# Kconfig - Cryptography primitive options for wolfSSL

#
# Copyright (c) 2016 Intel Corporation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

config ZEPHYR_WOLFSSL_MODULE
        bool
config WOLFSSL_PROMPTLESS
        bool
        help
          Symbol to disable the prompt for WOLFSSL selection.
          This symbol may be used internally in a Kconfig tree to hide the
          wolfSSL menu prompt and instead handle the selection of WOLFSSL from
          dependent sub-configurations and thus prevent stuck symbol behavior.


menuconfig WOLFSSL
	bool "wolfSSL Support" if !WOLFSSL_PROMPTLESS
	help
	  This option enables the wolfSSL cryptography library.

if WOLFSSL

choice WOLFSSL_IMPLEMENTATION
	prompt "Select implementation"
	default WOLFSSL_BUILTIN

config WOLFSSL_BUILTIN
	bool "Enable wolfSSL integrated sources"
	help
	  Link with local wolfSSL sources instead of external library.

config WOLFSSL_LIBRARY
	bool "Enable wolfSSL external library"
	help
	  This option enables wolfSSL library.

endchoice

config WOLFSSL_SETTINGS_FILE
	string "wolfSSL settings file"
	depends on WOLFSSL_BUILTIN
	help
	  Use a specific wolfSSL settings file. The default config file
	  file can be tweaked with Kconfig. The default settings is
	  suitable to communicate with majority of HTTPS servers on the Internet,
	  but has relatively many features enabled. To optimize resources for
	  special TLS usage, use available Kconfig settings, or select an
	  alternative config.

rsource "Kconfig.tls-generic"

config WOLFCRYPT_FIPS
	bool "wolfCrypt FIPS support"
	depends on WOLFSSL_BUILTIN
	help
	  Enable the wolfCrypt FIPS 140-3 module boundary. Requires the wolfSSL
	  FIPS bundle (fips.c, fips_test.c, wolfcrypt_first.c, wolfcrypt_last.c)
	  dropped into wolfcrypt/src/ - the CMake FIPS-boundary block compiles them.
	  Select the version that matches the bundle under "wolfCrypt FIPS version".

choice
	prompt "wolfCrypt FIPS version"
	depends on WOLFCRYPT_FIPS
	default WOLFCRYPT_FIPS_V6
	help
	  Select the FIPS module version. It must match the dropped-in bundle: the
	  in-core integrity check and the in-boundary algorithm set are keyed to the
	  version, so a mismatch fails the power-on self test. Values mirror
	  configure.ac's --enable-fips=VERSION mapping.

config WOLFCRYPT_FIPS_V2
	bool "FIPS 140-2 (Cert #3389)"
	help
	  Legacy FIPS 140-2 validated module (HAVE_FIPS_VERSION 2.0.0).

config WOLFCRYPT_FIPS_V5
	bool "FIPS 140-3 (Cert #4718)"
	help
	  wolfCrypt FIPS 140-3 validated module, Certificate #4718 (version 5.2.1).

config WOLFCRYPT_FIPS_V6
	bool "FIPS 140-3 (SRTP-KDF full submission)"
	help
	  wolfCrypt FIPS 140-3 SRTP-KDF full submission (version 6.0.0).

config WOLFCRYPT_FIPS_V7
	bool "FIPS 140-3 (v7 full submission)"
	help
	  wolfCrypt FIPS 140-3 v7 full submission (version 7.0.0).

config WOLFCRYPT_FIPS_READY
	bool "FIPS Ready (in-tree, uncertified)"
	help
	  FIPS-Ready in-tree sources, feature locked (version 8.0.0 - kept one ahead
	  of the latest submission). Carries the newest in-boundary algorithms but is
	  not yet NIST-certified; use it for pre-certification integration.

endchoice

config WOLFSSL_CRYPTO_ONLY
	bool "Build wolfCrypt only (no TLS layer)"
	depends on WOLFSSL_BUILTIN
	help
	  Define WOLFCRYPT_ONLY: compile only the wolfCrypt crypto library and
	  leave the wolfSSL TLS layer out of the build.

config WOLFSSL_SINGLE_THREADED
	bool "wolfCrypt single-threaded"
	depends on WOLFSSL_BUILTIN
	default y if !MULTITHREADING
	help
	  Define SINGLE_THREADED: build wolfCrypt without internal locking, for a
	  single-threaded system or when the caller serializes all access. Defaults
	  on when the kernel has no threading (!MULTITHREADING), so consumers such
	  as wolfPSA do not need to select it themselves.

config WOLFSSL_DTLS
  bool "wolfSSL DTLS support"
  help
    Enable DTLS support

config WOLFSSL_ALPN
  bool "wolfSSL ALPN support"
  help
    Enable ALPN support

config WOLFSSL_PSK
  bool "wolfSSL PSK support"
  help
    Enable PSK support

config WOLFSSL_MLKEM
  bool "wolfSSL PQC ML-KEM support"
  help
    Enable PQC ML-KEM support for Key Exchange

config WOLFSSL_MLDSA
  bool "wolfSSL PQC ML-DSA support"
  help
    Enable PQC ML-DSA (Dilithium) signatures.

config WOLFSSL_LMS
  bool "wolfSSL LMS/HSS hash-based signatures"
  help
    Enable LMS/HSS stateful hash-based signature verification (verify-only).

config WOLFSSL_XMSS
  bool "wolfSSL XMSS/XMSS^MT hash-based signatures"
  help
    Enable XMSS/XMSS^MT stateful hash-based signature verification (verify-only).

config WOLFSSL_FALCON
  bool "wolfSSL PQC Falcon signatures"
  help
    Enable PQC Falcon (FN-DSA) signatures.

config WOLFSSL_RSA
  bool "wolfCrypt RSA support"
  default y
  help
    Enable RSA (define RSA support; NO_RSA when off).

config WOLFSSL_ECC
  bool "wolfCrypt ECC support"
  default y
  help
    Enable ECC (HAVE_ECC, SECP256R1).

config WOLFSSL_CHACHA_POLY
  bool "wolfCrypt ChaCha20-Poly1305 support"
  default y
  help
    Enable ChaCha20 and Poly1305 (HAVE_CHACHA, HAVE_POLY1305).

config WOLFSSL_CURVE25519
  bool "wolfCrypt Curve25519 / Ed25519 support"
  default n
  help
    Enable Curve25519 and Ed25519 (HAVE_CURVE25519, HAVE_ED25519).

config WOLFSSL_SNI
  bool "wolfSSL Server Name Indication (SNI)"
  default y
  help
    Enable TLS Server Name Indication (HAVE_SNI).

config WOLFSSL_SESSION_CACHE
  bool "wolfSSL TLS session cache"
  default y
  help
    Enable the TLS session cache (SMALL_SESSION_CACHE; NO_SESSION_CACHE off).

config WOLFSSL_SESSION_TICKET
  bool "wolfSSL TLS session tickets"
  default y
  help
    Enable TLS session tickets (HAVE_SESSION_TICKET, TLS 1.3 resumption).

config WOLFSSL_MAX_FRAGMENT_LEN
  int
  default 3
  range 1 6
  help
    Sets the maximum fragment length wolfSSL will use, values 1-6 correspond to enum values
    WOLFSSL_MFL_* in ssl.h

config WOLFSSL_SESSION_EXPORT
  bool "wolfSSL session export support"
  help
    Enable external session cache (HAVE_EXT_CACHE)

config WOLFSSL_KEEP_PEER_CERT
  bool "wolfSSL keep peer certificate support"
  help
    Retain peer certificate after handshake (KEEP_PEER_CERT)

config WOLFSSL_ALWAYS_VERIFY_CB
  bool "wolfSSL always invoke verify callback"
  help
    Invoke verify callback on success as well as failure (WOLFSSL_ALWAYS_VERIFY_CB)

config WOLFSSL_OPENSSL_EXTRA_X509_SMALL
  bool "wolfSSL minimal X509 compat APIs"
  help
    Define OPENSSL_EXTRA_X509_SMALL. Exposes a small subset of X509
    helpers (wolfSSL_X509_free, wolfSSL_get_verify_result, ...) without
    the rest of OPENSSL_EXTRA.

config WOLFCRYPT_ARMASM
	bool "wolfCrypt ARM Assembly support"
	depends on WOLFSSL_BUILTIN
	help
	  wolfCrypt ARM (ARMv8/ARMv7) assembly support for AES, SHA-2, SHA-3,
	  ChaCha20/Poly1305 and Curve25519

config WOLFCRYPT_ARMASM_THUMB2
	bool "wolfCrypt ARM Thumb2 Assembly support"
	depends on WOLFCRYPT_ARMASM
	help
	  Enable Thumb2 assembly optimizations for ARM processors

config WOLFCRYPT_INTELASM
	bool "wolfCrypt Intel Assembly support"
	depends on WOLFSSL_BUILTIN
	help
	  wolfCrypt Intel Aassembly support (AVX/AVX2/AESNI)

config WOLFSSL_NO_HAVE_MIN_MAX
	bool "Force wolfSSL to use its own min/max"
	help
	  Disable this if Zephyr min()/max() macros cause
	  issues. By default wolfSSL defers to Zephyr's
	  min/max on >= 4.3.

config WOLFSSL_DEBUG
	bool "wolfSSL debug activation"
	depends on WOLFSSL_BUILTIN
	help
	  Enable debugging activation for wolfSSL configuration. If you use
	  wolfSSL/Zephyr integration (e.g. net_app), this will activate debug
	  logging (of the level configured by WOLFSSL_DEBUG_LEVEL).

config WOLFSSL_INSTALL_PATH
	string "wolfSSL install path"
	depends on WOLFSSL_LIBRARY
	help
	  This option holds the path where the wolfSSL libraries and headers are
	  installed. Make sure this option is properly set when WOLFSSL_LIBRARY
	  is enabled otherwise the build will fail.

config APP_LINK_WITH_WOLFSSL
	bool "Link 'app' with WOLFSSL"
	default y
	help
	  Add WOLFSSL header files to the 'app' include path. It may be
	  disabled if the include paths for WOLFSSL are causing aliasing
	  issues for 'app'.

endif

