What the developer wrote
Authored by Marko Bencun
Shrink mbedtls AES tables
Enable MBEDTLS_AES_FEWER_TABLES in the Optiga Trust M mbedTLS
user config.
This keeps the same AES/CCM functionality, but trades a small
amount of AES speed for smaller ROM usage by deriving the extra
AES lookup tables from FT0/RT0 instead of keeping all eight
tables in flash.
- savings: 6208 bytes
The main win is that six live 1024-byte AES tables drop out of
the final image: FT1, FT2, FT3, RT1, RT2, and RT3. FT0 and RT0
remain, and the AES encrypt/decrypt functions shrink slightly as
well.
No functionality changes are intended; this is a ROM-for-speed
tradeoff in the mbedTLS AES implementation used by the Optiga
Trust M integration.
What changed, and why it matters
This commit changes a single configuration line in the firmware's cryptography library setup. It tells the AES encryption code to use smaller lookup tables, saving about 6 KB of storage space at the cost of a small speed reduction. The commit explicitly states there are no intended functionality changes, and the diff shows only the addition of one configuration macro.
No security action required. This is a benign size optimization. Normal review and testing to confirm AES/CCM behavior remains unchanged is sufficient.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds #define MBEDTLS_AES_FEWER_TABLES to external/mbedtls_config.h for the Optiga Trust M mbedTLS user config. This is a standard mbedTLS option that removes six of the eight 1024-byte AES T-tables (FT1/FT2/FT3 and RT1/RT2/RT3) and derives their values from FT0/RT0 at runtime. It is a documented size-versus-speed tradeoff and does not alter the AES/CCM algorithm or its output.
Changed components
external/mbedtls_config.hInspect captured patch +1 / −0
diff --git a/external/mbedtls_config.h b/external/mbedtls_config.h
index 9073117..8df96e6 100644
--- a/external/mbedtls_config.h
+++ b/external/mbedtls_config.h
@@ -64,6 +64,7 @@
/* Save RAM at the expense of ROM */
#define MBEDTLS_AES_ROM_TABLES
+#define MBEDTLS_AES_FEWER_TABLES
/* Save some RAM by adjusting to your exact needs */
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.