MbedTLS3 and CAAM driver for Non-PSA operations

[jslota13245]

Dear Everyone,

We followed the deprecation note about the mbedTLS 2 and we did an update to mbedTLS3. We found out that NXP has two repositories of mbedTLS.

(ver 2.x deprecated)
https://github.com/nxp-mcuxpresso/mbedtls

(ver 3.x)
https://github.com/NXP/nxp_mbedtls

We found it by reading through the yaml file which sdk uses - we're wondering if we'll lose performance if we choose ver 3x and won't use PSA API?

Version 2 provided a set of alternate functions through port/ksdk which could be used to delegate cryptographic operations to CAAM driver like ksdk_mbedtls:

https://github.com/nxp-mcuxpresso/mbedtls/blob/release/25.06.00/port/ksdk/ksdk_mbedtls.c

We use raw CAAM driver through fsl_caam for aes256 encryption and we would like to use mbedtls to generate a pair of ecdsa keys. Our goal is to have mbedTLS3 and delegate all possible jobs to CAAM hardware - if anyone knows an application note/port done or a guideline on how to design such it would be great.

Thank you for any support

[jslota13245]

Also minor info, we're using imxrt1176 and have a FreeRTOS on it, do we read the port right that the mbedtls_ksdk.c:
672 - 674

https://github.com/nxp-mcuxpresso/mbedtls/blob/release/25.06.00/port/ksdk/ksdk_mbedtls.c


#endif /* MBEDTLS_THREADING_C */
if (ctx->mode == MBEDTLS_DES_ENCRYPT) {
status = CAAM_DES_EncryptEcb(CAAM_INSTANCE, &s_caamHandle, input, output, 8, key);

Does this port use blocking operations? So that the other FreeRTOS Threads are blocked - we found this port to be used in freertos examples of mbedtls so it was a surprise for us

[Sam_Gao]

Hi,

It seems there are mbedtls and mebedtls 3.x in the SDK as following, and CAAM(Cryptographic Acceleration and Assurance Module) example as well. 

https://mcuxpresso.nxp.com/mcuxsdk/latest/html/examples/driver_examples/caam/readme.html 

https://mcuxpresso.nxp.com/mcuxsdk/latest/html/examples/mbedtls3x_examples/index.html 

https://mcuxpresso.nxp.com/mcuxsdk/latest/html/examples/mbedtls_examples/index.html 

Yes, it is a blocking operation.