RE: Enabling ciphersuites on NRF Connect SDK

Hieu — Thu, 25 Jan 2024 13:11:58 GMT

Hi Aman,

For TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, you will need to set the CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED.

To set CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED, you will need to satisfy its dependencies. If you trace back all of its dependency, it will boil down to:

CONFIG_MBEDTLS_GCM_C || CONFIG_PSA_WANT_ALG_GCM
CONFIG_MBEDTLS_ECDH_C || CONFIG_PSA_WANT_ALG_ECDH
CONFIG_MBEDTLS_ECDSA_C || CONFIG_PSA_WANT_ALG_ECDSA

The MBEDTLS_ line of configs is legacy. We recommend enabling the PSA_ configs instead.

For clues on which Kconfig needs to be set for a particular cipher suite, please refer to the generated Mbed TLS config file at <SDK root>\modules\crypto\mbedtls\include\mbedtls\mbedtls_config.h.
Here is the same file used in NCS v2.5.0 on GitHub: sdk-mbedtls/include/mbedtls/mbedtls_config.h at v3.3.0-ncs2 · nrfconnect/sdk-mbedtls · GitHub.

Regards,

Hieu

RE: Enabling ciphersuites on NRF Connect SDK

Hieu — Wed, 24 Jan 2024 21:23:54 GMT

Hi Aman,

As a general solution, you should be able to use CONFIG_MBEDTLS_KEY_EXCHANGE_ALL_ENABLED and get enable supports for all cipher suites available in the SDK.

However, that can result in wasted memory use. It can be better to enable only a specific cipher suite or a specific group of suites. I am investigating this direction and will follow up with details shortly.

Regards,

Hieu