What the developer wrote
Authored by Marko Bencun
Shrink mbedtls SHA256 core
Enable MBEDTLS_SHA256_SMALLER in the Optiga Trust M mbedTLS
user config.
This keeps the same SHA256 and HMAC-SHA256 behavior, but switches
mbedTLS to its smaller SHA256 implementation for the live Optiga
crypto path.
Savings: 1392 bytes.
The main win is that mbedtls_internal_sha256_process shrinks by
1396 bytes in the final image. The surrounding PAL, HMAC, and CCM
entry points remain live, so this is a pure ROM-for-speed tradeoff
rather than a functionality change.
What changed, and why it matters
This commit changes a single compiler setting in the firmware's cryptography library (mbedTLS) to use a smaller, slower implementation of the SHA-256 hashing routine. The commit message explicitly states this is a size-versus-speed tradeoff and does not change functionality. There is no indication of a security bug or vulnerability fix.
No security action required. Treat as a normal firmware size optimization. If desired, verify that the smaller SHA-256 implementation passes the project's existing cryptographic self-tests and that performance remains acceptable for the Optiga Trust M live crypto path.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change adds #define MBEDTLS_SHA256_SMALLER to external/mbedtls_config.h. This mbedTLS option replaces the default SHA-256 compression function (mbedtls_internal_sha256_process) with a more compact implementation, saving 1,392 bytes of flash/ROM at the cost of some runtime performance. The commit notes that SHA-256, HMAC-SHA256, and the Optiga Trust M crypto path remain functionally unchanged; only the internal process function is swapped.
Changed components
external/mbedtls_config.hmbedtls_internal_sha256_process implementation (size-optimized variant)Inspect captured patch +1 / −0
diff --git a/external/mbedtls_config.h b/external/mbedtls_config.h
index 8df96e6..9281105 100644
--- a/external/mbedtls_config.h
+++ b/external/mbedtls_config.h
@@ -65,6 +65,7 @@
/* Save RAM at the expense of ROM */
#define MBEDTLS_AES_ROM_TABLES
#define MBEDTLS_AES_FEWER_TABLES
+#define MBEDTLS_SHA256_SMALLER
/* Save some RAM by adjusting to your exact needs */
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.