From 71fa5b0a4c3cce55460de2f6d49e3a4a63f1b933 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Mon, 10 Dec 2018 16:14:58 +0100 Subject: tls: introduce FEATURE_TLS_SHA1 to make SHA1 code optional When disabled: function old new delta xwrite_encrypted 580 579 -1 prf_hmac_sha256 222 217 -5 hmac_begin 158 149 -9 static.ciphers 32 20 -12 tls_handshake 2115 2095 -20 hmac 87 61 -26 ------------------------------------------------------------------------------ (add/remove: 0/0 grow/shrink: 0/6 up/down: 0/-73) Total: -73 bytes Signed-off-by: Denys Vlasenko --- networking/Config.src | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'networking/Config.src') diff --git a/networking/Config.src b/networking/Config.src index 2ce5287de..04d644bc9 100644 --- a/networking/Config.src +++ b/networking/Config.src @@ -46,6 +46,17 @@ config VERBOSE_RESOLUTION_ERRORS "can't resolve 'hostname.com'" and want to know more. This may increase size of your executable a bit. +config FEATURE_TLS_SHA1 + bool "In TLS code, support ciphers which use deprecated SHA1" + depends on TLS + default n + help + Selecting this option increases interoperability with very old + servers, but slightly increases code size. + + Most TLS servers support SHA256 today (2018), since SHA1 is + considered possibly insecure (although not yet definitely broken). + INSERT source networking/udhcp/Config.in -- cgit v1.2.3