Skip to content

mbedTLS 4 / PSA Crypto support on 2_x_dev #813

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vikramdattu wants to merge 5 commits into
base: 2_x_dev
Choose a base branch
from
Open

mbedTLS 4 / PSA Crypto support on 2_x_dev #813

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
82f3326
mbedtls: add mbedTLS 4 / PSA Crypto support (WIP, gated)
vikramdattu Jun 1, 2026
6d6c04e
fixup: tighten GCM dir check + status code; document AES-ICM SRTP cou…
vikramdattu Jun 1, 2026
bd11b49
ci: fix mbedtls 2.x include + mbedtls4 PIC + macOS prefix
vikramdattu Jun 1, 2026
246c006
review fixes: msg_octets guard, psa_reset_key_attributes, CI mbedtls …
vikramdattu Jul 6, 2026
3747a63
fix(aes-icm): avoid in-place psa_cipher_update on TF-PSA-Crypto (mbed…
vikramdattu Jul 6, 2026
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 40 additions & 1 deletion .github/workflows/cmake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
crypto: [internal, openssl, openssl3, nss, mbedtls]
crypto: [internal, openssl, openssl3, nss, mbedtls, mbedtls4]
exclude:
- os: windows-latest
crypto: openssl
Expand All @@ -24,6 +24,8 @@ jobs:
crypto: nss
- os: windows-latest
crypto: mbedtls
- os: windows-latest
crypto: mbedtls4
- os: ubuntu-latest
crypto: openssl3
include:
Expand All @@ -37,6 +39,8 @@ jobs:
cmake-crypto-enable: "-DENABLE_NSS=ON"
- crypto: mbedtls
cmake-crypto-enable: "-DENABLE_MBEDTLS=ON"
- crypto: mbedtls4
cmake-crypto-enable: "-DENABLE_MBEDTLS=ON"

runs-on: ${{ matrix.os }}

Expand All @@ -54,6 +58,23 @@ jobs:
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'mbedtls'
run: sudo apt-get install libmbedtls-dev

- name: Setup Ubuntu MbedTLS 4
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'mbedtls4'
run: |
python3 -m pip install --break-system-packages --upgrade jsonschema jinja2
git clone https://github.com/Mbed-TLS/mbedtls.git /tmp/mbedtls4-src
cd /tmp/mbedtls4-src
git checkout mbedtls-4.1.0
git submodule update --init --recursive
# PIC is required to link the static libtfpsacrypto into libsrtp2's
# shared library; without it the final shared link fails with
# "relocation R_X86_64_PC32 ... can not be used when making a shared
# object; recompile with -fPIC".
cmake -S . -B build -DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF \
-DCMAKE_POSITION_INDEPENDENT_CODE=ON
cmake --build build -j
sudo cmake --install build

- name: Setup macOS OpenSSL
if: matrix.os == 'macos-latest' && matrix.crypto == 'openssl'
run: echo "cmake-crypto-dir=-DOPENSSL_ROOT_DIR=$(brew --prefix openssl@1.1)" >> $GITHUB_ENV
Expand All @@ -74,6 +95,24 @@ jobs:
brew install mbedtls@3
echo "CMAKE_PREFIX_PATH=$(brew --prefix mbedtls@3)" >> $GITHUB_ENV

- name: Setup macOS MbedTLS 4
if: matrix.os == 'macos-latest' && matrix.crypto == 'mbedtls4'
run: |
# Install under /tmp/ (outside $GITHUB_WORKSPACE) so the install
# survives the actions/checkout@v2 step that runs later in this job
# and clears the workspace.
python3 -m pip install --break-system-packages --upgrade jsonschema jinja2
git clone https://github.com/Mbed-TLS/mbedtls.git /tmp/mbedtls4-src
cd /tmp/mbedtls4-src
git checkout mbedtls-4.1.0
git submodule update --init --recursive
cmake -S . -B build -DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF \
-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-DCMAKE_INSTALL_PREFIX=/tmp/mbedtls4-prefix
cmake --build build -j
cmake --install build
echo "CMAKE_PREFIX_PATH=/tmp/mbedtls4-prefix" >> $GITHUB_ENV

- uses: actions/checkout@v2

- name: Create Build Environment
Expand Down
37 changes: 36 additions & 1 deletion .github/workflows/meson.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
crypto: [internal, openssl, openssl3, nss, mbedtls]
crypto: [internal, openssl, openssl3, nss, mbedtls, mbedtls4]
exclude:
- os: windows-latest
crypto: openssl
Expand All @@ -24,6 +24,8 @@ jobs:
crypto: nss
- os: windows-latest
crypto: mbedtls
- os: windows-latest
crypto: mbedtls4
- os: ubuntu-latest
crypto: openssl3
include:
Expand All @@ -37,6 +39,8 @@ jobs:
meson-crypto-enable: "-Dcrypto-library=nss"
- crypto: mbedtls
meson-crypto-enable: "-Dcrypto-library=mbedtls"
- crypto: mbedtls4
meson-crypto-enable: "-Dcrypto-library=mbedtls"

runs-on: ${{ matrix.os }}

Expand Down Expand Up @@ -71,6 +75,20 @@ jobs:
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'mbedtls'
run: sudo apt-get install libmbedtls-dev

- name: Setup Ubuntu MbedTLS 4
if: matrix.os == 'ubuntu-latest' && matrix.crypto == 'mbedtls4'
run: |
python3 -m pip install --break-system-packages --upgrade jsonschema jinja2
git clone https://github.com/Mbed-TLS/mbedtls.git /tmp/mbedtls4-src
cd /tmp/mbedtls4-src
git checkout mbedtls-4.1.0
git submodule update --init --recursive
# PIC: static libtfpsacrypto must be linkable into libsrtp2.so.
cmake -S . -B build -DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF \
-DCMAKE_POSITION_INDEPENDENT_CODE=ON
cmake --build build -j
sudo cmake --install build

- name: Setup macOS OpenSSL
if: matrix.os == 'macos-latest' && matrix.crypto == 'openssl'
run: echo "PKG_CONFIG_PATH=$(brew --prefix openssl@1.1)/lib/pkgconfig" >> $GITHUB_ENV
Expand All @@ -91,6 +109,23 @@ jobs:
brew install mbedtls@3
echo "PKG_CONFIG_PATH=$(brew --prefix mbedtls@3)/lib/pkgconfig" >> $GITHUB_ENV

- name: Setup macOS MbedTLS 4
if: matrix.os == 'macos-latest' && matrix.crypto == 'mbedtls4'
run: |
# Install outside $GITHUB_WORKSPACE so the install survives the
# actions/checkout@v2 step that wipes the workspace later in the job.
python3 -m pip install --break-system-packages --upgrade jsonschema jinja2
git clone https://github.com/Mbed-TLS/mbedtls.git /tmp/mbedtls4-src
cd /tmp/mbedtls4-src
git checkout mbedtls-4.1.0
git submodule update --init --recursive
cmake -S . -B build -DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF \
-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-DCMAKE_INSTALL_PREFIX=/tmp/mbedtls4-prefix
cmake --build build -j
cmake --install build
echo "PKG_CONFIG_PATH=/tmp/mbedtls4-prefix/lib/pkgconfig" >> $GITHUB_ENV

- uses: actions/checkout@v2

- name: Create Build Environment
Expand Down
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,6 +303,12 @@ Option | Description
By default there is no log output, logging can be enabled to be output to stdout
or a given file using the configure options.

> **mbedTLS 4 / PSA note:** When built against mbedTLS 4.x, the mbedTLS backend
> uses the PSA Crypto API, which keeps keys in a process-wide (shared) key
> store. If your application drives libSRTP from multiple threads (e.g. separate
> RX/TX streams), build mbedTLS with `MBEDTLS_THREADING_C` enabled so PSA's key
> store is accessed safely. mbedTLS 3.x (the default) is unaffected.

This package has been tested on the following platforms: Mac OS X
(powerpc-apple-darwin1.4), Cygwin (i686-pc-cygwin), Solaris
(sparc-sun-solaris2.6), RedHat Linux 7.1 and 9 (i686-pc-linux), and
Expand Down
11 changes: 10 additions & 1 deletion cmake/FindMbedTLS.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,22 @@ find_library(MBEDTLS_LIBRARY mbedtls)
find_library(MBEDX509_LIBRARY mbedx509)
find_library(MBEDCRYPTO_LIBRARY mbedcrypto)

# mbedTLS 4.x splits the PSA Crypto implementation into its own library
# (libtfpsacrypto). libmbedcrypto remains as a thin wrapper but the actual
# psa_* symbols live in tfpsacrypto, so we must link it when present. Older
# 3.x installs do not ship this library; the find is best-effort.
find_library(MBEDTFPSACRYPTO_LIBRARY tfpsacrypto)

set(MBEDTLS_LIBRARIES "${MBEDTLS_LIBRARY}" "${MBEDX509_LIBRARY}" "${MBEDCRYPTO_LIBRARY}")
if(MBEDTFPSACRYPTO_LIBRARY)
list(APPEND MBEDTLS_LIBRARIES "${MBEDTFPSACRYPTO_LIBRARY}")
endif()

include(FindPackageHandleStandardArgs)
find_package_handle_standard_args(MbedTLS DEFAULT_MSG
MBEDTLS_LIBRARY MBEDTLS_INCLUDE_DIRS MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)

mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY MBEDTFPSACRYPTO_LIBRARY)

if(NOT TARGET MbedTLS)
message("in mbedtls ${MBEDTLS_LIBRARY}")
Expand Down
Loading
Loading