Mbed-TLS/mbedtls
Mbedtls
Mbed TLS is a C library that provides a full implementation of the TLS and DTLS protocols for secure network communication, a library of fundamental cryptographic primitives, and a reference implementation of the PSA Cryptography API. It also includes libraries for parsing, validating, and managing X.509 digital certificates, as well as support for integrating hardware cryptoprocessors through the PSA Cryptoprocessor Driver Interface.
The library is designed for resource-constrained environments and is built from source with a customizable feature set, allowing developers to select which TLS versions, key exchanges, and cryptographic modules to include. It offers a platform abstraction layer that lets users replace default memory allocation, file I/O, network transport, timer callbacks, and diagnostic output with custom implementations. Build-time configuration is managed through C header files, with an option to use an external configuration file, and a Python script is available to programmatically enable or disable build options.
Mbed TLS supports static memory allocation for environments without a heap, and provides mechanisms to register custom entropy sources, disable file system access or real-time clock dependencies, and initialize platform hardware. The library can be integrated into larger CMake projects as a subdirectory or consumed as a CMake dependency, and pre-packaged source archives are available for download.
Features
- TLS Libraries - Provides a full TLS and DTLS library with a small footprint for embedded systems.
- PSA Cryptoprocessor Integrations - Offloads cryptographic operations to dedicated hardware through the PSA Cryptoprocessor Driver Interface.
- Platform Abstraction Layers - Ships a platform abstraction layer that lets users replace memory, I/O, network, and timer callbacks.
- Compile-Time Header Configurations - Build options are set by editing C header files before compilation for fine-grained feature selection.
- PSA Cryptography Implementations - Provides a reference implementation of the PSA Cryptography API for standardized cryptographic operations.
- Compile-Time Configurations - Sets build-time options by editing dedicated configuration header files.
- Embedded - Provides a full implementation of TLS and DTLS protocols for secure communication in embedded systems.
- Feature Set Customizations - Selects which TLS versions, key exchanges, and cryptographic modules to include or exclude from the build.
- Cryptographic Primitives - Ships a library of fundamental cryptographic primitives including encryption, hashing, and signing.
- Hardware-Accelerated Primitive Substitutions - Substitutes software cipher or hash implementations with hardware-accelerated drivers using compile-time ALT macros.
- PSA Crypto API Implementations - Implements the PSA Cryptography API for standardized cryptographic operations across platforms.
- X.509 Certificate Parsing and Validation - Provides libraries for parsing, validating, and managing X.509 digital certificates in PKI deployments.
- Library Feature Configurators - Compile-time configuration of TLS library features, algorithms, and platform abstractions.
- General TLS Connection Establishment - Implements the TLS protocol for establishing encrypted communication channels between peers.
- Platform Abstraction Layers - Provides a platform abstraction layer to replace I/O, timing, memory, and diagnostics with custom implementations.
- DTLS Protocol Implementations - Implements the DTLS protocol for secure communication over unreliable datagram transports.
- Library Lifecycle Hardware Initializers - Provides custom setup and teardown functions to manage underlying hardware or accelerators.
- Memory-Buffer File I/O Replacements - Removes all file I/O dependencies by using memory-buffer equivalents for every file-accessing function.
- Custom Memory Allocators - Overrides default dynamic memory functions with custom allocators, including a buffer-based static memory option.
- Static Memory Allocations - Supports static memory allocation for environments without a heap.
- Clock-Abstracted Time Validation - Switches off time-based features like certificate validity checks using usage-count fallbacks.
- Predefined Security Configurations - Loads ready-made minimal configurations such as the NSA Suite B TLS profile.
- DTLS Session Managers - Manages DTLS session lifecycles including handshake retransmission over unreliable datagram transports.
- Custom Entropy Source Registrations - Allows registering custom hardware or OS-specific entropy collectors to feed the random number generator.
- Cryptography - Portable TLS library and PSA reference implementation.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
