From f7efa1436da91350c00cf7394c75a73978089b43 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 16 Jul 2025 15:47:35 +0200 Subject: [PATCH 01/13] Add checker classes for options used in the wrong project Signed-off-by: Gilles Peskine --- .../config_checks_generator.py | 64 ++++++++++++++++++- 1 file changed, 63 insertions(+), 1 deletion(-) diff --git a/scripts/mbedtls_framework/config_checks_generator.py b/scripts/mbedtls_framework/config_checks_generator.py index f55c061cb..1d1581f58 100644 --- a/scripts/mbedtls_framework/config_checks_generator.py +++ b/scripts/mbedtls_framework/config_checks_generator.py @@ -14,7 +14,7 @@ import re import sys import textwrap import typing -from typing import Iterator, List +from typing import Iterator, List, Optional from . import build_tree from . import typing_util @@ -106,6 +106,68 @@ class Internal(Checker): """Checker for an internal-only option.""" +class SubprojectInternal(Checker): + """Checker for an internal macro of a subproject.""" + + # meant to be overridden in child classes + SUBPROJECT = None #type: Optional[str] + + def __init__(self, name: str, suggestion: str = '', + subproject: Optional[str] = None) -> None: + super().__init__(name, suggestion) + if subproject is not None: + self.subproject = subproject + elif self.SUBPROJECT is not None: + self.subproject = self.SUBPROJECT + else: + raise ValueError('No subproject specified for ' + name) + + def _basic_message(self) -> str: + return f'{self.name} is an internal macro of {self.subproject} and may not be configured.' + + def before(self, prefix: str) -> str: + return f''' + #if defined({self.name}) + # define {prefix}_WASSET_{self.name} 1 + #else + # define {prefix}_WASSET_{self.name} 0 + #endif + #undef {self.name} + ''' + + def user(self, prefix: str) -> str: + return f''' + #if defined({self.name}) + # error {self._quoted_message()} + #endif + #if {prefix}_WASSET_{self.name} + # define {self.name} + #endif + #undef {prefix}_WASSET_{self.name} + ''' + + +class SubprojectOption(SubprojectInternal): + """Checker for a configuration option of a subproject.""" + + def __init__(self, name: str, subproject: Optional[str] = None) -> None: + super().__init__(name, subproject=subproject) + + def _basic_message(self) -> str: + return f'{self.name} must be configured in {self.subproject}.' + + def user(self, prefix: str) -> str: + return f''' + #if defined({self.name}) && !{prefix}_WASSET_{self.name} + # error {self._quoted_message()} + #endif + #if {prefix}_WASSET_{self.name} + # define {self.name} + #endif + #undef {prefix}_WASSET_{self.name} + ''' + + class Removed(Checker): """Checker for an option that has been removed.""" From 103cdbc45c12ba01e09c9d3e12a22da6b898de16 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 1 Aug 2025 22:40:24 +0200 Subject: [PATCH 02/13] Support non-ASCII compiler messages (assume UTF-8) Signed-off-by: Gilles Peskine --- scripts/mbedtls_framework/unittest_config_checks.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/mbedtls_framework/unittest_config_checks.py b/scripts/mbedtls_framework/unittest_config_checks.py index ba8fc8f98..65e97038b 100644 --- a/scripts/mbedtls_framework/unittest_config_checks.py +++ b/scripts/mbedtls_framework/unittest_config_checks.py @@ -72,7 +72,7 @@ class TestConfigChecks(unittest.TestCase): return None if content and not content.endswith('\n'): content += '\n' - with open(file_name, 'w', encoding='ascii') as out: + with open(file_name, 'w', encoding='utf-8') as out: out.write(content) return file_name @@ -102,7 +102,7 @@ class TestConfigChecks(unittest.TestCase): cmd.append(self.PROJECT_CONFIG_C) return subprocess.run(cmd, check=False, - encoding='ascii', + encoding='utf-8', stdout=subprocess.PIPE, stderr=subprocess.PIPE) From 172e29bd7c27846a978e2c44c8b096c7edcf5a85 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 1 Aug 2025 22:41:09 +0200 Subject: [PATCH 03/13] Run cc instead of cpp Run a C compiler, not just the preprocessor. This allows capturing static assertions (`MBEDTLS_STATIC_ASSERT`). Signed-off-by: Gilles Peskine --- .../unittest_config_checks.py | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/scripts/mbedtls_framework/unittest_config_checks.py b/scripts/mbedtls_framework/unittest_config_checks.py index 65e97038b..95ad0416b 100644 --- a/scripts/mbedtls_framework/unittest_config_checks.py +++ b/scripts/mbedtls_framework/unittest_config_checks.py @@ -2,7 +2,7 @@ This tests the output of ``generate_config_checks.py``. This can also let us verify what we enforce in the manually written -checks in ``_check_config.h``. +checks in ``_check_config.h`` and ``_config.c``. """ ## Copyright The Mbed TLS Contributors @@ -29,27 +29,27 @@ class TestConfigChecks(unittest.TestCase): PROJECT_SPECIFIC_INCLUDE_DIRECTORIES = [] #type: List[str] # Increase the length of strings that assertion failures are willing to - # print. This is useful for failures where the preprocessor has a lot + # print. This is useful for failures where the compiler has a lot # to say. maxDiff = 9999 def setUp(self) -> None: - self.cpp_output = None #type: Optional[str] + self.cc_output = None #type: Optional[str] def tearDown(self) -> None: - """Log the preprocessor output to a file, if available and desired. + """Log the compiler output to a file, if available and desired. This is intended for debugging. It only happens if the environment variable UNITTEST_CONFIG_CHECKS_DEBUG is non-empty. """ if os.getenv('UNITTEST_CONFIG_CHECKS_DEBUG'): - # We set self.cpp_output to the preprocessor output before + # We set self.cc_output to the compiler output before # asserting, and set it to None if all the assertions pass. - if self.cpp_output is not None: + if self.cc_output is not None: basename = os.path.splitext(os.path.basename(sys.argv[0]))[0] filename = f'{basename}.{self._testMethodName}.out.txt' with open(filename, 'w') as out: - out.write(self.cpp_output) + out.write(self.cc_output) def user_config_file_name(self, variant: str) -> str: """Construct a unique temporary file name for a user config header.""" @@ -81,12 +81,12 @@ class TestConfigChecks(unittest.TestCase): mbedtls_user_config_file: Optional[str], extra_options: List[str], ) -> subprocess.CompletedProcess: - """Run cpp with the given user configuration files. + """Run cc with the given user configuration files. Return the CompletedProcess object capturing the return code, stdout and stderr. """ - cmd = ['cpp'] + cmd = [os.getenv('CC', 'cc')] if os.getenv('UNITTEST_CONFIG_CHECKS_DEBUG'): cmd += ['-dD'] if crypto_user_config_file is not None: @@ -99,7 +99,7 @@ class TestConfigChecks(unittest.TestCase): cmd += ['-Iinclude', '-I.', '-I' + os.path.dirname(self.PROJECT_CONFIG_C)] - cmd.append(self.PROJECT_CONFIG_C) + cmd += ['-o', os.devnull, '-c', self.PROJECT_CONFIG_C] return subprocess.run(cmd, check=False, encoding='utf-8', @@ -111,7 +111,7 @@ class TestConfigChecks(unittest.TestCase): mbedtls_user_config: Optional[str] = None, extra_options: Optional[List[str]] = None, ) -> subprocess.CompletedProcess: - """Run cpp with the given content for user configuration files. + """Run cc with the given content for user configuration files. Return the CompletedProcess object capturing the return code, stdout and stderr. @@ -149,18 +149,18 @@ class TestConfigChecks(unittest.TestCase): mbedtls_user_config: Optional[str] = None, extra_options: Optional[List[str]] = None, ) -> None: - """Run cpp with the given user config(s). Expect no error. + """Run cc with the given user config(s). Expect no error. - Pass extra_options on the command line of cpp. + Pass extra_options on the command line of cc. """ cp = self.run_with_config(crypto_user_config, mbedtls_user_config, extra_options=extra_options) # Assert the error text before the status. That way, if it fails, # we see the unexpected error messages in the test log. - self.cpp_output = cp.stdout + self.cc_output = cp.stdout self.assertEqual(cp.stderr, '') self.assertEqual(cp.returncode, 0) - self.cpp_output = None + self.cc_output = None def bad_case(self, crypto_user_config: Optional[str], @@ -168,22 +168,22 @@ class TestConfigChecks(unittest.TestCase): error: Optional[Union[str, Pattern]] = None, extra_options: Optional[List[str]] = None, ) -> None: - """Run cpp with the given user config(s). Expect errors. + """Run cc with the given user config(s). Expect errors. - Pass extra_options on the command line of cpp. + Pass extra_options on the command line of cc. - If error is given, the standard error from cpp must match this regex. + If error is given, the standard error from cc must match this regex. """ cp = self.run_with_config(crypto_user_config, mbedtls_user_config, extra_options=extra_options) - self.cpp_output = cp.stdout + self.cc_output = cp.stdout if error is not None: # Assert the error text before the status. That way, if it fails, # we see the unexpected error messages in the test log. self.assertRegex(cp.stderr, error) self.assertGreater(cp.returncode, 0) self.assertLess(cp.returncode, 126) - self.cpp_output = None + self.cc_output = None # Nominal case, run first def test_01_nominal(self) -> None: From 08b8ce3a4bb5add2d536429ee9c641f8c2c53dfd Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Sep 2025 15:13:43 +0200 Subject: [PATCH 04/13] Add function to get the framework root Signed-off-by: Gilles Peskine --- scripts/mbedtls_framework/build_tree.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/scripts/mbedtls_framework/build_tree.py b/scripts/mbedtls_framework/build_tree.py index cb5f5c958..04dbf54fc 100644 --- a/scripts/mbedtls_framework/build_tree.py +++ b/scripts/mbedtls_framework/build_tree.py @@ -130,6 +130,12 @@ def guess_tf_psa_crypto_root(root: Optional[str] = None) -> str: else: raise Exception('TF-PSA-Crypto source tree not found') +def framework_root(root: Optional[str] = None) -> str: + """Return the path to the framework directory for this project.""" + if root is None: + root = guess_project_root() + return os.path.join(root, 'framework') + def is_mbedtls_3_6() -> bool: """Whether the working tree is an Mbed TLS 3.6 one or not From 2a68ccf3d12e32a654d33d93a36cda597e04d2e9 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Sep 2025 15:15:14 +0200 Subject: [PATCH 05/13] New module to load historical config options information Signed-off-by: Gilles Peskine --- scripts/mbedtls_framework/config_history.py | 57 +++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 scripts/mbedtls_framework/config_history.py diff --git a/scripts/mbedtls_framework/config_history.py b/scripts/mbedtls_framework/config_history.py new file mode 100644 index 000000000..b00dcb9db --- /dev/null +++ b/scripts/mbedtls_framework/config_history.py @@ -0,0 +1,57 @@ +"""Historical information about the library configuration. +""" + +## Copyright The Mbed TLS Contributors +## SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + +import glob +import os +import re +from typing import Dict, FrozenSet + +from . import build_tree + +class ConfigHistory: + """Historical information about the library configuration. + """ + + @staticmethod + def load_options(filename: str) -> FrozenSet[str]: + """Load the options from the given file. + + The file must contain one option name per line, with no whitespace. + """ + with open(filename) as inp: + return frozenset(inp.read().splitlines()) + + def load_history_files(self, + variety: str, + exclude_dict: Dict[str, Dict[str, FrozenSet[str]]] + ) -> Dict[str, Dict[str, FrozenSet[str]]]: + """Load all files containing macro lists of the given variety""" + data = {} #type: Dict[str, Dict[str, FrozenSet[str]]] + glob_pattern = os.path.join(self._history_dir, + f'config-{variety}-*-*.txt') + for filename in sorted(glob.glob(glob_pattern)): + basename = os.path.splitext(os.path.basename(filename))[0] + m = re.match(r'config-\w+-(.*?)-(.*)', basename) + assert m is not None + (product, version) = m.groups() + options = self.load_options(filename) + exclude = exclude_dict.get(product, {}).get(version, frozenset()) + data.setdefault(product, {})[version] = options - exclude + return data + + def __init__(self) -> None: + """Load all files containing historical option lists.""" + self._history_dir = os.path.join(build_tree.framework_root(), 'history') + self._options = self.load_history_files('options', {}) + self._internal = self.load_history_files('adjust', self._options) + + def options(self, product: str, version: str) -> FrozenSet[str]: + """The set of options in the given product version.""" + return self._options[product][version] + + def internal(self, product: str, version: str) -> FrozenSet[str]: + """The set of internal option-like macros in the given product version.""" + return self._internal[product][version] From 83e8568dcf72531409f6bfe20d9a2c05f4d47a62 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Sep 2025 15:15:28 +0200 Subject: [PATCH 06/13] New script to save historical config options information Signed-off-by: Gilles Peskine --- scripts/save_config_history.sh | 81 ++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100755 scripts/save_config_history.sh diff --git a/scripts/save_config_history.sh b/scripts/save_config_history.sh new file mode 100755 index 000000000..b610c9e4b --- /dev/null +++ b/scripts/save_config_history.sh @@ -0,0 +1,81 @@ +#!/bin/sh + +usage () { + cat <&2; exit 120;; + esac +done + +if [ $# -ne 2 ]; then + echo >&2 "This script requires exactly two non-option arguments: COMMIT VERSION" + usage >&2 + exit 120 +fi +commit=$1 +version=$2 + +# Assert that the git commit exists +git -C "$project_root" cat-file -e "${commit}^{commit}" + +product=mbedtls +if git -C "$project_root" merge-base --is-ancestor 0679e3a841c3317dc1f4a0faacc350bc91662b04 "$commit"; then + product=tfpsacrypto +else + product=mbedtls +fi + +temp_file=$(mktemp) +trap 'rm -f "$temp_file"' EXIT INT TERM + +collect_macros () { + output_file="$history_dir/config-$1-$product-$version.txt" + shift + : >"$temp_file" + for header in "$@"; do + git -C "$project_root" show "$commit:$header" >>"$temp_file" + done + sed -n 's![/ ]*# *define *\([A-Z_a-z][0-9A-Z_a-z]*\).*!\1!p' <"$temp_file" | + sort -u >"$output_file" + if [ ! -s "$output_file" ]; then + echo >&2 "$0: Failed to find any config option" + exit 1 + fi +} + + +collect_macros options $(git -C "$project_root" ls-tree -r --name-only "$commit" \ + include/mbedtls/mbedtls_config.h include/psa/crypto_config.h) +collect_macros adjust $(git -C "$project_root" ls-tree -r --name-only "$commit" | + grep '_adjust.*\.h$') From 013438891a1faf64adfb164f78dee1395e0ed19d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Sep 2025 15:20:00 +0200 Subject: [PATCH 07/13] Save config information about Mbed TLS 3.6 Use the latest patch release at this time, namely 3.6.4. This is the last release made before the first non-beta release of the next major version. ``` scripts/save_config_history.sh mbedtls-3.6.4 3.6 ``` Signed-off-by: Gilles Peskine --- history/config-adjust-mbedtls-3.6.txt | 327 +++++++++++++++++++ history/config-options-mbedtls-3.6.txt | 432 +++++++++++++++++++++++++ 2 files changed, 759 insertions(+) create mode 100644 history/config-adjust-mbedtls-3.6.txt create mode 100644 history/config-options-mbedtls-3.6.txt diff --git a/history/config-adjust-mbedtls-3.6.txt b/history/config-adjust-mbedtls-3.6.txt new file mode 100644 index 000000000..787ed4d57 --- /dev/null +++ b/history/config-adjust-mbedtls-3.6.txt @@ -0,0 +1,327 @@ +MBEDTLS_AES_C +MBEDTLS_ARIA_C +MBEDTLS_ASN1_PARSE_C +MBEDTLS_ASN1_WRITE_C +MBEDTLS_BIGNUM_C +MBEDTLS_BLOCK_CIPHER_AES_VIA_LEGACY +MBEDTLS_BLOCK_CIPHER_AES_VIA_PSA +MBEDTLS_BLOCK_CIPHER_ARIA_VIA_LEGACY +MBEDTLS_BLOCK_CIPHER_ARIA_VIA_PSA +MBEDTLS_BLOCK_CIPHER_C +MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_LEGACY +MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_PSA +MBEDTLS_BLOCK_CIPHER_CAN_AES +MBEDTLS_BLOCK_CIPHER_CAN_ARIA +MBEDTLS_BLOCK_CIPHER_CAN_CAMELLIA +MBEDTLS_BLOCK_CIPHER_SOME_PSA +MBEDTLS_CAMELLIA_C +MBEDTLS_CAN_ECDH +MBEDTLS_CCM_C +MBEDTLS_CCM_GCM_CAN_AES +MBEDTLS_CCM_GCM_CAN_ARIA +MBEDTLS_CCM_GCM_CAN_CAMELLIA +MBEDTLS_CHACHA20_C +MBEDTLS_CHACHAPOLY_C +MBEDTLS_CIPHER_C +MBEDTLS_CIPHER_MODE_CBC +MBEDTLS_CIPHER_MODE_CFB +MBEDTLS_CIPHER_MODE_CTR +MBEDTLS_CIPHER_MODE_OFB +MBEDTLS_CIPHER_PADDING_PKCS7 +MBEDTLS_CMAC_C +MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H +MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H +MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H +MBEDTLS_CONFIG_ADJUST_PSA_SUPERSET_LEGACY_H +MBEDTLS_CONFIG_ADJUST_SSL_H +MBEDTLS_CONFIG_ADJUST_X509_H +MBEDTLS_DES_C +MBEDTLS_ECDH_C +MBEDTLS_ECDSA_C +MBEDTLS_ECDSA_DETERMINISTIC +MBEDTLS_ECJPAKE_C +MBEDTLS_ECP_C +MBEDTLS_ECP_DP_BP256R1_ENABLED +MBEDTLS_ECP_DP_BP384R1_ENABLED +MBEDTLS_ECP_DP_BP512R1_ENABLED +MBEDTLS_ECP_DP_CURVE25519_ENABLED +MBEDTLS_ECP_DP_CURVE448_ENABLED +MBEDTLS_ECP_DP_SECP192K1_ENABLED +MBEDTLS_ECP_DP_SECP192R1_ENABLED +MBEDTLS_ECP_DP_SECP224R1_ENABLED +MBEDTLS_ECP_DP_SECP256K1_ENABLED +MBEDTLS_ECP_DP_SECP256R1_ENABLED +MBEDTLS_ECP_DP_SECP384R1_ENABLED +MBEDTLS_ECP_DP_SECP521R1_ENABLED +MBEDTLS_ECP_HAVE_BP256R1 +MBEDTLS_ECP_HAVE_BP384R1 +MBEDTLS_ECP_HAVE_BP512R1 +MBEDTLS_ECP_HAVE_CURVE25519 +MBEDTLS_ECP_HAVE_CURVE448 +MBEDTLS_ECP_HAVE_SECP192K1 +MBEDTLS_ECP_HAVE_SECP192R1 +MBEDTLS_ECP_HAVE_SECP224K1 +MBEDTLS_ECP_HAVE_SECP224R1 +MBEDTLS_ECP_HAVE_SECP256K1 +MBEDTLS_ECP_HAVE_SECP256R1 +MBEDTLS_ECP_HAVE_SECP384R1 +MBEDTLS_ECP_HAVE_SECP521R1 +MBEDTLS_ECP_LIGHT +MBEDTLS_GCM_C +MBEDTLS_GENPRIME +MBEDTLS_HMAC_DRBG_C +MBEDTLS_MD5_C +MBEDTLS_MD_C +MBEDTLS_MD_CAN_MD5 +MBEDTLS_MD_CAN_RIPEMD160 +MBEDTLS_MD_CAN_SHA1 +MBEDTLS_MD_CAN_SHA224 +MBEDTLS_MD_CAN_SHA256 +MBEDTLS_MD_CAN_SHA384 +MBEDTLS_MD_CAN_SHA3_224 +MBEDTLS_MD_CAN_SHA3_256 +MBEDTLS_MD_CAN_SHA3_384 +MBEDTLS_MD_CAN_SHA3_512 +MBEDTLS_MD_CAN_SHA512 +MBEDTLS_MD_LIGHT +MBEDTLS_MD_MD5_VIA_PSA +MBEDTLS_MD_RIPEMD160_VIA_PSA +MBEDTLS_MD_SHA1_VIA_PSA +MBEDTLS_MD_SHA224_VIA_PSA +MBEDTLS_MD_SHA256_VIA_PSA +MBEDTLS_MD_SHA384_VIA_PSA +MBEDTLS_MD_SHA3_224_VIA_PSA +MBEDTLS_MD_SHA3_256_VIA_PSA +MBEDTLS_MD_SHA3_384_VIA_PSA +MBEDTLS_MD_SHA3_512_VIA_PSA +MBEDTLS_MD_SHA512_VIA_PSA +MBEDTLS_MD_SOME_LEGACY +MBEDTLS_MD_SOME_PSA +MBEDTLS_OID_C +MBEDTLS_PKCS1_V15 +MBEDTLS_PKCS1_V21 +MBEDTLS_PK_CAN_ECDSA_SIGN +MBEDTLS_PK_CAN_ECDSA_SOME +MBEDTLS_PK_CAN_ECDSA_VERIFY +MBEDTLS_PK_HAVE_ECC_KEYS +MBEDTLS_PK_PARSE_EC_COMPRESSED +MBEDTLS_PLATFORM_SNPRINTF_ALT +MBEDTLS_PLATFORM_VSNPRINTF_ALT +MBEDTLS_POLY1305_C +MBEDTLS_PSA_ACCEL_ALG_ECDH +MBEDTLS_PSA_ACCEL_ALG_ECDSA +MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING +MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 +MBEDTLS_PSA_BUILTIN_ALG_CCM +MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG +MBEDTLS_PSA_BUILTIN_ALG_CFB +MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 +MBEDTLS_PSA_BUILTIN_ALG_CMAC +MBEDTLS_PSA_BUILTIN_ALG_CTR +MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA +MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING +MBEDTLS_PSA_BUILTIN_ALG_ECDH +MBEDTLS_PSA_BUILTIN_ALG_ECDSA +MBEDTLS_PSA_BUILTIN_ALG_FFDH +MBEDTLS_PSA_BUILTIN_ALG_GCM +MBEDTLS_PSA_BUILTIN_ALG_HKDF +MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND +MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT +MBEDTLS_PSA_BUILTIN_ALG_HMAC +MBEDTLS_PSA_BUILTIN_ALG_JPAKE +MBEDTLS_PSA_BUILTIN_ALG_MD5 +MBEDTLS_PSA_BUILTIN_ALG_OFB +MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 +MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC +MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 +MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP +MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT +MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN +MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS +MBEDTLS_PSA_BUILTIN_ALG_SHA3_224 +MBEDTLS_PSA_BUILTIN_ALG_SHA3_256 +MBEDTLS_PSA_BUILTIN_ALG_SHA3_384 +MBEDTLS_PSA_BUILTIN_ALG_SHA3_512 +MBEDTLS_PSA_BUILTIN_ALG_SHA_1 +MBEDTLS_PSA_BUILTIN_ALG_SHA_224 +MBEDTLS_PSA_BUILTIN_ALG_SHA_256 +MBEDTLS_PSA_BUILTIN_ALG_SHA_384 +MBEDTLS_PSA_BUILTIN_ALG_SHA_512 +MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER +MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS +MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF +MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS +MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 +MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 +MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 +MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 +MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 +MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 +MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 +MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 +MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 +MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA +MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA +MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_PAKE +MBEDTLS_PSA_CRYPTO_CLIENT +MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS +MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS +MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES +MBEDTLS_PSA_UTIL_HAVE_ECDSA +MBEDTLS_RIPEMD160_C +MBEDTLS_RSA_C +MBEDTLS_SHA1_C +MBEDTLS_SHA224_C +MBEDTLS_SHA256_C +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +MBEDTLS_SHA384_C +MBEDTLS_SHA3_C +MBEDTLS_SHA512_C +MBEDTLS_SSL_HAVE_AEAD +MBEDTLS_SSL_HAVE_AES +MBEDTLS_SSL_HAVE_ARIA +MBEDTLS_SSL_HAVE_CAMELLIA +MBEDTLS_SSL_HAVE_CBC +MBEDTLS_SSL_HAVE_CCM +MBEDTLS_SSL_HAVE_CHACHAPOLY +MBEDTLS_SSL_HAVE_GCM +MBEDTLS_SSL_TLS1_2_SOME_ECC +PSA_CRYPTO_ADJUST_AUTO_ENABLED_H +PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H +PSA_CRYPTO_ADJUST_CONFIG_SYNONYMS_H +PSA_CRYPTO_ADJUST_KEYPAIR_TYPES_H +PSA_HAVE_SOFT_BLOCK_CIPHER +PSA_HAVE_SOFT_BLOCK_MODE +PSA_HAVE_SOFT_KEY_TYPE_AES +PSA_HAVE_SOFT_KEY_TYPE_ARIA +PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA +PSA_HAVE_SOFT_KEY_TYPE_DES +PSA_HAVE_SOFT_PBKDF2 +PSA_HAVE_SOFT_PBKDF2_CMAC +PSA_HAVE_SOFT_PBKDF2_HMAC +PSA_WANT_ALG_CBC_NO_PADDING +PSA_WANT_ALG_CBC_PKCS7 +PSA_WANT_ALG_CCM +PSA_WANT_ALG_CCM_STAR_NO_TAG +PSA_WANT_ALG_CFB +PSA_WANT_ALG_CHACHA20_POLY1305 +PSA_WANT_ALG_CMAC +PSA_WANT_ALG_CTR +PSA_WANT_ALG_DETERMINISTIC_ECDSA +PSA_WANT_ALG_ECB_NO_PADDING +PSA_WANT_ALG_ECDH +PSA_WANT_ALG_ECDSA +PSA_WANT_ALG_ECDSA_ANY +PSA_WANT_ALG_FFDH +PSA_WANT_ALG_GCM +PSA_WANT_ALG_HKDF +PSA_WANT_ALG_HKDF_EXPAND +PSA_WANT_ALG_HKDF_EXTRACT +PSA_WANT_ALG_HMAC +PSA_WANT_ALG_JPAKE +PSA_WANT_ALG_MD5 +PSA_WANT_ALG_OFB +PSA_WANT_ALG_RIPEMD160 +PSA_WANT_ALG_RSA_OAEP +PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +PSA_WANT_ALG_RSA_PKCS1V15_SIGN +PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW +PSA_WANT_ALG_RSA_PSS +PSA_WANT_ALG_RSA_PSS_ANY_SALT +PSA_WANT_ALG_SHA3_224 +PSA_WANT_ALG_SHA3_256 +PSA_WANT_ALG_SHA3_384 +PSA_WANT_ALG_SHA3_512 +PSA_WANT_ALG_SHA_1 +PSA_WANT_ALG_SHA_224 +PSA_WANT_ALG_SHA_256 +PSA_WANT_ALG_SHA_384 +PSA_WANT_ALG_SHA_512 +PSA_WANT_ALG_STREAM_CIPHER +PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS +PSA_WANT_ALG_TLS12_PRF +PSA_WANT_ALG_TLS12_PSK_TO_MS +PSA_WANT_DH_RFC7919_2048 +PSA_WANT_DH_RFC7919_3072 +PSA_WANT_DH_RFC7919_4096 +PSA_WANT_DH_RFC7919_6144 +PSA_WANT_DH_RFC7919_8192 +PSA_WANT_ECC_BRAINPOOL_P_R1_256 +PSA_WANT_ECC_BRAINPOOL_P_R1_384 +PSA_WANT_ECC_BRAINPOOL_P_R1_512 +PSA_WANT_ECC_MONTGOMERY_255 +PSA_WANT_ECC_MONTGOMERY_448 +PSA_WANT_ECC_SECP_K1_192 +PSA_WANT_ECC_SECP_K1_224 +PSA_WANT_ECC_SECP_K1_256 +PSA_WANT_ECC_SECP_R1_192 +PSA_WANT_ECC_SECP_R1_224 +PSA_WANT_ECC_SECP_R1_256 +PSA_WANT_ECC_SECP_R1_384 +PSA_WANT_ECC_SECP_R1_521 +PSA_WANT_KEY_TYPE_AES +PSA_WANT_KEY_TYPE_ARIA +PSA_WANT_KEY_TYPE_CAMELLIA +PSA_WANT_KEY_TYPE_CHACHA20 +PSA_WANT_KEY_TYPE_DERIVE +PSA_WANT_KEY_TYPE_DES +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +PSA_WANT_KEY_TYPE_HMAC +PSA_WANT_KEY_TYPE_PASSWORD +PSA_WANT_KEY_TYPE_PASSWORD_HASH +PSA_WANT_KEY_TYPE_RAW_DATA +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY diff --git a/history/config-options-mbedtls-3.6.txt b/history/config-options-mbedtls-3.6.txt new file mode 100644 index 000000000..edc77b2b7 --- /dev/null +++ b/history/config-options-mbedtls-3.6.txt @@ -0,0 +1,432 @@ +MBEDTLS_AESCE_C +MBEDTLS_AESNI_C +MBEDTLS_AES_ALT +MBEDTLS_AES_C +MBEDTLS_AES_DECRYPT_ALT +MBEDTLS_AES_ENCRYPT_ALT +MBEDTLS_AES_FEWER_TABLES +MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH +MBEDTLS_AES_ROM_TABLES +MBEDTLS_AES_SETKEY_DEC_ALT +MBEDTLS_AES_SETKEY_ENC_ALT +MBEDTLS_AES_USE_HARDWARE_ONLY +MBEDTLS_ARIA_ALT +MBEDTLS_ARIA_C +MBEDTLS_ASN1_PARSE_C +MBEDTLS_ASN1_WRITE_C +MBEDTLS_BASE64_C +MBEDTLS_BIGNUM_C +MBEDTLS_BLOCK_CIPHER_NO_DECRYPT +MBEDTLS_CAMELLIA_ALT +MBEDTLS_CAMELLIA_C +MBEDTLS_CAMELLIA_SMALL_MEMORY +MBEDTLS_CCM_ALT +MBEDTLS_CCM_C +MBEDTLS_CHACHA20_ALT +MBEDTLS_CHACHA20_C +MBEDTLS_CHACHAPOLY_ALT +MBEDTLS_CHACHAPOLY_C +MBEDTLS_CHECK_RETURN +MBEDTLS_CHECK_RETURN_WARNING +MBEDTLS_CIPHER_C +MBEDTLS_CIPHER_MODE_CBC +MBEDTLS_CIPHER_MODE_CFB +MBEDTLS_CIPHER_MODE_CTR +MBEDTLS_CIPHER_MODE_OFB +MBEDTLS_CIPHER_MODE_XTS +MBEDTLS_CIPHER_NULL_CIPHER +MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +MBEDTLS_CIPHER_PADDING_PKCS7 +MBEDTLS_CIPHER_PADDING_ZEROS +MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +MBEDTLS_CMAC_ALT +MBEDTLS_CMAC_C +MBEDTLS_CONFIG_FILE +MBEDTLS_CONFIG_VERSION +MBEDTLS_CTR_DRBG_C +MBEDTLS_CTR_DRBG_ENTROPY_LEN +MBEDTLS_CTR_DRBG_MAX_INPUT +MBEDTLS_CTR_DRBG_MAX_REQUEST +MBEDTLS_CTR_DRBG_MAX_SEED_INPUT +MBEDTLS_CTR_DRBG_RESEED_INTERVAL +MBEDTLS_CTR_DRBG_USE_128_BIT_KEY +MBEDTLS_DEBUG_C +MBEDTLS_DEPRECATED_REMOVED +MBEDTLS_DEPRECATED_WARNING +MBEDTLS_DES3_CRYPT_ECB_ALT +MBEDTLS_DES_ALT +MBEDTLS_DES_C +MBEDTLS_DES_CRYPT_ECB_ALT +MBEDTLS_DES_SETKEY_ALT +MBEDTLS_DHM_ALT +MBEDTLS_DHM_C +MBEDTLS_ECDH_C +MBEDTLS_ECDH_COMPUTE_SHARED_ALT +MBEDTLS_ECDH_GEN_PUBLIC_ALT +MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED +MBEDTLS_ECDSA_C +MBEDTLS_ECDSA_DETERMINISTIC +MBEDTLS_ECDSA_GENKEY_ALT +MBEDTLS_ECDSA_SIGN_ALT +MBEDTLS_ECDSA_VERIFY_ALT +MBEDTLS_ECJPAKE_ALT +MBEDTLS_ECJPAKE_C +MBEDTLS_ECP_ADD_MIXED_ALT +MBEDTLS_ECP_ALT +MBEDTLS_ECP_C +MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT +MBEDTLS_ECP_DOUBLE_JAC_ALT +MBEDTLS_ECP_DP_BP256R1_ENABLED +MBEDTLS_ECP_DP_BP384R1_ENABLED +MBEDTLS_ECP_DP_BP512R1_ENABLED +MBEDTLS_ECP_DP_CURVE25519_ENABLED +MBEDTLS_ECP_DP_CURVE448_ENABLED +MBEDTLS_ECP_DP_SECP192K1_ENABLED +MBEDTLS_ECP_DP_SECP192R1_ENABLED +MBEDTLS_ECP_DP_SECP224K1_ENABLED +MBEDTLS_ECP_DP_SECP224R1_ENABLED +MBEDTLS_ECP_DP_SECP256K1_ENABLED +MBEDTLS_ECP_DP_SECP256R1_ENABLED +MBEDTLS_ECP_DP_SECP384R1_ENABLED +MBEDTLS_ECP_DP_SECP521R1_ENABLED +MBEDTLS_ECP_FIXED_POINT_OPTIM +MBEDTLS_ECP_INTERNAL_ALT +MBEDTLS_ECP_NIST_OPTIM +MBEDTLS_ECP_NORMALIZE_JAC_ALT +MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT +MBEDTLS_ECP_NORMALIZE_MXZ_ALT +MBEDTLS_ECP_NO_FALLBACK +MBEDTLS_ECP_RANDOMIZE_JAC_ALT +MBEDTLS_ECP_RANDOMIZE_MXZ_ALT +MBEDTLS_ECP_RESTARTABLE +MBEDTLS_ECP_WINDOW_SIZE +MBEDTLS_ECP_WITH_MPI_UINT +MBEDTLS_ENTROPY_C +MBEDTLS_ENTROPY_FORCE_SHA256 +MBEDTLS_ENTROPY_HARDWARE_ALT +MBEDTLS_ENTROPY_MAX_GATHER +MBEDTLS_ENTROPY_MAX_SOURCES +MBEDTLS_ENTROPY_MIN_HARDWARE +MBEDTLS_ENTROPY_NV_SEED +MBEDTLS_ERROR_C +MBEDTLS_ERROR_STRERROR_DUMMY +MBEDTLS_FS_IO +MBEDTLS_GCM_ALT +MBEDTLS_GCM_C +MBEDTLS_GCM_LARGE_TABLE +MBEDTLS_GENPRIME +MBEDTLS_HAVE_ASM +MBEDTLS_HAVE_SSE2 +MBEDTLS_HAVE_TIME +MBEDTLS_HAVE_TIME_DATE +MBEDTLS_HKDF_C +MBEDTLS_HMAC_DRBG_C +MBEDTLS_HMAC_DRBG_MAX_INPUT +MBEDTLS_HMAC_DRBG_MAX_REQUEST +MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT +MBEDTLS_HMAC_DRBG_RESEED_INTERVAL +MBEDTLS_IGNORE_RETURN +MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED +MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +MBEDTLS_KEY_EXCHANGE_RSA_ENABLED +MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED +MBEDTLS_LMS_C +MBEDTLS_LMS_PRIVATE +MBEDTLS_MD5_ALT +MBEDTLS_MD5_C +MBEDTLS_MD5_PROCESS_ALT +MBEDTLS_MD_C +MBEDTLS_MEMORY_ALIGN_MULTIPLE +MBEDTLS_MEMORY_BACKTRACE +MBEDTLS_MEMORY_BUFFER_ALLOC_C +MBEDTLS_MEMORY_DEBUG +MBEDTLS_MPI_MAX_SIZE +MBEDTLS_MPI_WINDOW_SIZE +MBEDTLS_NET_C +MBEDTLS_NIST_KW_ALT +MBEDTLS_NIST_KW_C +MBEDTLS_NO_64BIT_MULTIPLICATION +MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES +MBEDTLS_NO_PLATFORM_ENTROPY +MBEDTLS_NO_UDBL_DIVISION +MBEDTLS_OID_C +MBEDTLS_PADLOCK_C +MBEDTLS_PEM_PARSE_C +MBEDTLS_PEM_WRITE_C +MBEDTLS_PKCS12_C +MBEDTLS_PKCS1_V15 +MBEDTLS_PKCS1_V21 +MBEDTLS_PKCS5_C +MBEDTLS_PKCS7_C +MBEDTLS_PK_C +MBEDTLS_PK_PARSE_C +MBEDTLS_PK_PARSE_EC_COMPRESSED +MBEDTLS_PK_PARSE_EC_EXTENDED +MBEDTLS_PK_RSA_ALT_SUPPORT +MBEDTLS_PK_WRITE_C +MBEDTLS_PLATFORM_C +MBEDTLS_PLATFORM_CALLOC_MACRO +MBEDTLS_PLATFORM_EXIT_ALT +MBEDTLS_PLATFORM_EXIT_MACRO +MBEDTLS_PLATFORM_FPRINTF_ALT +MBEDTLS_PLATFORM_FPRINTF_MACRO +MBEDTLS_PLATFORM_FREE_MACRO +MBEDTLS_PLATFORM_GMTIME_R_ALT +MBEDTLS_PLATFORM_MEMORY +MBEDTLS_PLATFORM_MS_TIME_ALT +MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO +MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +MBEDTLS_PLATFORM_NV_SEED_ALT +MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +MBEDTLS_PLATFORM_PRINTF_ALT +MBEDTLS_PLATFORM_PRINTF_MACRO +MBEDTLS_PLATFORM_SETBUF_ALT +MBEDTLS_PLATFORM_SETBUF_MACRO +MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +MBEDTLS_PLATFORM_SNPRINTF_ALT +MBEDTLS_PLATFORM_SNPRINTF_MACRO +MBEDTLS_PLATFORM_STD_CALLOC +MBEDTLS_PLATFORM_STD_EXIT +MBEDTLS_PLATFORM_STD_EXIT_FAILURE +MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +MBEDTLS_PLATFORM_STD_FPRINTF +MBEDTLS_PLATFORM_STD_FREE +MBEDTLS_PLATFORM_STD_MEM_HDR +MBEDTLS_PLATFORM_STD_NV_SEED_FILE +MBEDTLS_PLATFORM_STD_NV_SEED_READ +MBEDTLS_PLATFORM_STD_NV_SEED_WRITE +MBEDTLS_PLATFORM_STD_PRINTF +MBEDTLS_PLATFORM_STD_SETBUF +MBEDTLS_PLATFORM_STD_SNPRINTF +MBEDTLS_PLATFORM_STD_TIME +MBEDTLS_PLATFORM_TIME_ALT +MBEDTLS_PLATFORM_TIME_MACRO +MBEDTLS_PLATFORM_TIME_TYPE_MACRO +MBEDTLS_PLATFORM_VSNPRINTF_ALT +MBEDTLS_PLATFORM_VSNPRINTF_MACRO +MBEDTLS_PLATFORM_ZEROIZE_ALT +MBEDTLS_POLY1305_ALT +MBEDTLS_POLY1305_C +MBEDTLS_PRINTF_MS_TIME +MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS +MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS +MBEDTLS_PSA_CRYPTO_C +MBEDTLS_PSA_CRYPTO_CLIENT +MBEDTLS_PSA_CRYPTO_CONFIG +MBEDTLS_PSA_CRYPTO_CONFIG_FILE +MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG +MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +MBEDTLS_PSA_CRYPTO_SE_C +MBEDTLS_PSA_CRYPTO_SPM +MBEDTLS_PSA_CRYPTO_STORAGE_C +MBEDTLS_PSA_CRYPTO_STRUCT_FILE +MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE +MBEDTLS_PSA_HMAC_DRBG_MD_TYPE +MBEDTLS_PSA_INJECT_ENTROPY +MBEDTLS_PSA_ITS_FILE_C +MBEDTLS_PSA_KEY_SLOT_COUNT +MBEDTLS_PSA_KEY_STORE_DYNAMIC +MBEDTLS_PSA_P256M_DRIVER_ENABLED +MBEDTLS_PSA_STATIC_KEY_SLOTS +MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +MBEDTLS_PSK_MAX_LEN +MBEDTLS_RIPEMD160_ALT +MBEDTLS_RIPEMD160_C +MBEDTLS_RIPEMD160_PROCESS_ALT +MBEDTLS_RSA_ALT +MBEDTLS_RSA_C +MBEDTLS_RSA_GEN_KEY_MIN_BITS +MBEDTLS_RSA_NO_CRT +MBEDTLS_SELF_TEST +MBEDTLS_SHA1_ALT +MBEDTLS_SHA1_C +MBEDTLS_SHA1_PROCESS_ALT +MBEDTLS_SHA224_C +MBEDTLS_SHA256_ALT +MBEDTLS_SHA256_C +MBEDTLS_SHA256_PROCESS_ALT +MBEDTLS_SHA256_SMALLER +MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT +MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +MBEDTLS_SHA384_C +MBEDTLS_SHA3_C +MBEDTLS_SHA512_ALT +MBEDTLS_SHA512_C +MBEDTLS_SHA512_PROCESS_ALT +MBEDTLS_SHA512_SMALLER +MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT +MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY +MBEDTLS_SSL_ALL_ALERT_MESSAGES +MBEDTLS_SSL_ALPN +MBEDTLS_SSL_ASYNC_PRIVATE +MBEDTLS_SSL_CACHE_C +MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES +MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT +MBEDTLS_SSL_CID_IN_LEN_MAX +MBEDTLS_SSL_CID_OUT_LEN_MAX +MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY +MBEDTLS_SSL_CIPHERSUITES +MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME +MBEDTLS_SSL_CLI_C +MBEDTLS_SSL_CONTEXT_SERIALIZATION +MBEDTLS_SSL_COOKIE_C +MBEDTLS_SSL_COOKIE_TIMEOUT +MBEDTLS_SSL_DEBUG_ALL +MBEDTLS_SSL_DTLS_ANTI_REPLAY +MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE +MBEDTLS_SSL_DTLS_CONNECTION_ID +MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT +MBEDTLS_SSL_DTLS_HELLO_VERIFY +MBEDTLS_SSL_DTLS_MAX_BUFFERING +MBEDTLS_SSL_DTLS_SRTP +MBEDTLS_SSL_EARLY_DATA +MBEDTLS_SSL_ENCRYPT_THEN_MAC +MBEDTLS_SSL_EXTENDED_MASTER_SECRET +MBEDTLS_SSL_IN_CONTENT_LEN +MBEDTLS_SSL_KEEP_PEER_CERTIFICATE +MBEDTLS_SSL_KEYING_MATERIAL_EXPORT +MBEDTLS_SSL_MAX_EARLY_DATA_SIZE +MBEDTLS_SSL_MAX_FRAGMENT_LENGTH +MBEDTLS_SSL_OUT_CONTENT_LEN +MBEDTLS_SSL_PROTO_DTLS +MBEDTLS_SSL_PROTO_TLS1_2 +MBEDTLS_SSL_PROTO_TLS1_3 +MBEDTLS_SSL_RECORD_SIZE_LIMIT +MBEDTLS_SSL_RENEGOTIATION +MBEDTLS_SSL_SERVER_NAME_INDICATION +MBEDTLS_SSL_SESSION_TICKETS +MBEDTLS_SSL_SRV_C +MBEDTLS_SSL_TICKET_C +MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE +MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS +MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED +MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED +MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED +MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE +MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH +MBEDTLS_SSL_TLS_C +MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH +MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN +MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND +MBEDTLS_TEST_HOOKS +MBEDTLS_THREADING_ALT +MBEDTLS_THREADING_C +MBEDTLS_THREADING_PTHREAD +MBEDTLS_TIMING_ALT +MBEDTLS_TIMING_C +MBEDTLS_USER_CONFIG_FILE +MBEDTLS_USE_PSA_CRYPTO +MBEDTLS_VERSION_C +MBEDTLS_VERSION_FEATURES +MBEDTLS_X509_CREATE_C +MBEDTLS_X509_CRL_PARSE_C +MBEDTLS_X509_CRT_PARSE_C +MBEDTLS_X509_CRT_WRITE_C +MBEDTLS_X509_CSR_PARSE_C +MBEDTLS_X509_CSR_WRITE_C +MBEDTLS_X509_MAX_FILE_PATH_LEN +MBEDTLS_X509_MAX_INTERMEDIATE_CA +MBEDTLS_X509_REMOVE_INFO +MBEDTLS_X509_RSASSA_PSS_SUPPORT +MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK +MBEDTLS_X509_USE_C +PSA_CRYPTO_CONFIG_H +PSA_WANT_ALG_CBC_NO_PADDING +PSA_WANT_ALG_CBC_PKCS7 +PSA_WANT_ALG_CCM +PSA_WANT_ALG_CCM_STAR_NO_TAG +PSA_WANT_ALG_CFB +PSA_WANT_ALG_CHACHA20_POLY1305 +PSA_WANT_ALG_CMAC +PSA_WANT_ALG_CTR +PSA_WANT_ALG_DETERMINISTIC_ECDSA +PSA_WANT_ALG_ECB_NO_PADDING +PSA_WANT_ALG_ECDH +PSA_WANT_ALG_ECDSA +PSA_WANT_ALG_FFDH +PSA_WANT_ALG_GCM +PSA_WANT_ALG_HKDF +PSA_WANT_ALG_HKDF_EXPAND +PSA_WANT_ALG_HKDF_EXTRACT +PSA_WANT_ALG_HMAC +PSA_WANT_ALG_JPAKE +PSA_WANT_ALG_MD5 +PSA_WANT_ALG_OFB +PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 +PSA_WANT_ALG_PBKDF2_HMAC +PSA_WANT_ALG_RIPEMD160 +PSA_WANT_ALG_RSA_OAEP +PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +PSA_WANT_ALG_RSA_PKCS1V15_SIGN +PSA_WANT_ALG_RSA_PSS +PSA_WANT_ALG_SHA3_224 +PSA_WANT_ALG_SHA3_256 +PSA_WANT_ALG_SHA3_384 +PSA_WANT_ALG_SHA3_512 +PSA_WANT_ALG_SHA_1 +PSA_WANT_ALG_SHA_224 +PSA_WANT_ALG_SHA_256 +PSA_WANT_ALG_SHA_384 +PSA_WANT_ALG_SHA_512 +PSA_WANT_ALG_STREAM_CIPHER +PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS +PSA_WANT_ALG_TLS12_PRF +PSA_WANT_ALG_TLS12_PSK_TO_MS +PSA_WANT_DH_RFC7919_2048 +PSA_WANT_DH_RFC7919_3072 +PSA_WANT_DH_RFC7919_4096 +PSA_WANT_DH_RFC7919_6144 +PSA_WANT_DH_RFC7919_8192 +PSA_WANT_ECC_BRAINPOOL_P_R1_256 +PSA_WANT_ECC_BRAINPOOL_P_R1_384 +PSA_WANT_ECC_BRAINPOOL_P_R1_512 +PSA_WANT_ECC_MONTGOMERY_255 +PSA_WANT_ECC_MONTGOMERY_448 +PSA_WANT_ECC_SECP_K1_192 +PSA_WANT_ECC_SECP_K1_256 +PSA_WANT_ECC_SECP_R1_192 +PSA_WANT_ECC_SECP_R1_224 +PSA_WANT_ECC_SECP_R1_256 +PSA_WANT_ECC_SECP_R1_384 +PSA_WANT_ECC_SECP_R1_521 +PSA_WANT_KEY_TYPE_AES +PSA_WANT_KEY_TYPE_ARIA +PSA_WANT_KEY_TYPE_CAMELLIA +PSA_WANT_KEY_TYPE_CHACHA20 +PSA_WANT_KEY_TYPE_DERIVE +PSA_WANT_KEY_TYPE_DES +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +PSA_WANT_KEY_TYPE_HMAC +PSA_WANT_KEY_TYPE_PASSWORD +PSA_WANT_KEY_TYPE_PASSWORD_HASH +PSA_WANT_KEY_TYPE_RAW_DATA +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY From 8943efa13654ae87a7465cfcf9829a3843deb3d3 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Sep 2025 15:22:51 +0200 Subject: [PATCH 08/13] Save config information about TF-PSA-Crypto 1.0 and Mbed TLS 4.0 Use today's `development` head and the crypto submodule there. We may update this again before the release. Once the release is out, we should update to the release tags. ``` scripts/save_config_history.sh 06bae1e110ce71b44c3f4d17974d24feea4d2a92 1.0 scripts/save_config_history.sh 07912c9e3693d7ae5d62bfcbb8aef4daa9e3cafc 4.0 ``` Signed-off-by: Gilles Peskine --- history/config-adjust-mbedtls-4.0.txt | 3 + history/config-adjust-tfpsacrypto-1.0.txt | 318 +++++++++++++++++++++ history/config-options-mbedtls-4.0.txt | 78 +++++ history/config-options-tfpsacrypto-1.0.txt | 242 ++++++++++++++++ 4 files changed, 641 insertions(+) create mode 100644 history/config-adjust-mbedtls-4.0.txt create mode 100644 history/config-adjust-tfpsacrypto-1.0.txt create mode 100644 history/config-options-mbedtls-4.0.txt create mode 100644 history/config-options-tfpsacrypto-1.0.txt diff --git a/history/config-adjust-mbedtls-4.0.txt b/history/config-adjust-mbedtls-4.0.txt new file mode 100644 index 000000000..ef0c69363 --- /dev/null +++ b/history/config-adjust-mbedtls-4.0.txt @@ -0,0 +1,3 @@ +MBEDTLS_CONFIG_ADJUST_SSL_H +MBEDTLS_CONFIG_ADJUST_X509_H +MBEDTLS_SSL_TLS1_2_SOME_ECC diff --git a/history/config-adjust-tfpsacrypto-1.0.txt b/history/config-adjust-tfpsacrypto-1.0.txt new file mode 100644 index 000000000..09766414d --- /dev/null +++ b/history/config-adjust-tfpsacrypto-1.0.txt @@ -0,0 +1,318 @@ +MBEDTLS_AES_C +MBEDTLS_ARIA_C +MBEDTLS_ASN1_PARSE_C +MBEDTLS_ASN1_WRITE_C +MBEDTLS_BIGNUM_C +MBEDTLS_BLOCK_CIPHER_AES_VIA_LEGACY +MBEDTLS_BLOCK_CIPHER_AES_VIA_PSA +MBEDTLS_BLOCK_CIPHER_ARIA_VIA_LEGACY +MBEDTLS_BLOCK_CIPHER_ARIA_VIA_PSA +MBEDTLS_BLOCK_CIPHER_C +MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_LEGACY +MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_PSA +MBEDTLS_BLOCK_CIPHER_CAN_AES +MBEDTLS_BLOCK_CIPHER_CAN_ARIA +MBEDTLS_BLOCK_CIPHER_CAN_CAMELLIA +MBEDTLS_BLOCK_CIPHER_SOME_PSA +MBEDTLS_CAMELLIA_C +MBEDTLS_CAN_ECDH +MBEDTLS_CCM_C +MBEDTLS_CCM_GCM_CAN_AES +MBEDTLS_CCM_GCM_CAN_ARIA +MBEDTLS_CCM_GCM_CAN_CAMELLIA +MBEDTLS_CHACHA20_C +MBEDTLS_CHACHAPOLY_C +MBEDTLS_CIPHER_C +MBEDTLS_CIPHER_MODE_CBC +MBEDTLS_CIPHER_MODE_CFB +MBEDTLS_CIPHER_MODE_CTR +MBEDTLS_CIPHER_MODE_OFB +MBEDTLS_CIPHER_MODE_XTS +MBEDTLS_CIPHER_PADDING_PKCS7 +MBEDTLS_CMAC_C +MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H +MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H +MBEDTLS_CONFIG_ADJUST_PSA_SUPERSET_LEGACY_H +MBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS_H +MBEDTLS_DES_C +MBEDTLS_ECDH_C +MBEDTLS_ECDSA_C +MBEDTLS_ECDSA_DETERMINISTIC +MBEDTLS_ECJPAKE_C +MBEDTLS_ECP_C +MBEDTLS_ECP_DP_BP256R1_ENABLED +MBEDTLS_ECP_DP_BP384R1_ENABLED +MBEDTLS_ECP_DP_BP512R1_ENABLED +MBEDTLS_ECP_DP_CURVE25519_ENABLED +MBEDTLS_ECP_DP_CURVE448_ENABLED +MBEDTLS_ECP_DP_SECP192K1_ENABLED +MBEDTLS_ECP_DP_SECP192R1_ENABLED +MBEDTLS_ECP_DP_SECP256K1_ENABLED +MBEDTLS_ECP_DP_SECP256R1_ENABLED +MBEDTLS_ECP_DP_SECP384R1_ENABLED +MBEDTLS_ECP_DP_SECP521R1_ENABLED +MBEDTLS_ECP_LIGHT +MBEDTLS_ENTROPY_C +MBEDTLS_ENTROPY_HAVE_SOURCES +MBEDTLS_ENTROPY_TRUE_SOURCES +MBEDTLS_GCM_C +MBEDTLS_GENPRIME +MBEDTLS_HMAC_DRBG_C +MBEDTLS_MD5_C +MBEDTLS_MD_C +MBEDTLS_MD_LIGHT +MBEDTLS_MD_MD5_VIA_PSA +MBEDTLS_MD_RIPEMD160_VIA_PSA +MBEDTLS_MD_SHA1_VIA_PSA +MBEDTLS_MD_SHA224_VIA_PSA +MBEDTLS_MD_SHA256_VIA_PSA +MBEDTLS_MD_SHA384_VIA_PSA +MBEDTLS_MD_SHA3_224_VIA_PSA +MBEDTLS_MD_SHA3_256_VIA_PSA +MBEDTLS_MD_SHA3_384_VIA_PSA +MBEDTLS_MD_SHA3_512_VIA_PSA +MBEDTLS_MD_SHA512_VIA_PSA +MBEDTLS_MD_SOME_LEGACY +MBEDTLS_MD_SOME_PSA +MBEDTLS_PKCS1_V15 +MBEDTLS_PKCS1_V21 +MBEDTLS_PK_PARSE_EC_COMPRESSED +MBEDTLS_PLATFORM_SNPRINTF_ALT +MBEDTLS_PLATFORM_VSNPRINTF_ALT +MBEDTLS_POLY1305_C +MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING +MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7 +MBEDTLS_PSA_ACCEL_ALG_CCM +MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG +MBEDTLS_PSA_ACCEL_ALG_CFB +MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 +MBEDTLS_PSA_ACCEL_ALG_CMAC +MBEDTLS_PSA_ACCEL_ALG_CTR +MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA +MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING +MBEDTLS_PSA_ACCEL_ALG_ECDH +MBEDTLS_PSA_ACCEL_ALG_ECDSA +MBEDTLS_PSA_ACCEL_ALG_FFDH +MBEDTLS_PSA_ACCEL_ALG_GCM +MBEDTLS_PSA_ACCEL_ALG_HKDF +MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND +MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT +MBEDTLS_PSA_ACCEL_ALG_HMAC +MBEDTLS_PSA_ACCEL_ALG_JPAKE +MBEDTLS_PSA_ACCEL_ALG_MD5 +MBEDTLS_PSA_ACCEL_ALG_OFB +MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128 +MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC +MBEDTLS_PSA_ACCEL_ALG_RIPEMD160 +MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP +MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT +MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN +MBEDTLS_PSA_ACCEL_ALG_RSA_PSS +MBEDTLS_PSA_ACCEL_ALG_SHA3_224 +MBEDTLS_PSA_ACCEL_ALG_SHA3_256 +MBEDTLS_PSA_ACCEL_ALG_SHA3_384 +MBEDTLS_PSA_ACCEL_ALG_SHA3_512 +MBEDTLS_PSA_ACCEL_ALG_SHA_1 +MBEDTLS_PSA_ACCEL_ALG_SHA_224 +MBEDTLS_PSA_ACCEL_ALG_SHA_256 +MBEDTLS_PSA_ACCEL_ALG_SHA_384 +MBEDTLS_PSA_ACCEL_ALG_SHA_512 +MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER +MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS +MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF +MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS +MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 +MBEDTLS_PSA_ACCEL_KEY_TYPE_AES +MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA +MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA +MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 +MBEDTLS_PSA_ACCEL_KEY_TYPE_DERIVE +MBEDTLS_PSA_ACCEL_KEY_TYPE_DES +MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC +MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE +MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY +MBEDTLS_PSA_ACCEL_KEY_TYPE_HMAC +MBEDTLS_PSA_ACCEL_KEY_TYPE_PASSWORD +MBEDTLS_PSA_ACCEL_KEY_TYPE_PASSWORD_HASH +MBEDTLS_PSA_ACCEL_KEY_TYPE_RAW_DATA +MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC +MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE +MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT +MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING +MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 +MBEDTLS_PSA_BUILTIN_ALG_CCM +MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG +MBEDTLS_PSA_BUILTIN_ALG_CFB +MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 +MBEDTLS_PSA_BUILTIN_ALG_CMAC +MBEDTLS_PSA_BUILTIN_ALG_CTR +MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA +MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING +MBEDTLS_PSA_BUILTIN_ALG_ECDH +MBEDTLS_PSA_BUILTIN_ALG_ECDSA +MBEDTLS_PSA_BUILTIN_ALG_FFDH +MBEDTLS_PSA_BUILTIN_ALG_GCM +MBEDTLS_PSA_BUILTIN_ALG_HKDF +MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND +MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT +MBEDTLS_PSA_BUILTIN_ALG_HMAC +MBEDTLS_PSA_BUILTIN_ALG_JPAKE +MBEDTLS_PSA_BUILTIN_ALG_MD5 +MBEDTLS_PSA_BUILTIN_ALG_OFB +MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 +MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC +MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 +MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP +MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT +MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN +MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS +MBEDTLS_PSA_BUILTIN_ALG_SHA3_224 +MBEDTLS_PSA_BUILTIN_ALG_SHA3_256 +MBEDTLS_PSA_BUILTIN_ALG_SHA3_384 +MBEDTLS_PSA_BUILTIN_ALG_SHA3_512 +MBEDTLS_PSA_BUILTIN_ALG_SHA_1 +MBEDTLS_PSA_BUILTIN_ALG_SHA_224 +MBEDTLS_PSA_BUILTIN_ALG_SHA_256 +MBEDTLS_PSA_BUILTIN_ALG_SHA_384 +MBEDTLS_PSA_BUILTIN_ALG_SHA_512 +MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER +MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS +MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF +MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS +MBEDTLS_PSA_BUILTIN_ALG_XTS +MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 +MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 +MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 +MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 +MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 +MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 +MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 +MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 +MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 +MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 +MBEDTLS_PSA_BUILTIN_GET_ENTROPY_DEFINED +MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA +MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA +MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT +MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY +MBEDTLS_PSA_BUILTIN_PAKE +MBEDTLS_PSA_CRYPTO_CLIENT +MBEDTLS_PSA_CRYPTO_RNG_HASH +MBEDTLS_PSA_CRYPTO_RNG_STRENGTH +MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS +MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS +MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES +MBEDTLS_PSA_DRIVER_GET_ENTROPY +MBEDTLS_PSA_DRIVER_GET_ENTROPY_DEFINED +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC +MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES +MBEDTLS_RIPEMD160_C +MBEDTLS_RSA_C +MBEDTLS_SHA1_C +MBEDTLS_SHA224_C +MBEDTLS_SHA256_C +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +MBEDTLS_SHA384_C +MBEDTLS_SHA512_C +MBEDTLS_SSL_HAVE_AEAD +MBEDTLS_USE_PSA_CRYPTO +PSA_CRYPTO_ADJUST_AUTO_ENABLED_H +PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H +PSA_CRYPTO_ADJUST_CONFIG_DERIVED_H +PSA_CRYPTO_ADJUST_CONFIG_SYNONYMS_H +PSA_CRYPTO_ADJUST_KEYPAIR_TYPES_H +PSA_HAVE_ALG_ECDSA_SIGN +PSA_HAVE_ALG_ECDSA_VERIFY +PSA_HAVE_ALG_SOME_ECDSA +PSA_HAVE_SOFT_BLOCK_CIPHER +PSA_HAVE_SOFT_BLOCK_MODE +PSA_HAVE_SOFT_KEY_TYPE_AES +PSA_HAVE_SOFT_KEY_TYPE_ARIA +PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA +PSA_HAVE_SOFT_KEY_TYPE_DES +PSA_HAVE_SOFT_PBKDF2 +PSA_HAVE_SOFT_PBKDF2_CMAC +PSA_HAVE_SOFT_PBKDF2_HMAC +PSA_WANT_ALG_CMAC +PSA_WANT_ALG_ECB_NO_PADDING +PSA_WANT_ALG_ECDSA +PSA_WANT_ALG_ECDSA_ANY +PSA_WANT_ALG_HMAC +PSA_WANT_ALG_MD5 +PSA_WANT_ALG_RIPEMD160 +PSA_WANT_ALG_RSA_PKCS1V15_SIGN +PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW +PSA_WANT_ALG_RSA_PSS +PSA_WANT_ALG_RSA_PSS_ANY_SALT +PSA_WANT_ALG_SHA_1 +PSA_WANT_ALG_SHA_224 +PSA_WANT_ALG_SHA_256 +PSA_WANT_ALG_SHA_384 +PSA_WANT_ALG_SHA_512 +PSA_WANT_ALG_SOME_PAKE +PSA_WANT_ECC_BRAINPOOL_P_R1_256 +PSA_WANT_ECC_BRAINPOOL_P_R1_384 +PSA_WANT_ECC_BRAINPOOL_P_R1_512 +PSA_WANT_ECC_MONTGOMERY_255 +PSA_WANT_ECC_MONTGOMERY_448 +PSA_WANT_ECC_SECP_K1_192 +PSA_WANT_ECC_SECP_K1_256 +PSA_WANT_ECC_SECP_R1_192 +PSA_WANT_ECC_SECP_R1_256 +PSA_WANT_ECC_SECP_R1_384 +PSA_WANT_ECC_SECP_R1_521 +PSA_WANT_KEY_TYPE_AES +PSA_WANT_KEY_TYPE_DERIVE +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +PSA_WANT_KEY_TYPE_HMAC +PSA_WANT_KEY_TYPE_PASSWORD +PSA_WANT_KEY_TYPE_PASSWORD_HASH +PSA_WANT_KEY_TYPE_RAW_DATA +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY diff --git a/history/config-options-mbedtls-4.0.txt b/history/config-options-mbedtls-4.0.txt new file mode 100644 index 000000000..cadd768dc --- /dev/null +++ b/history/config-options-mbedtls-4.0.txt @@ -0,0 +1,78 @@ +MBEDTLS_CONFIG_FILE +MBEDTLS_CONFIG_VERSION +MBEDTLS_DEBUG_C +MBEDTLS_ERROR_C +MBEDTLS_ERROR_STRERROR_DUMMY +MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED +MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +MBEDTLS_NET_C +MBEDTLS_PKCS7_C +MBEDTLS_PSK_MAX_LEN +MBEDTLS_SSL_ALL_ALERT_MESSAGES +MBEDTLS_SSL_ALPN +MBEDTLS_SSL_ASYNC_PRIVATE +MBEDTLS_SSL_CACHE_C +MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES +MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT +MBEDTLS_SSL_CID_IN_LEN_MAX +MBEDTLS_SSL_CID_OUT_LEN_MAX +MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY +MBEDTLS_SSL_CIPHERSUITES +MBEDTLS_SSL_CLI_C +MBEDTLS_SSL_CONTEXT_SERIALIZATION +MBEDTLS_SSL_COOKIE_C +MBEDTLS_SSL_COOKIE_TIMEOUT +MBEDTLS_SSL_DEBUG_ALL +MBEDTLS_SSL_DTLS_ANTI_REPLAY +MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE +MBEDTLS_SSL_DTLS_CONNECTION_ID +MBEDTLS_SSL_DTLS_HELLO_VERIFY +MBEDTLS_SSL_DTLS_MAX_BUFFERING +MBEDTLS_SSL_DTLS_SRTP +MBEDTLS_SSL_EARLY_DATA +MBEDTLS_SSL_ENCRYPT_THEN_MAC +MBEDTLS_SSL_EXTENDED_MASTER_SECRET +MBEDTLS_SSL_IN_CONTENT_LEN +MBEDTLS_SSL_KEEP_PEER_CERTIFICATE +MBEDTLS_SSL_KEYING_MATERIAL_EXPORT +MBEDTLS_SSL_MAX_EARLY_DATA_SIZE +MBEDTLS_SSL_MAX_FRAGMENT_LENGTH +MBEDTLS_SSL_OUT_CONTENT_LEN +MBEDTLS_SSL_PROTO_DTLS +MBEDTLS_SSL_PROTO_TLS1_2 +MBEDTLS_SSL_PROTO_TLS1_3 +MBEDTLS_SSL_RECORD_SIZE_LIMIT +MBEDTLS_SSL_RENEGOTIATION +MBEDTLS_SSL_SERVER_NAME_INDICATION +MBEDTLS_SSL_SESSION_TICKETS +MBEDTLS_SSL_SRV_C +MBEDTLS_SSL_TICKET_C +MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE +MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS +MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED +MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED +MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED +MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE +MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH +MBEDTLS_SSL_TLS_C +MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH +MBEDTLS_TIMING_ALT +MBEDTLS_TIMING_C +MBEDTLS_USER_CONFIG_FILE +MBEDTLS_VERSION_C +MBEDTLS_VERSION_FEATURES +MBEDTLS_X509_CREATE_C +MBEDTLS_X509_CRL_PARSE_C +MBEDTLS_X509_CRT_PARSE_C +MBEDTLS_X509_CRT_WRITE_C +MBEDTLS_X509_CSR_PARSE_C +MBEDTLS_X509_CSR_WRITE_C +MBEDTLS_X509_MAX_FILE_PATH_LEN +MBEDTLS_X509_MAX_INTERMEDIATE_CA +MBEDTLS_X509_REMOVE_INFO +MBEDTLS_X509_RSASSA_PSS_SUPPORT +MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK +MBEDTLS_X509_USE_C diff --git a/history/config-options-tfpsacrypto-1.0.txt b/history/config-options-tfpsacrypto-1.0.txt new file mode 100644 index 000000000..d8458a8ff --- /dev/null +++ b/history/config-options-tfpsacrypto-1.0.txt @@ -0,0 +1,242 @@ +MBEDTLS_AESCE_C +MBEDTLS_AESNI_C +MBEDTLS_AES_FEWER_TABLES +MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH +MBEDTLS_AES_ROM_TABLES +MBEDTLS_AES_USE_HARDWARE_ONLY +MBEDTLS_ASN1_PARSE_C +MBEDTLS_ASN1_WRITE_C +MBEDTLS_BASE64_C +MBEDTLS_BIGNUM_C +MBEDTLS_BLOCK_CIPHER_NO_DECRYPT +MBEDTLS_CAMELLIA_SMALL_MEMORY +MBEDTLS_CHECK_RETURN +MBEDTLS_CHECK_RETURN_WARNING +MBEDTLS_CIPHER_NULL_CIPHER +MBEDTLS_CTR_DRBG_C +MBEDTLS_DEPRECATED_REMOVED +MBEDTLS_DEPRECATED_WARNING +MBEDTLS_ECDH_C +MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED +MBEDTLS_ECDSA_C +MBEDTLS_ECJPAKE_C +MBEDTLS_ECP_C +MBEDTLS_ECP_DP_BP256R1_ENABLED +MBEDTLS_ECP_DP_BP384R1_ENABLED +MBEDTLS_ECP_DP_BP512R1_ENABLED +MBEDTLS_ECP_DP_CURVE25519_ENABLED +MBEDTLS_ECP_DP_CURVE448_ENABLED +MBEDTLS_ECP_DP_SECP192K1_ENABLED +MBEDTLS_ECP_DP_SECP192R1_ENABLED +MBEDTLS_ECP_DP_SECP256K1_ENABLED +MBEDTLS_ECP_DP_SECP256R1_ENABLED +MBEDTLS_ECP_DP_SECP384R1_ENABLED +MBEDTLS_ECP_DP_SECP521R1_ENABLED +MBEDTLS_ECP_FIXED_POINT_OPTIM +MBEDTLS_ECP_NIST_OPTIM +MBEDTLS_ECP_RESTARTABLE +MBEDTLS_ECP_WINDOW_SIZE +MBEDTLS_ECP_WITH_MPI_UINT +MBEDTLS_ENTROPY_NO_SOURCES_OK +MBEDTLS_ENTROPY_NV_SEED +MBEDTLS_FS_IO +MBEDTLS_GCM_LARGE_TABLE +MBEDTLS_HAVE_ASM +MBEDTLS_HAVE_SSE2 +MBEDTLS_HAVE_TIME +MBEDTLS_HAVE_TIME_DATE +MBEDTLS_HMAC_DRBG_C +MBEDTLS_IGNORE_RETURN +MBEDTLS_LMS_C +MBEDTLS_LMS_PRIVATE +MBEDTLS_MD_C +MBEDTLS_MEMORY_ALIGN_MULTIPLE +MBEDTLS_MEMORY_BACKTRACE +MBEDTLS_MEMORY_BUFFER_ALLOC_C +MBEDTLS_MEMORY_DEBUG +MBEDTLS_MPI_MAX_SIZE +MBEDTLS_MPI_WINDOW_SIZE +MBEDTLS_NIST_KW_C +MBEDTLS_NO_64BIT_MULTIPLICATION +MBEDTLS_NO_UDBL_DIVISION +MBEDTLS_PEM_PARSE_C +MBEDTLS_PEM_WRITE_C +MBEDTLS_PKCS5_C +MBEDTLS_PK_C +MBEDTLS_PK_PARSE_C +MBEDTLS_PK_PARSE_EC_COMPRESSED +MBEDTLS_PK_PARSE_EC_EXTENDED +MBEDTLS_PK_WRITE_C +MBEDTLS_PLATFORM_C +MBEDTLS_PLATFORM_CALLOC_MACRO +MBEDTLS_PLATFORM_EXIT_ALT +MBEDTLS_PLATFORM_EXIT_MACRO +MBEDTLS_PLATFORM_FPRINTF_ALT +MBEDTLS_PLATFORM_FPRINTF_MACRO +MBEDTLS_PLATFORM_FREE_MACRO +MBEDTLS_PLATFORM_GET_ENTROPY_ALT +MBEDTLS_PLATFORM_GMTIME_R_ALT +MBEDTLS_PLATFORM_MEMORY +MBEDTLS_PLATFORM_MS_TIME_ALT +MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO +MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +MBEDTLS_PLATFORM_NV_SEED_ALT +MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +MBEDTLS_PLATFORM_PRINTF_ALT +MBEDTLS_PLATFORM_PRINTF_MACRO +MBEDTLS_PLATFORM_SETBUF_ALT +MBEDTLS_PLATFORM_SETBUF_MACRO +MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +MBEDTLS_PLATFORM_SNPRINTF_ALT +MBEDTLS_PLATFORM_SNPRINTF_MACRO +MBEDTLS_PLATFORM_STD_CALLOC +MBEDTLS_PLATFORM_STD_EXIT +MBEDTLS_PLATFORM_STD_EXIT_FAILURE +MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +MBEDTLS_PLATFORM_STD_FPRINTF +MBEDTLS_PLATFORM_STD_FREE +MBEDTLS_PLATFORM_STD_MEM_HDR +MBEDTLS_PLATFORM_STD_NV_SEED_FILE +MBEDTLS_PLATFORM_STD_NV_SEED_READ +MBEDTLS_PLATFORM_STD_NV_SEED_WRITE +MBEDTLS_PLATFORM_STD_PRINTF +MBEDTLS_PLATFORM_STD_SETBUF +MBEDTLS_PLATFORM_STD_SNPRINTF +MBEDTLS_PLATFORM_STD_TIME +MBEDTLS_PLATFORM_TIME_ALT +MBEDTLS_PLATFORM_TIME_MACRO +MBEDTLS_PLATFORM_TIME_TYPE_MACRO +MBEDTLS_PLATFORM_VSNPRINTF_ALT +MBEDTLS_PLATFORM_VSNPRINTF_MACRO +MBEDTLS_PLATFORM_ZEROIZE_ALT +MBEDTLS_PRINTF_MS_TIME +MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS +MBEDTLS_PSA_BUILTIN_GET_ENTROPY +MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS +MBEDTLS_PSA_CRYPTO_C +MBEDTLS_PSA_CRYPTO_CLIENT +MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG +MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +MBEDTLS_PSA_CRYPTO_RNG_HASH +MBEDTLS_PSA_CRYPTO_RNG_STRENGTH +MBEDTLS_PSA_CRYPTO_SPM +MBEDTLS_PSA_CRYPTO_STORAGE_C +MBEDTLS_PSA_CRYPTO_STRUCT_FILE +MBEDTLS_PSA_DRIVER_GET_ENTROPY +MBEDTLS_PSA_ITS_FILE_C +MBEDTLS_PSA_KEY_SLOT_COUNT +MBEDTLS_PSA_KEY_STORE_DYNAMIC +MBEDTLS_PSA_P256M_DRIVER_ENABLED +MBEDTLS_PSA_RNG_RESEED_INTERVAL +MBEDTLS_PSA_STATIC_KEY_SLOTS +MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +MBEDTLS_RSA_GEN_KEY_MIN_BITS +MBEDTLS_RSA_NO_CRT +MBEDTLS_SELF_TEST +MBEDTLS_SHA256_SMALLER +MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT +MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +MBEDTLS_SHA512_SMALLER +MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT +MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY +MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN +MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND +MBEDTLS_TEST_HOOKS +MBEDTLS_THREADING_ALT +MBEDTLS_THREADING_C +MBEDTLS_THREADING_PTHREAD +PSA_CRYPTO_CONFIG_H +PSA_WANT_ALG_CBC_NO_PADDING +PSA_WANT_ALG_CBC_PKCS7 +PSA_WANT_ALG_CCM +PSA_WANT_ALG_CCM_STAR_NO_TAG +PSA_WANT_ALG_CFB +PSA_WANT_ALG_CHACHA20_POLY1305 +PSA_WANT_ALG_CMAC +PSA_WANT_ALG_CTR +PSA_WANT_ALG_DETERMINISTIC_ECDSA +PSA_WANT_ALG_ECB_NO_PADDING +PSA_WANT_ALG_ECDH +PSA_WANT_ALG_ECDSA +PSA_WANT_ALG_FFDH +PSA_WANT_ALG_GCM +PSA_WANT_ALG_HKDF +PSA_WANT_ALG_HKDF_EXPAND +PSA_WANT_ALG_HKDF_EXTRACT +PSA_WANT_ALG_HMAC +PSA_WANT_ALG_JPAKE +PSA_WANT_ALG_MD5 +PSA_WANT_ALG_OFB +PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 +PSA_WANT_ALG_PBKDF2_HMAC +PSA_WANT_ALG_RIPEMD160 +PSA_WANT_ALG_RSA_OAEP +PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +PSA_WANT_ALG_RSA_PKCS1V15_SIGN +PSA_WANT_ALG_RSA_PSS +PSA_WANT_ALG_SHA3_224 +PSA_WANT_ALG_SHA3_256 +PSA_WANT_ALG_SHA3_384 +PSA_WANT_ALG_SHA3_512 +PSA_WANT_ALG_SHA_1 +PSA_WANT_ALG_SHA_224 +PSA_WANT_ALG_SHA_256 +PSA_WANT_ALG_SHA_384 +PSA_WANT_ALG_SHA_512 +PSA_WANT_ALG_STREAM_CIPHER +PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS +PSA_WANT_ALG_TLS12_PRF +PSA_WANT_ALG_TLS12_PSK_TO_MS +PSA_WANT_DH_RFC7919_2048 +PSA_WANT_DH_RFC7919_3072 +PSA_WANT_DH_RFC7919_4096 +PSA_WANT_DH_RFC7919_6144 +PSA_WANT_DH_RFC7919_8192 +PSA_WANT_ECC_BRAINPOOL_P_R1_256 +PSA_WANT_ECC_BRAINPOOL_P_R1_384 +PSA_WANT_ECC_BRAINPOOL_P_R1_512 +PSA_WANT_ECC_MONTGOMERY_255 +PSA_WANT_ECC_MONTGOMERY_448 +PSA_WANT_ECC_SECP_K1_192 +PSA_WANT_ECC_SECP_K1_256 +PSA_WANT_ECC_SECP_R1_192 +PSA_WANT_ECC_SECP_R1_256 +PSA_WANT_ECC_SECP_R1_384 +PSA_WANT_ECC_SECP_R1_521 +PSA_WANT_KEY_TYPE_AES +PSA_WANT_KEY_TYPE_ARIA +PSA_WANT_KEY_TYPE_CAMELLIA +PSA_WANT_KEY_TYPE_CHACHA20 +PSA_WANT_KEY_TYPE_DERIVE +PSA_WANT_KEY_TYPE_DES +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +PSA_WANT_KEY_TYPE_HMAC +PSA_WANT_KEY_TYPE_PASSWORD +PSA_WANT_KEY_TYPE_PASSWORD_HASH +PSA_WANT_KEY_TYPE_RAW_DATA +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE +PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +TF_PSA_CRYPTO_CONFIG_FILE +TF_PSA_CRYPTO_USER_CONFIG_FILE +TF_PSA_CRYPTO_VERSION From fcfe1920c4d39f3ac6d0d8d7e3f2c451b6b9acbd Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 23 Sep 2025 16:13:02 +0200 Subject: [PATCH 09/13] Remove subproject as a constructor argument There's only one subproject and that's unlikely to change, so being able to specify a subproject at runtime is overkill. Signed-off-by: Gilles Peskine --- .../mbedtls_framework/config_checks_generator.py | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/scripts/mbedtls_framework/config_checks_generator.py b/scripts/mbedtls_framework/config_checks_generator.py index 1d1581f58..957099edc 100644 --- a/scripts/mbedtls_framework/config_checks_generator.py +++ b/scripts/mbedtls_framework/config_checks_generator.py @@ -109,18 +109,14 @@ class Internal(Checker): class SubprojectInternal(Checker): """Checker for an internal macro of a subproject.""" - # meant to be overridden in child classes + # must be overridden in child classes SUBPROJECT = None #type: Optional[str] - def __init__(self, name: str, suggestion: str = '', - subproject: Optional[str] = None) -> None: + def __init__(self, name: str, suggestion: str = '') -> None: super().__init__(name, suggestion) - if subproject is not None: - self.subproject = subproject - elif self.SUBPROJECT is not None: - self.subproject = self.SUBPROJECT - else: + if self.SUBPROJECT is None: raise ValueError('No subproject specified for ' + name) + self.subproject = self.SUBPROJECT #type: str def _basic_message(self) -> str: return f'{self.name} is an internal macro of {self.subproject} and may not be configured.' @@ -150,9 +146,6 @@ class SubprojectInternal(Checker): class SubprojectOption(SubprojectInternal): """Checker for a configuration option of a subproject.""" - def __init__(self, name: str, subproject: Optional[str] = None) -> None: - super().__init__(name, subproject=subproject) - def _basic_message(self) -> str: return f'{self.name} must be configured in {self.subproject}.' From 4402172a0f7051d52af913ae22a7310572a29dc6 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 23 Sep 2025 16:18:17 +0200 Subject: [PATCH 10/13] Remove redundant assignment Signed-off-by: Gilles Peskine --- scripts/save_config_history.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/save_config_history.sh b/scripts/save_config_history.sh index b610c9e4b..a45d1d3ba 100755 --- a/scripts/save_config_history.sh +++ b/scripts/save_config_history.sh @@ -49,7 +49,6 @@ version=$2 # Assert that the git commit exists git -C "$project_root" cat-file -e "${commit}^{commit}" -product=mbedtls if git -C "$project_root" merge-base --is-ancestor 0679e3a841c3317dc1f4a0faacc350bc91662b04 "$commit"; then product=tfpsacrypto else From 00dddd271fcbc53a160b84f548cfb152e6256f1d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 23 Sep 2025 16:24:05 +0200 Subject: [PATCH 11/13] Fix save_config_history.sh when options are passed Signed-off-by: Gilles Peskine --- scripts/save_config_history.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/save_config_history.sh b/scripts/save_config_history.sh index a45d1d3ba..5500a01e0 100755 --- a/scripts/save_config_history.sh +++ b/scripts/save_config_history.sh @@ -37,6 +37,7 @@ while getopts o:d: OPTLET; do *) usage >&2; exit 120;; esac done +shift $((OPTIND - 1)) if [ $# -ne 2 ]; then echo >&2 "This script requires exactly two non-option arguments: COMMIT VERSION" From 48a1cbc9304e3c316ebe17a89a2df804afc69f6c Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 23 Sep 2025 16:24:27 +0200 Subject: [PATCH 12/13] Use -C as the option to convey a directory to run git in Signed-off-by: Gilles Peskine --- scripts/save_config_history.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/save_config_history.sh b/scripts/save_config_history.sh index 5500a01e0..c45f2a5f1 100755 --- a/scripts/save_config_history.sh +++ b/scripts/save_config_history.sh @@ -9,7 +9,7 @@ Record information for the git commit COMMIT (tag, sha or any other refspec). Store the list of config options and internal macros in file names indicating the version VERSION. - -g DIR Top-level directory where the git commit can be found + -C DIR Top-level directory where the git commit can be found (default: $project_root) -o DIR Directory for the output files (default: $history_dir) EOF @@ -30,9 +30,9 @@ if [ $# -ne 0 ] && [ "$1" = "--help" ]; then exit 0 fi -while getopts o:d: OPTLET; do +while getopts C:o: OPTLET; do case $OPTLET in - g) project_root=$OPTARG;; + C) project_root=$OPTARG;; o) history_dir=$OPTARG;; *) usage >&2; exit 120;; esac From 0acab5c3c6b875489fac6a9c42e6d07ac2d938c3 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 23 Sep 2025 16:26:04 +0200 Subject: [PATCH 13/13] Improve documentation Signed-off-by: Gilles Peskine --- scripts/save_config_history.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/scripts/save_config_history.sh b/scripts/save_config_history.sh index c45f2a5f1..6a8d3c131 100755 --- a/scripts/save_config_history.sh +++ b/scripts/save_config_history.sh @@ -9,9 +9,10 @@ Record information for the git commit COMMIT (tag, sha or any other refspec). Store the list of config options and internal macros in file names indicating the version VERSION. - -C DIR Top-level directory where the git commit can be found - (default: $project_root) - -o DIR Directory for the output files (default: $history_dir) + -C DIR Top-level directory where the git commit can be found. + Default: $project_root + -o DIR Directory for the output files. It must exist. + Default: $history_dir EOF } @@ -59,6 +60,9 @@ fi temp_file=$(mktemp) trap 'rm -f "$temp_file"' EXIT INT TERM +## collect_macros VARIANT FILENAME... +## Find the macros defined in the given files. Save the result in +## $history_dir/config-VARIANT-*.txt. collect_macros () { output_file="$history_dir/config-$1-$product-$version.txt" shift