this to disable support for HelloVerifyRequest.

Definition at line 1918 of file config.h.

## MBEDTLS_SSL_DTLS_SRTP

#define MBEDTLS_SSL_DTLS_SRTP

Enable support for negotiation of DTLS-SRTP (RFC 5764) through the use_srtp extension.

Note
  This feature provides the minimum functionality required to negotiate the use of DTLS-SRTP and to allow the derivation of the associated SRTP packet protection key material. In particular, the SRTP packet protection itself, as well as the demultiplexing of RTP and DTLS packets at the datagram layer (see Section 5 of RFC 5764), are not handled by this feature. Instead, after successful completion of a handshake negotiating the use of DTLS-SRTP, the extended key exporter API mbedtls_ssl_conf_export_keys_ext_cb() should be used to implement the key exporter described in Section 4.2 of RFC 5764 and RFC 5705 (this is implemented in the SSL example programs). The resulting key should then be passed to an SRTP stack.

Setting this option enables the runtime API mbedtls_ssl_conf_dtls_srtp_protection_profiles() through which the supported DTLS-SRTP protection profiles can be configured. You must call this API at runtime if you wish to negotiate the use of DTLS-SRTP.

Requires: MBEDTLS_SSL_PROTO_DTLS

Uncomment this to enable support for use_srtp extension.

Definition at line 1949 of file config.h.

## MBEDTLS_SSL_ENCRYPT_THEN_MAC

#define MBEDTLS_SSL_ENCRYPT_THEN_MAC

Enable support for Encrypt-then-MAC, RFC 7366.

This allows peers that both support it to use a more robust protection for ciphersuites using CBC, providing deep resistance against timing attacks on the padding or underlying cipher.

This only affects CBC ciphersuites, and is useless if none is defined.

Requires: MBEDTLS_SSL_PROTO_TLS1 or MBEDTLS_SSL_PROTO_TLS1_1 or MBEDTLS_SSL_PROTO_TLS1_2

Comment this macro to disable support for Encrypt-then-MAC

Definition at line 1654 of file config.h.

## MBEDTLS_SSL_EXPORT_KEYS

#define MBEDTLS_SSL_EXPORT_KEYS

Enable support for exporting key block and master secret. This is required for certain users of TLS, e.g. EAP-TLS.

Comment this macro to disable support for key export

Definition at line 2000 of file config.h.

## MBEDTLS_SSL_EXTENDED_MASTER_SECRET

#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET

Enable support for RFC 7627: Session Hash and Extended Master Secret Extension.

This was introduced as "the proper fix" to the Triple Handshake familiy of attacks, but it is recommended to always use it (even if you disable renegotiation), since it actually fixes a more fundamental issue in the original SSL/TLS design, and has implications beyond Triple Handshake.

Requires: MBEDTLS_SSL_PROTO_TLS1 or MBEDTLS_SSL_PROTO_TLS1_1 or MBEDTLS_SSL_PROTO_TLS1_2

Comment this macro to disable support for Extended Master Secret.

Definition at line 1672 of file config.h.

## MBEDTLS_SSL_FALLBACK_SCSV

#define MBEDTLS_SSL_FALLBACK_SCSV

Enable support for RFC 7507: Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks.

For servers, it is recommended to always enable this, unless you support only one version of TLS, or know for sure that none of your clients implements a fallback strategy.

For clients, you only need this if you're using a fallback strategy, which is not recommended in the first place, unless you absolutely need it to interoperate with buggy (version-intolerant) servers.

Comment this macro to disable support for FALLBACK_SCSV

Definition at line 1690 of file config.h.

## MBEDTLS_SSL_KEEP_PEER_CERTIFICATE

#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE

This option controls the availability of the API mbedtls_ssl_get_peer_cert() giving access to the peer's certificate after completion of the handshake.

Unless you need mbedtls_ssl_peer_cert() in your application, it is recommended to disable this option for reduced RAM usage.

Note
  If this option is disabled, mbedtls_ssl_get_peer_cert() is still defined, but always returns `NULL`.
  This option has no influence on the protection against the triple handshake attack. Even if it is disabled, Mbed TLS will still ensure that certificates do not change during renegotiation, for exaple by keeping a hash of the peer's certificate.

Comment this macro to disable storing the peer's certificate after the handshake.

Definition at line 1712 of file config.h.

## MBEDTLS_SSL_MAX_FRAGMENT_LENGTH

#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH

Enable support for RFC 6066 max_fragment_length extension in SSL.

Comment this macro to disable support for the max_fragment_length extension

Definition at line 1791 of file config.h.

## MBEDTLS_SSL_PROTO_DTLS

#define MBEDTLS_SSL_PROTO_DTLS

Enable support for DTLS (all available versions).

Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.

Requires: MBEDTLS_SSL_PROTO_TLS1_1 or MBEDTLS_SSL_PROTO_TLS1_2

Comment this macro to disable support for DTLS

Definition at line 1876 of file config.h.

## MBEDTLS_SSL_PROTO_TLS1

#define MBEDTLS_SSL_PROTO_TLS1

Enable support for TLS 1.0.

Requires: MBEDTLS_MD5_C MBEDTLS_SHA1_C

Comment this macro to disable support for TLS 1.0

Definition at line 1818 of file config.h.

## MBEDTLS_SSL_PROTO_TLS1_1

#define MBEDTLS_SSL_PROTO_TLS1_1

Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).

Requires: MBEDTLS_MD5_C MBEDTLS_SHA1_C

Comment this macro to disable support for TLS 1.1 / DTLS 1.0

Definition at line 1830 of file config.h.

## MBEDTLS_SSL_PROTO_TLS1_2

#define MBEDTLS_SSL_PROTO_TLS1_2

Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).

Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C (Depends on ciphersuites)

Comment this macro to disable support for TLS 1.2 / DTLS 1.2

Definition at line 1842 of file config.h.

## MBEDTLS_SSL_RECORD_CHECKING

#define MBEDTLS_SSL_RECORD_CHECKING

Enable the function mbedtls_ssl_check_record() which can be used to check the validity and authenticity of an incoming record, to verify that it has not been seen before. These checks are performed without modifying the externally visible state of the SSL context.

See mbedtls_ssl_check_record() for more information.

Uncomment to enable support for record checking.

Definition at line 1554 of file config.h.

## MBEDTLS_SSL_RENEGOTIATION

#define MBEDTLS_SSL_RENEGOTIATION

Enable support for TLS renegotiation.

The two main uses of renegotiation are (1) refresh keys on long-lived connections and (2) client authentication after the initial handshake. If you don't need renegotiation, it's probably better to disable it, since it has been associated with security issues in the past and is easy to misuse/misunderstand.

Comment this to disable support for renegotiation.

Note
  Even if this option is disabled, both client and server are aware of the Renegotiation Indication Extension (RFC 5746) used to prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). (See `mbedtls_ssl_conf_legacy_renegotiation` for the configuration of this extension).

Definition at line 1759 of file config.h.

## MBEDTLS_SSL_SERVER_NAME_INDICATION

#define MBEDTLS_SSL_SERVER_NAME_INDICATION

Enable support for RFC 6066 server name indication (SNI) in SSL.

Requires: MBEDTLS_X509_CRT_PARSE_C

Comment this macro to disable support for server name indication in SSL

Definition at line 2011 of file config.h.

## MBEDTLS_SSL_SESSION_TICKETS

#define MBEDTLS_SSL_SESSION_TICKETS

Enable support for RFC 5077 session tickets in SSL. Client-side, provides full support for session tickets (maintenance of a session store remains the responsibility of the application, though). Server-side, you also need to provide callbacks for writing and parsing tickets, including authenticated encryption and key management. Example callbacks are provided by MBEDTLS_SSL_TICKET_C.

Comment this macro to disable support for SSL session tickets

Definition at line 1990 of file config.h.

## MBEDTLS_SSL_SRV_C

#define MBEDTLS_SSL_SRV_C

Enable the SSL/TLS server code.

Module: library/ssl_srv.c Caller:

Requires: MBEDTLS_SSL_TLS_C

This module is required for SSL/TLS server support.

Definition at line 3417 of file config.h.

## MBEDTLS_SSL_TICKET_C

#define MBEDTLS_SSL_TICKET_C

Enable an implementation of TLS server-side callbacks for session tickets.

Module: library/ssl_ticket.c Caller:

Requires: MBEDTLS_CIPHER_C

Definition at line 3389 of file config.h.

## MBEDTLS_SSL_TLS_C

#define MBEDTLS_SSL_TLS_C

Enable the generic SSL/TLS code.

Module: library/ssl_tls.c Caller: library/ssl_cli.c library/ssl_srv.c

Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C and at least one of the MBEDTLS_SSL_PROTO_XXX defines

This module is required for SSL/TLS.

Definition at line 3433 of file config.h.

## MBEDTLS_SSL_TRUNCATED_HMAC

#define MBEDTLS_SSL_TRUNCATED_HMAC

Enable support for RFC 6066 truncated HMAC in SSL.

Comment this macro to disable support for truncated HMAC in SSL

Definition at line 2020 of file config.h.

## MBEDTLS_THREADING_C

#define MBEDTLS_THREADING_C

Enable the threading abstraction layer. By default mbed TLS assumes it is used in a non-threaded environment or that contexts are not shared between threads. If you do intend to use contexts between threads, you will need to enable this layer to prevent race conditions. See also our Knowledge Base article about threading: https://tls.mbed.org/kb/development/thread-safety-and-multi-threading

Module: library/threading.c

This allows different threading implementations (self-implemented or provided).

You will have to enable either MBEDTLS_THREADING_ALT or MBEDTLS_THREADING_PTHREAD.

Enable this layer to allow use of mutexes within mbed TLS

Definition at line 3455 of file config.h.

## MBEDTLS_THREADING_PTHREAD

#define MBEDTLS_THREADING_PTHREAD

Enable the pthread wrapper layer for the threading layer.

Requires: MBEDTLS_THREADING_C

Uncomment this to enable pthread mutexes.

Definition at line 2132 of file config.h.

## MBEDTLS_TIMING_C

#define MBEDTLS_TIMING_C

Enable the semi-portable timing interface.

Note
  The provided implementation only works on POSIX/Unix (including Linux, BSD and OS X) and Windows. On other platforms, you can either disable that module and provide your own implementations of the callbacks needed by `mbedtls_ssl_set_timer_cb()` for DTLS, or leave it enabled and provide your own implementation of the whole module by setting `MBEDTLS_TIMING_ALT` in the current file.
  See also our Knowledge Base article about porting to a new environment: https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS

Module: library/timing.c Caller: library/havege.c

This module is used by the HAVEGE random number generator.

Definition at line 3478 of file config.h.

## MBEDTLS_VERSION_C

#define MBEDTLS_VERSION_C

Enable run-time version information.

Module: library/version.c

This module provides run-time version information.

Definition at line 3489 of file config.h.

## MBEDTLS_VERSION_FEATURES

#define MBEDTLS_VERSION_FEATURES

Allow run-time checking of compile-time enabled features. Thus allowing users to check at run-time if the library is for instance compiled with threading support via mbedtls_version_check_feature().

Requires: MBEDTLS_VERSION_C

Comment this to disable run-time checking and save ROM space

Definition at line 2188 of file config.h.

## MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE

#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE

Enable verification of the extendedKeyUsage extension (leaf certificates).

Disabling this avoids problems with mis-issued and/or misused certificates.

Warning
  Depending on your PKI use, disabling this can be a security risk!

Comment to skip extendedKeyUsage checking for certificates.

Definition at line 2256 of file config.h.

## MBEDTLS_X509_CHECK_KEY_USAGE

#define MBEDTLS_X509_CHECK_KEY_USAGE

Enable verification of the keyUsage extension (CA and leaf certificates).

Disabling this avoids problems with mis-issued and/or misused (intermediate) CA and leaf certificates.

Warning
  Depending on your PKI use, disabling this can be a security risk!

Comment to skip keyUsage checking for both CA and leaf certificates.

Definition at line 2243 of file config.h.

## MBEDTLS_X509_CREATE_C

#define MBEDTLS_X509_CREATE_C

Enable X.509 core for creating certificates.

Module: library/x509_create.c

Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C

This module is the basis for creating X.509 certificates and CSRs.

Definition at line 3563 of file config.h.

## MBEDTLS_X509_CRL_PARSE_C

#define MBEDTLS_X509_CRL_PARSE_C

Enable X.509 CRL parsing.

Module: library/x509_crl.c Caller: library/x509_crt.c

Requires: MBEDTLS_X509_USE_C

This module is required for X.509 CRL parsing.

Definition at line 3536 of file config.h.

## MBEDTLS_X509_CRT_PARSE_C

#define MBEDTLS_X509_CRT_PARSE_C

Enable X.509 certificate parsing.

Module: library/x509_crt.c Caller: library/ssl_cli.c library/ssl_srv.c library/ssl_tls.c

Requires: MBEDTLS_X509_USE_C

This module is required for X.509 certificate parsing.

Definition at line 3522 of file config.h.

## MBEDTLS_X509_CRT_WRITE_C

#define MBEDTLS_X509_CRT_WRITE_C

Enable creating X.509 certificates.

Module: library/x509_crt_write.c

Requires: MBEDTLS_X509_CREATE_C

This module is required for X.509 certificate creation.

Definition at line 3576 of file config.h.

## MBEDTLS_X509_CSR_PARSE_C

#define MBEDTLS_X509_CSR_PARSE_C

Enable X.509 Certificate Signing Request (CSR) parsing.

Module: library/x509_csr.c Caller: library/x509_crt_write.c

Requires: MBEDTLS_X509_USE_C

This module is used for reading X.509 certificate request.

Definition at line 3550 of file config.h.

## MBEDTLS_X509_CSR_WRITE_C

#define MBEDTLS_X509_CSR_WRITE_C

Enable creating X.509 Certificate Signing Requests (CSR).

Module: library/x509_csr_write.c

Requires: MBEDTLS_X509_CREATE_C

This module is required for X.509 certificate request writing.

Definition at line 3589 of file config.h.

## MBEDTLS_X509_RSASSA_PSS_SUPPORT

#define MBEDTLS_X509_RSASSA_PSS_SUPPORT

Enable parsing and verification of X.509 certificates, CRLs and CSRS signed with RSASSA-PSS (aka PKCS#1 v2.1).

Comment this macro to disallow using RSASSA-PSS in certificates.

Definition at line 2266 of file config.h.

## MBEDTLS_X509_USE_C

#define MBEDTLS_X509_USE_C

Enable X.509 core for using certificates.

Module: library/x509.c Caller: library/x509_crl.c library/x509_crt.c library/x509_csr.c

Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C

This module is required for the X.509 parsing modules.

Definition at line 3506 of file config.h.

## MBEDTLS_XTEA_C

#define MBEDTLS_XTEA_C

Enable the XTEA block cipher.

Module: library/xtea.c Caller:

Definition at line 3599 of file config.h.