ra8-firmware 0.1.0
Bare-metal firmware for the Renesas RA8 family (RA8D2 / RA8P1)
Loading...
Searching...
No Matches
mbedtls_config.h File Reference

Project-wide Mbed TLS 4.x configuration for the RA8 firmware. More...

Go to the source code of this file.

Macros

#define MBEDTLS_CONFIG_VERSION   (0x04000000)
 MBEDTLS CONFIG VERSION.
#define MBEDTLS_ERROR_C
 MBEDTLS ERROR c.
#define MBEDTLS_ERROR_STRERROR_DUMMY
 MBEDTLS ERROR STRERROR DUMMY.
#define MBEDTLS_VERSION_C
 MBEDTLS VERSION c.
#define MBEDTLS_VERSION_FEATURES
 MBEDTLS VERSION FEATURES.
#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
 MBEDTLS KEY EXCHANGE ECDHE ECDSA ENABLED.
#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 MBEDTLS KEY EXCHANGE ECDHE RSA ENABLED.
#define MBEDTLS_SSL_TLS_C
 MBEDTLS SSL TLS c.
#define MBEDTLS_SSL_CLI_C
 MBEDTLS SSL CLI c.
#define MBEDTLS_SSL_PROTO_TLS1_2
 MBEDTLS SSL PROTO TLS1 2.
#define MBEDTLS_SSL_PROTO_TLS1_3
 MBEDTLS SSL PROTO TLS1 3.
#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
 MBEDTLS SSL TLS1 3 KEY EXCHANGE MODE EPHEMERAL ENABLED.
#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
 MBEDTLS SSL TLS1 3 COMPATIBILITY MODE.
#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
 MBEDTLS SSL KEEP PEER CERTIFICATE.
#define MBEDTLS_SSL_SESSION_TICKETS
 MBEDTLS SSL SESSION TICKETS.
#define MBEDTLS_SSL_SERVER_NAME_INDICATION
 MBEDTLS SSL SERVER NAME INDICATION.
#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
 MBEDTLS SSL ALL ALERT MESSAGES.
#define MBEDTLS_SSL_ALPN
 MBEDTLS SSL ALPN.
#define MBEDTLS_SSL_ENCRYPT_THEN_MAC
 MBEDTLS SSL ENCRYPT THEN MAC.
#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
 Enable the mbedTLS selector MBEDTLS_SSL_EXTENDED_MASTER_SECRET (RFC 7627).
#define MBEDTLS_SSL_RENEGOTIATION
 MBEDTLS SSL RENEGOTIATION.
#define MBEDTLS_SSL_MAX_CONTENT_LEN   (16384)
 MBEDTLS SSL MAX CONTENT LEN.
#define MBEDTLS_X509_USE_C
 MBEDTLS X509 USE c.
#define MBEDTLS_X509_CRT_PARSE_C
 MBEDTLS X509 CRT PARSE c.
#define MBEDTLS_X509_CRL_PARSE_C
 MBEDTLS X509 CRL PARSE c.
#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
 MBEDTLS X509 RSASSA PSS SUPPORT.
#define MBEDTLS_X509_CHECK_KEY_USAGE
 MBEDTLS X509 CHECK KEY USAGE.
#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
 MBEDTLS X509 CHECK EXTENDED KEY USAGE.

Detailed Description

Project-wide Mbed TLS 4.x configuration for the RA8 firmware.

Tag
[Ring 4 / PORT] {World: NS}

Mbed TLS reads its compile-time feature set from a single C preprocessor file – either include/mbedtls/mbedtls_config.h (the upstream default) or a project-supplied override pointed to by MBEDTLS_CONFIG_FILE. Our cmake/mbedtls.cmake defines MBEDTLS_CONFIG_FILE to this path so every TU in the vendored Mbed TLS tree picks up exactly the surface this firmware needs.

Mbed TLS 4.x split the cryptographic primitives out of this config file into the companion TF-PSA-Crypto repository. All AES / SHA / RSA / ECC / bignum / DRBG / entropy knobs are now PSA_WANT_* flags in port/mbedtls/inc/tf_psa_crypto_config.h (or the upstream tf-psa-crypto/include/psa/crypto_config.h default). This file only owns the TLS / X.509 / SSL / NET / TIMING / DEBUG layer.

Surface this config enables

  • TLS 1.2 + TLS 1.3 – both versions, client side. The example app talks to www.example.com which negotiates 1.3 happily; older HTTPS endpoints on the lab network may still need 1.2, so we keep both.
  • Forward-secret key exchanges – ECDHE-RSA + ECDHE-ECDSA. Static-RSA key exchange is omitted (no PFS, deprecated).
  • X.509 certificate parsing – chain validation against a baked-in CA trust anchor.
  • Server Name Indication (SNI) – needed for any host on a virtual-hosted HTTPS endpoint.
  • Renegotiation + ALPN + session tickets + extended primary secret – the modern hardening defaults Mbed TLS ships.

Surface this config disables

  • No DTLS – this firmware only does TCP TLS.
  • No server side – client-only build (MBEDTLS_SSL_SRV_C is omitted).
  • No filesystem / no PEM I/O – certs are baked in as DER blobs.
  • No POSIX BSD socket adapter – NetX Duo is the transport; the example app supplies its own mbedtls_ssl_set_bio callbacks.
  • No POSIX timing helpers – MBEDTLS_TIMING_C and MBEDTLS_TIMING_ALT are BOTH left undefined (see the timing section below); the SSL layer falls back to its generation-counter heuristic. Wiring ra8_time in as a TIMING_ALT hook is future work, not the current state.
Copyright
Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file mbedtls_config.h.

Macro Definition Documentation

◆ MBEDTLS_CONFIG_VERSION

#define MBEDTLS_CONFIG_VERSION   (0x04000000)

MBEDTLS CONFIG VERSION.

Definition at line 63 of file mbedtls_config.h.

◆ MBEDTLS_ERROR_C

#define MBEDTLS_ERROR_C

MBEDTLS ERROR c.

Definition at line 70 of file mbedtls_config.h.

◆ MBEDTLS_ERROR_STRERROR_DUMMY

#define MBEDTLS_ERROR_STRERROR_DUMMY

MBEDTLS ERROR STRERROR DUMMY.

Definition at line 72 of file mbedtls_config.h.

◆ MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED

MBEDTLS KEY EXCHANGE ECDHE ECDSA ENABLED.

Definition at line 87 of file mbedtls_config.h.

◆ MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED

#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED

MBEDTLS KEY EXCHANGE ECDHE RSA ENABLED.

Definition at line 89 of file mbedtls_config.h.

◆ MBEDTLS_SSL_ALL_ALERT_MESSAGES

#define MBEDTLS_SSL_ALL_ALERT_MESSAGES

MBEDTLS SSL ALL ALERT MESSAGES.

Definition at line 114 of file mbedtls_config.h.

◆ MBEDTLS_SSL_ALPN

#define MBEDTLS_SSL_ALPN

MBEDTLS SSL ALPN.

Definition at line 116 of file mbedtls_config.h.

◆ MBEDTLS_SSL_CLI_C

#define MBEDTLS_SSL_CLI_C

MBEDTLS SSL CLI c.

Definition at line 98 of file mbedtls_config.h.

◆ MBEDTLS_SSL_ENCRYPT_THEN_MAC

#define MBEDTLS_SSL_ENCRYPT_THEN_MAC

MBEDTLS SSL ENCRYPT THEN MAC.

Definition at line 118 of file mbedtls_config.h.

◆ MBEDTLS_SSL_EXTENDED_MASTER_SECRET

#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET

Enable the mbedTLS selector MBEDTLS_SSL_EXTENDED_MASTER_SECRET (RFC 7627).

Definition at line 120 of file mbedtls_config.h.

◆ MBEDTLS_SSL_KEEP_PEER_CERTIFICATE

#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE

MBEDTLS SSL KEEP PEER CERTIFICATE.

Definition at line 108 of file mbedtls_config.h.

◆ MBEDTLS_SSL_MAX_CONTENT_LEN

#define MBEDTLS_SSL_MAX_CONTENT_LEN   (16384)

MBEDTLS SSL MAX CONTENT LEN.

Definition at line 124 of file mbedtls_config.h.

◆ MBEDTLS_SSL_PROTO_TLS1_2

#define MBEDTLS_SSL_PROTO_TLS1_2

MBEDTLS SSL PROTO TLS1 2.

Definition at line 100 of file mbedtls_config.h.

◆ MBEDTLS_SSL_PROTO_TLS1_3

#define MBEDTLS_SSL_PROTO_TLS1_3

MBEDTLS SSL PROTO TLS1 3.

Definition at line 102 of file mbedtls_config.h.

◆ MBEDTLS_SSL_RENEGOTIATION

#define MBEDTLS_SSL_RENEGOTIATION

MBEDTLS SSL RENEGOTIATION.

Definition at line 122 of file mbedtls_config.h.

◆ MBEDTLS_SSL_SERVER_NAME_INDICATION

#define MBEDTLS_SSL_SERVER_NAME_INDICATION

MBEDTLS SSL SERVER NAME INDICATION.

Definition at line 112 of file mbedtls_config.h.

◆ MBEDTLS_SSL_SESSION_TICKETS

#define MBEDTLS_SSL_SESSION_TICKETS

MBEDTLS SSL SESSION TICKETS.

Definition at line 110 of file mbedtls_config.h.

◆ MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE

#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE

MBEDTLS SSL TLS1 3 COMPATIBILITY MODE.

Definition at line 106 of file mbedtls_config.h.

◆ MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED

#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED

MBEDTLS SSL TLS1 3 KEY EXCHANGE MODE EPHEMERAL ENABLED.

Definition at line 104 of file mbedtls_config.h.

◆ MBEDTLS_SSL_TLS_C

#define MBEDTLS_SSL_TLS_C

MBEDTLS SSL TLS c.

Definition at line 96 of file mbedtls_config.h.

◆ MBEDTLS_VERSION_C

#define MBEDTLS_VERSION_C

MBEDTLS VERSION c.

Definition at line 74 of file mbedtls_config.h.

◆ MBEDTLS_VERSION_FEATURES

#define MBEDTLS_VERSION_FEATURES

MBEDTLS VERSION FEATURES.

Definition at line 76 of file mbedtls_config.h.

◆ MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE

#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE

MBEDTLS X509 CHECK EXTENDED KEY USAGE.

Definition at line 141 of file mbedtls_config.h.

◆ MBEDTLS_X509_CHECK_KEY_USAGE

#define MBEDTLS_X509_CHECK_KEY_USAGE

MBEDTLS X509 CHECK KEY USAGE.

Definition at line 139 of file mbedtls_config.h.

◆ MBEDTLS_X509_CRL_PARSE_C

#define MBEDTLS_X509_CRL_PARSE_C

MBEDTLS X509 CRL PARSE c.

Definition at line 135 of file mbedtls_config.h.

◆ MBEDTLS_X509_CRT_PARSE_C

#define MBEDTLS_X509_CRT_PARSE_C

MBEDTLS X509 CRT PARSE c.

Definition at line 133 of file mbedtls_config.h.

◆ MBEDTLS_X509_RSASSA_PSS_SUPPORT

#define MBEDTLS_X509_RSASSA_PSS_SUPPORT

MBEDTLS X509 RSASSA PSS SUPPORT.

Definition at line 137 of file mbedtls_config.h.

◆ MBEDTLS_X509_USE_C

#define MBEDTLS_X509_USE_C

MBEDTLS X509 USE c.

Definition at line 131 of file mbedtls_config.h.