Mbed TLS

Mbed TLS is a C library that implements X.509 certificate manipulation and the TLS and DTLS protocols. Its small code footprint makes it suitable for embedded systems. Mbed TLS includes the TF-PSA-Crypto repository that provides an implementation of the PSA Cryptography API. Configuration options related to X.509 and TLS are available in include/mbedtls/mbedtls config.h , while cryptography and platform options are located in the TF-PSA-Crypto configuration file tf-psa-crypto/include/psa/crypto config.h . With the default platform options, Mbed TLS should build out of the box on most systems. These configuration files can be edited manually, or programmatically using the Python script scripts/config.py (run with --help for usage instructions). We provide some non-standard configurations focused on specific use cases in the configs/ directory. You can read more about those in configs/README.txt . 1. Make sure that Doxygen is installed. 1. Run cmake -B /path/to/build dir /path/to/mbedtls/source 1. Run cmake --build /path/to/build dir --target mbedtls-apidoc 1. Open one of the main generated HTML files: apidoc/index.html apidoc/modules.html or apidoc/topics.html We use CMake to configure and drive our build process. Three libraries are built: libtfpsacrypto , libmbedx509 , and libmbedtls . Note that libmbedtls depends on libmbedx509 and libtfpsacrypto , and libmbedx509 depends on libtfpsacrypto . As a result, some linkers will expect flags to be in a specific order, for example the GNU linker wants -lmbedtls -lmbedx509 -ltfpsacrypto . The cryptographic library libtfpsacrypto is also provided under its legacy name, libmbedcrypto . You need the following tools to build the library from the main branch with the provided CMake files. Mbed TLS minimum tool version requirements are set based on the versions shipped in the latest or penultimate (depending on the release cadence) long-term support releases of major Linux distributions, namely at time of writing: Ubuntu 22.04, RHEL 9, and SLES 15 SP4. CMake 3.20.2 or later. A build system like Make or Ninja for which CMake can generate build files. A C99 toolchain (compiler, linker, archiver). We actively test with GCC 5.4, Clang 3.8, Arm Compiler 6, and Visual Studio 2017 Compiler. More recent versions should work. Slightly older versions may work. Python 3.8 or later to generate the test code. Python is also needed to build the development branch (see next section). Perl to run the tests, and to generate some source files in the development branch. Doxygen 1.8.14 or later (if building the documentation; slightly older versions should work). The supported branches (see BRANCHES.md ) use Git submodules. They contain two submodules: the framework submodule and the tf-psa-crypto submodule, except for the 3.6 LTS branch, which contains only the framework submodule. Release tags also use Git submodules. However, the official source release tarballs (e.g. mbedtls-4.0.0.tar.bz2) include the contents of the submodules. The source code of Mbed TLS includes some files that are automatically generated by scripts and whose content depends only on the Mbed TLS source, not on the platform or on the library configuration. These files are not included in the development branch of Mbed TLS, but the generated files are included in official releases. This section explains how to generate the missing files in the development branch. Perl, for some library source files. Python 3 and some Python packages, for some library source files, sample programs and test data. To install the necessary packages, run: Depending on your Python installation, you may need to invoke python instead of python3 . To install the packages system-wide or in a virtual environment, omit the --user option. A C compiler for the host platform, for some test data. On non-Windows systems, when not cross-compiling, CMake generates the required files automatically. Run framework/scripts/make generated files.py to generate all