1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
|
/* user_settings_wolfssh.h
*
* Copyright (C) 2006-2025 wolfSSL Inc.
*
* This file is part of wolfSSL.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
/* To use the rename file to user_settings.h and define WOLFSSL_USER_SETTINGS */
/* Started from the following configure and hand tuned, organized and commented:
./configure --enable-wolfssh --enable-sp=small --enable-sp-math \
--disable-sp-asm --disable-asm --disable-sys-ca-certs --enable-aesgcm=small \
--enable-cryptonly --disable-sha3 --disable-chacha --disable-poly1305 \
--disable-md5 --disable-error-queue-per-thread --disable-pkcs12 \
--disable-errorstrings --disable-sni --disable-sha224
make
*/
/* Tested using:
cp ./examples/configs/user_settings_wolfssh.h user_settings.h
cp ./examples/configs/user_settings_wolfssh.h ../wolfSSH/user_settings.h
wolfSSL:
./configure --enable-usersettings --disable-examples CFLAGS="-Os"
make
sudo make install
wolfSSH:
./configure --enable-scp --disable-shared --disable-term \
CFLAGS="-DWOLFSSL_USER_SETTINGS -Os"
make
*/
#ifndef WOLFSSL_USER_SETTINGS_SSH_H
#define WOLFSSL_USER_SETTINGS_SSH_H
#ifdef __cplusplus
extern "C" {
#endif
/* #define USE_LOW_RESOURCE */
/* Platform */
#ifdef USE_LOW_RESOURCE
/* Threading and filesystem required for wolfSSH tests \
* Can be set for wolfSSH library only use */
#define SINGLE_THREADED
#define NO_FILESYSTEM
#define BENCH_EMBEDDED
#endif
/* Features */
#define WOLFSSL_WOLFSSH
#if 1
#define WOLFCRYPT_ONLY /* no TLS */
#endif
#define HAVE_HASHDRBG
#define WOLFSSL_ASN_TEMPLATE
#define WOLFSSL_PUBLIC_MP
#ifndef USE_LOW_RESOURCE
#define WOLFSSL_BASE64_ENCODE
#endif
#ifndef WOLFCRYPT_ONLY
#define HAVE_TLS_EXTENSIONS
#define HAVE_SUPPORTED_CURVES
#define HAVE_ENCRYPT_THEN_MAC
#endif
/* Timing Resistance */
#define TFM_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT
#define WC_RSA_BLINDING
/* Asymmetric */
#if 1 /* RSA - PKCS1v1.5 */
#undef NO_RSA
#define WC_NO_RSA_OAEP /* SSH does not use OAEP */
#ifdef USE_LOW_RESOURCE
#define RSA_LOW_MEM
#endif
#else
#define NO_RSA
#endif
#if 1 /* DH */
/* RFC 4253 requires "DH w/SHA-1"
* RFC 9142 requires "diffie-hellman-group14-sha256"
*/
#undef NO_DH
#ifndef WOLFCRYPT_ONLY
#define HAVE_DH_DEFAULT_PARAMS
#define HAVE_FFDHE_2048
#endif
#else
#define NO_DH
#endif
#if 1 /* ECC */
#define HAVE_ECC
#ifndef USE_LOW_RESOURCE /* optional ECC SHAMIR speedup */
#define ECC_SHAMIR
#endif
#define ECC_USER_CURVES
#ifndef USE_LOW_RESOURCE
#define HAVE_ECC384
#define HAVE_ECC521
#endif
#endif
/* Symmetric AES CBC/GCM */
#undef NO_AES_CBC
#if 1 /* GCM */
#define HAVE_AESGCM
#define GCM_SMALL
#endif
#ifdef USE_LOW_RESOURCE
#define WOLFSSL_AES_SMALL_TABLES
#endif
/* Hashing SHA-1/SHA2-256 */
#undef NO_SHA
#undef NO_SHA256
#ifdef USE_LOW_RESOURCE
#define USE_SLOW_SHA
#define USE_SLOW_SHA256
#endif
#if 0
#define WOLFSSL_SHA384
#define WOLFSSL_SHA512
#ifdef USE_LOW_RESOURCE
#define USE_SLOW_SHA512
#endif
#endif
/* Math */
/* Multi Precision (MP): Enable support for uncommon key sizes / curves */
#if 0
#define WOLFSSL_SP_MATH_ALL
#endif
/* Single Precision (SP) Math */
#define WOLFSSL_SP_MATH
#define WOLFSSL_SP_SMALL
#if !defined(NO_RSA) || !defined(NO_DH)
#undef WOLFSSL_SP_NO_2048 /* 2048-bit */
#ifdef USE_LOW_RESOURCE
#define WOLFSSL_SP_NO_3072 /* 3072-bit */
#else
#undef WOLFSSL_SP_NO_3072 /* 3072-bit */
#define WOLFSSL_SP_4096 /* 4096-bit */
#endif
#ifndef NO_RSA
#define WOLFSSL_HAVE_SP_RSA
#endif
#ifndef NO_DH
#define WOLFSSL_HAVE_SP_DH
#endif
#endif
#ifdef HAVE_ECC
#define WOLFSSL_HAVE_SP_ECC
#undef WOLFSSL_SP_NO_256 /* 256-bit */
#ifdef HAVE_ECC384
#define WOLFSSL_SP_384 /* 384-bit */
#endif
#ifdef HAVE_ECC521
#define WOLFSSL_SP_521 /* 521-bit */
#endif
#endif
/* Disable Algorithms */
#define NO_DSA
#define NO_DES3
#define NO_MD4
#define NO_MD5
#define NO_RC4
#define NO_PSK
#define NO_PKCS12
#define NO_PWDBASED
#define WOLFSSL_NO_SHAKE128
#define WOLFSSL_NO_SHAKE256
/* Disable Features */
#define NO_ERROR_STRINGS
#define WC_NO_ASYNC_THREADING
#define NO_DES3_TLS_SUITES
#define NO_OLD_TLS
#define WOLFSSL_NO_TLS12
#ifdef __cplusplus
}
#endif
#endif /* WOLFSSL_USER_SETTINGS_SSH_H */
|
