mbed-tls November 2025

mbed-tls@lists.trustedfirmware.org

6 participants
6 discussions

Question about using hardware-backed parameters in ALT crypto implementations

by Massimiliano Cialdi

Hi, I’m working with Mbed TLS 2.28.x on a microcontroller that provides a built-in crypto engine. The existing *_ALT support works fine for performance, and higher-level modules correctly route their block operations through the accelerated backend. On this platform the crypto hardware can also use internal key material stored in dedicated slots. These values are not accessible as byte arrays and cannot be passed to the usual setkey_*() API. Question Is there a recommended way to configure an ALT implementation so that it can select an internal key slot instead of receiving a buffer? Or, more generally, how should an ALT backend represent a key that is not exposed to software? Any guidance on the intended design would be appreciated. Thanks! Massimiliano Cialdi FIRMWARE ENGINEERING PROFESSIONAL LEADER Powersoft S.p.A. Via E. Conti, 5 - Scandicci (Fi) 50018 - Italy OFFICE: +39 055 7350230 [cid:2_3b23bc2c-3db3-4330-b6f5-3fb62b89422a.png]<https://www.facebook.com/powersoft/>[cid:3_7da2eb67-7c7f-41e6-9598-128bdd52ec04.png]<https://www.instagram.com/powersoft.official/>[cid:4_a5d469e7-3228-4fb1-948d-4c3e879ea0da.png]<https://www.youtube.com/@powersoftaudio>[cid:5_e4390674-51fd-4219-9389-28ae9a12796d.png]<https://www.linkedin.com/company/powersoft>[cid:6_083a55f9-076c-4d52-9f93-69225b28cb32.png]<https://open.spotify.com/show/6lwXROYcCyrVnJi6J9fA42>[cid:7_7fd8585e-63fd-441a-95f3-6c0b23d059e1.png]<https://x.com/Powersoft_Japan>[cid:8_6308aaa9-b97d-405b-a86c-0300a381d13f.png]<https://space.bilibili.com/3546387314641333>[cid:9_9af1e42f-0019-42c4-8046-d6246e65ed9e.png]<https://teams.microsoft.com/l/chat/0/0?users=massimiliano.cialdi@powersoft.…> [cid:pwsrgbn_12214209-f50f-45fa-be18-2a4cf1a5818a.png]<https://www.powersoft.com/en>

3 days, 10 hours

Re: How can I read plain-text private key into rsa_context?

by Shannek Pierce

05 DC AD 24 F4 E4 B1 C4 39 15 62 45 02 DC 7B 4A C6 57 8F FC 40 5B 5E 6F 55 FB E1 F6 58 62 CB 57 05 Sent from my iPhone

1 week

AI Policy - Guidance on AI-assisted contributions

by Shaun Longhorn

All, Please be aware that today we have published our AI policy with Guidance on AI-assisted contributions. See the full details here: https://www.trustedfirmware.org/aipolicy/ Should you have any questions feel free to raise them. Thanks, Shaun Community Manager

1 week, 1 day

Re: [Hafnium] Re: Gerrit scheduled maintenance: 8th November 8-12 UTC

by Saheer Babu

Hi Jerome Could you try again please? Thanks, Saheer From: Jerome Forissier <jerome.forissier(a)linaro.org> Date: Monday, 10 November 2025 at 10:19 To: Saheer Babu <Saheer.Babu(a)arm.com>, tf-m(a)lists.trustedfirmware.org <tf-m(a)lists.trustedfirmware.org>, tf-rmm(a)lists.trustedfirmware.org <tf-rmm(a)lists.trustedfirmware.org>, hafnium(a)lists.trustedfirmware.org <hafnium(a)lists.trustedfirmware.org>, mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org>, olivier.deprez--- via Tf-openci <tf-openci(a)lists.trustedfirmware.org> Subject: Re: [Hafnium] Re: Gerrit scheduled maintenance: 8th November 8-12 UTC Hi Saheer, On 11/9/25 00:19, Saheer Babu via Hafnium wrote: > Hi > > Just wanted to let you all know that maintenance was done in the morning and site is back to normal. I'm getting a 403 from here: $ curl --show-headers https://review.trustedfirmware.org/ HTTP/2 403 server: awselb/2.0 date: Mon, 10 Nov 2025 10:14:55 GMT content-type: text/html content-length: 118 <html> <head><title>403 Forbidden</title></head> <body> <center><h1>403 Forbidden</h1></center> </body> </html> Same for git.trustedfirmware.org which makes the OP-TEE CI fail: https://github.com/OP-TEE/optee_os/actions/runs/19226835413/job/54955917815… Regards, -- Jerome > > Thanks, > Saheer > > From: Saheer Babu <Saheer.Babu(a)arm.com> > Date: Thursday, 30 October 2025 at 16:13 > To: tf-m(a)lists.trustedfirmware.org <tf-m(a)lists.trustedfirmware.org>, tf-rmm(a)lists.trustedfirmware.org <tf-rmm(a)lists.trustedfirmware.org>, hafnium(a)lists.trustedfirmware.org <hafnium(a)lists.trustedfirmware.org>, mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org>, olivier.deprez--- via Tf-openci <tf-openci(a)lists.trustedfirmware.org> > Subject: Gerrit scheduled maintenance: 8th November 8-12 UTC > Hi All, > > We will be performing maintenance activity on review.trustedfirmware.org and service will be unavailable on 8th November between 8 AM-11 AM UTC. > > Best regards, > > Saheer >

1 week, 5 days

FW: CI infrastructure scheduled maintenance: 12th Sep 2025

by Joanna Farley

FYI From: Saheer Babu via Tf-openci <tf-openci(a)lists.trustedfirmware.org> Date: Wednesday, 10 September 2025 at 15:17 To: tf-openci(a)lists.trustedfirmware.org <tf-openci(a)lists.trustedfirmware.org> Subject: [Tf-openci] CI infrastructure scheduled maintenance: 12th Sep 2025 Hi all, We will be performing upgrade of the clusters hosting review.trustedfirmware.org and ci.trustedfirmware.org on Friday, 12th Sep 2025 at 16:00 GMT+1. During this maintenance window, both services will be unavailable for approximately 4 hours. A follow-up email will be sent once the services are fully restored. Best regards, Saheer IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. -- Tf-openci mailing list -- tf-openci(a)lists.trustedfirmware.org To unsubscribe send an email to tf-openci-leave(a)lists.trustedfirmware.org

2 weeks

Security backports for v2.28

by Matt Bauman

Hello all, I know that v2.28.10 is EOL, but I've been working on bringing security bug fixes to our distribution of it as part of my work in shoring up the Julia package ecosystem. I've largely leaned on the Debian security team's work thus far; they have the much harder task of supporting 2.16.9 for bullseye (security) and have done great work in bringing that version up to date through CVE-2025-52497. I've re-landed their backport patches against v2.28.10; these can be found on our build tree [1] or my fork [2]: 1. https://github.com/JuliaPackaging/Yggdrasil/tree/54c5a3e8e72899a3a778d8617f… 2. https://github.com/Mbed-TLS/mbedtls/compare/v2.28.10...mbauman:mbedtls:v2.2… Now I'm faced with the daunting prospect of last week's CVE-2025-54764 and CVE-2025-59438. These are *much* larger changesets. Has anyone else begun tackling this? I very much appreciated the guidance that’s included in the advisory itself, but I'm guessing there may be others in our situation... and I came here looking to see if anyone had begun talking about this (or working on it) yet. Best, Matt

2 weeks, 2 days

2025

2024

2023

2022

2021

2020

mbed-tls November 2025