Zephyr 3.7 security related modules update overview

[aescolar]

Umbrella issue for tracking security related modules which may require an update before Zephyr 3.7.

• https://github.com/zephyrproject-rtos/mbedtls (@ceolin , @d3zd3z , @tomi-font)
  • Seems to be on upstream latest 3.6.0 LTS https://github.com/Mbed-TLS/mbedtls
• https://github.com/zephyrproject-rtos/tinycrypt (@ceolin )
  • Upstream not being developed anymore https://github.com/intel/tinycrypt
• https://github.com/zephyrproject-rtos/trusted-firmware-m (@d3zd3z , @ithinuel , @tomi-font )
  • Seems to have been update to the latest upstream 2.1.0
  • https://tf-m-user-guide.trustedfirmware.org/releases/index.html
• https://github.com/zephyrproject-rtos/trusted-firmware-a (@povergoing, @SgrrZhf, @ithinuel )
  • Seems to be 2 upstream releases behind (2.9.0 vs 2.11.0), ~1year
  • https://trustedfirmware-a.readthedocs.io/en/latest/change-log.html
  • Updated to 2.10.4 manifest: Update TF-A to v2.10.4 #74111
• https://github.com/zephyrproject-rtos/uoscore-uedhoc (@rlubos , @StefanHri )

[aescolar]

• Wrt MbedTLS & tinycrypt, @ceolin can you confirm that we are up to date for the Zephyr 3.7LTS release?
• Wrt TF-M @d3zd3z @ithinuel can you confirm that we are up to date?
• Wrt TF-A @povergoing would an update of TF-A before the 3.7LTS release be a good idea from a security point of view?

[dleach02]

Where should we also track any other modules that need to be updated for the? LVGL is one that comes to mind.

[aescolar]

Where should we also track any other modules that need to be updated for the? LVGL is one that comes to mind.

@faxe1008 ^^

What we discussed is that that would be the responsibility of each west project maintainer.
Though, @dleach02, you are welcome to make a list and check the status of each module and/or ping each maintainer.

[rlubos]

uoscore-uedhoc upmerge PRs:
zephyrproject-rtos/uoscore-uedhoc#4
#73848
Went quite smooth, no surprises.

[dkalowsk]

@povergoing @SgrrZhf @ithinuel does it make sense to move Zephyr 3.7 LTS up to TF-A v 2.10 which is the TF-A LTS release. The biggest challenge I see with it (not having tested it) is that 2.10 drops support for the cryptocell712, and I don't know who is or isn't using that in Zephyr.

[dleach02]

that was supposed to be the plan to align all the TFM/TFA/mbedTLS to LTS with the Zephyr LTS.