[PATCH 0/4] Add a PSA Crypto API backend (CONFIG_TLS=psa)

[Krishna Chaitanya]

On Thu, Jul 9, 2026 at 1:49 AM Chaitanya Tata <chaitanya.mgit at gmail.com> wrote:
>
> From: Chaitanya Tata <Chaitanya.Tata at nordicsemi.no>
>
> This series adds a new crypto/TLS backend selected with CONFIG_TLS=psa,
> built on the Arm PSA Crypto API with MbedTLS 4.x / TF-PSA-Crypto 1.x as the
> reference provider. It targets resource-constrained and PSA-based platforms
> (Nordic nRF Connect SDK with Oberon PSA Crypto + CryptoCell, TF-M, ...),
> where crypto is exposed through the standardized PSA API rather than a
> specific library.
>
> Design (PSA-first, explicit non-PSA boundary): crypto_psa.c has the portable
> PSA-only primitives; crypto_psa_mbedtls.c has the bignum/EC-point/DH math the
> PSA API does not expose (SAE/DPP/PASN/EAP-PWD) via MbedTLS builtin modules;
> tls_psa.c does TLS/X.509 via MbedTLS.
>
> Tested: tests/build configs build wpa_supplicant + hostapd clean (-Werror)
> against MbedTLS 4.2.0 + TF-PSA-Crypto 1.2.0; MODULE_TESTS pass on both; hwsim
> open/WPA2-PSK/SAE/OWE and EAP-TLS/PEAP/TTLS associations pass.
>
> Known limitations (README-psa.md; follow-up; none affect core Personal/
> Enterprise): EAP-FAST/TEAP, RSA-OAEP (DPP2/DPP3, EAP-SIM/AKA IMSI privacy),
> OCSP, PKCS#12.
>
> Relation to prior work: the 2022 library-specific mbed TLS backend [1] was
> not merged; this PSA-API approach is more general (any PSA provider) and
> matches the PSA-native direction of MbedTLS 4 / TF-PSA-Crypto, obsoleting it.
>
> [1] https://patchwork.ozlabs.org/project/hostap/patch/20220424161034.1365496-1-krish271828@gmail.com/
>
> Cc: Maochen Wang <maochen.wang at nxp.com>
>
> Chaitanya Tata (4):
>   crypto: Add PSA-based crypto and TLS backend (CONFIG_TLS=psa)
>   tests: Add build configs for the PSA crypto backend
>   tests: hwsim: Add PSA crypto backend option
>   docs: Document the PSA crypto backend
>
>  hostapd/Makefile                            |   83 +
>  hostapd/defconfig                           |    4 +
>  src/crypto/README-psa.md                    |  113 +
>  src/crypto/crypto_psa.c                     | 1491 +++++++++
>  src/crypto/crypto_psa_mbedtls.c             | 2357 +++++++++++++++
>  src/crypto/tls_psa.c                        | 2999 +++++++++++++++++++
>  tests/build/build-hostapd-psa.config        |   50 +
>  tests/build/build-wpa_supplicant-psa.config |   52 +
>  tests/hwsim/example-hostapd.config          |   24 +
>  tests/hwsim/example-wpa_supplicant.config   |   24 +
>  tests/hwsim/start.sh                        |   17 +
>  wpa_supplicant/Makefile                     |   66 +
>  wpa_supplicant/defconfig                    |    4 +
>  13 files changed, 7284 insertions(+)
>  create mode 100644 src/crypto/README-psa.md
>  create mode 100644 src/crypto/crypto_psa.c
>  create mode 100644 src/crypto/crypto_psa_mbedtls.c
>  create mode 100644 src/crypto/tls_psa.c
>  create mode 100644 tests/build/build-hostapd-psa.config
>  create mode 100644 tests/build/build-wpa_supplicant-psa.config
>
> --
> 2.43.0
>
 Gentle reminder.