Support Mbed-TLS 4.0.0

[kstribrnAmzn]

Mbed-TLS version 4.0.0 was launched October 15th, 2025. CorePKCS11 needs to be compatible with this latest version going forward.

More on how to perform the migration can be found in the 4.0 migration guide.

[skkrems]

+1 — ESP-IDF v6.0.2 migration blocked by this

We're migrating a production IoT product to ESP-IDF v6.0.2, which ships with Mbed TLS v4.0. corePKCS11 v3.6.3 fails to compile because core_pkcs11_mbedtls.c relies on legacy mbedtls_* APIs that were removed in 4.0.

Specific breakage:

• mbedtls_pk_parse_key() / mbedtls_pk_sign() / mbedtls_pk_verify() → removed, replaced by psa_import_key() / psa_sign_hash() / psa_verify_hash()

• mbedtls_entropy_* / mbedtls_ctr_drbg_* → removed, replaced by psa_generate_random()

• mbedtls_sha256_* → removed, replaced by psa_hash_compute()

Impact: We cannot use the software PKCS#11 implementation on any platform shipping Mbed TLS 4.x. Our current workaround is staying on ESP-IDF v5.x, which blocks us from other v6.0 features and security improvements.

Timeline pressure: Mbed TLS 3.6 LTS reaches EOL in March 2027. ESP-IDF, Zephyr ([zephyrproject-rtos/zephyr#97660](zephyrproject-rtos/zephyr#97660)), and other ecosystems have already moved to 4.x — this gap will affect an increasing number of users.

Is there a timeline or branch in progress for the PSA Crypto migration?