Hi, As suggested by @Gilles Peskine , I did try enabling MBEDTLS_ENTROPY_FORCE_SHA256 , but even after enabling this mbedtls_ctr_drbg_seed was still returning 0X0034 (MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED ), please note that I'm using NVRAM for Seeding. I'm attaching my config.h file along with this mail for you reference. PFA

-----Original Message----- From: mbed-tls mbed-tls-bounces@lists.trustedfirmware.org On Behalf Of mbed-tls-request@lists.trustedfirmware.org Sent: Thursday, January 28, 2021 1:19 AM To: mbed-tls@lists.trustedfirmware.org Subject: mbed-tls Digest, Vol 11, Issue 7

This message is from an external sender. Be cautious, especially with links and attachments.

Send mbed-tls mailing list submissions to mbed-tls@lists.trustedfirmware.org

To subscribe or unsubscribe via the World Wide Web, visit https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.trus... or, via email, send a message with subject or body 'help' to mbed-tls-request@lists.trustedfirmware.org

You can reach the person managing the list at mbed-tls-owner@lists.trustedfirmware.org

When replying, please edit your Subject line so it is more specific than "Re: Contents of mbed-tls digest..."

Today's Topics:

1. Re: ENTROPY_SOURCE_FAILED :0x0034 (Gilles Peskine) 2. Re: Reduce mbedTLS memory and storage footprint (Gilles Peskine)

----------------------------------------------------------------------

Message: 1 Date: Wed, 27 Jan 2021 20:36:18 +0100 From: Gilles Peskine gilles.peskine@arm.com To: mbed-tls@lists.trustedfirmware.org Subject: Re: [mbed-tls] ENTROPY_SOURCE_FAILED :0x0034 Message-ID: 9fcd3d55-ad54-05cf-63f9-7f3d09f3ee0d@arm.com Content-Type: text/plain; charset=windows-1252

Hello,

The entropy module uses a hash to mix the entropy. It uses SHA-512 if present and SHA-256 otherwise. Depending on the hash function, the entropy module can return either up to 64 bytes (SHA-512) or 32 bytes (SHA-256). The CTR_DRBG module knows about this and requests only 32 bytes at a time if the entropy module only delivers 32 bytes at a time.

It looks like something goes wrong when CTR_DRBG tries to request 64 bytes. This could be, for example, because a buffer is too small somewhere, or because of a limitation of the entropy source. You would need to debug the call to mbedtls_entropy_func to know more.

As a workaround, you can enable MBEDTLS_ENTROPY_FORCE_SHA256. Then the entropy module will use SHA-256 (even if MBEDTLS_SHA512_C is enabled) and only return 32 bytes at a time, and CTR_DRBG understands this and will only request 32 bytes.

-- Gilles Peskine Mbed TLS developer

On 27/01/2021 06:08, T V LIJIN (EXT) via mbed-tls wrote:

Hi, After enabling *MBEDTLS_NO_PLATFORM_ENTROPY* and*MBEDTLS_SHA512_C* , /mbedtls_ctr_drbg_seed/ is returning *0x0034 */(MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED)/ But if I just enable *MBEDTLS_NO_PLATFORM_ENTROPY* and keep *MBEDTLS_SHA512_C* disabled, it does not return any error for /mbedtls_ctr_drbg_seed./ / / My project uses certificates with SHA384 signature, so it requires***MBEDTLS_SHA512_C *to be enabled. /*MBEDTLS_NO_PLATFORM_ENTROPY* and*MBEDTLS_SHA512_C* /both needs to be enabled in my project , but Iam facing issue with mbedtls_ctr_drbg_seed returning 0x0034. Please guide me on this. What might be the reason for mbedtls_ctr_drbg_seed to fail while enabling/////*MBEDTLS_SHA512_C.*///// How to overcome this issue?

Thanks, LIJIN T V

------------------------------

Message: 2 Date: Wed, 27 Jan 2021 20:48:27 +0100 From: Gilles Peskine gilles.peskine@arm.com To: mbed-tls@lists.trustedfirmware.org Subject: Re: [mbed-tls] Reduce mbedTLS memory and storage footprint Message-ID: b59f3e91-ae60-fae6-5fca-402894b0a890@arm.com Content-Type: text/plain; charset=windows-1252

Hello,

The most important thing is to make sure you've disabled all the features you don't need in config.h. The default configuration enables most cryptographic mechanisms, but typical constrained systems usually only need a few.

If your toolchain supports it, use link-time optimization (e.g. gcc -Os -flto or clang -Oz -flto). I've seen that this makes a significant improvement for Mbed TLS (I got -30% on one build, obviously the numbers depend heavily on the configuration and the compiler). (In contrast LTO when optimizing for performance doesn't seem to improve anything.)

MBEDTLS_MPI_WINDOW_SIZE, MBEDTLS_MPI_MAX_SIZE and MBEDTLS_ECP_MAX_BITS only impact memory usage (stack and heap), not code size.

-- Gilles Peskine Mbed TLS developer

On 27/01/2021 05:36, T V LIJIN (EXT) via mbed-tls wrote:

Hi, I'm trying to optimize the size of my binary file by making the following changes in "*mbedtls/config.h*"

#define MBEDTLS_MPI_WINDOW_SIZE 1 #define MBEDTLS_MPI_MAX_SIZE 32 #define MBEDTLS_ECP_MAX_BITS 256 #define MBEDTLS_SHA256_SMALLER

Even after making the above changes I couldn't see any change in the binary size. https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftls. mbed.org%2Fkb%2Fhow-to%2Freduce-mbedtls-memory-and-storage-footprint&a mp;data=04%7C01%7Clijin.tv%40kone.com%7C1a138332ca084342827b08d8c2fc9d b9%7C2bb82c642eb143f78862fdc1d2333b50%7C0%7C0%7C637473737538267015%7CU nknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1ha WwiLCJXVCI6Mn0%3D%7C1000&sdata=ql17fsSC0eX7Hq5ofrsWAe%2BEenOc2piLq 4jBix%2Bjr20%3D&reserved=0

• This is the link I referred to follow the above-mentioned steps.

Is there anything else I can try to reduce my final binary file size (ROM size) ?

Thanks, LIJIN T V

------------------------------

Subject: Digest Footer

mbed-tls mailing list mbed-tls@lists.trustedfirmware.org https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.trus...

------------------------------

End of mbed-tls Digest, Vol 11, Issue 7 ***************************************