ARMmbed/mbedtls

Features

• TLS Library Integrations - Provides a portable TLS and cryptography library designed for integration into resource-constrained embedded systems.
• General TLS Connection Establishment - Establishes secure TLS connections with full handshake and cipher suite negotiation.
• Public Key Cryptography - Implements asymmetric key pair operations for encryption, signing, and key exchange.
• X.509 Certificate Parsers - Ships a full X.509 parser and encoder for certificate, key, and CRL structures.
• Cryptographic Primitive Substitutions - Provides compile-time ALT macros for substituting cryptographic primitives with hardware-accelerated versions.
• Build Feature Selectors - Allows selecting which TLS versions, key exchanges, elliptic curves, and cryptographic modules to include or exclude from the build.
• PSA Cryptography Implementations - Ships a reference implementation of the PSA Cryptography API for standardized cryptographic operations across platforms.
• TLS Libraries - Ships an open-source TLS and DTLS library with a small footprint for embedded systems and IoT devices.
• Secure Session Negotiation - Provides a full TLS/DTLS library that negotiates encrypted sessions between devices.
• Certificate Management - Parses, validates, and manages X.509 certificates and certificate chains for secure communications.
• Cryptographic Hash Generation - Generates cryptographic hashes like SHA-256 for data integrity verification.
• Cryptographic Libraries - Provides a portable library of symmetric ciphers, hashing, and public-key cryptography for diverse environments.
• Cryptographic Operations - Provides a library of cryptographic primitives including encryption, hashing, and signing via the PSA Crypto API.
• Cryptographic Primitives - Provides implementations of AES, RSA, ECC, and hashing algorithms for data protection.
• PSA Crypto API Implementations - Implements the PSA Cryptography API for standardized cryptographic operations across platforms.
• X.509 Certificate Parsing and Validation - Parses, validates, and manages X.509 certificates for authentication in secure communications.
• Certificate Trust Validation - Parses and verifies X.509 certificate chains to authenticate peers and establish trust.
• General Data Encryption - Encrypts data using symmetric and asymmetric algorithms to protect confidentiality.
• Certificate Chain Validation - Validates certificate trust chains against trusted root authorities for peer authentication.
• SSL/TLS Connection Security - Establishes secure encrypted channels using the TLS protocol with mutual certificate authentication.
• Symmetric Encryption - Provides symmetric encryption algorithms like AES for data confidentiality.
• TLS Transfer Security - Secures network data transfers using TLS and DTLS protocols with certificate validation.
• Build-Time Feature Toggles - Uses compile-time macros and Python scripts to enable or disable cryptographic modules and protocol features during the build process.
• Platform Abstraction Layers - Decouples the library from OS-specific services like file I/O, memory allocation, networking, and timing through replaceable function pointers and macros.
• DTLS Protocol Implementations - Implements the DTLS protocol for secure datagram communication in IoT and real-time applications.
• DTLS Session Managers - Supports full DTLS session management with handshake retransmission for unreliable transports.
• PSA Cryptoprocessor Integrations - Offloads cryptographic operations to dedicated hardware through the PSA Cryptoprocessor Driver Interface.
• TLS/DTLS Handshake Testers - Includes integration tests that verify TLS and DTLS handshake completion and data transfer correctness.
• DTLS Handshake Timer Callbacks - Provides custom timer callbacks for DTLS handshake retransmission in environments without a built-in timing module.
• Cryptoprocessor Driver Interfaces - Implements a standardized driver model for hardware security modules to replace software cryptographic implementations.
• Custom Network Transport Layers - Swaps the default BSD-sockets network module with custom read and write callbacks for any transport stack.
• File Stream Function Replacements - Disables or replaces file stream functions used for reading certificates, keys, and seed files.
• Pluggable Network I/O Stacks - Swaps the built-in socket module with custom networking callbacks or a third-party stack like lwIP.
• Memory-Buffer File I/O Replacements - Removes all file I/O dependencies by providing memory-buffer equivalents for every file-accessing function.
• Custom Memory Allocators - Substitutes dynamic memory functions with custom allocators or a static buffer-based allocator.
• Platform-Specific Libc Replacements - Replaces standard libc functions with platform-specific implementations using configuration flags and abstraction layers.
• Hardware-Accelerated Primitive Substitutions - Ships compile-time ALT macros to substitute cryptographic primitives with hardware-accelerated implementations.
• Certificate Validity Skippers - Provides a configuration option to skip certificate expiration checks when no real-time clock is available.
• Hardware Security Module Integrations - Supports cryptoprocessor drivers through the PSA Cryptoprocessor Driver Interface for hardware-accelerated security.
• Predefined Security Configurations - Ships predefined configuration files for specific security profiles like NSA Suite B to minimize resource usage.
• Library Feature Configurators - Supports compile-time configuration of TLS versions, key exchanges, elliptic curves, and cryptographic modules.
• Memory-Buffer File I/O Replacements - Provides memory-buffer equivalents for all file-accessing functions to enable fully static operation without a filesystem.
• Pluggable Entropy Sources - Allows registering platform-specific entropy collection functions into the random number generator pool.
• Custom Entropy Source Registrations - Ships a registration API for adding platform-specific entropy collection functions to the random number generator pool.
• Integration Testing Suites - Includes integration tests that verify TLS interoperability across configurations and cipher suites.
• Embedded Software Libraries - Portable and flexible SSL/TLS library.
• Embedded System Utilities - Portable SSL library for embedded security.
• Embedded Utility Libraries - Portable and flexible SSL/TLS library for secure communication.
• Cryptography Libraries - Portable and flexible library for SSL and TLS protocols.

Star 历史