update Mbed TLS to v4.1.0#28496
Merged
Merged
Conversation
NordicBuilder
added
doc-required
Contributor
Contributor
CI InformationTo view the history of this post, click the 'edited' button above Inputs:Sources:trusted-firmware-m: PR head: e476105018a2bf2dd8f87bca30a8e766846b4048 more detailstrusted-firmware-m:
sdk-nrf:
mcuboot:
nrfxlib:
find-my:
mbedtls:
openthread:
matter:
oberon-psa-crypto:
hostap:
zephyr:
Github labels
List of changed files detected by CI (2650)File list hidden for private repositories. Outputs:ToolchainVersion: f0aa129f09 Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
tomi-font
force-pushed
the
mbedtls_update_4.1.0
branch
from
6b7a015 to
db350e8
Compare
|
You can find the documentation preview for this PR here. Preview links for modified nRF Connect SDK documents: https://ncsbmdoc.z6.web.core.windows.net/ncs/PR-28496/nrf/app_dev/device_guides/kmu_guides/kmu_provisioning_overview.html |
tomi-font
force-pushed
the
mbedtls_update_4.1.0
branch
from
8c93dd0 to
85b9eb3
Compare
tomi-font
force-pushed
the
mbedtls_update_4.1.0
branch
2 times, most recently
from
1f52ce0 to
8ae399d
Compare
tomi-font
force-pushed
the
mbedtls_update_4.1.0
branch
from
8ae399d to
0b0fbad
Compare
tomi-font
force-pushed
the
mbedtls_update_4.1.0
branch
6 times, most recently
from
7769acc to
1db5745
Compare
tomi-font
force-pushed
the
mbedtls_update_4.1.0
branch
from
1db5745 to
bb1dcb5
Compare
Remove Kconfig options CONFIG_NORDIC_SECURITY_BACKEND and CONFIG_MBEDTLS_LEGACY_CRYPTO_C. Replace uses of them by what they used to enable. Individual code owners should check whether all of them are needed, adjust accordingly, and convert those to use the PSA version instead. CONFIG_MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS is also enabled as it's a required option to be able to use internal symbols outside of Mbed TLS/TF-PSA-Crypto. It's not actually needed in most cases because legacy crypto was enabled for RSA support in TLS which now works with PSA out of the box. But it's still added because for now that Kconfig option temporarily still acts as a guard for the CONFIG_*_BACKEND Kconfig options which haven't been removed yet. Once those Kconfig options are removed, CONFIG_MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS can be removed from pretty much all the configurations. Here is what happens to the Kconfig options that used to be guarded by CONFIG_MBEDTLS_LEGACY_CRYPTO_C in Kconfig.legacy: - Most of them are removed. They don't exist anymore, some of them already didn't have an effect or weren't used. - For those that are used, they are extracted and moved to the Kconfig file for deprecated options. From now on, all those Kconfig options do is enable their PSA counterparts (and trigger a deprecation warning). Translating them to MBEDTLS_* config options is of no use because in TF-PSA-Crypto and Oberon PSA Crypto these options are automatically derived from their PSA counterparts, so it's better to just have PSA_WANTs in our configuration files, no more legacy. The Kconfig options are temporarily kept purely as a convenience and to let individual teams do the transition to PSA at the Kconfig level themselves. - MBEDTLS_MD5_C is removed completely as it doesn't have an implementation by default in Oberon and MD5 doesn't seem to really be needed anywhere. The legacy crypto files are deleted as they are not relevant anymore. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
The function was removed from Mbed TLS 4, but the pre-built OT library still links against it, so provide an empty stub. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Now that we have switched to using the builtin Mbed TLS integration from Zephyr we need to enable CONFIG_MBEDLTS whenever using TLS/X.509 (previously it did not matter). So as a convenience make CONFIG_MBEDTLS_TLS_LIBRARY select it. This for example fixes the sample.openthread.cli* builds. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
HostAP mbedtls alt needs mbedtls_ecp_muladd, which requires PSA_WANT_ECC_SECP_R1_256 so TF-PSA exposes short-Weierstrass ECP. Enable for legacy PSA and enterprise. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no> Assisted-by: Cursor: Auto
When PSA HKDF is disabled, HostAP still needs software KDF for SHA-384 and SHA-512 on the legacy PSA path. SHA-512 needs nrf_security sha512.c. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no> Assisted-by: Cursor: Auto
HOSTAP_CRYPTO_ENTERPRISE depends on ALT_LEGACY_PSA and selects MBEDTLS_ECP_C for mbedtls_ecp_muladd with Oberon TF-PSA. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no> Assisted-by: Cursor: Auto
This target does not exist anymore, so remove it from the CMake logic. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no> Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Remove the config options CC3XX/OBERON _BACKEND options. These options enable the legacy mbedTLS crypto APIs to be provided by the binary libraries in nrfxlib. With the new TF-PSA-Crypto these binaries are being removed and thus these options need to be removed as well. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
Remove the CONFIG_CC3XX_BACKEND option which it does not exist with the new TF-PSA-Crypto. Also remove the unused MBEDTLS_ options. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
This needs to be handled separately. Either another signature type will be used, or a PSA implementation will replace the current RSA one which uses legacy. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
This is to allow enabling NRF_SECURITY without PSA_CRYPTO. Currently needed by MCUboot's BOOT_SIGNATURE_TYPE_ECDSA_P256. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Memfault fails to compile without CONFIG_PSA_WANT_ALG_SHA_1 enabled (errors out in memfault_platform_http.c), so enable it. Then disable it specifically on the Thingies which overflow. Memfault probably doesn't actually need SHA-1 to be enabled, so this would something to fix in the Memfault SDK itself. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
The downloaded t_cose library includes files from the Mbed TLS v3 era and so is incompatible with the new TF-PSA-Crypto structure. Quarantine these tests until we update TF-M to v2.3.0. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
- Enable CONFIG_MBEDTLS_BIGNUM_C so that e.g. mbedtls_mpi_*() functions are built and available. - Compile dhm.c and supp_psa_api.c in all cases to also have definitions of functions they implement. - Add compile definitions so that the code in des.c and dhm.c is compiled in and not left out. set_source_file_properties() didn't work for some reason. - Add the path to the Mbed TLS headers to the include directories to make oid.h available. This header is gone from TF-PSA-Crypto, and we want to be able to compile HostAP also when Mbed TLS is disabled, so because of that we need to manually add that include directory. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Matter/OT uses this target and includes headers from it. In some configurations this include is missing so add it here. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
To align with sdk-nrf. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
The previous (outdated) way did not result in PSA Crypto getting enabled. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
From the verify_hash() function. Otherwise TLS tests would fail because of this. This relates to sdk-mbedtls commit 5ca712905aac158b310144d9e09fdfb66bd4a4a5 which has now been discarded. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
Enable the MBEDTLS_TLS_LIBRARY for OPENTHREAD shell, since it is needed to get the TLS includes and the mbedTLS debug functionality. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
The current pre-compiled libraries are incompatible with the new Mbed TLS version. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
In some scenarios we would get an undefined reference to mbedtls_debug_set_threshold() because Mbed TLS wouldn't be compiled in. The proper fix for this would be to #ifdef out the use of this function if it is the only undefined reference. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
pascal-nordic
approved these changes
May 22, 2026
magnev
approved these changes
May 22, 2026
Vge0rge
approved these changes
May 22, 2026
juhaylinen
approved these changes
May 22, 2026
trantanen
approved these changes
May 22, 2026
simensrostad
approved these changes
May 22, 2026
Contributor
|
DNM removed, hostap fork not needed anymore. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See individual commits for explanations of the changes.
Documentation updates, including release notes/migration guide, will come in a separate PR.
Changes include, but are not limited to:
Update Mbed TLS from v3.6.6 to v4.1.0.
Update Oberon PSA Crypto from v1.5.4 to v2.0.0. (It now acts as our fork of TF-PSA-Crypto.)
Add TF-PSA-Crypto (v1.1.0) as a new module, imported as is from Zephyr.
CONFIG_TF_PSA_CRYPTO_BUILTIN=y, which is automatically enabled whenCONFIG_NRF_SECURITYis disabled, which happens when building on board targets other than Nordic's Arm cores (sonative_sim,*/cpuflpr, ...).CONFIG_TF_PSA_CRYPTO_CUSTOMis enabled and Oberon PSA Crypto is used instead.From now on, enabling
CONFIG_MBEDTLSshould be done only if you are using TLS or X.509. If you don't, make sure it's disabled.If you just need to do crypto operations, enable
CONFIG_PSA_CRYPTOinstead. This will make all the TF-PSA-Crypto APIs available, including PSA Crypto.(Confusingly enough, options that configure TF-PSA-Crypto are still prefixed with
MBEDTLS_, so you may find yourself rightfully enablingCONFIG_MBEDTLS_*Kconfig options whileCONFIG_MBEDTLSitself is disabled.)test_crypto: PR-1001
test_tfm: PR-227