menu "Nordic Security"

config NORDIC_SECURITY_BACKEND
	bool
	prompt "Use Nordic provided security backend"
	depends on SOC_FAMILY_NRF
	select NRFXLIB_CRYPTO
	select ENTROPY_GENERATOR if (SOC_NRF52810 || SOC_NRF52832)
	help
	  nRF Connect SDK Security provides crypto functionality through
	  different backends.
	  Some HW platforms supports the used of HW accelerated crypto
	  features.

if NORDIC_SECURITY_BACKEND

comment "mbed TLS Configuration File"

config MBEDTLS_CFG_FILE
	string "mbed TLS configuration file"
	default "nrf-config.h"

config GENERATE_MBEDTLS_CFG_FILE
	bool
	prompt "Generate mbed TLS config file"
	default y
	help
	  nRF Connect SDK Security will generate a mbed TLS configuration file
	  based on the selection of configuration options in Kconfig.
	  However, if the generated configuration file needs custom
	  adjustments, this setting can be used to disable generating the
	  mbed TLS configuration file. Only disable this setting if you know
	  what you are doing.


config MBEDTLS_X509_LIBRARY
	bool
	prompt "Create mbed TLS x509 library"
	help
	  Create the mbed x509 library for handling of certificates.

config MBEDTLS_TLS_LIBRARY
	bool
	prompt "Create mbed TLS transport layer security library"
	select MBEDTLS_X509_LIBRARY
	help
	  Create the mbed SSL/TLS library in addition to the mbed crypto
	  library.

menu "mbed TLS memory configuration"

config MBEDTLS_ENABLE_HEAP
	bool "Enable global heap for mbed TLS"
	help
	  This option enables the mbedtls to use the heap. This setting must
	  be global so that various applications and libraries in Zephyr do not
	  try to do this themselves as there can be only one heap defined
	  in mbedtls. If this is enabled, then the Zephyr will, during the device
	  startup, initialize the heap automatically.

config MBEDTLS_HEAP_SIZE
	int "Heap size for mbed TLS"
	default 512
	depends on MBEDTLS_ENABLE_HEAP
	help
	  The mbedtls routines will use this heap if enabled.
	  For streaming communication with arbitrary (HTTPS) servers on the
	  Internet, 32KB + overheads (up to another 20KB) may be needed.
	  Ensure to adjust the heap size according to the need of the
	  application.

endmenu

comment "Backend Selection"

menuconfig CC310_BACKEND
	bool "Use cc310 backend"
	default y
	# On the nRF9160, cc310 shall be accessible when:
	# - Using a secure image
	# - When using a non-secure app WITHOUT Trusted Execution bit (SPM)
	#   This is tested as (SOC_NRF9160 && !SPM) because TRUSTED_EXECUTION_NONSECURE can be omitted in this case.
	depends on SOC_NRF52840 || (SOC_NRF9160 && TRUSTED_EXECUTION_SECURE) || (SOC_NRF9160 && !SPM)
	select NRF_CRYPTO_BACKEND_COMBINATION_0 if MBEDTLS_VANILLA_BACKEND
	select NRF_CC310_PLATFORM
	help
	  Enable cc310 backend

if CC310_BACKEND

config HW_CC310_INTERRUPT
	bool "Use interrupt version of nrf cc310 platform and crypto libraries"

endif

config MBEDTLS_VANILLA_BACKEND
	bool "Use mbed TLS backend"
	default y if !(SOC_NRF52840 || (SOC_NRF9160 && TRUSTED_EXECUTION_SECURE))
	help
	  Enable mbed TLS vanilla backend

# Backend combination group 0 is used to indicate when two or more backends are
# selected which all supports the following crypto features:
# - AES
# - CMAC
# - DHM
# - ECDH
# - ECDSA
# - RSA
# - SHA
#
# Purpose of th backend combination is to reduce the need for testing against
# multiple backends and make it easier to add additional backends.
#
config NRF_CRYPTO_BACKEND_COMBINATION_0
	bool

#
# Configuration to indicate that a glue layer is needed
# This is used when multiple backend are enabled that supports
# a glued functionality (like AES)
#
config NRF_CRYPTO_GLUE_LIBRARY
	bool

#
# List of additional symbols to indicate cipher key sizes.
# Currently selected based backend selection.
#
config MBEDTLS_CIPHER_AES_256_ECB_C
	bool

config MBEDTLS_CIPHER_AES_256_CBC_C
	bool

config MBEDTLS_CIPHER_AES_256_CTR_C
	bool

config MBEDTLS_CIPHER_AES_256_CCM_C
	bool

config MBEDTLS_CIPHER_AES_256_CFB_C
	bool

config MBEDTLS_CIPHER_AES_256_OFB_C
	bool

comment "Configuration section"

config NRF_SECURITY_RNG
	bool
	prompt "Random Number Generator support"
	default y
	select MBEDTLS_AES_C
	select MBEDTLS_SHA256_C
	help
	  The Random Number Generator support in nRF Security provides a
	  Pseudorandom Number Generator, PRNG.
	  The Pseudorandom Number Generator is seeded by a True Random Number
	  Generator, TRNG, available in hardware.

menuconfig MBEDTLS_AES_C
	bool
	prompt "AES   - Advanced Encryption Standard"
	depends on CC310_BACKEND || MBEDTLS_VANILLA_BACKEND
	select MBEDTLS_CIPHER_AES_256_ECB_C if MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0
	default y
	help
	  This setting will enable AES block cipher, including ECB - Electronic Code Book.
	  Enabling AES will provide a sub-menu which allows for fine grained
	  configuration of specific cipher support.
	  Corresponds to MBEDTLS_AES_C setting in mbed TLS config file.

if MBEDTLS_AES_C

config GLUE_MBEDTLS_AES_C
	bool

if NRF_CRYPTO_BACKEND_COMBINATION_0

comment "General AES Backend Selection"

config CC310_MBEDTLS_AES_C
	bool "cc310 (AES-128)"
	depends on CC310_BACKEND
	default y

config VANILLA_MBEDTLS_AES_C
	bool "mbed TLS (AES-128, AES-192, AES-256)"
	depends on MBEDTLS_VANILLA_BACKEND
	select GLUE_MBEDTLS_AES_C if CC310_MBEDTLS_AES_C
	select NRF_CRYPTO_GLUE_LIBRARY if CC310_MBEDTLS_AES_C
	select MBEDTLS_CIPHER_AES_256_ECB_C

comment "Cipher Selection"

endif # NRF_CRYPTO_BACKEND_COMBINATION_0

config GLUE_MBEDTLS_CIPHER_MODE_CBC
	bool

config CC310_MBEDTLS_CIPHER_MODE_CBC
	bool

config VANILLA_MBEDTLS_CIPHER_MODE_CBC
	bool

config MBEDTLS_CIPHER_MODE_CBC
	bool "AES-CBC - AES Cipher Block Chaining mode"
	depends on (MBEDTLS_AES_C && !NRF_CRYPTO_BACKEND_COMBINATION_0) || (VANILLA_MBEDTLS_AES_C || CC310_MBEDTLS_AES_C)
	default y
	select MBEDTLS_CIPHER_AES_256_CBC_C if MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0
	select MBEDTLS_CIPHER_AES_256_CBC_C if GLUE_MBEDTLS_AES_C || VANILLA_MBEDTLS_AES_C
	select GLUE_MBEDTLS_CIPHER_MODE_CBC if GLUE_MBEDTLS_AES_C
	select CC310_MBEDTLS_CIPHER_MODE_CBC if GLUE_MBEDTLS_AES_C
	select VANILLA_MBEDTLS_CIPHER_MODE_CBC if GLUE_MBEDTLS_AES_C
	help
	  Enable the AES Cipher Block Chaining (CBC) mode,
	  MBEDTLS_CIPHER_MODE_CBC setting in mbed TLS config file.

menu "CBC cipher padding modes"
	depends on MBEDTLS_CIPHER_MODE_CBC

config MBEDTLS_CIPHER_PADDING_PKCS7
	bool
	prompt "Enable MBEDTLS_CIPHER_PADDING_PKCS7"
	default y
	help
	  Enable support for PKCS7 padding for CBC cipher functions in mbedTLS.
	  That is, fill buffer with ll bytes, where ll is padding length.

config MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
	bool
	prompt "Enable MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS"
	default y
	help
	  Enable support for one and zeros padding for CBC cipher functions in mbedTLS.
	  That is, fill buffer with 80 00 .. 00.

config MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
	bool
	prompt "Enable MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN"
	default y
	help
	  Enable support for zeros and length padding for CBC cipher functions in mbedTLS.
	  That is, fill buffer with 00 .. 00 ll, where ll is padding length.

config MBEDTLS_CIPHER_PADDING_ZEROS
	bool
	prompt "Enable MBEDTLS_CIPHER_PADDING_ZEROS"
	default y
	help
	  Enable support for zeros padding for CBC cipher functions in mbedTLS.
	  That is, fill buffer with 00 .. 00.

endmenu

config GLUE_MBEDTLS_CIPHER_MODE_CTR
	bool

config CC310_MBEDTLS_CIPHER_MODE_CTR
	bool

config VANILLA_MBEDTLS_CIPHER_MODE_CTR
	bool

config MBEDTLS_CIPHER_MODE_CTR
	bool "AES-CTR - AES Counter Block Cipher mode"
	depends on (MBEDTLS_AES_C && !NRF_CRYPTO_BACKEND_COMBINATION_0) || (VANILLA_MBEDTLS_AES_C || CC310_MBEDTLS_AES_C)
	default y
	select MBEDTLS_CIPHER_AES_256_CTR_C if MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0
	select MBEDTLS_CIPHER_AES_256_CTR_C if GLUE_MBEDTLS_AES_C || VANILLA_MBEDTLS_AES_C
	select GLUE_MBEDTLS_CIPHER_MODE_CTR if GLUE_MBEDTLS_AES_C
	select CC310_MBEDTLS_CIPHER_MODE_CTR if GLUE_MBEDTLS_AES_C
	select VANILLA_MBEDTLS_CIPHER_MODE_CTR if GLUE_MBEDTLS_AES_C
	help
	  Enable the AES Counter Block Cipher mode (CTR) mode,
	  MBEDTLS_CIPHER_MODE_CTR setting in mbed TLS config file.

config GLUE_MBEDTLS_CIPHER_MODE_CFB
	bool

config CC310_MBEDTLS_CIPHER_MODE_CFB
	bool

config VANILLA_MBEDTLS_CIPHER_MODE_CFB
	bool

config MBEDTLS_CIPHER_MODE_CFB
	bool "AES-CFB - AES Cipher Feedback mode"
	depends on (MBEDTLS_AES_C && !NRF_CRYPTO_BACKEND_COMBINATION_0) || (VANILLA_MBEDTLS_AES_C || CC310_MBEDTLS_AES_C)
	default y
	select MBEDTLS_CIPHER_AES_256_CFB_C if GLUE_MBEDTLS_AES_C || VANILLA_MBEDTLS_AES_C
	select MBEDTLS_CIPHER_AES_256_CFB_C if MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0
	select GLUE_MBEDTLS_CIPHER_MODE_CFB if GLUE_MBEDTLS_AES_C || VANILLA_MBEDTLS_AES_C
	select CC310_MBEDTLS_CIPHER_MODE_CFB if GLUE_MBEDTLS_AES_C
	select VANILLA_MBEDTLS_CIPHER_MODE_CFB if GLUE_MBEDTLS_AES_C
	help
	  Enable the AES Cipher Feedback mode (CFB) mode,
	  MBEDTLS_CIPHER_MODE_CFB setting in mbed TLS config file.

config GLUE_MBEDTLS_CIPHER_MODE_OFB
	bool

config CC310_MBEDTLS_CIPHER_MODE_OFB
	bool

config VANILLA_MBEDTLS_CIPHER_MODE_OFB
	bool

config MBEDTLS_CIPHER_MODE_OFB
	bool "AES-OFB - AES Output Feedback mode"
	depends on (MBEDTLS_AES_C && !NRF_CRYPTO_BACKEND_COMBINATION_0) || (VANILLA_MBEDTLS_AES_C || CC310_MBEDTLS_AES_C)
	default y
	select MBEDTLS_CIPHER_AES_256_OFB_C if GLUE_MBEDTLS_AES_C || VANILLA_MBEDTLS_AES_C
	select MBEDTLS_CIPHER_AES_256_OFB_C if MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0
	select GLUE_MBEDTLS_CIPHER_MODE_OFB if GLUE_MBEDTLS_AES_C
	select CC310_MBEDTLS_CIPHER_MODE_OFB if GLUE_MBEDTLS_AES_C
	select VANILLA_MBEDTLS_CIPHER_MODE_OFB if GLUE_MBEDTLS_AES_C
	help
	  Enable the AES Output Feedback mode (OFB) mode,
	  MBEDTLS_CIPHER_MODE_OFB setting in mbed TLS config file.

config MBEDTLS_CIPHER_MODE_XTS
	bool "AES-XTS - AES Xor-encrypt-xor with ciphertext stealing mode"
	default y
	depends on (MBEDTLS_AES_C && MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0) || (VANILLA_MBEDTLS_AES_C)
	depends on !CC310_MBEDTLS_AES_C
	help
	  Enable the AES Xor-encrypt-xor with ciphertext stealing mode (XTS) mode,
	  MBEDTLS_CIPHER_MODE_XTS setting in mbed TLS config file.

config MBEDTLS_AES_256_CMAC_C
	bool

config MBEDTLS_CMAC_C
	bool
	prompt "AES-CMAC - AES Cipher-based Message Authentication Code mode for block ciphers"
	default y
	depends on (MBEDTLS_AES_C && !NRF_CRYPTO_BACKEND_COMBINATION_0) || (VANILLA_MBEDTLS_AES_C || CC310_MBEDTLS_AES_C)
	select MBEDTLS_AES_256_CMAC_C if MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0
	help
	  Enable the CMAC module.
	  MBEDTLS_CMAC_C setting in mbed TLS config file.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_CMAC_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_CMAC_C

config CC310_MBEDTLS_CMAC_C
	bool "cc310" if CC310_BACKEND
	help
	  HW accelerated CMAC support for AES-128

config VANILLA_MBEDTLS_CMAC_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND
	select MBEDTLS_AES_256_CMAC_C
	help
	  CMAC support for AES-128, AES-192, AES-256

endchoice

endif # MBEDTLS_AES_C

menu "AEAD  - Authenticated Encryption with Associated Data"
	depends on CC310_BACKEND || MBEDTLS_VANILLA_BACKEND

config MBEDTLS_CCM_C
	bool "AES-CCM - AES Counter with CBC-MAC mode"
	depends on MBEDTLS_AES_C
	depends on !NRF_CRYPTO_BACKEND_COMBINATION_0
	default y
	select MBEDTLS_CIPHER_AES_256_CCM_C if MBEDTLS_VANILLA_BACKEND
	help
	  Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
	  This also includes CCM*
	  MBEDTLS_CCM_C setting in mbed TLS config file.

menu "AES-CCM - Counter with CBC-MAC mode"
	depends on NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_CCM_C if CC310_MBEDTLS_AES_C
	default VANILLA_MBEDTLS_CCM_C if (!CC310_MBEDTLS_AES_C && VANILLA_MBEDTLS_AES_C)

config GLUE_MBEDTLS_CCM_C
	bool

config CC310_MBEDTLS_CCM_C
	bool "cc310"
	default y
	help
	  Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
	  This also includes CCM*
	  MBEDTLS_CCM_C setting in mbed TLS config file.

config VANILLA_MBEDTLS_CCM_C
	bool "mbed TLS"
	depends on VANILLA_MBEDTLS_AES_C
	select GLUE_MBEDTLS_CCM_C if CC310_MBEDTLS_CCM_C
	select NRF_CRYPTO_GLUE_LIBRARY if CC310_MBEDTLS_CCM_C
	select MBEDTLS_CIPHER_AES_256_CCM_C
	help
	  Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
	  This also includes CCM*
	  MBEDTLS_CCM_C setting in mbed TLS config file.

endmenu # "AES-CCM - Counter with CBC-MAC mode"

config MBEDTLS_GCM_C
	bool

config VANILLA_MBEDTLS_GCM_C
	bool
	prompt "AES-GCM - AES Galois/Counter Mode support"
	default y
	depends on VANILLA_MBEDTLS_AES_C || (MBEDTLS_VANILLA_BACKEND && MBEDTLS_AES_C && !NRF_CRYPTO_BACKEND_COMBINATION_0)
	select MBEDTLS_GCM_C
	help
	  Enable the GCM module.
	  MBEDTLS_GCM_C setting in mbed TLS config file.

config MBEDTLS_CHACHA20_C
	bool
	prompt "CHACHA20 stream cipher support"
	default y
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	help
	  Enable the CHACHA20 stream cipher.
	  MBEDTLS_CHACHA20_C setting in mbed TLS config file.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_CHACHA20_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_CHACHA20_C

config CC310_MBEDTLS_CHACHA20_C
	bool "cc310" if CC310_BACKEND
	help
	  HW accelerated chacha20 support

config VANILLA_MBEDTLS_CHACHA20_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND
	help
	  SW implemented chacha20 support

endchoice

config MBEDTLS_POLY1305_C
	bool
	prompt "POLY1305 module support"
	default y
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	help
	  Enable the POLY1305 module.
	  MBEDTLS_POLY1305_C setting in mbed TLS config file.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_POLY1305_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_POLY1305_C

config CC310_MBEDTLS_POLY1305_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_POLY1305_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

config MBEDTLS_CHACHAPOLY_C
	bool
	prompt "CHACHA-POLY module support"
	default y
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	depends on (MBEDTLS_CHACHA20_C && MBEDTLS_POLY1305_C)
	help
	  Enable the CHACHA-POLY module.
	  MBEDTLS_CHACHAPOLY_C setting in mbed TLS config file.

choice
	bool
	prompt "Backend selection"
	depends on (MBEDTLS_CHACHAPOLY_C && NRF_CRYPTO_BACKEND_COMBINATION_0)
	default CC310_MBEDTLS_CHACHAPOLY_C

config CC310_MBEDTLS_CHACHAPOLY_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_CHACHAPOLY_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

endmenu # AEAD  - Authenticated Encryption with Associated Data

config MBEDTLS_DHM_C
	bool
	prompt "DHM   - Diffie-Hellman-Merkel"
	default y
	depends on !NRF_CRYPTO_BACKEND_COMBINATION_0
	depends on CC310_BACKEND || MBEDTLS_VANILLA_BACKEND
	help
	  Enable the DHM module.
	  MBEDTLS_DHM_C setting in mbed TLS config file.

menu "DHM   - Diffie-Hellman-Merkel"
	depends on NRF_CRYPTO_BACKEND_COMBINATION_0

config GLUE_MBEDTLS_DHM_C
	bool

config CC310_MBEDTLS_DHM_C
	bool "cc310" if CC310_BACKEND
	default y
	help
	  Enable the DHM module from nrf cc310.
	  MBEDTLS_DHM_C setting in mbed TLS config file.

config VANILLA_MBEDTLS_DHM_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND
	select GLUE_MBEDTLS_DHM_C if CC310_MBEDTLS_DHM_C
	select NRF_CRYPTO_GLUE_LIBRARY if CC310_MBEDTLS_DHM_C
	help
	  Enable the DHM module from mbed TLS vanilla.
	  MBEDTLS_DHM_C setting in mbed TLS config file.
endmenu

menuconfig MBEDTLS_ECP_C
	bool
	prompt "ECC - Eliptic Curve Cryptography"
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	default y
	help
	  Enable low level APIs for elliptic curves for
	  additional functionality (besides ECDH and ECDSA)
	  Enabling ECC will provide a sub-menu which allows for fine grained
	  configuration of ECC based features and specific cipher support.
	  Corresponds to MBEDTLS_ECP_C setting in mbed TLS config file.

if MBEDTLS_ECP_C

if NRF_CRYPTO_BACKEND_COMBINATION_0

comment "General ECC Backend Selection"

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_ECP_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_ECP_C

config CC310_MBEDTLS_ECP_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_ECP_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

comment "ECC Feature Selection"

endif # NRF_CRYPTO_BACKEND_COMBINATION_0

config MBEDTLS_ECDH_C
	bool
	prompt "ECDH  - Elliptic Curve Diffie-Hellman"
	default y
	depends on CC310_BACKEND || MBEDTLS_VANILLA_BACKEND
	help
	  Enable the ECDH module.
	  MBEDTLS_ECDH_C setting in mbed TLS config file.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_ECDH_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_ECDH_C

config CC310_MBEDTLS_ECDH_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_ECDH_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

config MBEDTLS_ECDSA_C
	bool
	prompt "ECDSA - Elliptic Curve Digital Signature Algorithm"
	default y
	depends on CC310_BACKEND || MBEDTLS_VANILLA_BACKEND
	help
	  Enable the ECDSA module.
	  MBEDTLS_ECDSA_C setting in mbed TLS config file.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_ECDSA_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_ECDSA_C

config CC310_MBEDTLS_ECDSA_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_ECDSA_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

config CC310_MBEDTLS_ECJPAKE_C
	bool

config MBEDTLS_ECJPAKE_C
	bool "ECJPAKE - Elliptic curve J-PAKE"
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	depends on MBEDTLS_ECP_C
	select CC310_MBEDTLS_ECJPAKE_C if CC310_BACKEND
	default y
	help
	  Enable support for ECJPAKE

menu "ECC curves"
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)

config MBEDTLS_ECP_DP_SECP192R1_ENABLED
	bool "Enable NIST curve secp192r1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP192R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP224R1_ENABLED
	bool "Enable NIST curve secp224r1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP224R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP256R1_ENABLED
	bool "Enable NIST curve secp256r1"
	default y
	help
	  MBEDTLS_ECP_DP_SECP256R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP384R1_ENABLED
	bool "Enable NIST curve secp384r1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP384R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP521R1_ENABLED
	bool "Enable NIST curve secp521r1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP521R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP192K1_ENABLED
	bool "Enable Koblitz curve secp192k1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP192K1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP224K1_ENABLED
	bool "Enable Koblitz curve secp224k1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP224K1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_SECP256K1_ENABLED
	bool "Enable Koblitz curve secp256k1"
	default n
	help
	  MBEDTLS_ECP_DP_SECP256K1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_BP256R1_ENABLED
	bool "Enable Brainpool curve bp256r1"
	depends on (VANILLA_MBEDTLS_ECP_C && !CC310_MBEDTLS_ECDH_C && !CC310_MBEDTLS_ECDSA_C) || (MBEDTLS_ECP_C && MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0)
	default n
	help
	  MBEDTLS_ECP_DP_BP256R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_BP384R1_ENABLED
	bool "Enable Brainpool curve bp384r1"
	depends on (VANILLA_MBEDTLS_ECP_C && !CC310_MBEDTLS_ECDH_C && !CC310_MBEDTLS_ECDSA_C) || (MBEDTLS_ECP_C && MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0)
	default n
	help
	  MBEDTLS_ECP_DP_BP384R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_BP512R1_ENABLED
	bool "Enable Brainpool curve bp512r1"
	depends on (VANILLA_MBEDTLS_ECP_C && !CC310_MBEDTLS_ECDH_C && !CC310_MBEDTLS_ECDSA_C) || (MBEDTLS_ECP_C && MBEDTLS_VANILLA_BACKEND && !NRF_CRYPTO_BACKEND_COMBINATION_0)
	default n
	help
	  MBEDTLS_ECP_DP_BP512R1_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_CURVE25519_ENABLED
	bool "Enable Curve25519 aka Edwards25519"
	default n
	help
	  MBEDTLS_ECP_DP_CURVE25519_ENABLED setting in mbed TLS config file.

config MBEDTLS_ECP_DP_CURVE448_ENABLED
	bool "Enable Curve448 aka Edwards448"
	depends on (VANILLA_MBEDTLS_ECDSA_C || VANILLA_MBEDTLS_ECP_C || VANILLA_MBEDTLS_ECDH_C	)
	default n
	help
	  MBEDTLS_ECP_DP_CURVE448_ENABLED setting in mbed TLS config file.

endmenu # ECC curves

endif # MBEDTLS_ECP_C


menuconfig MBEDTLS_RSA_C
	bool
	prompt "RSA   - Rivest–Shamir–Adleman cryptosystem"
	default y
	depends on CC310_BACKEND || MBEDTLS_VANILLA_BACKEND
	help
	  Enable RSA cryptosystem support.
	  MBEDTLS_RSA_C setting in mbed TLS config file.

if MBEDTLS_RSA_C

if NRF_CRYPTO_BACKEND_COMBINATION_0

comment "RSA Backend Selection"

choice
	bool
	prompt "Backend selection" if MBEDTLS_RSA_C
	depends on NRF_CRYPTO_BACKEND_COMBINATION_0
	depends on MBEDTLS_RSA_C
	default CC310_MBEDTLS_RSA_C

config CC310_MBEDTLS_RSA_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_RSA_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

comment "RSA Encoding Selection"

endif # NRF_CRYPTO_BACKEND_COMBINATION_0

config MBEDTLS_PKCS1_V15
	bool "PKCS1 v1.5 support"
	depends on MBEDTLS_RSA_C

config MBEDTLS_PKCS1_V21
	bool "PKCS1 v2.1 support"
	depends on MBEDTLS_RSA_C
	default y

endif # MBEDTLS_RSA_C

menu "SHA   - Secure Hash Algorithm"
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)

config MBEDTLS_SHA1_C
	bool
	prompt "SHA-1 hash functionality"
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	default y
	help
	  SHA-1 hash functionality.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_SHA1_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_SHA1_C

config CC310_MBEDTLS_SHA1_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_SHA1_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

config MBEDTLS_SHA256_C
	bool
	prompt "SHA-256 hash functionality"
	depends on (CC310_BACKEND || MBEDTLS_VANILLA_BACKEND)
	default y
	help
	  SHA-256 hash functionality.

choice
	bool
	prompt "Backend selection"
	depends on MBEDTLS_SHA256_C && NRF_CRYPTO_BACKEND_COMBINATION_0
	default CC310_MBEDTLS_SHA256_C

config CC310_MBEDTLS_SHA256_C
	bool "cc310" if CC310_BACKEND

config VANILLA_MBEDTLS_SHA256_C
	bool "mbed TLS vanilla" if MBEDTLS_VANILLA_BACKEND

endchoice

config MBEDTLS_SHA512_C
	bool
	prompt "SHA-512 hash functionality"
	depends on MBEDTLS_VANILLA_BACKEND
	default y
	help
	  SHA-512 hash support

endmenu # SHA - Secure Hash Algorithm

config APP_LINK_WITH_MBEDTLS_INCLUDES
	bool
	default y
	help
	  Add mbedcrypto header files to the 'app' include path.

if MBEDTLS_VANILLA_BACKEND

comment "Advanced configuration section"

menuconfig NRF_SECURITY_ADVANCED
	bool
	prompt "Advanced mbed TLS Configuration Settings"
	depends on MBEDTLS_VANILLA_BACKEND
	help
	  This setting will enable the advanced configuration menu.
	  The advanced configuration allows for further fine tuning of the mbed TLS configuration
	  by adjusting , as example: SSL maximum content sizes, disabling of specific cipher suites,
	  ECP bit sizes, Bignum options.

if NRF_SECURITY_ADVANCED

comment "Advanced mbed TLS settings"

config MBEDTLS_MPI_WINDOW_SIZE
	int "MPI - Multiple Precision Integers window size"
	range 1 6
	default 6
	help
	  Window size used for Multiple Precision Integers (MPI) / Bignum calculation.
	  Note that reducing this value might have an impact on the performance.
	  MBEDTLS_MPI_WINDOW_SIZE setting in mbed TLS config file.

config MBEDTLS_MPI_MAX_SIZE
	int "MPI - Multiple Precision Integers maximum size"
	range 0 1024
	default 1024
	help
	  Maximum number of bytes for usable Multiple Precision Integers (MPI) / Bignum.
	  This will reduce the size of MPIs that can be used for calculation.
	  Only reduce this value if it is ensured that the system won't need larger numbers.
	  MBEDTLS_MPI_MAX_SIZE setting in mbed TLS config file.

config MBEDTLS_ECP_MAX_BITS
	int "ECP - Max bit size of Elliptic Curves"
	range 0 521
	default 521
	help
	  This setting controls the largest elliptic curve supported in the library.
	  If only smaller curves are used, then this value can be reduced in order to save memory.
	  MBEDTLS_ECP_MAX_BITS setting in mbed TLS config file.

config MBEDTLS_ECP_WINDOW_SIZE
	int "ECP - Elliptic Curve multiplication window size"
	range 2 6
	default 6
	help
	  Window sized used for elliptic curve multiplication. This value can be reduce down to 2.
	  Reducing the value will impact the performance of the system.
	  MBEDTLS_ECP_WINDOW_SIZE setting in mbed TLS config file.

config MBEDTLS_ECP_FIXED_POINT_OPTIM
	bool "ECP - Elliptic Curve fixed point optimization"
	default y
	help
	  This setting control ECP fixed point optimizations.
	  If disabled, the system will use less memory, but it will also reduce the performance of
	  the system.
	  MBEDTLS_ECP_FIXED_POINT_OPTIM setting in mbed TLS config file.

config MBEDTLS_SHA256_SMALLER
	bool "Use SHA256 small footprint implementation"
	depends on NRF_SECURITY_ADVANCED && (VANILLA_MBEDTLS_SHA256_C || (MBEDTLS_SHA256_C && !NRF_CRYPTO_BACKEND_COMBINATION_0))
	help
	  Use a SHA-256 implementation with smaller footprint.
	  Note, that this implementation will also have a lower performance.
	  On a Cortex-M4 the size of mbedtls_sha256_process() will be reduced from ~2KB to ~0.5KB,
	  however it will also perform around 30% slower.
	  MBEDTLS_SHA256_SMALLER setting in mbed TLS config file.

config MBEDTLS_SSL_MAX_CONTENT_LEN
	int "SSL - Maximum buffer size"
	range 0 16384
	default 16384
	depends on MBEDTLS_TLS_LIBRARY
	help
	  Maximum buffer size for incoming and outgoing mbed TLS I/O buffers.
	  MBEDTLS_SSL_MAX_CONTENT_LEN setting in mbed TLS config file.

config MBEDTLS_SSL_CIPHERSUITES
	string "SSL - Cipher suites tuning"
	depends on MBEDTLS_TLS_LIBRARY
	help
	  List of cipher suites to support in SSL/TLS.
	  The cipher suites are given as a comma separated string, and in order of preference.
	  This list can only be used for restricting cipher suites available in the system.
	  Warning: This field has offers no validation checks.
	  MBEDTLS_SSL_CIPHERSUITES setting in mbed TLS config file.


endif # NRF_SECURITY_ADVANCED

endif # MBEDTLS_VANILLA_BACKEND

endif # NORDIC_SECURITY_BACKEND

endmenu
