Repository: Mbed-TLS/TF-PSA-Crypto
Pull request #285: [tf-psa-crypto] Remove MBEDTLS_USE_PSA_CRYPTO from PK module
Author: login: valeriosetti
Labels: name: priority-high
description: High priority - will be reviewed soon
name: size-xs
description: Estimated task size: extra small (a few hours at most)
name: approved
description: Design and code approved - may be waiting for CI or backports
Created: 2025-05-07T10:08:42Z | Merged: 2025-05-20T09:08:55Z

## Description

Resolves #283

## PR checklist

- [x] **changelog** not required because: internal
- [x] **development PR** not required because: crypto only
- [x] **TF-PSA-Crypto PR** provided HERE
- [x] **framework PR** not required
- [x] **3.6 PR** not required because: 1.0 only
- **tests**  not required because: removing dead code

Linked issue #283: Remove MBEDTLS_USE_PSA_CRYPTO from PK module
### Suggested enhancement

Since MBEDTLS_USE_PSA_CRYPTO will be assumed to be always enabled its usage in the PK module can be removed.

### Justification

TF-PSA-Crypto needs this because it removes dead code and simplifies code reading.


Linked issue comments: user: login: mpg
created_at: 2025-05-07T08:11:06Z
body: Note: this is a part of a larger task: https://github.com/Mbed-TLS/mbedtls/issues/9631
author_association: CONTRIBUTOR

Diff:
diff --git a/drivers/builtin/src/pk.c b/drivers/builtin/src/pk.c
index 533a234e91..c23b643338 100644
--- a/drivers/builtin/src/pk.c
+++ b/drivers/builtin/src/pk.c
@@ -42,9 +42,7 @@ void mbedtls_pk_init(mbedtls_pk_context *ctx)
 {
     ctx->pk_info = NULL;
     ctx->pk_ctx = NULL;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     ctx->priv_id = MBEDTLS_SVC_KEY_ID_INIT;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
     memset(ctx->pub_raw, 0, sizeof(ctx->pub_raw));
     ctx->pub_raw_len = 0;
@@ -148,7 +146,6 @@ int mbedtls_pk_setup(mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info)
     return 0;
 }
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 /*
  * Initialise a PSA-wrapping context
  */
@@ -185,7 +182,6 @@ int mbedtls_pk_setup_opaque(mbedtls_pk_context *ctx,
 
     return 0;
 }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 /*
  * Tell if a PK can do the operations of the given type
@@ -202,7 +198,6 @@ int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type)
     return ctx->pk_info->can_do(type);
 }
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 /*
  * Tell if a PK can do the operations of the given PSA algorithm
  */
@@ -339,7 +334,6 @@ int mbedtls_pk_can_do_ext(const mbedtls_pk_context *ctx, psa_algorithm_t alg,
 
     return 0;
 }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 #if defined(MBEDTLS_PSA_CRYPTO_CLIENT)
 #if defined(MBEDTLS_RSA_C)
@@ -476,7 +470,6 @@ int mbedtls_pk_get_psa_attributes(const mbedtls_pk_context *pk,
         }
 #endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
         case MBEDTLS_PK_OPAQUE:
         {
             psa_key_attributes_t old_attributes = PSA_KEY_ATTRIBUTES_INIT;
@@ -526,7 +519,6 @@ int mbedtls_pk_get_psa_attributes(const mbedtls_pk_context *pk,
             psa_set_key_algorithm(attributes, psa_get_key_algorithm(&old_attributes));
             break;
         }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
         default:
             return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
@@ -545,7 +537,6 @@ int mbedtls_pk_get_psa_attributes(const mbedtls_pk_context *pk,
     return 0;
 }
 
-#if defined(MBEDTLS_PK_USE_PSA_EC_DATA) || defined(MBEDTLS_USE_PSA_CRYPTO)
 static psa_status_t export_import_into_psa(mbedtls_svc_key_id_t old_key_id,
                                            const psa_key_attributes_t *attributes,
                                            mbedtls_svc_key_id_t *new_key_id)
@@ -597,7 +588,6 @@ static int copy_into_psa(mbedtls_svc_key_id_t old_key_id,
     }
     return PSA_PK_TO_MBEDTLS_ERR(status);
 }
-#endif /* MBEDTLS_PK_USE_PSA_EC_DATA || MBEDTLS_USE_PSA_CRYPTO */
 
 static int import_pair_into_psa(const mbedtls_pk_context *pk,
                                 const psa_key_attributes_t *attributes,
@@ -683,10 +673,8 @@ static int import_pair_into_psa(const mbedtls_pk_context *pk,
         }
 #endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
         case MBEDTLS_PK_OPAQUE:
             return copy_into_psa(pk->priv_id, attributes, key_id);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
         default:
             return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
@@ -698,12 +686,7 @@ static int import_public_into_psa(const mbedtls_pk_context *pk,
                                   mbedtls_svc_key_id_t *key_id)
 {
     psa_key_type_t psa_type = psa_get_key_type(attributes);
-
-#if defined(MBEDTLS_RSA_C) ||                                           \
-    (defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && !defined(MBEDTLS_PK_USE_PSA_EC_DATA)) || \
-    defined(MBEDTLS_USE_PSA_CRYPTO)
     unsigned char key_buffer[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
-#endif
     unsigned char *key_data = NULL;
     size_t key_length = 0;
 
@@ -762,7 +745,6 @@ static int import_public_into_psa(const mbedtls_pk_context *pk,
         }
 #endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
         case MBEDTLS_PK_OPAQUE:
         {
             psa_key_attributes_t old_attributes = PSA_KEY_ATTRIBUTES_INIT;
@@ -785,7 +767,6 @@ static int import_public_into_psa(const mbedtls_pk_context *pk,
             key_data = key_buffer;
             break;
         }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
         default:
             return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
@@ -1231,8 +1212,6 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type,
     }
 
 #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     const psa_algorithm_t psa_md_alg = mbedtls_md_psa_alg_from_type(md_alg);
     if (psa_md_alg == 0) {
         return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
@@ -1258,27 +1237,6 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type,
     return mbedtls_pk_psa_rsa_sign_ext(PSA_ALG_RSA_PSS(psa_md_alg),
                                        ctx->pk_ctx, hash, hash_len,
                                        sig, sig_size, sig_len);
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-
-    if (sig_size < mbedtls_pk_get_len(ctx)) {
-        return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL;
-    }
-
-    if (pk_hashlen_helper(md_alg, &hash_len) != 0) {
-        return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
-    }
-
-    mbedtls_rsa_context *const rsa_ctx = mbedtls_pk_rsa(*ctx);
-
-    const int ret = mbedtls_rsa_rsassa_pss_sign_no_mode_check(rsa_ctx, md_alg,
-                                                              (unsigned int) hash_len, hash, sig);
-    if (ret == 0) {
-        *sig_len = rsa_ctx->len;
-    }
-    return ret;
-
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
 #else
     return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
 #endif /* MBEDTLS_RSA_C && MBEDTLS_PKCS1_V21 */
diff --git a/drivers/builtin/src/pk_ecc.c b/drivers/builtin/src/pk_ecc.c
index 58a3272d30..96d7b6195d 100644
--- a/drivers/builtin/src/pk_ecc.c
+++ b/drivers/builtin/src/pk_ecc.c
@@ -94,7 +94,7 @@ int mbedtls_pk_ecc_set_pubkey_from_prv(mbedtls_pk_context *pk,
                                    &pk->pub_raw_len);
     return psa_pk_status_to_mbedtls(status);
 
-#elif defined(MBEDTLS_USE_PSA_CRYPTO) /* && !MBEDTLS_PK_USE_PSA_EC_DATA */
+#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
 
     psa_status_t status;
 
@@ -126,15 +126,7 @@ int mbedtls_pk_ecc_set_pubkey_from_prv(mbedtls_pk_context *pk,
     /* Load serialized public key into ecp_keypair structure */
     return mbedtls_ecp_point_read_binary(&eck->grp, &eck->Q, pub, pub_len);
 
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-
-    (void) prv;
-    (void) prv_len;
-
-    mbedtls_ecp_keypair *eck = (mbedtls_ecp_keypair *) pk->pk_ctx;
-    return mbedtls_ecp_mul(&eck->grp, &eck->Q, &eck->d, &eck->grp.G);
-
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
+#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
 }
 
 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
diff --git a/drivers/builtin/src/pk_internal.h b/drivers/builtin/src/pk_internal.h
index fe5e4fe50f..4816f0f9e7 100644
--- a/drivers/builtin/src/pk_internal.h
+++ b/drivers/builtin/src/pk_internal.h
@@ -88,7 +88,6 @@ static inline mbedtls_ecp_group_id mbedtls_pk_get_ec_group_id(const mbedtls_pk_c
 {
     mbedtls_ecp_group_id id;
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_OPAQUE) {
         psa_key_attributes_t opaque_attrs = PSA_KEY_ATTRIBUTES_INIT;
         psa_key_type_t opaque_key_type;
@@ -101,9 +100,7 @@ static inline mbedtls_ecp_group_id mbedtls_pk_get_ec_group_id(const mbedtls_pk_c
         curve = PSA_KEY_TYPE_ECC_GET_FAMILY(opaque_key_type);
         id = mbedtls_ecc_group_from_psa(curve, psa_get_key_bits(&opaque_attrs));
         psa_reset_key_attributes(&opaque_attrs);
-    } else
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-    {
+    } else {
 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
         id = mbedtls_ecc_group_from_psa(pk->ec_family, pk->ec_bits);
 #else /* MBEDTLS_PK_USE_PSA_EC_DATA */
@@ -175,10 +172,8 @@ int mbedtls_pk_ecc_set_pubkey(mbedtls_pk_context *pk, const unsigned char *pub,
  * as it's available at each calling site, and useful in some configs
  * (as otherwise we would have to re-serialize it from the pk context).
  *
- * There are three implementations of this function:
- * 1. MBEDTLS_PK_USE_PSA_EC_DATA,
- * 2. MBEDTLS_USE_PSA_CRYPTO but not MBEDTLS_PK_USE_PSA_EC_DATA,
- * 3. not MBEDTLS_USE_PSA_CRYPTO.
+ * There are two implementations of this function depending on
+ * MBEDTLS_PK_USE_PSA_EC_DATA being set or not.
  */
 int mbedtls_pk_ecc_set_pubkey_from_prv(mbedtls_pk_context *pk,
                                        const unsigned char *prv, size_t prv_len);
diff --git a/drivers/builtin/src/pk_wrap.c b/drivers/builtin/src/pk_wrap.c
index 461d8bc1c6..ea072b1339 100644
--- a/drivers/builtin/src/pk_wrap.c
+++ b/drivers/builtin/src/pk_wrap.c
@@ -26,7 +26,6 @@
 #include "mbedtls/ecdsa.h"
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "psa_util_internal.h"
 #include "psa/crypto.h"
 #include "mbedtls/psa_util.h"
@@ -40,7 +39,6 @@
 #include "mbedtls/asn1write.h"
 #include "mbedtls/asn1.h"
 #endif
-#endif  /* MBEDTLS_USE_PSA_CRYPTO */
 
 #include "mbedtls/platform.h"
 
@@ -61,7 +59,6 @@ static size_t rsa_get_bitlen(mbedtls_pk_context *pk)
     return mbedtls_rsa_get_bitlen(rsa);
 }
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 static int rsa_verify_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
                            const unsigned char *hash, size_t hash_len,
                            const unsigned char *sig, size_t sig_len)
@@ -126,45 +123,7 @@ static int rsa_verify_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
 
     return ret;
 }
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int rsa_verify_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
-                           const unsigned char *hash, size_t hash_len,
-                           const unsigned char *sig, size_t sig_len)
-{
-    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-    mbedtls_rsa_context *rsa = (mbedtls_rsa_context *) pk->pk_ctx;
-    size_t rsa_len = mbedtls_rsa_get_len(rsa);
-
-#if SIZE_MAX > UINT_MAX
-    if (md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len) {
-        return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
-    }
-#endif
-
-    if (sig_len < rsa_len) {
-        return MBEDTLS_ERR_RSA_VERIFY_FAILED;
-    }
-
-    if ((ret = mbedtls_rsa_pkcs1_verify(rsa, md_alg,
-                                        (unsigned int) hash_len,
-                                        hash, sig)) != 0) {
-        return ret;
-    }
-
-    /* The buffer contains a valid signature followed by extra data.
-     * We have a special error code for that so that so that callers can
-     * use mbedtls_pk_verify() to check "Does the buffer start with a
-     * valid signature?" and not just "Does the buffer contain a valid
-     * signature?". */
-    if (sig_len > rsa_len) {
-        return MBEDTLS_ERR_RSA_VERIFY_FAILED;
-    }
-
-    return 0;
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 int  mbedtls_pk_psa_rsa_sign_ext(psa_algorithm_t alg,
                                  mbedtls_rsa_context *rsa_ctx,
                                  const unsigned char *hash, size_t hash_len,
@@ -224,9 +183,7 @@ int  mbedtls_pk_psa_rsa_sign_ext(psa_algorithm_t alg,
     }
     return ret;
 }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 static int rsa_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
                          const unsigned char *hash, size_t hash_len,
                          unsigned char *sig, size_t sig_size, size_t *sig_len)
@@ -246,31 +203,7 @@ static int rsa_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
     return mbedtls_pk_psa_rsa_sign_ext(psa_alg, pk->pk_ctx, hash, hash_len,
                                        sig, sig_size, sig_len);
 }
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int rsa_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
-                         const unsigned char *hash, size_t hash_len,
-                         unsigned char *sig, size_t sig_size, size_t *sig_len)
-{
-    mbedtls_rsa_context *rsa = (mbedtls_rsa_context *) pk->pk_ctx;
 
-#if SIZE_MAX > UINT_MAX
-    if (md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len) {
-        return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
-    }
-#endif
-
-    *sig_len = mbedtls_rsa_get_len(rsa);
-    if (sig_size < *sig_len) {
-        return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL;
-    }
-
-    return mbedtls_rsa_pkcs1_sign(rsa,
-                                  md_alg, (unsigned int) hash_len,
-                                  hash, sig);
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 static int rsa_decrypt_wrap(mbedtls_pk_context *pk,
                             const unsigned char *input, size_t ilen,
                             unsigned char *output, size_t *olen, size_t osize)
@@ -332,23 +265,7 @@ static int rsa_decrypt_wrap(mbedtls_pk_context *pk,
 
     return ret;
 }
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int rsa_decrypt_wrap(mbedtls_pk_context *pk,
-                            const unsigned char *input, size_t ilen,
-                            unsigned char *output, size_t *olen, size_t osize)
-{
-    mbedtls_rsa_context *rsa = (mbedtls_rsa_context *) pk->pk_ctx;
 
-    if (ilen != mbedtls_rsa_get_len(rsa)) {
-        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
-    }
-
-    return mbedtls_rsa_pkcs1_decrypt(rsa,
-                                     olen, input, output, osize);
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 static int rsa_encrypt_wrap(mbedtls_pk_context *pk,
                             const unsigned char *input, size_t ilen,
                             unsigned char *output, size_t *olen, size_t osize)
@@ -409,22 +326,6 @@ static int rsa_encrypt_wrap(mbedtls_pk_context *pk,
 
     return ret;
 }
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int rsa_encrypt_wrap(mbedtls_pk_context *pk,
-                            const unsigned char *input, size_t ilen,
-                            unsigned char *output, size_t *olen, size_t osize)
-{
-    mbedtls_rsa_context *rsa = (mbedtls_rsa_context *) pk->pk_ctx;
-    *olen = mbedtls_rsa_get_len(rsa);
-
-    if (*olen > osize) {
-        return MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
-    }
-
-    return mbedtls_rsa_pkcs1_encrypt(rsa,
-                                     ilen, input, output);
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 static int rsa_check_pair_wrap(mbedtls_pk_context *pub, mbedtls_pk_context *prv)
 {
@@ -508,7 +409,6 @@ static size_t eckey_get_bitlen(mbedtls_pk_context *pk)
 }
 
 #if defined(PSA_HAVE_ALG_ECDSA_VERIFY)
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 /* Common helper for ECDSA verify using PSA functions. */
 static int ecdsa_verify_psa(unsigned char *key, size_t key_len,
                             psa_ecc_family_t curve, size_t curve_bits,
@@ -642,24 +542,9 @@ static int ecdsa_verify_wrap(mbedtls_pk_context *pk,
                             hash, hash_len, sig, sig_len);
 }
 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int ecdsa_verify_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
-                             const unsigned char *hash, size_t hash_len,
-                             const unsigned char *sig, size_t sig_len)
-{
-    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-    ((void) md_alg);
-
-    ret = mbedtls_ecdsa_read_signature((mbedtls_ecdsa_context *) pk->pk_ctx,
-                                       hash, hash_len, sig, sig_len);
-
-    return ret;
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 #endif /* PSA_HAVE_ALG_ECDSA_VERIFY */
 
 #if defined(PSA_HAVE_ALG_ECDSA_SIGN)
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 /* Common helper for ECDSA sign using PSA functions.
  * Instead of extracting key's properties in order to check which kind of ECDSA
  * signature it supports, we try both deterministic and non-deterministic.
@@ -768,16 +653,6 @@ static int ecdsa_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
     return ret;
 }
 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int ecdsa_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
-                           const unsigned char *hash, size_t hash_len,
-                           unsigned char *sig, size_t sig_size, size_t *sig_len)
-{
-    return mbedtls_ecdsa_write_signature((mbedtls_ecdsa_context *) pk->pk_ctx,
-                                         md_alg, hash, hash_len,
-                                         sig, sig_size, sig_len);
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 #endif /* PSA_HAVE_ALG_ECDSA_SIGN */
 
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
@@ -886,7 +761,6 @@ static int eckey_sign_rs_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
 }
 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
 static int eckey_check_pair_psa(mbedtls_pk_context *pub, mbedtls_pk_context *prv)
 {
@@ -979,15 +853,7 @@ static int eckey_check_pair_wrap(mbedtls_pk_context *pub, mbedtls_pk_context *pr
 {
     return eckey_check_pair_psa(pub, prv);
 }
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-static int eckey_check_pair_wrap(mbedtls_pk_context *pub, mbedtls_pk_context *prv)
-{
-    return mbedtls_ecp_check_pub_priv((const mbedtls_ecp_keypair *) pub->pk_ctx,
-                                      (const mbedtls_ecp_keypair *) prv->pk_ctx);
-}
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
 /* When PK_USE_PSA_EC_DATA is defined opaque and non-opaque keys end up
  * using the same function. */
@@ -1023,7 +889,6 @@ static int ecdsa_opaque_check_pair_wrap(mbedtls_pk_context *pub,
     return 0;
 }
 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
 static void *eckey_alloc_wrap(void)
@@ -1215,7 +1080,6 @@ const mbedtls_pk_info_t mbedtls_ecdsa_info = {
 #endif /* PSA_HAVE_ALG_SOME_ECDSA */
 #endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 static size_t opaque_get_bitlen(mbedtls_pk_context *pk)
 {
     size_t bits;
@@ -1381,6 +1245,4 @@ const mbedtls_pk_info_t mbedtls_rsa_opaque_info = {
     .debug_func = NULL,
 };
 
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
 #endif /* MBEDTLS_PK_C */
diff --git a/drivers/builtin/src/pk_wrap.h b/drivers/builtin/src/pk_wrap.h
index 3dc0eb2339..6d477debee 100644
--- a/drivers/builtin/src/pk_wrap.h
+++ b/drivers/builtin/src/pk_wrap.h
@@ -15,9 +15,7 @@
 
 #include "mbedtls/pk.h"
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "psa/crypto.h"
-#endif
 
 struct mbedtls_pk_info_t {
     /** Public key type */
@@ -98,7 +96,6 @@ extern const mbedtls_pk_info_t mbedtls_eckeydh_info;
 extern const mbedtls_pk_info_t mbedtls_ecdsa_info;
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 extern const mbedtls_pk_info_t mbedtls_ecdsa_opaque_info;
 extern const mbedtls_pk_info_t mbedtls_rsa_opaque_info;
 
@@ -110,6 +107,4 @@ int mbedtls_pk_psa_rsa_sign_ext(psa_algorithm_t psa_alg_md,
                                 size_t *sig_len);
 #endif /* MBEDTLS_RSA_C */
 
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
 #endif /* MBEDTLS_PK_WRAP_H */
diff --git a/drivers/builtin/src/pkparse.c b/drivers/builtin/src/pkparse.c
index a2dd226ba2..675f2a8d88 100644
--- a/drivers/builtin/src/pkparse.c
+++ b/drivers/builtin/src/pkparse.c
@@ -20,10 +20,8 @@
 
 #include <string.h>
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "mbedtls/psa_util.h"
 #include "psa/crypto.h"
-#endif
 
 /* Key types */
 #if defined(MBEDTLS_RSA_C)
diff --git a/drivers/builtin/src/pkwrite.c b/drivers/builtin/src/pkwrite.c
index e146879f59..6012901948 100644
--- a/drivers/builtin/src/pkwrite.c
+++ b/drivers/builtin/src/pkwrite.c
@@ -36,24 +36,14 @@
 #include "rsa_internal.h"
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "psa/crypto.h"
 #include "psa_util_internal.h"
-#endif
 #include "mbedtls/platform.h"
 
 /* Helpers for properly sizing buffers aimed at holding public keys or
  * key-pairs based on build symbols. */
-#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
 #define PK_MAX_EC_PUBLIC_KEY_SIZE       PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
 #define PK_MAX_EC_KEY_PAIR_SIZE         MBEDTLS_PSA_MAX_EC_KEY_PAIR_LENGTH
-#elif defined(MBEDTLS_USE_PSA_CRYPTO)
-#define PK_MAX_EC_PUBLIC_KEY_SIZE       PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
-#define PK_MAX_EC_KEY_PAIR_SIZE         MBEDTLS_PSA_MAX_EC_KEY_PAIR_LENGTH
-#else
-#define PK_MAX_EC_PUBLIC_KEY_SIZE       MBEDTLS_ECP_MAX_PT_LEN
-#define PK_MAX_EC_KEY_PAIR_SIZE         MBEDTLS_ECP_MAX_BYTES
-#endif
 
 /******************************************************************************
  * Internal functions for RSA keys.
@@ -62,7 +52,6 @@
 static int pk_write_rsa_der(unsigned char **p, unsigned char *buf,
                             const mbedtls_pk_context *pk)
 {
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_OPAQUE) {
         uint8_t tmp[PSA_EXPORT_KEY_PAIR_MAX_SIZE];
         size_t tmp_len = 0;
@@ -81,7 +70,6 @@ static int pk_write_rsa_der(unsigned char **p, unsigned char *buf,
 
         return (int) tmp_len;
     }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
     return mbedtls_rsa_write_key(mbedtls_pk_rsa(*pk), buf, p);
 }
 #endif /* MBEDTLS_RSA_C */
@@ -124,7 +112,6 @@ static int pk_write_ec_pubkey(unsigned char **p, unsigned char *start,
     mbedtls_ecp_keypair *ec = mbedtls_pk_ec(*pk);
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_OPAQUE) {
         if (psa_export_public_key(pk->priv_id, buf, sizeof(buf), &len) != PSA_SUCCESS) {
             return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
@@ -136,9 +123,7 @@ static int pk_write_ec_pubkey(unsigned char **p, unsigned char *start,
         *p -= len;
         memcpy(*p, buf, len);
         return (int) len;
-    } else
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-    {
+    } else {
         if ((ret = mbedtls_ecp_point_write_binary(&ec->grp, &ec->Q,
                                                   MBEDTLS_ECP_PF_UNCOMPRESSED,
                                                   &len, buf, sizeof(buf))) != 0) {
@@ -196,7 +181,6 @@ static int pk_write_ec_private(unsigned char **p, unsigned char *start,
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     unsigned char tmp[PK_MAX_EC_KEY_PAIR_SIZE];
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     psa_status_t status;
     if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_OPAQUE) {
         status = psa_export_key(pk->priv_id, tmp, sizeof(tmp), &byte_length);
@@ -204,9 +188,7 @@ static int pk_write_ec_private(unsigned char **p, unsigned char *start,
             ret = PSA_PK_ECDSA_TO_MBEDTLS_ERR(status);
             return ret;
         }
-    } else
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-    {
+    } else {
         mbedtls_ecp_keypair *ec = mbedtls_pk_ec_rw(*pk);
         byte_length = (ec->grp.pbits + 7) / 8;
 
@@ -356,7 +338,6 @@ static int pk_write_ec_der(unsigned char **p, unsigned char *buf,
 /******************************************************************************
  * Internal functions for Opaque keys.
  ******************************************************************************/
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 static int pk_write_opaque_pubkey(unsigned char **p, unsigned char *start,
                                   const mbedtls_pk_context *pk)
 {
@@ -378,7 +359,6 @@ static int pk_write_opaque_pubkey(unsigned char **p, unsigned char *start,
 
     return (int) len;
 }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 /******************************************************************************
  * Generic helpers
@@ -390,7 +370,6 @@ static mbedtls_pk_type_t pk_get_type_ext(const mbedtls_pk_context *pk)
 {
     mbedtls_pk_type_t pk_type = mbedtls_pk_get_type(pk);
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     if (pk_type == MBEDTLS_PK_OPAQUE) {
         psa_key_attributes_t opaque_attrs = PSA_KEY_ATTRIBUTES_INIT;
         psa_key_type_t opaque_key_type;
@@ -408,8 +387,8 @@ static mbedtls_pk_type_t pk_get_type_ext(const mbedtls_pk_context *pk)
         } else {
             return MBEDTLS_PK_NONE;
         }
-    } else
-#endif
+    }
+
     return pk_type;
 }
 
@@ -432,12 +411,11 @@ int mbedtls_pk_write_pubkey(unsigned char **p, unsigned char *start,
         MBEDTLS_ASN1_CHK_ADD(len, pk_write_ec_pubkey(p, start, key));
     } else
 #endif
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     if (mbedtls_pk_get_type(key) == MBEDTLS_PK_OPAQUE) {
         MBEDTLS_ASN1_CHK_ADD(len, pk_write_opaque_pubkey(p, start, key));
-    } else
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-    return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
+    } else {
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
+    }
 
     return (int) len;
 }
diff --git a/drivers/builtin/src/pkwrite.h b/drivers/builtin/src/pkwrite.h
index 4611643a58..ef30a35374 100644
--- a/drivers/builtin/src/pkwrite.h
+++ b/drivers/builtin/src/pkwrite.h
@@ -15,9 +15,7 @@
 
 #include "mbedtls/pk.h"
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "psa/crypto.h"
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 /*
  * Max sizes of key per types. Shown as tag + len (+ content).
@@ -70,14 +68,10 @@
 /* Find the maximum number of bytes necessary to store an EC point. When USE_PSA
  * is defined this means looking for the maximum between PSA and built-in
  * supported curves. */
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #define MBEDTLS_PK_MAX_ECC_BYTES   (PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \
                                     MBEDTLS_ECP_MAX_BYTES ? \
                                     PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) : \
                                     MBEDTLS_ECP_MAX_BYTES)
-#else /* MBEDTLS_USE_PSA_CRYPTO */
-#define MBEDTLS_PK_MAX_ECC_BYTES   MBEDTLS_ECP_MAX_BYTES
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 /*
  * EC public keys:
diff --git a/drivers/builtin/src/psa_util.c b/drivers/builtin/src/psa_util.c
index 19ef2f5b40..047d6732ad 100644
--- a/drivers/builtin/src/psa_util.c
+++ b/drivers/builtin/src/psa_util.c
@@ -32,8 +32,7 @@
     defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
 #include <mbedtls/rsa.h>
 #endif
-#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
-    defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
 #include <mbedtls/ecp.h>
 #endif
 #if defined(MBEDTLS_PK_C)
@@ -90,8 +89,7 @@ const mbedtls_error_pair_t psa_to_pk_rsa_errors[] =
 };
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
-    defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
 const mbedtls_error_pair_t psa_to_pk_ecdsa_errors[] =
 {
     { PSA_SUCCESS,                     0 },
diff --git a/drivers/builtin/src/psa_util_internal.h b/drivers/builtin/src/psa_util_internal.h
index 04e5c0adb6..7cacda3ec7 100644
--- a/drivers/builtin/src/psa_util_internal.h
+++ b/drivers/builtin/src/psa_util_internal.h
@@ -71,8 +71,7 @@ extern const mbedtls_error_pair_t psa_to_lms_errors[3];
 extern const mbedtls_error_pair_t psa_to_pk_rsa_errors[8];
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
-    defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
 extern const mbedtls_error_pair_t psa_to_pk_ecdsa_errors[7];
 #endif
 
diff --git a/include/mbedtls/pk.h b/include/mbedtls/pk.h
index 7e20459222..18fff7f949 100644
--- a/include/mbedtls/pk.h
+++ b/include/mbedtls/pk.h
@@ -130,7 +130,6 @@ typedef struct mbedtls_pk_rsassa_pss_options {
 #define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 #if PSA_SIGNATURE_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE
 /* PSA_SIGNATURE_MAX_SIZE is the maximum size of a signature made
  * through the PSA API in the PSA representation. */
@@ -148,28 +147,22 @@ typedef struct mbedtls_pk_rsassa_pss_options {
 #undef MBEDTLS_PK_SIGNATURE_MAX_SIZE
 #define MBEDTLS_PK_SIGNATURE_MAX_SIZE (PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11)
 #endif
-#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */
 
 /* Internal helper to define which fields in the pk_context structure below
  * should be used for EC keys: legacy ecp_keypair or the raw (PSA friendly)
  * format. It should be noted that this only affects how data is stored, not
  * which functions are used for various operations. The overall picture looks
  * like this:
- * - if USE_PSA is not defined and ECP_C is defined then use ecp_keypair data
- *   structure and legacy functions. (MBEDTLS_USE_PSA_CRYPTO is always on and
- *   although this codepath remains present, it never will be taken.)
- * - if USE_PSA is defined and
- *     - if ECP_C then use ecp_keypair structure, convert data to a PSA friendly
- *       format and use PSA functions
- *     - if !ECP_C then use new raw data and PSA functions directly.
- *
- * The main reason for the "intermediate" (USE_PSA + ECP_C) above is that as long
+ * - if ECP_C then use ecp_keypair structure, convert data to a PSA friendly
+ *   format and use PSA functions
+ * - if !ECP_C then use new raw data and PSA functions directly.
+ *
+ * The main reason to keep support for the ecp_keypair structure is that as long
  * as ECP_C is defined mbedtls_pk_ec() gives the user a read/write access to the
  * ecp_keypair structure inside the pk_context so they can modify it using
  * ECP functions which are not under PK module's control.
  */
-#if defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \
-    !defined(MBEDTLS_ECP_C)
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && !defined(MBEDTLS_ECP_C)
 #define MBEDTLS_PK_USE_PSA_EC_DATA
 #endif
 
@@ -212,6 +205,7 @@ typedef struct mbedtls_pk_info_t mbedtls_pk_info_t;
 typedef struct mbedtls_pk_context {
     const mbedtls_pk_info_t *MBEDTLS_PRIVATE(pk_info);    /**< Public key information         */
     void *MBEDTLS_PRIVATE(pk_ctx);                        /**< Underlying public key context  */
+
     /* The following field is used to store the ID of a private key in the
      * following cases:
      * - opaque key
@@ -225,9 +219,8 @@ typedef struct mbedtls_pk_context {
      * Note: this private key storing solution only affects EC keys, not the
      *       other ones. The latters still use the pk_ctx to store their own
      *       context. */
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_svc_key_id_t MBEDTLS_PRIVATE(priv_id);      /**< Key ID for opaque keys */
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
     /* The following fields are meant for storing the public key in raw format
      * which is handy for:
      * - easily importing it into the PSA context
@@ -331,7 +324,6 @@ void mbedtls_pk_restart_free(mbedtls_pk_restart_ctx *ctx);
  */
 int mbedtls_pk_setup(mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info);
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 /**
  * \brief Initialize a PK context to wrap a PSA key.
  *
@@ -370,7 +362,6 @@ int mbedtls_pk_setup(mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info);
  */
 int mbedtls_pk_setup_opaque(mbedtls_pk_context *ctx,
                             const mbedtls_svc_key_id_t key);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 /**
  * \brief           Get the size in bits of the underlying key
@@ -407,7 +398,6 @@ static inline size_t mbedtls_pk_get_len(const mbedtls_pk_context *ctx)
  */
 int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type);
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
 /**
  * \brief           Tell if context can do the operation given by PSA algorithm
  *
@@ -437,7 +427,6 @@ int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type);
  */
 int mbedtls_pk_can_do_ext(const mbedtls_pk_context *ctx, psa_algorithm_t alg,
                           psa_key_usage_t usage);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 #if defined(MBEDTLS_PSA_CRYPTO_CLIENT)
 /**
diff --git a/include/tf-psa-crypto/check_config.h b/include/tf-psa-crypto/check_config.h
index f5e54a9374..1c5761219e 100644
--- a/include/tf-psa-crypto/check_config.h
+++ b/include/tf-psa-crypto/check_config.h
@@ -151,14 +151,14 @@
 #error "MBEDTLS_ECDSA_C defined, but not all prerequisites"
 #endif
 
-#if defined(MBEDTLS_PK_C) && defined(MBEDTLS_USE_PSA_CRYPTO)
+#if defined(MBEDTLS_PK_C)
 #if defined(PSA_HAVE_ALG_ECDSA_SIGN) && !defined(MBEDTLS_ASN1_WRITE_C)
-#error "MBEDTLS_PK_C with MBEDTLS_USE_PSA_CRYPTO needs MBEDTLS_ASN1_WRITE_C for ECDSA signature"
+#error "MBEDTLS_PK_C needs MBEDTLS_ASN1_WRITE_C for ECDSA signature"
 #endif
 #if defined(PSA_HAVE_ALG_ECDSA_VERIFY) && !defined(MBEDTLS_ASN1_PARSE_C)
-#error "MBEDTLS_PK_C with MBEDTLS_USE_PSA_CRYPTO needs MBEDTLS_ASN1_PARSE_C for ECDSA verification"
+#error "MBEDTLS_PK_C needs MBEDTLS_ASN1_PARSE_C for ECDSA verification"
 #endif
-#endif /* MBEDTLS_PK_C && MBEDTLS_USE_PSA_CRYPTO */
+#endif /* MBEDTLS_PK_C */
 
 #if defined(MBEDTLS_ECJPAKE_C) && \
     !defined(MBEDTLS_ECP_C)
diff --git a/tests/suites/test_suite_pk.data b/tests/suites/test_suite_pk.data
index 62fe38bdfa..f508bc3bff 100644
--- a/tests/suites/test_suite_pk.data
+++ b/tests/suites/test_suite_pk.data
@@ -588,7 +588,7 @@ mbedtls_pk_check_pair:"../framework/data_files/ec_256_pub.pem":"../framework/dat
 
 Check pair #2 (EC, bad)
 depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PEM_PARSE_C
-mbedtls_pk_check_pair:"../framework/data_files/ec_256_pub.pem":"../framework/data_files/server5.key":MBEDTLS_ERR_ECP_BAD_INPUT_DATA
+mbedtls_pk_check_pair:"../framework/data_files/ec_256_pub.pem":"../framework/data_files/server5.key":MBEDTLS_ERR_PK_BAD_INPUT_DATA
 
 Check pair #3 (RSA, OK)
 depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:MBEDTLS_PEM_PARSE_C
@@ -1312,67 +1312,51 @@ PSA import into PSA: transparent -> persistent public
 pk_import_into_psa_lifetime:0:0:1:1:1
 
 PSA import into PSA: opaque volatile [export] -> volatile pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:1:0:0
 
 PSA import into PSA: opaque volatile [export] -> persistent pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:1:0:1
 
 PSA import into PSA: opaque volatile [export] -> volatile public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:1:1:0
 
 PSA import into PSA: opaque volatile [export] -> persistent public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:1:1:1
 
 PSA import into PSA: opaque volatile [copy] -> volatile pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:0:0:0
 
 PSA import into PSA: opaque volatile [copy] -> persistent pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:0:0:1
 
 PSA import into PSA: opaque volatile [copy] -> volatile public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:0:1:0
 
 PSA import into PSA: opaque volatile [copy] -> persistent public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:0:0:1:1
 
 PSA import into PSA: opaque persistent [export] -> volatile pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:1:0:0
 
 PSA import into PSA: opaque persistent [export] -> persistent pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:1:0:1
 
 PSA import into PSA: opaque persistent [export] -> volatile public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:1:1:0
 
 PSA import into PSA: opaque persistent [export] -> persistent public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:1:1:1
 
 PSA import into PSA: opaque persistent [copy] -> volatile pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:0:0:0
 
 PSA import into PSA: opaque persistent [copy] -> persistent pair
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:0:0:1
 
 PSA import into PSA: opaque persistent [copy] -> volatile public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:0:1:0
 
 PSA import into PSA: opaque persistent [copy] -> persistent public
-depends_on:MBEDTLS_USE_PSA_CRYPTO
 pk_import_into_psa_lifetime:1:1:0:1:1
 
 PSA import into PSA: opaque RSA, COPY (ok)
diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function
index a11d45ef63..c654a67a66 100644
--- a/tests/suites/test_suite_pk.function
+++ b/tests/suites/test_suite_pk.function
@@ -15,9 +15,6 @@
 #include <limits.h>
 #include <stdint.h>
 
-/* Needed only for test case data under #if defined(MBEDTLS_USE_PSA_CRYPTO),
- * but the test code generator requires test case data to be valid C code
- * unconditionally (https://github.com/Mbed-TLS/mbedtls/issues/2023). */
 #include "psa/crypto.h"
 #include "mbedtls/psa_util.h"
 
@@ -28,12 +25,6 @@
 /* Needed for the definition of MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE. */
 #include "pkwrite.h"
 
-#if defined(MBEDTLS_RSA_C) ||                                           \
-    defined(MBEDTLS_ECDSA_C) ||                                         \
-    defined(MBEDTLS_USE_PSA_CRYPTO)
-#define PK_CAN_SIGN_SOME
-#endif
-
 /* MBEDTLS_TEST_PK_PSA_SIGN is enabled when:
  * - The build has PK_[PARSE/WRITE]_C for RSA or ECDSA signature.
  * - The build has built-in ECC and ECDSA signature.
@@ -609,7 +600,7 @@ exit:
  * END_DEPENDENCIES
  */
 
-/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
+/* BEGIN_CASE */
 void pk_psa_utils(int key_is_rsa)
 {
     mbedtls_pk_context pk, pk2;
@@ -712,7 +703,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
+/* BEGIN_CASE */
 void pk_can_do_ext(int opaque_key, int key_type, int key_usage, int key_alg,
                    int key_alg2, int curve_or_keybits, int alg_check, int usage_check,
                    int result)
@@ -944,26 +935,15 @@ exit:
 void mbedtls_pk_check_pair(char *pub_file, char *prv_file, int ret)
 {
     mbedtls_pk_context pub, prv, alt;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_svc_key_id_t opaque_key_id = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t opaque_key_attr = PSA_KEY_ATTRIBUTES_INIT;
     int is_ec_key = 0;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     mbedtls_pk_init(&pub);
     mbedtls_pk_init(&prv);
     mbedtls_pk_init(&alt);
     PSA_INIT();
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    /* mbedtls_pk_check_pair() returns either PK or ECP error codes depending
-       on MBEDTLS_USE_PSA_CRYPTO so here we dynamically translate between the
-       two */
-    if (ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA) {
-        ret = MBEDTLS_ERR_PK_BAD_INPUT_DATA;
-    }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
     TEST_ASSERT(mbedtls_pk_parse_public_keyfile(&pub, pub_file) == 0);
     TEST_ASSERT(mbedtls_pk_parse_keyfile(&prv, prv_file, NULL)
                 == 0);
@@ -971,7 +951,6 @@ void mbedtls_pk_check_pair(char *pub_file, char *prv_file, int ret)
     TEST_ASSERT(mbedtls_pk_check_pair(&pub, &prv)
                 == ret);
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     is_ec_key = (mbedtls_pk_get_type(&prv) == MBEDTLS_PK_ECKEY);
     /* Turn the prv PK context into an opaque one.*/
     TEST_EQUAL(mbedtls_pk_get_psa_attributes(&prv, PSA_KEY_USAGE_SIGN_HASH,
@@ -987,12 +966,9 @@ void mbedtls_pk_check_pair(char *pub_file, char *prv_file, int ret)
     } else {
         TEST_EQUAL(mbedtls_pk_check_pair(&pub, &prv), MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE);
     }
-#endif
 
 exit:
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     psa_destroy_key(opaque_key_id);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
     mbedtls_pk_free(&pub);
     mbedtls_pk_free(&prv);
     mbedtls_pk_free(&alt);
@@ -1034,31 +1010,13 @@ void pk_rsa_verify_test_vec(data_t *message_str, int padding, int digest,
     int actual_result;
     actual_result = mbedtls_pk_verify(&pk, digest, message_str->x, 0,
                                       result_str->x, mbedtls_pk_get_len(&pk));
-#if !defined(MBEDTLS_USE_PSA_CRYPTO)
-    if (actual_result == MBEDTLS_ERR_RSA_INVALID_PADDING &&
-        expected_result == MBEDTLS_ERR_RSA_VERIFY_FAILED) {
-        /* Tolerate INVALID_PADDING error for an invalid signature with
-         * the legacy API (but not with PSA). */
-    } else
-#endif
-    {
-        TEST_EQUAL(actual_result, expected_result);
-    }
+    TEST_EQUAL(actual_result, expected_result);
 
     actual_result = mbedtls_pk_verify_restartable(&pk, digest, message_str->x, 0,
                                                   result_str->x,
                                                   mbedtls_pk_get_len(&pk),
                                                   rs_ctx);
-#if !defined(MBEDTLS_USE_PSA_CRYPTO)
-    if (actual_result == MBEDTLS_ERR_RSA_INVALID_PADDING &&
-        expected_result == MBEDTLS_ERR_RSA_VERIFY_FAILED) {
-        /* Tolerate INVALID_PADDING error for an invalid signature with
-         * the legacy API (but not with PSA). */
-    } else
-#endif
-    {
-        TEST_EQUAL(actual_result, expected_result);
-    }
+    TEST_EQUAL(actual_result, expected_result);
 
 exit:
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
@@ -1222,7 +1180,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:PSA_WANT_ALG_SHA_256:PK_CAN_SIGN_SOME */
+/* BEGIN_CASE depends_on:PSA_WANT_ALG_SHA_256 */
 void pk_sign_verify(int type, int curve_or_keybits, int rsa_padding, int rsa_md_alg,
                     int sign_ret, int verify_ret)
 {
@@ -1456,7 +1414,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_USE_PSA_CRYPTO */
+/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
 void pk_wrap_rsa_decrypt_test_vec(data_t *cipher, int mod,
                                   char *input_P, char *input_Q,
                                   char *input_N, char *input_E,
@@ -1603,7 +1561,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:MBEDTLS_PK_PARSE_C:PSA_WANT_ALG_SHA_256:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_TEST_PK_PSA_SIGN */
+/* BEGIN_CASE depends_on:MBEDTLS_PK_PARSE_C:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_PK_PSA_SIGN */
 void pk_psa_sign(int psa_type, int bits, int rsa_padding)
 {
     mbedtls_pk_context pk;
@@ -1793,7 +1751,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_USE_PSA_CRYPTO */
+/* BEGIN_CASE depends_on:MBEDTLS_RSA_C */
 void pk_psa_wrap_sign_ext(int pk_type, int key_bits, int key_pk_type, int md_alg)
 {
     mbedtls_pk_context pk;
@@ -2041,7 +1999,6 @@ void pk_import_into_psa_lifetime(int from_opaque,
     PSA_INIT();
 
     if (from_opaque) {
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
         psa_key_type_t from_psa_type =
             PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY);
         psa_key_usage_t psa_key_usage =
@@ -2058,11 +2015,6 @@ void pk_import_into_psa_lifetime(int from_opaque,
                                 persistent_key_id, &old_key_id));
         TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, old_key_id), 0);
         psa_reset_key_attributes(&attributes);
-#else
-        (void) from_persistent;
-        (void) from_exportable;
-        TEST_FAIL("Attempted to test opaque key without opaque key support");
-#endif
     } else {
         psa_key_type_t psa_type_according_to_setup;
         TEST_EQUAL(pk_setup_for_type(MBEDTLS_PK_ECKEY, 1,
@@ -2110,7 +2062,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
+/* BEGIN_CASE */
 void pk_get_psa_attributes_opaque(int from_type_arg, int from_bits_arg,
                                   int from_usage_arg, int from_alg_arg,
                                   int usage_arg,
@@ -2207,7 +2159,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
+/* BEGIN_CASE */
 void pk_import_into_psa_opaque(int from_type, int from_bits,
                                int from_usage, int from_alg,
                                int to_type, int to_bits,
diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function
index 1d006c0e57..73f9261820 100644
--- a/tests/suites/test_suite_pkwrite.function
+++ b/tests/suites/test_suite_pkwrite.function
@@ -75,10 +75,8 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der)
     unsigned char *start_buf;
     size_t buf_len, check_buf_len;
     int expected_result;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_svc_key_id_t opaque_id = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     USE_PSA_INIT();
 
@@ -126,7 +124,6 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der)
 
     TEST_MEMORY_COMPARE(start_buf, buf_len, check_buf, check_buf_len);
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     /* Verify that pk_write works also for opaque private keys */
     if (!is_public_key) {
         memset(buf, 0, check_buf_len);
@@ -150,12 +147,9 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der)
 
         TEST_MEMORY_COMPARE(start_buf, buf_len, check_buf, check_buf_len);
     }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 exit:
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     psa_destroy_key(opaque_id);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
     mbedtls_free(buf);
     mbedtls_free(check_buf);
     mbedtls_pk_free(&key);
@@ -192,10 +186,8 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file)
     size_t derived_key_len = 0;
     uint8_t *pub_key_raw = NULL;
     size_t pub_key_len = 0;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_svc_key_id_t opaque_key_id = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     mbedtls_pk_init(&priv_key);
     USE_PSA_INIT();
@@ -213,7 +205,6 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file)
     TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len,
                         pub_key_raw, pub_key_len);
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_platform_zeroize(derived_key_raw, derived_key_len);
 
     /* Turn the priv_key PK context into an opaque one. */
@@ -228,12 +219,9 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file)
 
     TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len,
                         pub_key_raw, pub_key_len);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 exit:
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     psa_destroy_key(opaque_key_id);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
     mbedtls_free(derived_key_raw);
     mbedtls_free(pub_key_raw);
     mbedtls_pk_free(&priv_key);


Reviews:
user: login: bjwtaylor
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T10:46:13Z
user: login: bjwtaylor
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T10:47:20Z
user: login: bjwtaylor
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T10:50:01Z
user: login: bjwtaylor
body: Generally looks good, just had a few questions on some the removals that didn't seem related to the issue. Suspect they are fine though.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T10:52:09Z
user: login: valeriosetti
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T14:40:12Z
user: login: valeriosetti
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T14:41:12Z
user: login: valeriosetti
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T14:44:21Z
user: login: bjwtaylor
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T14:46:30Z
user: login: bjwtaylor
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-05-09T14:46:48Z
user: login: mpg
body: LGTM, thanks!
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-05-15T10:41:54Z
user: login: mpg
body: LGTM, based on the output of `echo "*/pk.h" > orderfile && git -c diff.orderfile=orderfile range-diff development 52782305fd80547eea575fa198d8f52d751a4ec2 public/pr/285` and manually reviewing the final commit.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T09:49:29Z
user: login: bjwtaylor
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T14:16:01Z

Review comments:
diff_hunk: @@ -28,12 +28,6 @@
 /* Needed for the definition of MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE. */
 #include "pkwrite.h"
 
-#if defined(MBEDTLS_RSA_C) ||                                           \
-    defined(MBEDTLS_ECDSA_C) ||                                         \
-    defined(MBEDTLS_USE_PSA_CRYPTO)
-#define PK_CAN_SIGN_SOME
path: tests/suites/test_suite_pk.function
user: login: bjwtaylor
body: Whats the thinking behind the removal of #define PK_CAN_SIGN_SOME? The above statement with MBEDTLS_USE_PSA_CRYPTO always defined should always evaluate to true, so is there another reason this needs to be removed?
created_at: 2025-05-09T10:46:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -944,34 +938,22 @@ exit:
 void mbedtls_pk_check_pair(char *pub_file, char *prv_file, int ret)
 {
     mbedtls_pk_context pub, prv, alt;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_svc_key_id_t opaque_key_id = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t opaque_key_attr = PSA_KEY_ATTRIBUTES_INIT;
     int is_ec_key = 0;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     mbedtls_pk_init(&pub);
     mbedtls_pk_init(&prv);
     mbedtls_pk_init(&alt);
     PSA_INIT();
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    /* mbedtls_pk_check_pair() returns either PK or ECP error codes depending
-       on MBEDTLS_USE_PSA_CRYPTO so here we dynamically translate between the
-       two */
-    if (ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA) {
-        ret = MBEDTLS_ERR_PK_BAD_INPUT_DATA;
-    }
path: tests/suites/test_suite_pk.function
user: login: bjwtaylor
body: Whats the thinking behind the removal of #define block? The above statement with MBEDTLS_USE_PSA_CRYPTO always defined should always evaluate to true, so is there another reason this needs to be removed?
created_at: 2025-05-09T10:47:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1222,7 +1183,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:PSA_WANT_ALG_SHA_256:PK_CAN_SIGN_SOME */
path: tests/suites/test_suite_pk.function
user: login: bjwtaylor
body: Tied to the previous comment, though is there some reason for removing PK_CAN_SIGN_SOME
created_at: 2025-05-09T10:50:01Z
author_association: CONTRIBUTOR
diff_hunk: @@ -28,12 +28,6 @@
 /* Needed for the definition of MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE. */
 #include "pkwrite.h"
 
-#if defined(MBEDTLS_RSA_C) ||                                           \
-    defined(MBEDTLS_ECDSA_C) ||                                         \
-    defined(MBEDTLS_USE_PSA_CRYPTO)
-#define PK_CAN_SIGN_SOME
path: tests/suites/test_suite_pk.function
user: login: valeriosetti
body: Since `MBEDTLS_USE_PSA_CRYPTO` this `#if defined()` check always evaluates to true so `PK_CAN_SIGN_SOME`. Therefore I can replace all potential checks of `PK_CAN_SIGN_SOME` with `true`
created_at: 2025-05-09T14:40:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1222,7 +1183,7 @@ exit:
 }
 /* END_CASE */
 
-/* BEGIN_CASE depends_on:PSA_WANT_ALG_SHA_256:PK_CAN_SIGN_SOME */
path: tests/suites/test_suite_pk.function
user: login: valeriosetti
body: Since `PK_CAN_SIGN_SOME` is [always set](https://github.com/Mbed-TLS/TF-PSA-Crypto/pull/285#discussion_r2081830573) it does not give any benefit in using it as filter for this test function. It would be an "always allow" filter, so I removed it.
Did I miss something?
created_at: 2025-05-09T14:41:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -944,34 +938,22 @@ exit:
 void mbedtls_pk_check_pair(char *pub_file, char *prv_file, int ret)
 {
     mbedtls_pk_context pub, prv, alt;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
     mbedtls_svc_key_id_t opaque_key_id = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t opaque_key_attr = PSA_KEY_ATTRIBUTES_INIT;
     int is_ec_key = 0;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     mbedtls_pk_init(&pub);
     mbedtls_pk_init(&prv);
     mbedtls_pk_init(&alt);
     PSA_INIT();
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    /* mbedtls_pk_check_pair() returns either PK or ECP error codes depending
-       on MBEDTLS_USE_PSA_CRYPTO so here we dynamically translate between the
-       two */
-    if (ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA) {
-        ret = MBEDTLS_ERR_PK_BAD_INPUT_DATA;
-    }
path: tests/suites/test_suite_pk.function
user: login: valeriosetti
body: In the past (i.e. up to 3.6) `mbedtls_pk_check_pair()` could return either `MBEDTLS_ERR_ECP_BAD_INPUT_DATA` or `MBEDTLS_ERR_PK_BAD_INPUT_DATA` based on `MBEDTLS_USE_PSA_CRYPTO` (as specified in the comment that I removed in that block). Since now `MBEDTLS_USE_PSA_CRYPTO` is always set, this error code conversion would always take place. Therefore instead of doing this extra step, I set the proper error code in `test_suite_pk.data` on the test `Check pair #2 (EC, bad)`.
created_at: 2025-05-09T14:44:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -28,12 +28,6 @@
 /* Needed for the definition of MBEDTLS_PK_WRITE_PUBKEY_MAX_SIZE. */
 #include "pkwrite.h"
 
-#if defined(MBEDTLS_RSA_C) ||                                           \
-    defined(MBEDTLS_ECDSA_C) ||                                         \
-    defined(MBEDTLS_USE_PSA_CRYPTO)
-#define PK_CAN_SIGN_SOME
path: tests/suites/test_suite_pk.function
user: login: bjwtaylor
body: No, makes sense.
created_at: 2025-05-09T14:46:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -15,7 +15,7 @@
 #include <limits.h>
 #include <stdint.h>
 
-/* Needed only for test case data under #if defined(MBEDTLS_USE_PSA_CRYPTO),
+/* Needed only for test case data using PSA API macros/types because
path: tests/suites/test_suite_pk.function
user: login: mpg
body: Minor: "because but" (over the line break). Actually I'd remove the comment entirely, I think these days we don't need to justify including `psa/crypto.h`.
created_at: 2025-05-15T10:37:25Z
author_association: CONTRIBUTOR

PR comments:
user: login: mpg
created_at: 2025-05-15T10:18:37Z
body: Again conflicts due to `pk.h` being move. Should not be complex to resolve, but perhaps a bit tedious if `git rebase` fails to understand what's going on.
author_association: CONTRIBUTOR
user: login: gilles-peskine-arm
created_at: 2025-05-15T10:32:31Z
body: I'd expect `git rebase` or `git merge` to work. Modern and even not-so-modern versions of git have no problem with a file being moved on one side and modified on the other. I guess it's a limitation of the old fork of git that runs on GitHub.
author_association: CONTRIBUTOR
user: login: valeriosetti
created_at: 2025-05-19T08:33:48Z
body: - 1st forced push:
    - address @mpg [comment](https://github.com/Mbed-TLS/TF-PSA-Crypto/pull/285#discussion_r2090867871)
    - remove update of the `framework`

- 2nd forced push: rebase on top of `development`to solve the conflict
author_association: CONTRIBUTOR