Unable to change MBEDTLS_CFG_FILE in NCS 3.2

[timonsku]

With NCS 3.2.1 I can't make use of custom mbed TLS config headers anymore, the MBEDTLS_CFG_FILE KConfig option always get overwritten. Previously setting CONFIG_CUSTOM_MBEDTLS_CFG_FILE=y would allow for overriding the config header. The documentation seems to have been removed from the Nordic docs but I can't find any mentions of this in the migration guides or elsewhere.

warning: MBEDTLS_CFG_FILE (defined at (...)nrf/modules/..\subsys\nrf_security/Kconfig:72, (...)/zephyr/modules/mbedtls/Kconfig:59, modules\mbedtls\Kconfig:59) was assigned the value
'nrf-config-user.h' but got the value 'nrf-config.h'.

This is also an issue in the Zephyr "psa_crypto" sample which seems to not build at all for a while now. Is mbed TLS completely deprecated in NCS? It seems to still exist in the Zephyr tree so unsure what the recommendation here is going forward. Should all mbedtls functions be seen as deprecated? If so is there a migration guide, this page: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/libraries/security/nrf_security/doc/backend_config.html#legacy-crypto-support mentions "equivalent functionality from PSA Crypto APIs" but the link does not make any mentions of how to migrate old mbedtls code over to newer APIs.

[Einar Thorsrud]

Hi,

As you note, legacy mbed TLS crypto API's have been deprecated for a while, and will soon be removed. I would strongly advice that you migrate to PSA crypto APIs. Regarding samples you should refer to the crypto samples under nrf. I do not believe we have a specific migration guide for migrating from legacy APIs to PSA crypto APIs, but I suggest referring to the samples to see how PSA crypto is used.

[timonsku]

Just to be clear, when you say legacy mbed TLS crypto APIs that means the entirety of mbed TLS is deprecated?
It is not quite clear from the docs if that just means certain parts of it or all of it. mbed TLS is still around in the SDK and there are not deprecation warnings when you make use of mbed TLS functions so its a bit confusing whether its just unsupported now or going to be fully deprecated.

[timonsku]

Especially as mbed TLS seems to still be very much needed. The PSA APIs would not cover X.509 or TLS related functionality. From the mbed TLS project: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/4.0-migration-guide.md
"Mbed TLS has been split between two products: TF-PSA-Crypto for cryptography, and Mbed TLS for X.509 and (D)TLS."
Which means needing to configure mbed TLS is still necessary but right now I get circular dependencies with anything related to setting a custom header file for mbed TLS.

[Einar Thorsrud]

Hi,

I am sorry for being confusing. It is not that mbed TLS is being removed, but the legacy mbedTLS crypto APIs will be removed. This is removed from mbedTLS itself in mbed TLS 4.0, so as a consequence, support will be removed when we integrate mbed TLS 4.0.

[timonsku]

Thanks for clarifying, thats what I figured after reading further into the upstream Zephyr plans on this and what happened in mbed TLS itself. It wasn't quite clear that only portions of mbed TLS has changed upstream and that this reflects those changes by the upstream project.
When I read "crypto APIs" in my head that extended to just refer to "mbed TLS" as in the past it was just "the crypto library" in projects.
I was able to resolve not being able to set the custom header. There was another config (CONFIG_MBEDTLS_BUILTIN) set to =y elsewhere that was a dependency of =n in order to be able to set a custom config