Skip to content

deprecate Trusted Storage#28996

Open
tomi-font wants to merge 3 commits into
nrfconnect:mainfrom
tomi-font:trusted_storage_deprecation
Open

deprecate Trusted Storage#28996
tomi-font wants to merge 3 commits into
nrfconnect:mainfrom
tomi-font:trusted_storage_deprecation

Conversation

@tomi-font
Copy link
Copy Markdown
Contributor

@tomi-font tomi-font commented May 25, 2026 •
edited
Loading

Replace in-tree uses of Trusted Storage by Secure Storage, mark Trusted Storage as deprecated, and recommend Secure Storage instead.

tomi-font added 3 commits May 25, 2026 15:05
@tomi-font
treewide: default to using Secure Storage
ac201a0 
It is the preferred option compared to Trusted Storage, so default to
using it.

It is still possible to use Trusted Storage by disabling
CONFIG_SECURE_STORAGE and enabling CONFIG_TRUSTED_STORAGE.
But for existing installations making use of Trusted Storage, they
can switch to using Secure Storage without losing any existing data by
simply enabling the CONFIG_SECURE_STORAGE_TRUSTED_STORAGE_COMPATIBILITY
Kconfig option.

In addition, CONFIG_TRUSTED_STORAGE now automatically enables
CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C so that users of Trusted Storage
don't have to enable it themselves anymore.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@tomi-font
secure_storage: remove experimental status from compatibility option
a0ea170 
CONFIG_SECURE_STORAGE_TRUSTED_STORAGE_COMPATIBILITY has sufficient
testing, so remove its experimental status.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@tomi-font
trusted_storage: deprecate
4fc6a2c 
Mark CONFIG_TRUSTED_STORAGE as deprecated for future removal.

Secure Storage is the future-proof and recommended option.

Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
@tomi-font tomi-font requested review from a team May 25, 2026 12:15
@tomi-font tomi-font requested review from a team as code owners May 25, 2026 12:15
@tomi-font tomi-font added this to the 3.4.0 milestone May 25, 2026
@NordicBuilder NordicBuilder added manifest ble mesh Label for ble mesh PRbot. Add this if PR is related to ble mesh and you need to get review. labels May 25, 2026
@NordicBuilder NordicBuilder requested review from a team May 25, 2026 12:15
@tomi-font tomi-font mentioned this pull request May 25, 2026
Open
@NordicBuilder
Copy link
Copy Markdown
Contributor

NordicBuilder commented May 25, 2026

The following west manifest projects have changed revision in this Pull Request:

Name Old Revision New Revision Diff
matter nrfconnect/sdk-connectedhomeip@106cf3d (master) nrfconnect/sdk-connectedhomeip#722 nrfconnect/sdk-connectedhomeip#722/files

⛔ DNM label due to: 1 project with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

@tomi-font tomi-font requested review from Copilot and greg-fer May 25, 2026 12:16
Copilot AI reviewed May 25, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the nRF Connect SDK storage configuration to make Secure Storage the preferred/default option, and formally deprecates Trusted Storage while preserving a migration path via the compatibility layer.

Changes:

  • Deprecate CONFIG_TRUSTED_STORAGE and have it automatically enable MBEDTLS_PSA_CRYPTO_STORAGE_C.
  • Remove the experimental status from CONFIG_SECURE_STORAGE_TRUSTED_STORAGE_COMPATIBILITY.
  • Switch selected subsystems (e.g., OpenThread, Bluetooth Mesh) to imply SECURE_STORAGE instead of TRUSTED_STORAGE, and adjust sample config accordingly.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
west.yml Updates the Matter module revision reference.
subsys/trusted_storage/Kconfig Marks Trusted Storage as deprecated and adds auto-enablement of PSA crypto storage support.
subsys/secure_storage/compatibility/Kconfig Removes the EXPERIMENTAL marker from the Trusted Storage compatibility option.
subsys/net/openthread/Kconfig Switches OpenThread PSA security to imply Secure Storage and adjusts Trusted Storage-specific defaults.
subsys/bluetooth/mesh/Kconfig Switches Bluetooth Mesh secure storage to imply Secure Storage and scopes Trusted Storage-only options.
samples/crypto/persistent_key_usage/prj.conf Removes explicit enabling of CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread west.yml
Comment thread subsys/net/openthread/Kconfig
if (OPENTHREAD_NRF_SECURITY_PSA && (BUILD_WITH_TFM || (!SOC_NRF5340_CPUAPP && !SOC_SERIES_NRF54L)))
# Set hash of UID as AEAD Key implementation for device that do not have hardware secure storage and TFM builds.
if OPENTHREAD_NRF_SECURITY_PSA && TRUSTED_STORAGE && !SOC_NRF5340_CPUAPP && !SOC_SERIES_NRF54L
# Set hash of UID as AEAD Key implementation for device that do not have hardware secure storage.
@NordicBuilder
Copy link
Copy Markdown
Contributor

NordicBuilder commented May 25, 2026 •
edited
Loading

CI Information

To view the history of this post, click the 'edited' button above
Build number: 1

Inputs:

Sources:

sdk-nrf: PR head: 4fc6a2c3778259cc39bf1be44b13b2a7168bb0d4
matter: PR head: 6d301f9f5755415403c8765f1216f523ee489bf2

more details

sdk-nrf:

PR head: 4fc6a2c3778259cc39bf1be44b13b2a7168bb0d4
merge base: d1bc47328e473e1889789caf5bd7ccb4338cc072
target head (main): d294950e7b6d59865fba3f6fd0d7646e010d4c6d
Diff

matter:

PR head: 6d301f9f5755415403c8765f1216f523ee489bf2
merge base: 106cf3d26c6b3354fc2006aa71684a9905d1af64
target head (master): 106cf3d26c6b3354fc2006aa71684a9905d1af64
Diff

Github labels

Enabled Name Description
ci-disabled Disable the ci execution
ci-all-test Run all of ci, no test spec filtering will be done
ci-force-downstream Force execution of downstream even if twister fails
ci-run-twister Force run twister
ci-run-zephyr-twister Force run zephyr twister
List of changed files detected by CI (7) 
modules
│  ├── lib
│  │  ├── matter
│  │  │  ├── config
│  │  │  │  ├── nrfconnect
│  │  │  │  │  ├── chip-module
│  │  │  │  │  │  │ Kconfig
samples
│  ├── crypto
│  │  ├── persistent_key_usage
│  │  │  │ prj.conf
subsys
│  ├── bluetooth
│  │  ├── mesh
│  │  │  │ Kconfig
│  ├── net
│  │  ├── openthread
│  │  │  │ Kconfig
│  ├── secure_storage
│  │  ├── compatibility
│  │  │  │ Kconfig
│  ├── trusted_storage
│  │  │ Kconfig
west.yml

Outputs:

Toolchain

Version: f0aa129f09
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:f0aa129f09_5ea73affbf

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

  • ◻️ Toolchain - Skipped: existing toolchain is used
  • ❌ Build twister
    • sdk-nrf test count: 2203
  • ❌ Integration tests
    • ❌ test-fw-nrfconnect-ble_mesh
    • ❌ test-fw-nrfconnect-chip
    • ❌ test-fw-nrfconnect-nrf_crypto
    • ❌ test-fw-nrfconnect-thread-main
Disabled integration tests
    • test-fw-nrfconnect-nrf_lrcs_mosh
    • test-fw-nrfconnect-nrf_lrcs_positioning
    • desktop52_verification
    • test_ble_nrf_config
    • test-fw-nrfconnect-apps
    • test-fw-nrfconnect-apps_nrfdesktop
    • test-fw-nrfconnect-ble_samples
    • test-fw-nrfconnect-fem
    • test-fw-nrfconnect-nfc
    • test-fw-nrfconnect-nrf-iot_libmodem-nrf
    • test-fw-nrfconnect-nrf-iot_lwm2m
    • test-fw-nrfconnect-nrf-iot_samples
    • test-fw-nrfconnect-nrf-iot_thingy91
    • test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
    • test-fw-nrfconnect-ps-main
    • test-fw-nrfconnect-rpc
    • test-fw-nrfconnect-rs
    • test-fw-nrfconnect-tfm
    • test-low-level
    • test-sdk-audio
    • test-sdk-dfu
    • test-sdk-find-my
    • test-sdk-mcuboot
    • test-sdk-wifi
    • test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

@tomi-font tomi-font modified the milestones: 3.4.0, 3.5.0 May 26, 2026
alxelax
alxelax reviewed May 26, 2026
View reviewed changes
Comment thread subsys/bluetooth/mesh/Kconfig
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@omkar3141 omkar3141 omkar3141 left review comments

@alxelax alxelax alxelax requested changes

Copilot code review Copilot Copilot left review comments

@nordicjm nordicjm nordicjm approved these changes

@greg-fer greg-fer Awaiting requested review from greg-fer

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

ble mesh Label for ble mesh PRbot. Add this if PR is related to ble mesh and you need to get review. DNM manifest manifest-matter

Projects

None yet

Milestone

3.5.0

Development

Successfully merging this pull request may close these issues.

6 participants

@tomi-font @NordicBuilder @omkar3141 @nordicjm @alxelax