mbedtls: use RAM instead of ROM to shrink size
What the developer wrote
Authored by Marko Bencun
mbedtls: use RAM instead of ROM to shrink size
Saves 2104 bytes.
What changed, and why it matters
This commit changes a build-time configuration option for the mbedTLS cryptography library. It disables AES lookup tables stored in read-only flash memory (ROM) and instead uses tables computed at runtime in regular working memory (RAM). The stated purpose is to reduce the overall firmware size by 2,104 bytes. This is a size-optimization change, not a security fix.
No security action required. Reviewers may want to confirm that the small increase in static RAM usage fits within the device's memory budget and does not affect performance-sensitive operations.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The single-line change comments out #define MBEDTLS_AES_ROM_TABLES in external/mbedtls_config.h, leaving MBEDTLS_AES_FEWER_TABLES enabled. When MBEDTLS_AES_ROM_TABLES is disabled, mbedTLS computes AES T-tables in RAM at startup rather than embedding precomputed tables in the firmware image. This trades a small amount of RAM for a larger reduction in ROM/flash usage. The change does not alter cryptographic algorithms, protocol behavior, or access controls.
Changed components
external/mbedtls_config.hInspect captured patch +2 / −1
diff --git a/external/mbedtls_config.h b/external/mbedtls_config.h
index 9281105..27ecea9 100644
--- a/external/mbedtls_config.h
+++ b/external/mbedtls_config.h
@@ -63,7 +63,8 @@
#define MBEDTLS_SSL_OUT_CONTENT_LEN 1024
/* Save RAM at the expense of ROM */
-#define MBEDTLS_AES_ROM_TABLES
+// #define MBEDTLS_AES_ROM_TABLES
+
#define MBEDTLS_AES_FEWER_TABLES
#define MBEDTLS_SHA256_SMALLER
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.