// ******************************************************************************
//
//
//  Version/Date    Comment
//   2026.05.28     - First release
// ******************************************************************************

#ifndef __MBEDTLS_CONFIG_H__
#define __MBEDTLS_CONFIG_H__

/************************************************************************
 * SECTION 1: System Support Override Settings (Target Environment)
 ************************************************************************/
#define MBEDTLS_PLATFORM_C
#define MBEDTLS_PLATFORM_MEMORY
#define MBEDTLS_NO_PLATFORM_ENTROPY
#define MBEDTLS_ENTROPY_HARDWARE_ALT
#define MBEDTLS_SELF_TEST

/************************************************************************
 * SECTION 2: Core Asymmetric Engines (Required for Key Handshakes)
 ************************************************************************/
/* Public Key & ASN.1 Parsing Structure Layers */
#define MBEDTLS_PK_C
#define MBEDTLS_PK_PARSE_C
#define MBEDTLS_PK_WRITE_C
#define MBEDTLS_ASN1_PARSE_C
#define MBEDTLS_ASN1_WRITE_C
#define MBEDTLS_OID_C

/* RSA Cryptography Primitives (Basic256Sha256 uses 2048-bit to 4096-bit RSA) */
#define MBEDTLS_RSA_C
#define MBEDTLS_BIGNUM_C

/* Elliptic Curve Cryptography (Required by open62541 common internal structs) */
#define MBEDTLS_ECP_C
#define MBEDTLS_ECDSA_C
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
#define MBEDTLS_ECP_DP_SECP384R1_ENABLED

/************************************************************************
 * SECTION 3: Asymmetric Padding, Hashing & Random Number Generation (DRBG)
 ************************************************************************/
/* Padding for Asymmetric Encrypt/Decrypt (RSA-OAEP / RSA-PKCS#1 v1.5) */
#define MBEDTLS_CIPHER_PADDING_PKCS7
#define MBEDTLS_PKCS1_V15
#define MBEDTLS_PKCS1_V21

/* Cryptographic Random Number Generation Pool */
#define MBEDTLS_CTR_DRBG_C
#define MBEDTLS_ENTROPY_C

/* Message Hashing Digests (Basic256Sha256 strictly requires SHA-256) */
#define MBEDTLS_MD_C
#define MBEDTLS_SHA256_C
/* Note: You can explicitly keep #undef MBEDTLS_SHA1_C and #undef MBEDTLS_SHA512_C */

/************************************************************************
 * SECTION 4: Symmetric Payload Ciphers (Message & Chunk Protection)
 ************************************************************************/
/* Symmetric Key Encryption Primitives */
#define MBEDTLS_AES_C
#define MBEDTLS_CIPHER_C
#define MBEDTLS_CIPHER_MODE_CBC

/************************************************************************
 * SECTION 5: Public Key Infrastructure & X.509 Operations
 ************************************************************************/
/* Application Node Certificates and Certificate Signing Requests (CSR) */
#define MBEDTLS_X509_USE_C
#define MBEDTLS_X509_CRT_PARSE_C
#define MBEDTLS_X509_CRT_WRITE_C
#define MBEDTLS_X509_CRL_PARSE_C
#define MBEDTLS_X509_CSR_PARSE_C
#define MBEDTLS_X509_CSR_WRITE_C

/* Core required backends for writing out X.509 Certificates */
#define MBEDTLS_PK_WRITE_C       /* Prerequisite 1: Key formatting module */
#define MBEDTLS_PK_GEN_C         /* Prerequisite 2: Asymmetric key generation engine */
#define MBEDTLS_PEM_WRITE_C      /* Prerequisite 3: Text-based base64 formatting encoder */

/* Essential encoding prerequisites for PEM operations */
#define MBEDTLS_BASE64_C
#define MBEDTLS_PEM_WRITE_C
#define MBEDTLS_PEM_PARSE_C   /* Recommended: Enables open62541 to read .pem files */

/* Mandatory hashing prerequisites for certificate generation/signing */
#define MBEDTLS_SHA256_C
#define MBEDTLS_SHA1_C         /* Required by Mbed TLS 3.x internal X509 signatures */

/* Mandatory formatting and parsing primitives */
#define MBEDTLS_ASN1_WRITE_C
#define MBEDTLS_OID_C

/* Mandatory Key Writing/Generation dependencies */
#define MBEDTLS_PK_WRITE_C
#define MBEDTLS_PK_GEN_C

/* Structural prerequisites for X.509 generation */
#define MBEDTLS_X509_CRT_PARSE_C  /* Required: The system must read structures before signing them */
#define MBEDTLS_X509_CREATE_C     /* Required: Internal abstraction library for building nodes */

/* Mandatory Hashing Primitives for basic validation */
#define MBEDTLS_SHA256_C
#define MBEDTLS_SHA1_C            /* Required: Mbed TLS internal legacy backward-compatibility fallbacks */

/* Key Serialization Primitives */
#define MBEDTLS_ASN1_WRITE_C
#define MBEDTLS_ASN1_PARSE_C
#define MBEDTLS_OID_C

/* Base Data Formatting Engines */
#define MBEDTLS_BASE64_C
#define MBEDTLS_PEM_WRITE_C
#define MBEDTLS_PEM_PARSE_C

/* Key Pair Management Engine */
#define MBEDTLS_PK_WRITE_C
#define MBEDTLS_PK_GEN_C

#define MBEDTLS_GENPRIME


// Directs Mbed TLS to route all AES API operations to the Tiva driver
#define MBEDTLS_AES_ALT
#define MBEDTLS_AES_SETKEY_ENC_ALT
#define MBEDTLS_AES_SETKEY_DEC_ALT

// Directs Mbed TLS to route SHA-256 context straight to the Tiva driver
#define MBEDTLS_SHA256_ALT

#endif // __MBEDTLS_CONFIG_H__
