SSL/TLS Cipher Selection#

SSL Parameters#


Macro	Meaning
`RSI_SSL_VERSION`	`RSI_SSL_V_2` = TLS 1.2 (default)
	`RSI_SSL_V_1` = TLS 1.1
	`RSI_SSL_V_0` = TLS 1.0
`RSI_SSL_RELEASE_2_0`	`RSI_ENABLE` - Use all ciphers configured by `SSL_RELEASE_2_0_ALL_CIPHERS`
	`RSI_DISABLE` - Only use ciphers supported by TLS 1.2
`RSI_SSL_CIPHERS`	If `RSI_SSL_RELEASE_2_0` is enabled, `SSL_RELEASE_2_0_ALL_CIPHERS` specifies the set of supported ciphers.

If RSI_SSL_RELEASE_2_0 is enabled, SSL_RELEASE_2_0_ALL_CIPHERS specifies which ciphers are enabled for use.


Macro	Meaning
`SSL_RELEASE_2_0_ALL_CIPHERS`	`BIT_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256`
	`BIT_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256`
	`BIT_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`
	`BIT_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`
	`BIT_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`
	`BIT_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`
	`BIT_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`
	`BIT_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
	`BIT_TLS_DHE_RSA_WITH_AES_256_CBC_SHA`
	`BIT_TLS_DHE_RSA_WITH_AES_128_CBC_SHA`
	`BIT_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`
	`BIT_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA`
	`BIT_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA`
	`BIT_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`
	`BIT_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA`
	`BIT_TLS_RSA_WITH_AES_256_CBC_SHA256`
	`BIT_TLS_RSA_WITH_AES_128_CBC_SHA256`
	`BIT_TLS_RSA_WITH_AES_256_CBC_SHA`
	`BIT_TLS_RSA_WITH_AES_128_CBC_SHA`
	`BIT_TLS_RSA_WITH_AES_128_CCM_8`
	`BIT_TLS_RSA_WITH_AES_256_CCM_8`

If RSI_SSL_RELEASE_2_0 is disabled, the following ciphers are enabled for use.


Macro	Meaning
`BIT_DHE_RSA_GCM`	`DHE_RSA` in combination with GCM secure ciphers ...
	> `BIT_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256`
	> `BIT_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384`
`BIT_ECDHE_RSA_GCM`	`ECDHE_RSA` in combination with GCM secure ciphers ...
	> `BIT_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`
	> `BIT_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
`BIT_DHE_RSA_CBC`	`DHE_RSA` in combination with CBC secure ciphers ...
	> `BIT_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256`
	> `BIT_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256`
`BIT_ECDHE_RSA_CBC`	`ECDHE_RSA` in combination with CBC secure ciphers ...
	> `BIT_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`
	> `BIT_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`
`BIT_ECDHE_ECDSA_CBC`	`ECDHE_ECDSA` in combination with CBC secure ciphers ...
	> `BIT_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`
	> `BIT_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`
`SSL_NEW_CIPHERS`	To enable more secure newly added ciphers

To use individual ciphers other than the default configurations shown above, configure the following macros under RSI_SSL_CIPHERS which is included in the release /sapi/include/rsi_wlan_common_config.h folder.


Bit Position	Macro
`BIT(0)`	`BIT_TLS_RSA_WITH_AES_256_CBC_SHA256`
`BIT(1)`	`BIT_TLS_RSA_WITH_AES_128_CBC_SHA256`
`BIT(2)`	`BIT_TLS_RSA_WITH_AES_256_CBC_SHA`
`BIT(3)`	`BIT_TLS_RSA_WITH_AES_128_CBC_SHA`
`BIT(4)`	`BIT_TLS_RSA_WITH_AES_128_CCM_8`
`BIT(5)`	`BIT_TLS_RSA_WITH_AES_256_CCM_8`
`BIT(6)`	Reserved
`BIT(7)`	Reserved
`BIT(8)`	`BIT_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256`
`BIT(9)`	`BIT_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384`
`BIT(10)`	`BIT_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`
`BIT(11)`	`BIT_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
`BIT(12)`	Reserved
`BIT(13)`	Reserved
`BIT(14)`	`BIT_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256`
`BIT(15)`	`BIT_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256`
`BIT(16)`	`BIT_TLS_DHE_RSA_WITH_AES_256_CBC_SHA`
`BIT(17)`	`BIT_TLS_DHE_RSA_WITH_AES_128_CBC_SHA`
`BIT(18)`	`BIT_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`
`BIT(19)`	`BIT_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`
`BIT(20)`	`BIT_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`
`BIT(21)`	`BIT_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
`BIT(22)`	`BIT_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`
`BIT(23)`	`BIT_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`
`BIT(24)`	`BIT_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`
`BIT(25)`	`BIT_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA`
`BIT(26)`	`BIT_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`
`BIT(27)`	`BIT_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA`
`BIT(28)`	Reserved
`BIT(29)`	Reserved
`BIT(30)`	Reserved
`BIT(31)`	`SSL_NEW_CIPHERS`

Note! The RS9116W does not include hardware support for GCM based ciphers. Use of these ciphers may impact performance since related crypto operations are performed by software.