Toit
#Significant TLS memory savings with dynamic buffers
Thread channel in help
Rikke 09/07/2026 12:46 PM
I tested the effect of enabling dynamic mbedTLS buffers and disabling retention of the peer certificate in Toit.
The test gradually increased memory pressure using dummy buffers until the TLS connection could no longer complete.
Default buffer handling
- Largest contiguous block at failure:24 KB
- Total free memory at failure:62 KB
- Dummy buffers before failure:58 KB
-~36 KB
Dynamic buffers enabled
- Largest contiguous block at failure:12 KB
- Total free memory at failure:49 KB
- Dummy buffers before failure:68 KB
-~12 KB
Dynamic buffers + peer certificate not retained
- Largest contiguous block at failure:5 KB
- Total free memory at failure:41 KB
- Dummy buffers before failure:75 KB
-~8 KB
The relevant configuration options are:
Dynamic buffers reduced tls/bignum usage from approximately 36 KB to 12 KB. Not retaining the peer certificate reduced it further to approximately 8 KB.
With both options enabled, the TLS connection tolerated memory pressure until the largest contiguous free block was only 5 KB, compared with 24 KB using default buffers.
The tests used
This is a significant improvement for ESP32 devices where total free memory is available, but obtaining a contiguous block larger than 20 KB can be difficult.
Device: ESP32-WROOM-32E
The test gradually increased memory pressure using dummy buffers until the TLS connection could no longer complete.
- Largest contiguous block at failure:
- Total free memory at failure:
- Dummy buffers before failure:
-
tls/bignum- Largest contiguous block at failure:
- Total free memory at failure:
- Dummy buffers before failure:
-
tls/bignum- Largest contiguous block at failure:
- Total free memory at failure:
- Dummy buffers before failure:
-
tls/bignumThe relevant configuration options are:
CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE=nDynamic buffers reduced tls/bignum usage from approximately 36 KB to 12 KB. Not retaining the peer certificate reduced it further to approximately 8 KB.
With both options enabled, the TLS connection tolerated memory pressure until the largest contiguous free block was only 5 KB, compared with 24 KB using default buffers.
The tests used
CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=122887800This is a significant improvement for ESP32 devices where total free memory is available, but obtaining a contiguous block larger than 20 KB can be difficult.
Device: ESP32-WROOM-32E
Rikke 09/07/2026 12:46 PM
I wanted to share these findings since the memory savings were significant in our tests. We have already enabled these options in our own sdkconfig, but they may also be worth considering as defaults in Toit.
floitsch 09/07/2026 12:59 PM
I will look into it. Thanks!
floitsch 09/07/2026 01:00 PM
Great find.
4 messages in total