modules: mbedtls: bump to 4.x

MAINTAINERS.yml

@@ -6447,7 +6447,7 @@ West:
     - crypto.mbedtls
     - psa.secure_storage
 
-"West project: mbedtls-framework":
+"West project: mbedtls-3.6":
   status: maintained
   maintainers:
     - ceolin
@@ -6479,6 +6479,16 @@ West:
   labels:
     - "area: Tracing"
 
+"West project: mldsa-native":
+  status: maintained
+  maintainers:
+    - ceolin
+    - valeriosetti
+    - tomi-font
+  files: []
+  labels:
+    - "area: TF-PSA-Crypto"
+
 "West project: nanopb":
   status: maintained
   maintainers:

drivers/bluetooth/hci/Kconfig.esp32

@@ -488,11 +488,16 @@ config ESP32_BT_LE_CRYPTO_STACK_MBEDTLS
 	bool "mbedTLS crypto stack"
 	depends on ESP32_BT_LE_SECURITY_ENABLE
 	default y
-	select MBEDTLS
-	select MBEDTLS_ECP_C
-	select MBEDTLS_ECP_DP_SECP256R1_ENABLED
-	select MBEDTLS_ECDH_C
-	select MBEDTLS_ENTROPY_C
+	select PSA_CRYPTO
+	select MBEDTLS_CTR_DRBG_C
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE
+	select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
+	select PSA_WANT_ECC_SECP_R1_256
+	select PSA_WANT_ALG_ECDH
+	# Keep access to legacy crypto headers
+	select MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
 	help
 	  Use mbedTLS library for BLE cryptographic operations.
 

drivers/wifi/esp32/Kconfig.esp32

@@ -12,6 +12,9 @@ menuconfig WIFI_ESP32
 	select NET_L2_ETHERNET_MGMT
 	select WIFI_USE_NATIVE_NETWORKING
 	select MBEDTLS
+	# This is needed because some guards in TLS now require PSA crypto stuff
+	# to be enabled
+	select PSA_CRYPTO
 	select THREAD_STACK_INFO
 	select DYNAMIC_THREAD
 	select DYNAMIC_THREAD_ALLOC
@@ -367,15 +370,18 @@ config ESP32_WIFI_SOFTAP_SUPPORT
 
 config ESP32_WIFI_MBEDTLS_CRYPTO
 	bool "Use MbedTLS crypto APIs"
-	select MBEDTLS_ECP_C
-	select MBEDTLS_ECDH_C
-	select MBEDTLS_ECDSA_C
+	select PSA_CRYPTO
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE
+	select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
+	select PSA_WANT_ECC_SECP_R1_256
+	select PSA_WANT_ALG_ECDH
+	select PSA_WANT_ALG_ECDSA
+	select PSA_WANT_ALG_CMAC
 	select MBEDTLS_PKCS5_C
 	select MBEDTLS_MD_C
 	select MBEDTLS_PK_WRITE_C
-	select MBEDTLS_CIPHER_MODE_CTR_ENABLED
-	select MBEDTLS_CMAC
-	select MBEDTLS_ENTROPY_C
 	help
 	  Select this option to use MbedTLS crypto APIs which utilize hardware acceleration.
 

modules/hostap/Kconfig

@@ -173,31 +173,16 @@ choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND
 config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
 	bool "Crypto Mbedtls alt support for WiFi"
 	select MBEDTLS
-	select MBEDTLS_CIPHER_MODE_CTR_ENABLED
-	select MBEDTLS_CIPHER_MODE_CBC_ENABLED
-	select MBEDTLS_CIPHER_AES_ENABLED
-	select MBEDTLS_CIPHER_DES_ENABLED
-	select MBEDTLS_SHA1
-	select MBEDTLS_SHA384
-	select MBEDTLS_ENTROPY_C
 	select MBEDTLS_CIPHER
-	select MBEDTLS_ECP_C
-	select MBEDTLS_ECP_ALL_ENABLED
-	select MBEDTLS_CMAC
 	select MBEDTLS_PKCS5_C
 	select MBEDTLS_MD_C
 	select MBEDTLS_PK_WRITE_C
-	select MBEDTLS_ECDH_C
-	select MBEDTLS_ECDSA_C
-	select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-	select MBEDTLS_RSA_C
-	select MBEDTLS_PKCS1_V15
-	select MBEDTLS_PKCS1_V21
-	select MBEDTLS_X509_CRT_PARSE_C
-	select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+	select MBEDTLS_CIPHERSUITE_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
+	select MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 	select MBEDTLS_NIST_KW_C
-	select MBEDTLS_DHM_C
-	select MBEDTLS_HKDF_C
+	select PSA_WANT_ALG_HKDF
+	select PSA_WANT_ALG_HKDF_EXTRACT
+	select PSA_WANT_ALG_HKDF_EXPAND
 
 config WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE
 	bool "No Crypto support for WiFi"
@@ -217,7 +202,7 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
 	default y
 	depends on WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
 	select PSA_CRYPTO
-	select MBEDTLS_USE_PSA_CRYPTO
+	select MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
 	select PSA_WANT_ALG_ECDH
 	select PSA_WANT_ALG_HMAC
 	select PSA_WANT_ALG_CCM
@@ -720,7 +705,7 @@ config SAE_PWE_EARLY_EXIT
 	  Note that this is highly insecure and shouldn't be used in production
 
 config WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST
-	bool
+	bool "Test crypto in HostAP"
 	depends on WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
 
 config WIFI_NM_WPA_CTRL_RESP_TIMEOUT_S