Cryptography Support in Zephyr: Recent Changes and Upcomings
summary
Year-long migration removes TinyCrypt and TinyCrypt deprecated, pushes Zephyr to use the PSA Crypto API adoption with Mbed TLS as the practical-only provider and TF‑M integration for hardware-backed crypto. Measured builds show elliptic-curve work moving from ~40K with TinyCrypt to ~55.5K with PSA then down to ~41.5K after P256M and static key buffers, and a 1MB nRF5340 image shrinks app space to ~192K when TF‑M partitions flash. Next Mbed TLS split and vendor driver support target Sept 2025.
AI-written summary · about
chapters (17)
- 0:00Cryptography support in Zephyr
- 1:03Crypto providers in Zephyr
- 2:06PSA Crypto API
- 3:53TinyCrypt deprecated
- 4:38mbed TLS crypto support
- 8:10Legacy vs PSA crypto interfaces
- 10:36Transition to PSA crypto drivers
- 12:01Trusted Firmware M as PSA provider
- 13:24Security benefits of TF-M
- 14:06mbed TLS vs TF-M crypto support
- 16:37Secure key storage in Zephyr
- 18:45Deprecating TinyCrypt challenges
- 21:08Optimizing mbed TLS for devices
- 23:35PSA Crypto entropy sources
- 26:49Future mbed TLS & TF-PSA changes
- 28:57PSA Crypto driver implementation
- 31:09Q&A
related talks
42mCryptography Support in Zephyr: Recent Changes and Upcomings
27mZephyr and Trusted Execution Environments
27mZephyr and Trusted Execution Environments
40mZephyr Project Security Status
38mIoT TLS: Why It's Hard
41mTrusted Firmware M: Introduction
16mDesigning Secure Systems for CRA Compliance leveraging Zephyr
34mX.509 Client Authentication in Zephyr