Summary: CONFIG_MBEDTLS is force-enabled and won't compile without PSA_CRYPTO, costing ~31 KB of secure RAM for unused functionality
I've just migrated my project from v.3.3.1 to v3.4.0
Since our application uses modem-offloaded TLS exclusively, we want to build with TF-M providing only the Platform partition (CONFIG_TFM_PARTITION_CRYPTO=n, ITS/PS/Attestation also off) to minimize secure RAM/flash. In NCS 3.4.0 this appears impossible: CONFIG_MBEDTLS is force-enabled and then fails to compile unless CONFIG_PSA_CRYPTO=y, which in turn unavoidably re-selects CONFIG_TFM_PARTITION_CRYPTO. The net cost we measured is ~31 KB(!!!!) of additional secure SRAM (TF-M RAM goes from 6,132 B with Crypto off to 37,180 B with Crypto+Platform on) for a service our application never calls.
An explicit # CONFIG_MBEDTLS is not set in our conf fragment is silently ignored: because MBEDTLS's prompt is conditional (bool "..." if !MBEDTLS_PROMPTLESS), the user assignment doesn't take effect against the imply. We only get the warning MBEDTLS was assigned the value 'n' but got the value 'y' and the build proceeds with CONFIG_MBEDTLS=y. (Disabling PSA_CRYPTO the same way does work, since its prompt is unconditional.)
With MBEDTLS=y and PSA_CRYPTO=n, compilation fails.
Is there a supported way to build BUILD_WITH_TFM=y with the Zephyr NS app while keeping CONFIG_MBEDTLS=n (or at least TFM_PARTITION_CRYPTO=n) when all TLS is modem-offloaded?
If not currently supported, can the imply MBEDTLS if !TFM_USE_NS_APP be relaxed (e.g., made overridable, or gated on something like NET_SOCKETS_OFFLOAD/an opt-out symbol) in a future release?