Skip to content

Commit 6369b1e

Browse files
jpbland1jpbland1
authored
Merge pull request #6371 from dgarske/lowres
Fixes and improvements for building with low footprint
2 parents 714ec82 + 4b90afa commit 6369b1e

9 files changed

Lines changed: 252 additions & 114 deletions

File tree

‎IDE/NETOS/user_settings.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -458,7 +458,6 @@ extern "C" {
458458
/* RNG */
459459
/* ------------------------------------------------------------------------- */
460460

461-
/* Seed Source */
462461
/* Seed Source */
463462
#if 1
464463
extern int my_rng_generate_seed(unsigned char* output, int sz);

‎configure.ac‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1849,10 +1849,13 @@ AC_ARG_ENABLE([lowresource],
18491849
if test "$ENABLED_LOWRESOURCE" = "yes"
18501850
then
18511851
# low memory / flash flags
1852-
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE -DRSA_LOW_MEM -DGCM_SMALL -DCURVE25519_SMALL -DED25519_SMALL -DWOLFSSL_SMALL_CERT_VERIFY -DWOLFSSL_NO_ASYNC_IO"
1852+
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE -DRSA_LOW_MEM -DCURVE25519_SMALL -DED25519_SMALL -DWOLFSSL_SMALL_CERT_VERIFY -DWOLFSSL_NO_ASYNC_IO"
18531853

18541854
# low flash flags
18551855
AM_CFLAGS="$AM_CFLAGS -DUSE_SLOW_SHA -DUSE_SLOW_SHA256 -DUSE_SLOW_SHA512"
1856+
1857+
# AES small
1858+
AM_CFLAGS="$AM_CFLAGS -DGCM_SMALL -DWOLFSSL_AES_NO_UNROLL -DWOLFSSL_AES_SMALL_TABLES"
18561859
fi
18571860

18581861

@@ -3998,7 +4001,7 @@ else
39984001
fi
39994002

40004003
if test "$ENABLED_RSA" = "yes" && test "$ENABLED_RSAVFY" = "no" && \
4001-
test "$ENABLED_ASN" = "no"
4004+
test "$ENABLED_ASN" = "no" && test "$ENABLED_LOWRESOURCE" = "no"
40024005
then
40034006
AC_MSG_ERROR([please disable rsa if disabling asn.])
40044007
fi
@@ -8465,7 +8468,7 @@ AM_CONDITIONAL([BUILD_SAKKE],[test "x$ENABLED_SAKKE" = "xyes" || test "x$ENABLED
84658468
AM_CONDITIONAL([BUILD_MEMORY],[test "x$ENABLED_MEMORY" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
84668469
AM_CONDITIONAL([BUILD_RSA],[test "x$ENABLED_RSA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
84678470
AM_CONDITIONAL([BUILD_DH],[test "x$ENABLED_DH" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
8468-
AM_CONDITIONAL([BUILD_ASN],[test "x$ENABLED_ASN" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
8471+
AM_CONDITIONAL([BUILD_ASN],[test "x$ENABLED_ASN" != "xno" || test "x$ENABLED_RSA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
84698472
AM_CONDITIONAL([BUILD_AES],[test "x$ENABLED_AES" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
84708473
AM_CONDITIONAL([BUILD_CODING],[test "x$ENABLED_CODING" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
84718474
AM_CONDITIONAL([BUILD_RC4],[test "x$ENABLED_ARC4" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])

‎examples/configs/user_settings_wolftpm.h‎

Lines changed: 135 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,44 @@
2020
*/
2121

2222

23-
/* should be renamed to user_settings.h for customer use
24-
* generated from configure and wolfssl/options.h using:
25-
* ./configure --enable-wolftpm --disable-dh --disable-oldtls \
26-
* --disable-sha3 --disable-sha512 --disable-sha384 --disable-sha224 \
27-
* --disable-pkcs12 --disable-chacha --disable-poly1305 \
28-
* --disable-sys-ca-certs --disable-examples
29-
*
30-
* Cleaned up by David Garske
23+
/* To use the rename file to user_settings.h and define WOLFSSL_USER_SETTINGS */
24+
25+
/* Test using:
26+
cp ./examples/configs/user_settings_wolftpm.h user_settings.h
27+
./configure --enable-usersettings --disable-examples CFLAGS="-Os"
28+
make
29+
*/
30+
31+
/* Options generated from configure and wolfssl/options.h using:
32+
./configure --enable-wolftpm --disable-dh --disable-oldtls \
33+
--disable-sha3 --disable-sha512 --disable-sha384 --disable-sha224 \
34+
--disable-pkcs12 --disable-chacha --disable-poly1305 \
35+
--disable-sys-ca-certs --disable-examples
36+
*/
37+
38+
/* Options for USE_LOW_RESOURCE generated with configure and wolfssl/options.h
39+
* using:
40+
./configure --enable-lowresource --enable-cryptonly --enable-aescfb \
41+
--enable-hmac --enable-cryptocb --enable-singlethreaded \
42+
--enable-sp=smallrsa2048 --enable-sp-math --disable-sp-asm \
43+
--disable-filesystem --disable-asm --disable-pkcs8 --disable-pkcs12 \
44+
--disable-ecc --disable-dh \
45+
--disable-sha224 --disable-sha384 --disable-sha512 \
46+
--disable-md5 --disable-sha3 \
47+
--disable-aescbc --disable-aesgcm --disable-aesccm \
48+
--disable-poly1305 --disable-chacha \
49+
--disable-hashdrbg \
50+
--disable-sys-ca-certs --disable-error-queue-per-thread \
51+
--disable-oldtls --disable-errorstrings --disable-memory --disable-coding \
52+
--disable-examples --disable-optflags \
53+
CFLAGS="-Os -DNO_SIG_WRAPPER -DNO_AES_192 -DNO_AES_256 \
54+
-DWOLFSSL_RSA_PUBLIC_ONLY -DWOLFSSL_RSA_VERIFY_INLINE -DNO_CHECK_PRIVATE_KEY"
3155
*/
3256

57+
/* For the wolfTPM build:
58+
./configure --enable-swtpm CFLAGS="-Os" && make
59+
*/
60+
3361

3462
#ifndef WOLF_USER_SETTINGS_TPM_H
3563
#define WOLF_USER_SETTINGS_TPM_H
@@ -38,7 +66,15 @@
3866
extern "C" {
3967
#endif
4068

41-
#if 1
69+
/* enable for low resource options */
70+
#if 0
71+
#define USE_LOW_RESOURCE
72+
#endif
73+
74+
#ifdef USE_LOW_RESOURCE
75+
/* wolfCrypt only (no SSL/TLS) */
76+
#define WOLFCRYPT_ONLY
77+
#else
4278
/* wolfTPM with TLS example (v1.3 only) */
4379
#define WOLFSSL_TLS13
4480
#define WOLFSSL_NO_TLS12
@@ -52,78 +88,136 @@ extern "C" {
5288
#define HAVE_HKDF
5389
#define WC_RSA_PSS
5490
#define WOLFSSL_PSS_LONG_SALT
55-
#else
56-
/* wolfCrypt only (no SSL/TLS) */
57-
#define WOLFCRYPT_ONLY
5891
#endif
5992

6093
/* No threading or file system */
6194
#define SINGLE_THREADED
62-
/* File system disable */
63-
#if 0
64-
#define NO_FILESYSTEM
65-
#endif
6695

6796
/* Enable crypto callbacks */
6897
#define WOLF_CRYPTO_CB
6998

70-
/* Enable PRNG (SHA2-256) */
71-
#define HAVE_HASHDRBG
72-
73-
/* Enable SP math all (sp_int.c) with multi-precision support */
74-
#define WOLFSSL_SP_MATH_ALL
99+
#ifdef USE_LOW_RESOURCE
100+
/* Single Precision math for RSA 2048 only (small) */
101+
#define WOLFSSL_HAVE_SP_RSA
102+
#define WOLFSSL_SP_MATH
103+
#define WOLFSSL_SP_SMALL
104+
#define WOLFSSL_SP_NO_3072 /* 2048-only */
105+
#else
106+
/* Enable SP math all (sp_int.c) with multi-precision support */
107+
#define WOLFSSL_SP_MATH_ALL
108+
#endif
75109

76110
/* Enable hardening (timing resistance) */
77111
#define TFM_TIMING_RESISTANT
78112
#define ECC_TIMING_RESISTANT
79113
#define WC_RSA_BLINDING
80114

115+
/* Enable PRNG (SHA2-256) */
116+
#ifdef USE_LOW_RESOURCE
117+
/* use TPM TRNG */
118+
#define WC_NO_HASHDRBG
119+
#else
120+
#define HAVE_HASHDRBG
121+
#endif
122+
81123
/* Asymmetric */
82-
#define HAVE_ECC
83-
#undef NO_RSA
84-
#define NO_DH
85-
#ifndef NO_DH
124+
#if 1 /* RSA - needed to encrypt salt */
125+
#undef NO_RSA
126+
#ifdef USE_LOW_RESOURCE
127+
#define WOLFSSL_RSA_PUBLIC_ONLY
128+
#define WOLFSSL_RSA_VERIFY_INLINE
129+
#define NO_CHECK_PRIVATE_KEY
130+
#endif
131+
#else
132+
#define NO_RSA
133+
#endif
134+
#ifndef USE_LOW_RESOURCE /* ECC */
135+
#define HAVE_ECC
136+
#define ECC_USER_CURVES /* default to only SECP256R1 */
137+
#endif
138+
#ifndef USE_LOW_RESOURCE /* DH */
139+
#undef NO_DH
86140
#define HAVE_FFDHE_2048
87141
#define HAVE_DH_DEFAULT_PARAMS
142+
#else
143+
#define NO_DH
88144
#endif
89145

90146
/* Symmetric Hash */
91147
#undef NO_SHA
92148
#undef NO_SHA256
93-
#define WOLFSSL_SHA512
94-
#define WOLFSSL_SHA384
149+
#ifndef USE_LOW_RESOURCE
150+
#define WOLFSSL_SHA512
151+
#define WOLFSSL_SHA384
152+
#endif
95153

96154
/* Symmetric Cipher */
97-
#define HAVE_AES_KEYWRAP
98-
#define WOLFSSL_AES_DIRECT
99155
#define WOLFSSL_AES_CFB
100-
#define HAVE_AESGCM
101-
#define GCM_TABLE_4BIT
156+
#define HAVE_AES_DECRYPT
157+
#ifndef USE_LOW_RESOURCE
158+
#define HAVE_AES_KEYWRAP
159+
#define WOLFSSL_AES_DIRECT
160+
#define HAVE_AESGCM
161+
#define GCM_TABLE_4BIT
162+
#else
163+
#define NO_AES_CBC
164+
#endif
102165

103-
#if 0
166+
#if 0 /* ChaCha20 / Poly1305 */
104167
#define HAVE_POLY1305
105168
#define HAVE_CHACHA
106169
#endif
107170

108171
/* Features */
109-
#define WOLFSSL_CERT_GEN
110-
#define WOLFSSL_CERT_REQ
111-
#define WOLFSSL_CERT_EXT
112-
113-
#define HAVE_PKCS7
114-
#define HAVE_X963_KDF
115-
#define WOLFSSL_BASE64_ENCODE
116-
172+
#define WOLFSSL_ASN_TEMPLATE
173+
#define WOLFSSL_USER_IO /* user recv/send callbacks for network IO */
174+
#ifndef USE_LOW_RESOURCE
175+
#define WOLFSSL_CERT_GEN
176+
#define WOLFSSL_CERT_REQ
177+
#define WOLFSSL_CERT_EXT
178+
179+
#define HAVE_PKCS7
180+
#define HAVE_X963_KDF
181+
#define WOLFSSL_BASE64_ENCODE
182+
#endif
117183

118184
/* Disables */
185+
#define NO_PKCS8
186+
#define NO_PKCS12
187+
#define NO_PWDBASED
119188
#define NO_DSA
120189
#define NO_DES3
121190
#define NO_RC4
122191
#define NO_PSK
123192
#define NO_MD4
193+
#define NO_MD5
124194
#define WOLFSSL_NO_SHAKE128
125195
#define WOLFSSL_NO_SHAKE256
126-
196+
#define NO_WRITEV
197+
198+
/* Low Resource Options */
199+
#ifdef USE_LOW_RESOURCE
200+
#define NO_FILESYSTEM /* File system disable */
201+
#define NO_ERROR_STRINGS
202+
#define WOLFSSL_NO_ASM
203+
#define TFM_NO_ASM
204+
#define NO_WOLFSSL_MEMORY
205+
#define NO_SESSION_CACHE
206+
#define RSA_LOW_MEM
207+
#define WOLFSSL_AES_SMALL_TABLES
208+
#define WOLFSSL_AES_NO_UNROLL
209+
#define GCM_SMALL
210+
#undef GCM_TABLE_4BIT
211+
#define NO_AES_192
212+
#define NO_AES_256
213+
#define USE_SLOW_SHA
214+
#define USE_SLOW_SHA256
215+
#define USE_SLOW_SHA512
216+
#define NO_SIG_WRAPPER
217+
#define NO_ASN_TIME
218+
#define NO_CODING
219+
#define NO_BIG_INT
220+
#endif
127221

128222
#ifdef __cplusplus
129223
}

‎wolfcrypt/benchmark/benchmark.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6516,7 +6516,7 @@ static void bench_rsa_helper(int useDeviceID, RsaKey rsaKey[BENCH_MAX_PENDING],
65166516
BENCH_ASYNC_GET_DEV(&rsaKey[i]),
65176517
1, &times, ntimes, &pending)) {
65186518
ret = wc_RsaSSL_Sign(message, len, enc[i],
6519-
rsaKeySz/8, &rsaKey[i], &gRng);
6519+
rsaKeySz/8, &rsaKey[i], GLOBAL_RNG);
65206520
if (!bench_async_handle(&ret,
65216521
BENCH_ASYNC_GET_DEV(&rsaKey[i]),
65226522
1, &times, &pending)) {
@@ -7371,7 +7371,7 @@ void bench_ecc(int useDeviceID, int curveId)
73717371
}
73727372

73737373
ret = wc_ecc_sign_hash(digest[i], (word32)keySize, sig[i],
7374-
&x[i], &gRng, &genKey[i]);
7374+
&x[i], GLOBAL_RNG, &genKey[i]);
73757375

73767376
if (!bench_async_handle(&ret,
73777377
BENCH_ASYNC_GET_DEV(&genKey[i]), 1, &times,

0 commit comments

Comments
 (0)