reduce ciphers for mbedtls

Author: Jason2866

configs/defconfig.common

@@ -27,10 +27,10 @@ CONFIG_COMPILER_STACK_CHECK_MODE_NONE=y
 # CONFIG_ESP_ERR_TO_NAME_LOOKUP is not set
 # CONFIG_ESP_EVENT_POST_FROM_IRAM_ISR is not set
 CONFIG_COMPILER_SAVE_RESTORE_LIBCALLS=y
-CONFIG_ESP_HTTPS_SERVER_ENABLE=y
-CONFIG_ESP_HTTP_CLIENT_ENABLE_BASIC_AUTH=y
+# CONFIG_ESP_HTTPS_SERVER_ENABLE is not set
+# CONFIG_ESP_HTTP_CLIENT_ENABLE_HTTPS is not set
+# CONFIG_ESP_HTTP_CLIENT_ENABLE_BASIC_AUTH is not set
 CONFIG_RINGBUF_PLACE_FUNCTIONS_INTO_FLASH=y
-CONFIG_ESP_HTTP_CLIENT_ENABLE_BASIC_AUTH=y
 CONFIG_ESP_SYSTEM_ESP32_SRAM1_REGION_AS_IRAM=y
 CONFIG_ESP_INT_WDT_TIMEOUT_MS=300
 CONFIG_ESP_IPC_TASK_STACK_SIZE=1024
@@ -40,15 +40,23 @@ CONFIG_ESP_TASK_WDT_PANIC=y
 # CONFIG_ESP_SYSTEM_HW_STACK_GUARD is not set
 CONFIG_ESP_TIMER_TASK_STACK_SIZE=4096
 CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
-CONFIG_ESP_WIFI_FTM_ENABLE=y
 CONFIG_ESPTOOLPY_HEADER_FLASHSIZE_UPDATE=y
+# CONFIG_ESP_WIFI_MBEDTLS_CRYPTO is not set
+# CONFIG_ESP_WIFI_FTM_ENABLE is not set
+# CONFIG_ESP_WIFI_GMAC_SUPPORT is not set
+# CONFIG_ESP_WIFI_CSI_ENABLED is not set
+# CONFIG_ESP_WIFI_ENABLE_WPA3_SAE is not set
+# CONFIG_ESP_WIFI_ENABLE_SAE_PK is not set
+# CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT is not set
+# CONFIG_ESP_WIFI_MBEDTLS_TLS_CLIENT is not set
+# CONFIG_ESP_WIFI_SOFTAP_SAE_SUPPORT is not set
+# CONFIG_ESP_WIFI_ENABLE_WPA3_OWE_STA is not set
+CONFIG_ESP_WIFI_ESPNOW_MAX_ENCRYPT_NUM=0
+# CONFIG_ESP_WIFI_IRAM_OPT is not set
+# CONFIG_ESP_WIFI_RX_IRAM_OPT is not set
 CONFIG_ESP_WIFI_STATIC_RX_BUFFER_NUM=8
 CONFIG_ESP_WIFI_STATIC_TX_BUFFER_NUM=8
 CONFIG_ESP_WIFI_CACHE_TX_BUFFER_NUM=16
-CONFIG_ESP_WIFI_CSI_ENABLED=y
-CONFIG_ESP_WIFI_ENABLE_WPA3_SAE=y
-# CONFIG_ESP_WIFI_IRAM_OPT is not set
-# CONFIG_ESP_WIFI_RX_IRAM_OPT is not set
 CONFIG_ESP_PHY_REDUCE_TX_POWER=y
 CONFIG_ETH_TRANSMIT_MUTEX=y
 CONFIG_ETH_SPI_ETHERNET_DM9051=y
@@ -75,7 +83,6 @@ CONFIG_HTTPD_WS_SUPPORT=y
 CONFIG_LOG_DEFAULT_LEVEL_NONE=y
 # CONFIG_LOG_COLORS is not set
 CONFIG_LWIP_LOCAL_HOSTNAME="tasmota"
-CONFIG_LWIP_ETHARP_TRUST_IP_MAC=y
 CONFIG_LWIP_MAX_SOCKETS=16
 CONFIG_LWIP_SO_RCVBUF=y
 CONFIG_LWIP_IP_FORWARD=y
@@ -85,15 +92,12 @@ CONFIG_LWIP_TCP_SYNMAXRTX=6
 CONFIG_LWIP_TCP_MSS=1436
 CONFIG_LWIP_TCP_RTO_TIME=3000
 CONFIG_LWIP_TCP_MSL=6000
-CONFIG_LWIP_TCPIP_TASK_STACK_SIZE=4096
 CONFIG_LWIP_TCP_FIN_WAIT_TIMEOUT=2000
 CONFIG_LWIP_TCPIP_TASK_STACK_SIZE=2560
 CONFIG_LWIP_TCPIP_TASK_AFFINITY_CPU0=y
 CONFIG_LWIP_IPV6_AUTOCONFIG=y
 CONFIG_LWIP_IPV6_RDNSS_MAX_DNS_SERVERS=2
 CONFIG_LWIP_MAX_SOCKETS=16
-CONFIG_LWIP_IP_FORWARD=y
-CONFIG_LWIP_IPV4_NAPT=y
 CONFIG_LWIP_DHCP_RESTORE_LAST_IP=n
 CONFIG_LWIP_DHCP_OPTIONS_LEN=128
 CONFIG_LWIP_SNTP_MAX_SERVERS=3
@@ -104,15 +108,95 @@ CONFIG_LWIP_TCP_RECVMBOX_SIZE=16
 CONFIG_LWIP_UDP_RECVMBOX_SIZE=64
 CONFIG_NEWLIB_NANO_FORMAT=y
 # CONFIG_DAC_DMA_AUTO_16BIT_ALIGN is not set
-CONFIG_MBEDTLS_PSK_MODES=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_PSK=y
-CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE=y
-CONFIG_MBEDTLS_ECJPAKE_C=y
-CONFIG_MBEDTLS_HKDF_C=y
-CONFIG_MBEDTLS_CAMELLIA_C=y
-CONFIG_MBEDTLS_GCM_SUPPORT_NON_AES_CIPHER=y
+
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y
+CONFIG_MBEDTLS_TLS_DISABLED=y
+# CONFIG_MBEDTLS_TLS_ENABLED is not set
 # CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN is not set
-CONFIG_MBEDTLS_SSL_PROTO_DTLS=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_MAX_CERTS=500
+# CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is not set
+# CONFIG_MBEDTLS_PKCS7_C is not set
+# CONFIG_MBEDTLS_ERROR_STRINGS is not set
+
+#
+# Symmetric Ciphers
+#
+CONFIG_MBEDTLS_AES_C=y
+# CONFIG_MBEDTLS_CAMELLIA_C is not set
+# CONFIG_MBEDTLS_DES_C is not set
+# CONFIG_MBEDTLS_BLOWFISH_C is not set
+# CONFIG_MBEDTLS_XTEA_C is not set
+# CONFIG_MBEDTLS_CCM_C is not set
+# CONFIG_MBEDTLS_GCM_C is not set
+# CONFIG_MBEDTLS_NIST_KW_C is not set
+# end of Symmetric Ciphers
+
+
+#
+# TLS Key Exchange Methods
+#
+
+CONFIG_MBEDTLS_KEY_EXCHANGE_RSA=y
+# CONFIG_MBEDTLS_PSK_MODES is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ELLIPTIC_CURVE is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA is not set
+
+CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y
+# CONFIG_MBEDTLS_SSL_RENEGOTIATION is not set
+# CONFIG_MBEDTLS_SSL_PROTO_GMTSSL1_1 is not set
+# CONFIG_MBEDTLS_SSL_PROTO_DTLS is not set
+# CONFIG_MBEDTLS_SSL_ALPN is not set
+# CONFIG_MBEDTLS_CLIENT_SSL_SESSION_TICKETS is not set
+
+CONFIG_MBEDTLS_CMAC_C=y
+CONFIG_MBEDTLS_ROM_MD5=y
+CONFIG_MBEDTLS_HARDWARE_ECC=y
+CONFIG_MBEDTLS_HARDWARE_AES=y
+CONFIG_MBEDTLS_HARDWARE_MPI=y
+CONFIG_MBEDTLS_HARDWARE_SHA=y
+# CONFIG_MBEDTLS_ECC_OTHER_CURVES_SOFT_FALLBACK is not set
+# CONFIG_MBEDTLS_HAVE_TIME is not set
+# CONFIG_MBEDTLS_ECDSA_DETERMINISTIC is not set
+# CONFIG_MBEDTLS_SHA512_C is not set
+# CONFIG_MBEDTLS_RIPEMD160_C is not set
+
+#
+# Certificates
+#
+# CONFIG_MBEDTLS_PEM_PARSE_C is not set
+# CONFIG_MBEDTLS_PEM_WRITE_C is not set
+# CONFIG_MBEDTLS_X509_CRL_PARSE_C is not set
+# CONFIG_MBEDTLS_X509_CSR_PARSE_C is not set
+# end of Certificates
+
+CONFIG_MBEDTLS_ECP_C=y
+CONFIG_MBEDTLS_ECDH_C=y
+CONFIG_MBEDTLS_ECDSA_C=y
+CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED=y
+# CONFIG_MBEDTLS_DHM_C is not set
+# CONFIG_MBEDTLS_ECJPAKE_C is not set
+# CONFIG_MBEDTLS_CLIENT_SSL_SESSION_TICKETS is not set
+# CONFIG_MBEDTLS_SERVER_SSL_SESSION_TICKETS is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED is not set
+# CONFIG_MBEDTLS_ECP_FIXED_POINT_OPTIM is not set
+# CONFIG_MBEDTLS_ECP_NIST_OPTIM is not set
+# CONFIG_MBEDTLS_SSL_PROTO_GMTSSL1_1 is not set
+# CONFIG_MBEDTLS_SSL_PROTO_DTLS is not set
+
 CONFIG_OPENSSL_ASSERT_DO_NOTHING=y
 CONFIG_PTHREAD_TASK_STACK_SIZE_DEFAULT=2048
 CONFIG_SPI_FLASH_DANGEROUS_WRITE_ALLOWED=y