include/mbedtls/config_adjust_legacy_crypto.h

0001 /**
0002  * \file mbedtls/config_adjust_legacy_crypto.h
0003  * \brief Adjust legacy configuration configuration
0004  *
0005  * This is an internal header. Do not include it directly.
0006  *
0007  * Automatically enable certain dependencies. Generally, MBEDTLS_xxx
0008  * configurations need to be explicitly enabled by the user: enabling
0009  * MBEDTLS_xxx_A but not MBEDTLS_xxx_B when A requires B results in a
0010  * compilation error. However, we do automatically enable certain options
0011  * in some circumstances. One case is if MBEDTLS_xxx_B is an internal option
0012  * used to identify parts of a module that are used by other module, and we
0013  * don't want to make the symbol MBEDTLS_xxx_B part of the public API.
0014  * Another case is if A didn't depend on B in earlier versions, and we
0015  * want to use B in A but we need to preserve backward compatibility with
0016  * configurations that explicitly activate MBEDTLS_xxx_A but not
0017  * MBEDTLS_xxx_B.
0018  */
0019 /*
0020  *  Copyright The Mbed TLS Contributors
0021  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
0022  */
0023
0024 #ifndef MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H
0025 #define MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H
0026
0027 #if !defined(MBEDTLS_CONFIG_FILES_READ)
0028 #error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \
0029     "up to and including runtime errors such as buffer overflows. " \
0030     "If you're trying to fix a complaint from check_config.h, just remove " \
0031     "it from your configuration file: since Mbed TLS 3.0, it is included " \
0032     "automatically at the right point."
0033 #endif /* */
0034
0035 /* Ideally, we'd set those as defaults in mbedtls_config.h, but
0036  * putting an #ifdef _WIN32 in mbedtls_config.h would confuse config.py.
0037  *
0038  * So, adjust it here.
0039  * Not related to crypto, but this is the bottom of the stack. */
0040 #if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900)
0041 #if !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && \
0042     !defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO)
0043 #define MBEDTLS_PLATFORM_SNPRINTF_ALT
0044 #endif
0045 #if !defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && \
0046     !defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO)
0047 #define MBEDTLS_PLATFORM_VSNPRINTF_ALT
0048 #endif
0049 #endif /* _MINGW32__ || (_MSC_VER && (_MSC_VER <= 1900)) */
0050
0051 /* Auto-enable CIPHER_C when any of the unauthenticated ciphers is builtin
0052  * in PSA. */
0053 #if defined(MBEDTLS_PSA_CRYPTO_C) && \
0054     (defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) || \
0055     defined(MBEDTLS_PSA_BUILTIN_ALG_CTR) || \
0056     defined(MBEDTLS_PSA_BUILTIN_ALG_CFB) || \
0057     defined(MBEDTLS_PSA_BUILTIN_ALG_OFB) || \
0058     defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING) || \
0059     defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \
0060     defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7) || \
0061     defined(MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG) || \
0062     defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC))
0063 #define MBEDTLS_CIPHER_C
0064 #endif
0065
0066 /* Auto-enable MBEDTLS_MD_LIGHT based on MBEDTLS_MD_C.
0067  * This allows checking for MD_LIGHT rather than MD_LIGHT || MD_C.
0068  */
0069 #if defined(MBEDTLS_MD_C)
0070 #define MBEDTLS_MD_LIGHT
0071 #endif
0072
0073 /* Auto-enable MBEDTLS_MD_LIGHT if needed by a module that didn't require it
0074  * in a previous release, to ensure backwards compatibility.
0075  */
0076 #if defined(MBEDTLS_ECJPAKE_C) || \
0077     defined(MBEDTLS_PEM_PARSE_C) || \
0078     defined(MBEDTLS_ENTROPY_C) || \
0079     defined(MBEDTLS_PK_C) || \
0080     defined(MBEDTLS_PKCS12_C) || \
0081     defined(MBEDTLS_RSA_C) || \
0082     defined(MBEDTLS_SSL_TLS_C) || \
0083     defined(MBEDTLS_X509_USE_C) || \
0084     defined(MBEDTLS_X509_CREATE_C)
0085 #define MBEDTLS_MD_LIGHT
0086 #endif
0087
0088 #if defined(MBEDTLS_MD_LIGHT)
0089 /*
0090  * - MBEDTLS_MD_CAN_xxx is defined if the md module can perform xxx.
0091  * - MBEDTLS_MD_xxx_VIA_PSA is defined if the md module may perform xxx via PSA
0092  *   (see below).
0093  * - MBEDTLS_MD_SOME_PSA is defined if at least one algorithm may be performed
0094  *   via PSA (see below).
0095  * - MBEDTLS_MD_SOME_LEGACY is defined if at least one algorithm may be performed
0096  *   via a direct legacy call (see below).
0097  *
0098  * The md module performs an algorithm via PSA if there is a PSA hash
0099  * accelerator and the PSA driver subsytem is initialized at the time the
0100  * operation is started, and makes a direct legacy call otherwise.
0101  */
0102
0103 /* PSA accelerated implementations */
0104 #if defined(MBEDTLS_PSA_CRYPTO_C)
0105
0106 #if defined(MBEDTLS_PSA_ACCEL_ALG_MD5)
0107 #define MBEDTLS_MD_CAN_MD5
0108 #define MBEDTLS_MD_MD5_VIA_PSA
0109 #define MBEDTLS_MD_SOME_PSA
0110 #endif
0111 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1)
0112 #define MBEDTLS_MD_CAN_SHA1
0113 #define MBEDTLS_MD_SHA1_VIA_PSA
0114 #define MBEDTLS_MD_SOME_PSA
0115 #endif
0116 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224)
0117 #define MBEDTLS_MD_CAN_SHA224
0118 #define MBEDTLS_MD_SHA224_VIA_PSA
0119 #define MBEDTLS_MD_SOME_PSA
0120 #endif
0121 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256)
0122 #define MBEDTLS_MD_CAN_SHA256
0123 #define MBEDTLS_MD_SHA256_VIA_PSA
0124 #define MBEDTLS_MD_SOME_PSA
0125 #endif
0126 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384)
0127 #define MBEDTLS_MD_CAN_SHA384
0128 #define MBEDTLS_MD_SHA384_VIA_PSA
0129 #define MBEDTLS_MD_SOME_PSA
0130 #endif
0131 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512)
0132 #define MBEDTLS_MD_CAN_SHA512
0133 #define MBEDTLS_MD_SHA512_VIA_PSA
0134 #define MBEDTLS_MD_SOME_PSA
0135 #endif
0136 #if defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160)
0137 #define MBEDTLS_MD_CAN_RIPEMD160
0138 #define MBEDTLS_MD_RIPEMD160_VIA_PSA
0139 #define MBEDTLS_MD_SOME_PSA
0140 #endif
0141 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_224)
0142 #define MBEDTLS_MD_CAN_SHA3_224
0143 #define MBEDTLS_MD_SHA3_224_VIA_PSA
0144 #define MBEDTLS_MD_SOME_PSA
0145 #endif
0146 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_256)
0147 #define MBEDTLS_MD_CAN_SHA3_256
0148 #define MBEDTLS_MD_SHA3_256_VIA_PSA
0149 #define MBEDTLS_MD_SOME_PSA
0150 #endif
0151 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_384)
0152 #define MBEDTLS_MD_CAN_SHA3_384
0153 #define MBEDTLS_MD_SHA3_384_VIA_PSA
0154 #define MBEDTLS_MD_SOME_PSA
0155 #endif
0156 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_512)
0157 #define MBEDTLS_MD_CAN_SHA3_512
0158 #define MBEDTLS_MD_SHA3_512_VIA_PSA
0159 #define MBEDTLS_MD_SOME_PSA
0160 #endif
0161 #endif /* MBEDTLS_PSA_CRYPTO_C */
0162
0163 /* Built-in implementations */
0164 #if defined(MBEDTLS_MD5_C)
0165 #define MBEDTLS_MD_CAN_MD5
0166 #define MBEDTLS_MD_SOME_LEGACY
0167 #endif
0168 #if defined(MBEDTLS_SHA1_C)
0169 #define MBEDTLS_MD_CAN_SHA1
0170 #define MBEDTLS_MD_SOME_LEGACY
0171 #endif
0172 #if defined(MBEDTLS_SHA224_C)
0173 #define MBEDTLS_MD_CAN_SHA224
0174 #define MBEDTLS_MD_SOME_LEGACY
0175 #endif
0176 #if defined(MBEDTLS_SHA256_C)
0177 #define MBEDTLS_MD_CAN_SHA256
0178 #define MBEDTLS_MD_SOME_LEGACY
0179 #endif
0180 #if defined(MBEDTLS_SHA384_C)
0181 #define MBEDTLS_MD_CAN_SHA384
0182 #define MBEDTLS_MD_SOME_LEGACY
0183 #endif
0184 #if defined(MBEDTLS_SHA512_C)
0185 #define MBEDTLS_MD_CAN_SHA512
0186 #define MBEDTLS_MD_SOME_LEGACY
0187 #endif
0188 #if defined(MBEDTLS_SHA3_C)
0189 #define MBEDTLS_MD_CAN_SHA3_224
0190 #define MBEDTLS_MD_CAN_SHA3_256
0191 #define MBEDTLS_MD_CAN_SHA3_384
0192 #define MBEDTLS_MD_CAN_SHA3_512
0193 #define MBEDTLS_MD_SOME_LEGACY
0194 #endif
0195 #if defined(MBEDTLS_RIPEMD160_C)
0196 #define MBEDTLS_MD_CAN_RIPEMD160
0197 #define MBEDTLS_MD_SOME_LEGACY
0198 #endif
0199
0200 #endif /* MBEDTLS_MD_LIGHT */
0201
0202 /* BLOCK_CIPHER module can dispatch to PSA when:
0203  * - PSA is enabled and drivers have been initialized
0204  * - desired key type is supported on the PSA side
0205  * If the above conditions are not met, but the legacy support is enabled, then
0206  * BLOCK_CIPHER will dynamically fallback to it.
0207  *
0208  * In case BLOCK_CIPHER is defined (see below) the following symbols/helpers
0209  * can be used to define its capabilities:
0210  * - MBEDTLS_BLOCK_CIPHER_SOME_PSA: there is at least 1 key type between AES,
0211  *   ARIA and Camellia which is supported through a driver;
0212  * - MBEDTLS_BLOCK_CIPHER_xxx_VIA_PSA: xxx key type is supported through a
0213  *   driver;
0214  * - MBEDTLS_BLOCK_CIPHER_xxx_VIA_LEGACY: xxx key type is supported through
0215  *   a legacy module (i.e. MBEDTLS_xxx_C)
0216  */
0217 #if defined(MBEDTLS_PSA_CRYPTO_C)
0218 #if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES)
0219 #define MBEDTLS_BLOCK_CIPHER_AES_VIA_PSA
0220 #define MBEDTLS_BLOCK_CIPHER_SOME_PSA
0221 #endif
0222 #if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA)
0223 #define MBEDTLS_BLOCK_CIPHER_ARIA_VIA_PSA
0224 #define MBEDTLS_BLOCK_CIPHER_SOME_PSA
0225 #endif
0226 #if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA)
0227 #define MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_PSA
0228 #define MBEDTLS_BLOCK_CIPHER_SOME_PSA
0229 #endif
0230 #endif /* MBEDTLS_PSA_CRYPTO_C */
0231
0232 #if defined(MBEDTLS_AES_C)
0233 #define MBEDTLS_BLOCK_CIPHER_AES_VIA_LEGACY
0234 #endif
0235 #if defined(MBEDTLS_ARIA_C)
0236 #define MBEDTLS_BLOCK_CIPHER_ARIA_VIA_LEGACY
0237 #endif
0238 #if defined(MBEDTLS_CAMELLIA_C)
0239 #define MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_LEGACY
0240 #endif
0241
0242 /* Helpers to state that BLOCK_CIPHER module supports AES, ARIA and/or Camellia
0243  * block ciphers via either PSA or legacy. */
0244 #if defined(MBEDTLS_BLOCK_CIPHER_AES_VIA_PSA) || \
0245     defined(MBEDTLS_BLOCK_CIPHER_AES_VIA_LEGACY)
0246 #define MBEDTLS_BLOCK_CIPHER_CAN_AES
0247 #endif
0248 #if defined(MBEDTLS_BLOCK_CIPHER_ARIA_VIA_PSA) || \
0249     defined(MBEDTLS_BLOCK_CIPHER_ARIA_VIA_LEGACY)
0250 #define MBEDTLS_BLOCK_CIPHER_CAN_ARIA
0251 #endif
0252 #if defined(MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_PSA) || \
0253     defined(MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_LEGACY)
0254 #define MBEDTLS_BLOCK_CIPHER_CAN_CAMELLIA
0255 #endif
0256
0257 /* GCM_C and CCM_C can either depend on (in order of preference) BLOCK_CIPHER_C
0258  * or CIPHER_C. The former is auto-enabled when:
0259  * - CIPHER_C is not defined, which is also the legacy solution;
0260  * - BLOCK_CIPHER_SOME_PSA because in this case BLOCK_CIPHER can take advantage
0261  *   of the driver's acceleration.
0262  */
0263 #if (defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)) && \
0264     (!defined(MBEDTLS_CIPHER_C) || defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA))
0265 #define MBEDTLS_BLOCK_CIPHER_C
0266 #endif
0267
0268 /* Helpers for GCM/CCM capabilities */
0269 #if (defined(MBEDTLS_CIPHER_C) && defined(MBEDTLS_AES_C)) || \
0270     (defined(MBEDTLS_BLOCK_CIPHER_C) && defined(MBEDTLS_BLOCK_CIPHER_CAN_AES))
0271 #define MBEDTLS_CCM_GCM_CAN_AES
0272 #endif
0273
0274 #if (defined(MBEDTLS_CIPHER_C) && defined(MBEDTLS_ARIA_C)) || \
0275     (defined(MBEDTLS_BLOCK_CIPHER_C) && defined(MBEDTLS_BLOCK_CIPHER_CAN_ARIA))
0276 #define MBEDTLS_CCM_GCM_CAN_ARIA
0277 #endif
0278
0279 #if (defined(MBEDTLS_CIPHER_C) && defined(MBEDTLS_CAMELLIA_C)) || \
0280     (defined(MBEDTLS_BLOCK_CIPHER_C) && defined(MBEDTLS_BLOCK_CIPHER_CAN_CAMELLIA))
0281 #define MBEDTLS_CCM_GCM_CAN_CAMELLIA
0282 #endif
0283
0284 /* MBEDTLS_ECP_LIGHT is auto-enabled by the following symbols:
0285  * - MBEDTLS_ECP_C because now it consists of MBEDTLS_ECP_LIGHT plus functions
0286  *   for curve arithmetic. As a consequence if MBEDTLS_ECP_C is required for
0287  *   some reason, then MBEDTLS_ECP_LIGHT should be enabled as well.
0288  * - MBEDTLS_PK_PARSE_EC_EXTENDED and MBEDTLS_PK_PARSE_EC_COMPRESSED because
0289  *   these features are not supported in PSA so the only way to have them is
0290  *   to enable the built-in solution.
0291  *   Both of them are temporary dependencies:
0292  *   - PK_PARSE_EC_EXTENDED will be removed after #7779 and #7789
0293  *   - support for compressed points should also be added to PSA, but in this
0294  *     case there is no associated issue to track it yet.
0295  * - PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE because Weierstrass key derivation
0296  *   still depends on ECP_LIGHT.
0297  * - PK_C + USE_PSA + PSA_WANT_ALG_ECDSA is a temporary dependency which will
0298  *   be fixed by #7453.
0299  */
0300 #if defined(MBEDTLS_ECP_C) || \
0301     defined(MBEDTLS_PK_PARSE_EC_EXTENDED) || \
0302     defined(MBEDTLS_PK_PARSE_EC_COMPRESSED) || \
0303     defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
0304 #define MBEDTLS_ECP_LIGHT
0305 #endif
0306
0307 /* Backward compatibility: after #8740 the RSA module offers functions to parse
0308  * and write RSA private/public keys without relying on the PK one. Of course
0309  * this needs ASN1 support to do so, so we enable it here. */
0310 #if defined(MBEDTLS_RSA_C)
0311 #define MBEDTLS_ASN1_PARSE_C
0312 #define MBEDTLS_ASN1_WRITE_C
0313 #endif
0314
0315 /* MBEDTLS_PK_PARSE_EC_COMPRESSED is introduced in Mbed TLS version 3.5, while
0316  * in previous version compressed points were automatically supported as long
0317  * as PK_PARSE_C and ECP_C were enabled. As a consequence, for backward
0318  * compatibility, we auto-enable PK_PARSE_EC_COMPRESSED when these conditions
0319  * are met. */
0320 #if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_ECP_C)
0321 #define MBEDTLS_PK_PARSE_EC_COMPRESSED
0322 #endif
0323
0324 /* Helper symbol to state that there is support for ECDH, either through
0325  * library implementation (ECDH_C) or through PSA. */
0326 #if (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_ECDH)) || \
0327     (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C))
0328 #define MBEDTLS_CAN_ECDH
0329 #endif
0330
0331 /* PK module can achieve ECDSA functionalities by means of either software
0332  * implementations (ECDSA_C) or through a PSA driver. The following defines
0333  * are meant to list these capabilities in a general way which abstracts how
0334  * they are implemented under the hood. */
0335 #if !defined(MBEDTLS_USE_PSA_CRYPTO)
0336 #if defined(MBEDTLS_ECDSA_C)
0337 #define MBEDTLS_PK_CAN_ECDSA_SIGN
0338 #define MBEDTLS_PK_CAN_ECDSA_VERIFY
0339 #endif /* MBEDTLS_ECDSA_C */
0340 #else /* MBEDTLS_USE_PSA_CRYPTO */
0341 #if defined(PSA_WANT_ALG_ECDSA)
0342 #if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC)
0343 #define MBEDTLS_PK_CAN_ECDSA_SIGN
0344 #endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC */
0345 #if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
0346 #define MBEDTLS_PK_CAN_ECDSA_VERIFY
0347 #endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
0348 #endif /* PSA_WANT_ALG_ECDSA */
0349 #endif /* MBEDTLS_USE_PSA_CRYPTO */
0350
0351 #if defined(MBEDTLS_PK_CAN_ECDSA_VERIFY) || defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
0352 #define MBEDTLS_PK_CAN_ECDSA_SOME
0353 #endif
0354
0355 /* If MBEDTLS_PSA_CRYPTO_C is defined, make sure MBEDTLS_PSA_CRYPTO_CLIENT
0356  * is defined as well to include all PSA code.
0357  */
0358 #if defined(MBEDTLS_PSA_CRYPTO_C)
0359 #define MBEDTLS_PSA_CRYPTO_CLIENT
0360 #endif /* MBEDTLS_PSA_CRYPTO_C */
0361
0362 /* Helpers to state that each key is supported either on the builtin or PSA side. */
0363 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_521)
0364 #define MBEDTLS_ECP_HAVE_SECP521R1
0365 #endif
0366 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
0367 #define MBEDTLS_ECP_HAVE_BP512R1
0368 #endif
0369 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_448)
0370 #define MBEDTLS_ECP_HAVE_CURVE448
0371 #endif
0372 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
0373 #define MBEDTLS_ECP_HAVE_BP384R1
0374 #endif
0375 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_384)
0376 #define MBEDTLS_ECP_HAVE_SECP384R1
0377 #endif
0378 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
0379 #define MBEDTLS_ECP_HAVE_BP256R1
0380 #endif
0381 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_256)
0382 #define MBEDTLS_ECP_HAVE_SECP256K1
0383 #endif
0384 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_256)
0385 #define MBEDTLS_ECP_HAVE_SECP256R1
0386 #endif
0387 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_255)
0388 #define MBEDTLS_ECP_HAVE_CURVE25519
0389 #endif
0390 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_224)
0391 #define MBEDTLS_ECP_HAVE_SECP224K1
0392 #endif
0393 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_224)
0394 #define MBEDTLS_ECP_HAVE_SECP224R1
0395 #endif
0396 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_192)
0397 #define MBEDTLS_ECP_HAVE_SECP192K1
0398 #endif
0399 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_192)
0400 #define MBEDTLS_ECP_HAVE_SECP192R1
0401 #endif
0402
0403 /* Helper symbol to state that the PK module has support for EC keys. This
0404  * can either be provided through the legacy ECP solution or through the
0405  * PSA friendly MBEDTLS_PK_USE_PSA_EC_DATA (see pk.h for its description). */
0406 #if defined(MBEDTLS_ECP_C) || \
0407     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY))
0408 #define MBEDTLS_PK_HAVE_ECC_KEYS
0409 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA || MBEDTLS_ECP_C */
0410
0411 /* Historically pkparse did not check the CBC padding when decrypting
0412  * a key. This was a bug, which is now fixed. As a consequence, pkparse
0413  * now needs PKCS7 padding support, but existing configurations might not
0414  * enable it, so we enable it here. */
0415 #if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PKCS5_C) && defined(MBEDTLS_CIPHER_MODE_CBC)
0416 #define MBEDTLS_CIPHER_PADDING_PKCS7
0417 #endif
0418
0419 /* Backwards compatibility for some macros which were renamed to reflect that
0420  * they are related to Armv8, not aarch64. */
0421 #if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT) && \
0422     !defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT)
0423 #define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
0424 #endif
0425 #if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY) && !defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY)
0426 #define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY
0427 #endif
0428
0429 /* psa_util file features some ECDSA conversion functions, to convert between
0430  * legacy's ASN.1 DER format and PSA's raw one. */
0431 #if (defined(MBEDTLS_PSA_CRYPTO_CLIENT) && \
0432     (defined(PSA_WANT_ALG_ECDSA) || defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA)))
0433 #define MBEDTLS_PSA_UTIL_HAVE_ECDSA
0434 #endif
0435
0436 /* Some internal helpers to determine which keys are available. */
0437 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_AES_C)) || \
0438     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_AES))
0439 #define MBEDTLS_SSL_HAVE_AES
0440 #endif
0441 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ARIA_C)) || \
0442     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ARIA))
0443 #define MBEDTLS_SSL_HAVE_ARIA
0444 #endif
0445 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CAMELLIA_C)) || \
0446     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_CAMELLIA))
0447 #define MBEDTLS_SSL_HAVE_CAMELLIA
0448 #endif
0449
0450 /* Some internal helpers to determine which operation modes are available. */
0451 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CIPHER_MODE_CBC)) || \
0452     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_CBC_NO_PADDING))
0453 #define MBEDTLS_SSL_HAVE_CBC
0454 #endif
0455
0456 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_GCM_C)) || \
0457     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_GCM))
0458 #define MBEDTLS_SSL_HAVE_GCM
0459 #endif
0460
0461 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CCM_C)) || \
0462     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_CCM))
0463 #define MBEDTLS_SSL_HAVE_CCM
0464 #endif
0465
0466 #if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CHACHAPOLY_C)) || \
0467     (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_CHACHA20_POLY1305))
0468 #define MBEDTLS_SSL_HAVE_CHACHAPOLY
0469 #endif
0470
0471 #if defined(MBEDTLS_SSL_HAVE_GCM) || defined(MBEDTLS_SSL_HAVE_CCM) || \
0472     defined(MBEDTLS_SSL_HAVE_CHACHAPOLY)
0473 #define MBEDTLS_SSL_HAVE_AEAD
0474 #endif
0475
0476 #endif /* MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H */