I tested the effect of enabling dynamic mbedTLS buffers and disabling retention of the peer certificate in Toit. The test gradually increased memory pressure using dummy buffers until the TLS connection could no longer complete. Default buffer handling - Largest contiguous block at failure: 24 KB - Total free memory at failure: 62 KB - Dummy buffers before failure: 58 KB -

tls/bignum

usage: ~36 KB Dynamic buffers enabled - Largest contiguous block at failure: 12 KB - Total free memory at failure: 49 KB - Dummy buffers before failure: 68 KB -

tls/bignum

usage: ~12 KB Dynamic buffers + peer certificate not retained - Largest contiguous block at failure: 5 KB - Total free memory at failure: 41 KB - Dummy buffers before failure: 75 KB -

tls/bignum

usage: ~8 KB The relevant configuration options are:

text
CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE=n

Dynamic buffers reduced tls/bignum usage from approximately 36 KB to 12 KB. Not retaining the peer certificate reduced it further to approximately 8 KB. With both options enabled, the TLS connection tolerated memory pressure until the largest contiguous free block was only 5 KB, compared with 24 KB using default buffers. The tests used

CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=12288

, compared with Toit’s default of

7800

. This means that tls/bignum usage with the default Toit configuration should be approximately 4 KB lower than the results shown here. This is a significant improvement for ESP32 devices where total free memory is available, but obtaining a contiguous block larger than 20 KB can be difficult. Device: ESP32-WROOM-32E

I will look into it. Thanks!