Cryptography Support in Zephyr: Recent Changes and Upcomings
summary
Zephyr removes TinyCrypt because it is unmaintained and moves to PSA Crypto API adoption, leaving Mbed TLS as the default crypto stack while TF‑M provides a PSA-backed secure world. Measured footprint shifts: TinyCrypt build ≈40 KB, initial PSA+Mbed ≈55.5 KB, after static key buffers and P256M driver ≈41.5 KB. TF‑M partitioning on nRF5340 shrinks app space to ~192 KB but gives hardware key isolation. Secure storage now provides PSA-compatible at‑rest keys for non‑TF‑M platforms and vendor PSA drivers are required for crypto accelerators.
AI-written summary · about
chapters (17)
- 0:00Cryptography support in Zephyr
- 1:03Crypto providers in Zephyr
- 2:06PSA Crypto API
- 3:53TinyCrypt deprecated
- 4:38mbed TLS crypto support
- 8:10Legacy vs PSA crypto interfaces
- 10:36Transition to PSA crypto drivers
- 12:01Trusted Firmware M as PSA provider
- 13:24Security benefits of TF-M
- 14:06mbed TLS vs TF-M crypto support
- 16:37Secure key storage in Zephyr
- 18:45Deprecating TinyCrypt challenges
- 21:08Optimizing mbed TLS for devices
- 23:35PSA Crypto entropy sources
- 26:49Future mbed TLS & TF-PSA changes
- 28:57PSA Crypto driver implementation
- 31:09Q&A
related talks
42mCryptography Support in Zephyr: Recent Changes and Upcomings
27mZephyr and Trusted Execution Environments
38mIoT TLS: Why It's Hard
41mTrusted Firmware M: Introduction
27mZephyr and Trusted Execution Environments
24mSecure and Encrypted Boot in Zephyr RTOS
34mX.509 Client Authentication in Zephyr
16mDesigning Secure Systems for CRA Compliance leveraging Zephyr