Nrf cc3xx 0.9.21 by frkv · Pull Request #28555 · nrfconnect/sdk-nrf

frkv · 2026-05-06T06:51:15Z

Update to nrf_cc3xx v0.9.21

-Includes open-source drivers for ECC/RSA key management, key agreement and asymmetric signing

NordicBuilder · 2026-05-06T06:52:04Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
nrfxlib	nrfconnect/sdk-nrfxlib@`0178b40`	nrfconnect/sdk-nrfxlib@`332808f` (`main`)	nrfconnect/sdk-nrfxlib@0178b406..332808f1

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2026-05-06T07:01:09Z

CI Information

^{To view the history of this post, click the 'edited' button above}
Build number: 27

Inputs:

Sources:

sdk-nrf: PR head: d972c73294112b1176c6a3705599f7f0de5bf5fb
nrfxlib: PR head: 332808f18c01d7a418105274e2526f0dc05e111b

more details

sdk-nrf:

PR head: d972c73294112b1176c6a3705599f7f0de5bf5fb
merge base: a8f93c914bbf2ef88c70218b6d09d37806416088
target head (main): 8799840de0ce205c495c9e3a0a8a1153ba00f94b
Diff

nrfxlib:

PR head: 332808f18c01d7a418105274e2526f0dc05e111b
merge base: 0178b40672cb53ad50dda43c7ee9520f6b04f172
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (102)

nrfxlib
│  ├── crypto
│  │  ├── CMakeLists.txt
│  │  ├── doc
│  │  │  ├── CHANGELOG_cc3xx_mbedcrypto.rst
│  │  │  │ CHANGELOG_cc3xx_platform.rst
│  │  ├── nrf_cc310_mbedcrypto
│  │  │  ├── include
│  │  │  │  ├── cc3xx_asn1_util.h
│  │  │  │  ├── cc3xx_ecdh_util.h
│  │  │  │  ├── cc3xx_psa_asymmetric_signature.h
│  │  │  │  ├── cc3xx_psa_key_generation.h
│  │  │  │  ├── cc3xx_psa_rsa_util.h
│  │  │  │  ├── mbedtls_extra
│  │  │  │  │  │ cc_rnd_common.h
│  │  │  ├── lib
│  │  │  │  ├── cortex-m33
│  │  │  │  │  ├── hard-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  │  ├── soft-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  ├── cortex-m4
│  │  │  │  │  ├── hard-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  │  ├── soft-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  ├── libnrf_cc310_core_0.9.21.a
│  │  │  │  │  │  │  │  ├── libnrf_cc310_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │  │ libnrf_cc310_psa_crypto_0.9.21.a
│  │  ├── nrf_cc310_platform
│  │  │  ├── include
│  │  │  │  ├── nrf_cc3xx_platform_ctr_drbg.h
│  │  │  │  ├── nrf_cc3xx_platform_defines.h
│  │  │  │  │ nrf_cc3xx_platform_hmac_drbg.h
│  │  │  ├── lib
│  │  │  │  ├── cortex-m33
│  │  │  │  │  ├── hard-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  │  ├── soft-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  ├── cortex-m4
│  │  │  │  │  ├── hard-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  │  ├── soft-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  │ libnrf_cc310_platform_0.9.21.a
│  │  ├── nrf_cc312_mbedcrypto
│  │  │  ├── include
│  │  │  │  ├── cc3xx_asn1_util.h
│  │  │  │  ├── cc3xx_ecdh_util.h
│  │  │  │  ├── cc3xx_psa_asymmetric_signature.h
│  │  │  │  ├── cc3xx_psa_key_generation.h
│  │  │  │  ├── cc3xx_psa_rsa_util.h
│  │  │  │  ├── mbedtls_extra
│  │  │  │  │  │ cc_rnd_common.h
│  │  │  ├── lib
│  │  │  │  ├── cortex-m33
│  │  │  │  │  ├── hard-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  ├── libnrf_cc312_core_0.9.21.a
│  │  │  │  │  │  │  ├── libnrf_cc312_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │ libnrf_cc312_psa_crypto_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  ├── libnrf_cc312_core_0.9.21.a
│  │  │  │  │  │  │  │  ├── libnrf_cc312_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │  │ libnrf_cc312_psa_crypto_0.9.21.a
│  │  │  │  │  ├── soft-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  ├── libnrf_cc312_core_0.9.21.a
│  │  │  │  │  │  │  ├── libnrf_cc312_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │ libnrf_cc312_psa_crypto_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  ├── libnrf_cc312_core_0.9.21.a
│  │  │  │  │  │  │  │  ├── libnrf_cc312_legacy_crypto_0.9.21.a
│  │  │  │  │  │  │  │  │ libnrf_cc312_psa_crypto_0.9.21.a
│  │  ├── nrf_cc312_platform
│  │  │  ├── include
│  │  │  │  ├── nrf_cc3xx_platform_ctr_drbg.h
│  │  │  │  ├── nrf_cc3xx_platform_defines.h
│  │  │  │  │ nrf_cc3xx_platform_hmac_drbg.h
│  │  │  ├── lib
│  │  │  │  ├── cortex-m33
│  │  │  │  │  ├── hard-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │ libnrf_cc312_platform_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  │ libnrf_cc312_platform_0.9.21.a
│  │  │  │  │  ├── soft-float
│  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │ libnrf_cc312_platform_0.9.21.a
│  │  │  │  │  │  ├── short-wchar
│  │  │  │  │  │  │  ├── no-interrupts
│  │  │  │  │  │  │  │  │ libnrf_cc312_platform_0.9.21.a
│  ├── nrf_wifi
│  │  ├── bin
│  │  │  ├── zephyr
│  │  │  │  ├── default
│  │  │  │  │  │ nrf70.bin
│  │  │  │  ├── offloaded_raw_tx
│  │  │  │  │  │ nrf70.bin
│  │  │  │  ├── radio_test
│  │  │  │  │  │ nrf70.bin
│  │  │  │  ├── scan_only
│  │  │  │  │  │ nrf70.bin
│  │  │  │  ├── system_with_raw
│  │  │  │  │  │ nrf70.bin
samples
│  ├── crypto
│  │  ├── ecdh
│  │  │  ├── boards
│  │  │  │  ├── nrf52840dk_nrf52840.conf
│  │  │  │  ├── nrf5340dk_nrf5340_cpuapp.conf
│  │  │  │  ├── nrf5340dk_nrf5340_cpuapp_ns.conf
│  │  │  │  ├── nrf54h20dk_nrf54h20_cpuapp.conf
│  │  │  │  ├── nrf54l15dk_nrf54l05_cpuapp.conf
│  │  │  │  ├── nrf54l15dk_nrf54l10_cpuapp.conf
│  │  │  │  ├── nrf54l15dk_nrf54l15_cpuapp.conf
│  │  │  │  ├── nrf54lm20dk_nrf54lm20a_cpuapp.conf
│  │  │  │  ├── nrf54lm20dk_nrf54lm20b_cpuapp.conf
│  │  │  │  ├── nrf54ls05dk_nrf54ls05b_cpuapp.conf
│  │  │  │  ├── nrf54lv10dk_nrf54lv10a_cpuapp.conf
│  │  │  │  ├── nrf7120dk_nrf7120_cpuapp.conf
│  │  │  │  ├── nrf9151dk_nrf9151.conf
│  │  │  │  ├── nrf9151dk_nrf9151_ns.conf
│  │  │  │  ├── nrf9160dk_nrf9160.conf
│  │  │  │  ├── nrf9160dk_nrf9160_ns.conf
│  │  │  │  ├── nrf9161dk_nrf9161.conf
│  │  │  │  │ nrf9161dk_nrf9161_ns.conf
│  │  │  │ prj.conf
subsys
│  ├── nrf_security
│  │  ├── cmake
│  │  │  │ psa_crypto_config.cmake
│  │  ├── configs
│  │  │  │ psa_crypto_config.h.template
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── nrf_cc3xx
│  │  │  │  │  ├── CMakeLists.txt
│  │  │  │  │  ├── Kconfig
│  │  │  │  │  ├── public_cc3xx_psa_asymmetric_signature.c
│  │  │  │  │  ├── public_cc3xx_psa_key_agreement.c
│  │  │  │  │  │ public_cc3xx_psa_key_management.c
tests
│  ├── crypto
│  │  │ prj.conf
west.yml

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain
◻️ Build twister
◻️ Integration tests
- ◻️ test_ble_nrf_config
- ◻️ test-fw-nrfconnect-chip
- ◻️ test-fw-nrfconnect-nrf_crypto
- ◻️ test-fw-nrfconnect-rs
- ◻️ test-fw-nrfconnect-tfm
- ◻️ test-fw-nrfconnect-thread-main
- ◻️ test-sdk-wifi
- ◻️ test-sdk-mcuboot
- ◻️ test-sdk-dfu
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud
- ⚠️ test-sdk-find-my

Disabled integration tests

- test-fw-nrfconnect-nrf_lrcs_mosh
- test-fw-nrfconnect-nrf_lrcs_positioning
- desktop52_verification
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-low-level
- test-sdk-audio
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

github-actions · 2026-05-06T08:21:29Z

You can find the documentation preview for this PR here.

tomi-font

Quickly skimmed through build system stuff, looks good, just one remark

Vge0rge

Looks good :)

-Adding configurations not enabled for full execution of legacy tests -ChaCha20 -Poly1305 -AES GCM Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

-This commit adds aggregated configurations that can be used with a new PSA crypto driver for nrf_cc3xx for ECDSA, ECDH and RSA (sign verify) and key generation. These configurations are written to nrf-psa-crypto-user-config.h during build -Adding and propagating PSA_NEED_CC3XX_ECDH_WEIERSTRASS which signal that Weierstrass curves is supported for ECDH -Adding and propagating PSA_NEED_CC3XX_ECDSA which signal that Weierstrass curve sign/verify is supported -Propagating PSA_NEED_CC3XX_RSA_SIGN which signals that RSA sign/verify using PKCS#1 v1.5 or v2.1 (PSS) is supported -Adding and propagating PSA_NEED_CC3XX_KEY_TYPE_ECC_WEIERSTRASS which signal that Weierstrass key types are supported -Propagating PSA_NEED_CC3XX_KEY_TYPE_ECC_ANY to signal that ECC key type is supported -Propagating PSA_NEED_CC3XX_KEY_TYPE_RSA_ANY to signal that RSA key type is supported -Propagating PSA_NEED_CC3XX_ECDH_MONTGOMERY_255 (existing Kconfig) Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

-This adds a source-code version of PSA crypto driver for use by nrf_cc3xx library. This driver allows optimized build by filtering according to any of these enabled features: - ECDSA using Weierstrass curves (SECP R1, K1 and Brainpool) - EdDSA (Ed25519) - RSA (PKCS#1 v1.5 and v2.1 (PSS)) Note: Provided as a single commit for easier review. Usage requires nrfxlib update and a new version of nrf_cc3xx (v0.9.21) Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

-This adds a source-code version of PSA crypto driver for use by nrf_cc3xx library. This driver allows optimized build by filtering according to any of these enabled features: - ECDH using Weierstrass curves ( - x25519 (ECC Diffie-hellman using Montgomery curves) Note: Provided as a single commit for easier review. Usage requires nrfxlib update and a new version of nrf_cc3xx (v0.9.21) Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

-This adds a source-code version of PSA crypto driver for use by nrf_cc3xx library. This driver allows optimized build by filtering according to any of these enabled features: - ECC using Weierstrass curves - ECC using Curve25519 (Montgomery or Twisted Edwards) - RSA -This driver support generate, import and export public key Note: Provided as a single commit for easier review. Usage requires nrfxlib update and a new version of nrf_cc3xx (v0.9.21) Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

The CryptoCell library (0.9.21) requires more stack than before, but it reduces the memory used by compiled objects. Increase the stack size for the library for all the CryptoCell enabled targets which don't use TF-M. For the TF-M builds the this configuration does not affect the stack inside TF-M so it is not relevant. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>

-This manifest commit updates to nrf_cc3xx v0.9.21 -In addition this commit includes usage of the three new drivers that provide asymmetric signature, key agreement and key management using ECC and RSA based on the nrf_cc3xx library. This is provided together to ensure that the change is bisectable -The drivers are added to a new internal library called cc3xx_psa_driver Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

frkv requested review from a team and magnev as code owners May 6, 2026 06:51

NordicBuilder added the manifest label May 6, 2026

NordicBuilder added manifest-nrfxlib DNM labels May 6, 2026

frkv force-pushed the nrf_cc3xx_0.9.21 branch 6 times, most recently from 187c1a5 to f5c327a Compare May 6, 2026 07:48

tomi-font reviewed May 6, 2026

View reviewed changes

Comment thread subsys/nrf_security/src/drivers/nrf_cc3xx/CMakeLists.txt Outdated

Vge0rge mentioned this pull request May 6, 2026

manifest: sdk-nrfxlib: FOR CI ONLY #28274

Closed

frkv force-pushed the nrf_cc3xx_0.9.21 branch 11 times, most recently from cd3baa5 to 31f2811 Compare May 11, 2026 09:44

frkv modified the milestone: 3.4.0 May 11, 2026

frkv force-pushed the nrf_cc3xx_0.9.21 branch 5 times, most recently from f9826f6 to de79dea Compare May 12, 2026 07:00

tomi-font reviewed May 12, 2026

View reviewed changes

Comment thread samples/crypto/ecdh/boards/nrf54l15dk_nrf54l05_cpuapp.conf

Vge0rge self-requested a review May 12, 2026 07:35

Vge0rge approved these changes May 12, 2026

View reviewed changes

frkv added the no-changelog label May 12, 2026

frkv and others added 6 commits May 12, 2026 13:02

tests: crypto: Add missing legacy configs for tests

bd4a85c

-Adding configurations not enabled for full execution of legacy tests -ChaCha20 -Poly1305 -AES GCM Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>

frkv force-pushed the nrf_cc3xx_0.9.21 branch from de79dea to 7bee6cb Compare May 12, 2026 11:11

magnev approved these changes May 12, 2026

View reviewed changes

tejlmand approved these changes May 12, 2026

View reviewed changes

endre-nordic approved these changes May 12, 2026

View reviewed changes

frkv force-pushed the nrf_cc3xx_0.9.21 branch from 7bee6cb to d972c73 Compare May 13, 2026 06:20

NordicBuilder removed the DNM label May 13, 2026

nordicjm merged commit ef55d69 into nrfconnect:main May 13, 2026
20 of 21 checks passed

Vge0rge mentioned this pull request May 14, 2026

manifest: sdk-nrfxlib: nrf_cc3xx 0.9.21 #28553

Closed

Navigation Menu

Uh oh!

Nrf cc3xx 0.9.21 - #28555

Nrf cc3xx 0.9.21#28555
nordicjm merged 7 commits into
nrfconnect:mainfrom
frkv:nrf_cc3xx_0.9.21

frkv commented May 6, 2026

Uh oh!

NordicBuilder commented May 6, 2026 •

edited

Loading

Uh oh!

NordicBuilder commented May 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

Uh oh!

tomi-font left a comment

Uh oh!

Uh oh!

Vge0rge left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Uh oh!

Conversation

frkv commented May 6, 2026

Uh oh!

NordicBuilder commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Vge0rge left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

NordicBuilder commented May 6, 2026 •

edited

Loading

NordicBuilder commented May 6, 2026 •

edited

Loading