diff --git a/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst b/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst index 56922670a7c..e659ec07e80 100644 --- a/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst +++ b/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst @@ -128,6 +128,18 @@ Security :kconfig:option:`CONFIG_NRF_SECURITY` is now promptless and auto-enabled indirectly by :kconfig:option:`CONFIG_PSA_CRYPTO`. * Approach to store keys in the KMU so that AEAD algorithms with non-default (shortened) tag lengths are supported. +* Fixed: + + * Issues with incorrect support status on the :ref:`ug_crypto_supported_features` page: + + * The :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` Kconfig option is now correctly listed as unsupported for SoCs with Arm CryptoCell CC310. + * The tables for supported AES key wrapping algorithms for nRF54L Series devices now list the nRF54LS05 device (not supported in the CRACEN driver; experimental in the nrf_oberon driver). + * The post-quantum cryptography algorithms for nrf_oberon under Key types and key management are now correctly listed as experimental instead of supported. + * The SPAKE2+ for Matter is now correctly listed as supported instead of experimental. + * The WPA3-SAE hash-to-element algorithm is now correctly listed as a KDF algorithm, not a PAKE algorithm. + * The SHA-256/192 and SHAKE hashing algorithms are now correctly listed as not supported in the CRACEN driver and Experimental in the nrf_oberon driver. + The only exception is the SHAKE256 512 bits algorithm, which is supported in the both the CRACEN and nrf_oberon drivers. + * Removed: * The following Kconfig options: diff --git a/doc/nrf/security/crypto/crypto_supported_features.rst b/doc/nrf/security/crypto/crypto_supported_features.rst index 52a4296b9cf..1d42660d95e 100644 --- a/doc/nrf/security/crypto/crypto_supported_features.rst +++ b/doc/nrf/security/crypto/crypto_supported_features.rst @@ -264,104 +264,104 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - HSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_HSS_PUBLIC_KEY` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - LMS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_LMS_PUBLIC_KEY` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - XMSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_PUBLIC_KEY` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - XMSS-MT Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_MT_PUBLIC_KEY` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA-44 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_44` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA-65 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_65` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA-87 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_87` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_IMPORT` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_EXPORT` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_GENERATE` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_DERIVE` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-DSA Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_PUBLIC_KEY` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM-512 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_512` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM-768 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_768` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM-1024 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_1024` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_EXPORT` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_GENERATE` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_DERIVE` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ML-KEM Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_PUBLIC_KEY` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - ASCON - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ASCON` - Experimental @@ -539,64 +539,64 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - HSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_HSS_PUBLIC_KEY` - - Supported + - Experimental * - LMS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_LMS_PUBLIC_KEY` - - Supported + - Experimental * - XMSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_PUBLIC_KEY` - - Supported + - Experimental * - XMSS-MT Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_MT_PUBLIC_KEY` - - Supported + - Experimental * - ML-DSA-44 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_44` - - Supported + - Experimental * - ML-DSA-65 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_65` - - Supported + - Experimental * - ML-DSA-87 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_87` - - Supported + - Experimental * - ML-DSA Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_IMPORT` - - Supported + - Experimental * - ML-DSA Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_EXPORT` - - Supported + - Experimental * - ML-DSA Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_GENERATE` - - Supported + - Experimental * - ML-DSA Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_DERIVE` - - Supported + - Experimental * - ML-DSA Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_PUBLIC_KEY` - - Supported + - Experimental * - ML-KEM-512 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_512` - - Supported + - Experimental * - ML-KEM-768 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_768` - - Supported + - Experimental * - ML-KEM-1024 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_1024` - - Supported + - Experimental * - ML-KEM Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT` - - Supported + - Experimental * - ML-KEM Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_EXPORT` - - Supported + - Experimental * - ML-KEM Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_GENERATE` - - Supported + - Experimental * - ML-KEM Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_DERIVE` - - Supported + - Experimental * - ML-KEM Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_PUBLIC_KEY` - - Supported + - Experimental * - ASCON - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ASCON` - Experimental @@ -1211,184 +1211,184 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - HSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_HSS_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - LMS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_LMS_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - XMSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - XMSS-MT Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_MT_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA-44 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_44` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA-65 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_65` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA-87 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_87` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_IMPORT` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_EXPORT` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_GENERATE` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_DERIVE` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM-512 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_512` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM-768 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_768` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM-1024 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_1024` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - * - ML-KEM Key Pair Import - - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + * - ML-KEM Key Pair Import + - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT` + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_EXPORT` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_GENERATE` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_DERIVE` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - WPA3-SAE PT key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_WPA3_SAE` - Experimental @@ -1729,124 +1729,124 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - HSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_HSS_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - LMS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_LMS_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - XMSS Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - XMSS-MT Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_XMSS_MT_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA-44 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_44` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA-65 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_65` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA-87 - :kconfig:option:`CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_87` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_IMPORT` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_EXPORT` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_GENERATE` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_DERIVE` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-DSA Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM-512 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_512` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM-768 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_768` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM-1024 - :kconfig:option:`CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_1024` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Import - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Export - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_EXPORT` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Generate - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_GENERATE` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Key Pair Derive - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_DERIVE` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ML-KEM Public Key - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_PUBLIC_KEY` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - ASCON - :kconfig:option:`CONFIG_PSA_WANT_KEY_TYPE_ASCON` - Experimental @@ -2161,7 +2161,7 @@ The options are grouped by Series and drivers available for the device Series, a .. note:: Key size configuration is supported as described in `AES key size configuration`_, for all algorithms except the stream cipher. - The :ref:`nrf_security_drivers_cc3xx` is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310 (nrf_cc310). + The :ref:`nrf_security_drivers_cc3xx` is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310. .. tabs:: @@ -3346,6 +3346,11 @@ The options are grouped by Series and drivers available for the device Series, a - Supported - Supported - Supported + * - WPA3-SAE hash-to-element + - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` + - -- + - -- + - -- .. tab:: nRF53 Series @@ -3392,6 +3397,9 @@ The options are grouped by Series and drivers available for the device Series, a * - SP 800-108 HMAC counter mode - :kconfig:option:`CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_HMAC` - Supported + * - WPA3-SAE hash-to-element + - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` + - -- .. tab:: nRF54H Series @@ -3443,7 +3451,9 @@ The options are grouped by Series and drivers available for the device Series, a * - SP 800-108 HMAC counter mode - ``PSA_WANT_ALG_SP800_108_COUNTER_HMAC`` - -- - + * - WPA3-SAE hash-to-element + - ``PSA_WANT_ALG_WPA3_SAE_H2E`` + - -- .. tab:: nRF54L Series @@ -3546,14 +3556,23 @@ The options are grouped by Series and drivers available for the device Series, a - Supported - Supported - Experimental - - -- - * - SP 800-108 HMAC counter mode - - :kconfig:option:`CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_HMAC` - - Supported - - Supported - - Supported - - Supported - - Supported + - -- + * - SP 800-108 HMAC counter mode + - :kconfig:option:`CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_HMAC` + - Supported + - Supported + - Supported + - Supported + - Supported + - Experimental + - -- + * - WPA3-SAE hash-to-element + - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental - Experimental - -- @@ -3662,6 +3681,15 @@ The options are grouped by Series and drivers available for the device Series, a - Supported - Supported - Supported + * - WPA3-SAE hash-to-element + - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental .. tab:: nRF91 Series @@ -3741,6 +3769,12 @@ The options are grouped by Series and drivers available for the device Series, a - Supported - Supported - Supported + * - WPA3-SAE hash-to-element + - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` + - -- + - -- + - -- + - -- Key derivation function driver ------------------------------ @@ -3955,6 +3989,7 @@ The options are grouped by Series and drivers available for the device Series, a - nRF54LM20A - nRF54LM20B - nRF54LV10A + - nRF54LS05 * - AES Key wrap (AES-KW) - :kconfig:option:`CONFIG_PSA_WANT_ALG_AES_KW` - Experimental @@ -3963,6 +3998,7 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental (with exceptions, see note) - Experimental (with exceptions, see note) - Experimental (with exceptions, see note) + - -- * - AES Key wrap with Padding (AES-KWP) - :kconfig:option:`CONFIG_PSA_WANT_ALG_AES_KWP` - Experimental @@ -3971,6 +4007,7 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental (with exceptions, see note) - Experimental (with exceptions, see note) - Experimental (with exceptions, see note) + - -- .. note:: @@ -3993,6 +4030,7 @@ The options are grouped by Series and drivers available for the device Series, a - nRF54LM20A - nRF54LM20B - nRF54LV10A + - nRF54LS05 * - AES Key wrap (AES-KW) - :kconfig:option:`CONFIG_PSA_WANT_ALG_AES_KW` - Experimental @@ -4001,6 +4039,7 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental - Experimental - Experimental + - Experimental * - AES Key wrap with Padding (AES-KWP) - :kconfig:option:`CONFIG_PSA_WANT_ALG_AES_KWP` - Experimental @@ -4009,6 +4048,7 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental - Experimental - Experimental + - Experimental .. tab:: nRF91 Series @@ -4485,7 +4525,7 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - GCM - :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` - - Supported + - -- * - ChaCha20-Poly1305 - :kconfig:option:`CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305` - Supported @@ -4495,7 +4535,7 @@ The options are grouped by Series and drivers available for the device Series, a .. note:: - :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310; there is no hardware support for GCM on CC310. + :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310. .. tab:: nrf_oberon @@ -4621,7 +4661,8 @@ The options are grouped by Series and drivers available for the device Series, a - -- .. note:: - CRACEN only supports a 96-bit IV for AES GCM. + + CRACEN only supports a 96-bit IV for AES GCM. .. tab:: nRF54L Series @@ -4776,10 +4817,10 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - GCM - :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` - - Supported - - Supported - - Supported - - Supported + - -- + - -- + - -- + - -- * - ChaCha20-Poly1305 - :kconfig:option:`CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305` - Supported @@ -4793,6 +4834,10 @@ The options are grouped by Series and drivers available for the device Series, a - -- - -- + .. note:: + + :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310. + .. tab:: nrf_oberon .. list-table:: AEAD algorithm support (nrf_oberon driver) - nRF91 Series @@ -4859,8 +4904,7 @@ Based on this setting, Oberon PSA Crypto selects the most appropriate driver for * - Kconfig option - Supported AEAD algorithms * - :kconfig:option:`CONFIG_PSA_USE_CC3XX_AEAD_DRIVER` - - | :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` - | :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310, no hardware support for GCM on CC310) + - | :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310) | :kconfig:option:`CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305` .. tab:: nrf_oberon @@ -4893,7 +4937,7 @@ Based on this setting, Oberon PSA Crypto selects the most appropriate driver for - Supported AEAD algorithms * - :kconfig:option:`CONFIG_PSA_USE_CC3XX_AEAD_DRIVER` - | :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` - | :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310, no hardware support for GCM on CC310) + | :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` | :kconfig:option:`CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305` .. tab:: nrf_oberon @@ -4958,8 +5002,7 @@ Based on this setting, Oberon PSA Crypto selects the most appropriate driver for * - Kconfig option - Supported AEAD algorithms * - :kconfig:option:`CONFIG_PSA_USE_CC3XX_AEAD_DRIVER` - - | :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` - | :kconfig:option:`CONFIG_PSA_WANT_ALG_GCM` (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310, no hardware support for GCM on CC310) + - | :kconfig:option:`CONFIG_PSA_WANT_ALG_CCM` (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310) | :kconfig:option:`CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305` .. tab:: nrf_oberon @@ -8075,9 +8118,9 @@ The options are grouped by Series and drivers available for the device Series, a - -- * - SHA-256/192 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHA_256_192` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - SHAKE128 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE128_256` - Experimental @@ -8085,14 +8128,14 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental * - SHAKE256 192 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_192` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - SHAKE256 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_256` - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental * - SHAKE256 512 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_512` - Supported @@ -8200,16 +8243,16 @@ The options are grouped by Series and drivers available for the device Series, a - -- * - SHA-256/192 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHA_256_192` - - Supported + - Experimental * - SHAKE128 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE128_256` - Experimental * - SHAKE256 192 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_192` - - Supported + - Experimental * - SHAKE256 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_256` - - Supported + - Experimental * - SHAKE256 512 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_512` - Supported @@ -8384,48 +8427,48 @@ The options are grouped by Series and drivers available for the device Series, a - -- * - SHA-256/192 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHA_256_192` - - Supported - - Supported - - Supported - - Supported - - Supported - - Experimental + - -- + - -- + - -- + - -- + - -- + - -- - -- * - SHAKE128 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE128_256` - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental + - -- + - -- + - -- + - -- + - -- + - -- - -- * - SHAKE256 192 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_192` - - Supported - - Supported - - Supported - - Experimental - - Experimental - - Experimental + - -- + - -- + - -- + - -- + - -- + - -- - -- * - SHAKE256 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_256` - - Supported - - Supported - - Supported - - Experimental - - Experimental - - Experimental + - -- + - -- + - -- + - -- + - -- + - -- - -- * - SHAKE256 512 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_512` - Supported - Supported - Supported - - Experimental - - Experimental - - Experimental + - Supported + - Supported + - Supported - -- .. tab:: nrf_oberon @@ -8526,13 +8569,13 @@ The options are grouped by Series and drivers available for the device Series, a - -- * - SHA-256/192 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHA_256_192` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - SHAKE128 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE128_256` - Experimental @@ -8544,22 +8587,22 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental * - SHAKE256 192 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_192` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - SHAKE256 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_256` - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental + - Experimental * - SHAKE256 512 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_512` - Supported @@ -8750,10 +8793,10 @@ The options are grouped by Series and drivers available for the device Series, a - -- * - SHA-256/192 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHA_256_192` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - SHAKE128 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE128_256` - Experimental @@ -8762,16 +8805,16 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental * - SHAKE256 192 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_192` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - SHAKE256 256 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_256` - - Supported - - Supported - - Supported - - Supported + - Experimental + - Experimental + - Experimental + - Experimental * - SHAKE256 512 bits - :kconfig:option:`CONFIG_PSA_WANT_ALG_SHAKE256_512` - Supported @@ -9269,9 +9312,9 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - SPAKE2+ for Matter - :kconfig:option:`CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER` - - Experimental - - Experimental - - Experimental + - Supported + - Supported + - Supported * - SRP-6 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SRP_6` - Experimental @@ -9309,7 +9352,7 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - SPAKE2+ for Matter - :kconfig:option:`CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER` - - Experimental + - Supported * - SRP-6 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SRP_6` - Experimental @@ -9361,10 +9404,6 @@ The options are grouped by Series and drivers available for the device Series, a * - WPA3-SAE GDH - ``PSA_WANT_ALG_WPA3_SAE_GDH`` - -- - * - WPA3-SAE hash-to-element - - ``PSA_WANT_ALG_WPA3_SAE_H2E`` - - -- - .. tab:: nRF54L Series @@ -9416,12 +9455,12 @@ The options are grouped by Series and drivers available for the device Series, a - -- * - SPAKE2+ for Matter - :kconfig:option:`CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER` - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental + - Supported + - Supported + - Supported + - Supported + - Supported + - Supported - -- * - SRP-6 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SRP_6` @@ -9459,15 +9498,6 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental - Experimental - -- - * - WPA3-SAE hash-to-element - - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - -- .. tab:: nrf_oberon @@ -9513,13 +9543,13 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - SPAKE2+ for Matter - :kconfig:option:`CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER` - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental + - Supported + - Supported + - Supported + - Supported + - Supported + - Supported + - Supported * - SRP-6 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SRP_6` - Experimental @@ -9556,15 +9586,6 @@ The options are grouped by Series and drivers available for the device Series, a - Experimental - Experimental - Experimental - * - WPA3-SAE hash-to-element - - :kconfig:option:`CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E` - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental - - Experimental .. tab:: nRF91 Series @@ -9604,10 +9625,10 @@ The options are grouped by Series and drivers available for the device Series, a - Supported * - SPAKE2+ for Matter - :kconfig:option:`CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER` - - Experimental - - Experimental - - Experimental - - Experimental + - Supported + - Supported + - Supported + - Supported * - SRP-6 - :kconfig:option:`CONFIG_PSA_WANT_ALG_SRP_6` - Experimental @@ -10913,9 +10934,6 @@ Based on this setting, Oberon PSA Crypto selects the most appropriate driver for The options are grouped by Series and drivers available for the device Series, and support level for each device is listed. -.. note:: - CRACEN only supports a 96-bit IV for AES GCM. - .. tabs:: .. tab:: nRF52 Series