Architecture#
- Alternative implementations of Mbed TLS functionality
- Mbed TLS storage specification
- PSA Cryptography API implementation and PSA driver interface
- PSA key store design
- PSA migration strategy for hashes and ciphers
- Bridges between legacy and PSA crypto APIs
- Limitations relevant for G1 (performing crypto operations)
- Limitations relevant for G2 (isolation of long-term secrets)
- Goals
- Compile-time options
- Taking advantage of the existing abstractions layers - or not
- Supporting builds with drivers without the software implementation
- Migrating away from the legacy API
- Testing strategy for
MBEDTLS_USE_PSA_CRYPTO - General considerations
- Symmetric crypto
- Asymmetric crypto
- PSA API functions and shared memory
- PSA storage resilience design
- Thread-safety of the PSA subsystem
- Mbed TLS driver interface test strategy
- Mbed TLS invasive testing strategy
- Mbed TLS PSA keystore format stability testing strategy
- Mbed TLS test framework
- TLS 1.3 support