Mbed-TLS · sigvartmh · Aug 5, 2025 · Jun 18, 2026 · Jul 19, 2026 · Dec 3, 2025
diff --git a/ChangeLog.d/spake2p-cmac.txt b/ChangeLog.d/spake2p-cmac.txt
@@ -0,0 +1,4 @@
+Features
+   * Add CMAC support for SPAKE2+. The PSA_ALG_SPAKE2P_CMAC ciphersuites use
+     AES-CMAC-128 instead of HMAC for the key confirmation MAC (RFC 9383
+     Section 3.4); the key schedule stays HKDF. Resolves Mbed-TLS/mbedtls#9377.
diff --git a/ChangeLog.d/spake2p-get-shared-key.txt b/ChangeLog.d/spake2p-get-shared-key.txt
@@ -0,0 +1,7 @@
+Features
+   * Implement psa_pake_get_shared_key() for SPAKE2+. Once both the key share
+     and the key confirmation exchanges have completed, both parties can export
+     the RFC 9383 K_shared shared secret. As a security measure the shared key
+     is released only after the peer's confirmation MAC has been verified.
+     Use PSA_ALG_SPAKE2P_HMAC for P-256/P-384/P-521. Resolves Mbed-
+     TLS/mbedtls#9370.
diff --git a/ChangeLog.d/spake2p-key-pair-import-export.txt b/ChangeLog.d/spake2p-key-pair-import-export.txt
@@ -0,0 +1,8 @@
+Features
+   * Add support for importing and exporting SPAKE2+ key pairs
+     (key type PSA_KEY_TYPE_SPAKE2P_KEY_PAIR) through psa_import_key() and
+     psa_export_key(). The prover key pair is the concatenation w0 || w1 of
+     two equal-length secp256r1/secp384r1/secp521r1 scalars in the range
+     [1, n-1]. psa_export_public_key() computes the corresponding verifier
+     registration record w0 || L with L = w1 * P. Resolves Mbed-
+     TLS/mbedtls#9343.
diff --git a/ChangeLog.d/spake2p-matter.txt b/ChangeLog.d/spake2p-matter.txt
@@ -0,0 +1,7 @@
+Features
+   * Support the Matter SPAKE2+ ciphersuite (P256-SHA256-HKDF-HMAC-SHA256)
+     through PSA_ALG_SPAKE2P_MATTER. This is the HMAC-SHA-256 / P-256
+     ciphersuite using the older draft-bar-cfrg-spake2plus-02 key schedule
+     (split-digest Kae = Ka || Ke; the shared secret is Ke and the
+     confirmation keys are HKDF-expanded from Ka) rather than the RFC 9383
+     schedule. Resolves Mbed-TLS/mbedtls#9378.
diff --git a/ChangeLog.d/spake2p-prover-confirmation-check.txt b/ChangeLog.d/spake2p-prover-confirmation-check.txt
@@ -0,0 +1,9 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) prover confirmation check to the PSA PAKE API:
+     once both key shares have been exchanged, a CLIENT-role operation accepts
+     the PSA_PAKE_STEP_CONFIRM message through psa_pake_input(), verifying the
+     verifier's confirmation MAC confirmV = MAC(K_confirmV, shareP) in constant
+     time. A mismatching MAC is rejected with PSA_ERROR_INVALID_SIGNATURE.
+     Supported for the HMAC confirmation profile (PSA_ALG_SPAKE2P_HMAC) over
+     the
+     P-256/P-384/P-521 ciphersuites. Resolves Mbed-TLS/mbedtls#9355.
diff --git a/ChangeLog.d/spake2p-prover-confirmation.txt b/ChangeLog.d/spake2p-prover-confirmation.txt
@@ -0,0 +1,10 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) prover confirmation output to the PSA PAKE
+     API: once both key shares have been exchanged and the key schedule
+     (K_main, K_confirmP, K_confirmV, K_shared per RFC 9383 Section 3.3-3.4) is
+     derived, psa_pake_output() now accepts the PSA_PAKE_STEP_CONFIRM message
+     on the prover (client) side, returning the confirmation MAC confirmP.
+     Supported for the HMAC confirmation profile (PSA_ALG_SPAKE2P_HMAC) over
+     the P-256/P-384/P-521 ciphersuites. Resolves Mbed-TLS/mbedtls#9367 prover
+     confirmation
+     output.
diff --git a/ChangeLog.d/spake2p-prover-key-share.txt b/ChangeLog.d/spake2p-prover-key-share.txt
@@ -0,0 +1,7 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) Prover setup and key-share output to the PSA
+     PAKE API: psa_pake_setup() now accepts SPAKE2+ key types for the client
+     (Prover) role with PSA_ALG_SPAKE2P_HMAC, and psa_pake_output() produces
+     the
+     PSA_PAKE_STEP_KEY_SHARE message. Supported on the NIST P-256, P-384 and
+     P-521 curves. Resolves part of #9347 (Prover key share).
diff --git a/ChangeLog.d/spake2p-prover-transcript-hash.txt b/ChangeLog.d/spake2p-prover-transcript-hash.txt
@@ -0,0 +1,8 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) prover transcript hash to the PSA PAKE API:
+     a CLIENT-role operation now accumulates the transcript TT (RFC 9383
+     Section 3.3) over the fields derivable from the exchanged shares (Context,
+     idProver, idVerifier, M, N, shareP, shareV) across all prover-side calls,
+     and psa_pake_input() rejects an out-of-order PSA_PAKE_STEP_KEY_SHARE on
+     the
+     prover side with PSA_ERROR_BAD_STATE. Resolves Mbed-TLS/mbedtls#9359.
diff --git a/ChangeLog.d/spake2p-public-key-import-export.txt b/ChangeLog.d/spake2p-public-key-import-export.txt
@@ -0,0 +1,5 @@
+Features
+   * Add support for importing and exporting SPAKE2+ public keys
+     (key type PSA_KEY_TYPE_SPAKE2P_PUBLIC_KEY) through psa_import_key()
+     and psa_export_key(), following the PSA Crypto API encoding for
+     SPAKE2+. Resolves Mbed-TLS/mbedtls#9342.
diff --git a/ChangeLog.d/spake2p-registration.txt b/ChangeLog.d/spake2p-registration.txt
@@ -0,0 +1,10 @@
+Features
+   * Implement SPAKE2+ registration (RFC 9383 Section 3.2): derive a SPAKE2+
+     key pair from a key-derivation operation via
+     psa_key_derivation_output_key()
+     with key type PSA_KEY_TYPE_SPAKE2P_KEY_PAIR. For each scalar,
+     ceil(bits/8)+8
+     bytes are drawn from the operation and reduced modulo the group order to
+     produce w0 and w1, yielding the importable/usable key pair w0 || w1. Use
+     PSA_ALG_SPAKE2P_HMAC with the secp_r1 (Weierstrass) ciphersuites. Requires
+     PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_DERIVE. Resolves Mbed-TLS/mbedtls#9381.
diff --git a/ChangeLog.d/spake2p-set-context.txt b/ChangeLog.d/spake2p-set-context.txt
@@ -0,0 +1,5 @@
+Features
+   * Implement psa_pake_set_context() so a SPAKE2+ operation can store the
+     optional context string passed at the collect-inputs stage. The function
+     returns PSA_ERROR_BAD_STATE for EC-JPAKE, which does not take a context.
+     Resolves Mbed-TLS/mbedtls#9344.
diff --git a/ChangeLog.d/spake2p-verifier-confirmation-check.txt b/ChangeLog.d/spake2p-verifier-confirmation-check.txt
@@ -0,0 +1,9 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) verifier confirmation check to the PSA PAKE
+     API: once both key shares have been exchanged and the key schedule is
+     derived, psa_pake_input() now accepts the PSA_PAKE_STEP_CONFIRM message
+     on the verifier (server) side, verifying the prover's confirmation MAC
+     confirmP = MAC(K_confirmP, shareV) in constant time and failing with
+     PSA_ERROR_INVALID_SIGNATURE on mismatch. Supported for the HMAC
+     confirmation profile (PSA_ALG_SPAKE2P_HMAC) over the P-256/P-384/P-521
+     ciphersuites. Resolves Mbed-TLS/mbedtls#9367 verifier confirmation check.
diff --git a/ChangeLog.d/spake2p-verifier-confirmation.txt b/ChangeLog.d/spake2p-verifier-confirmation.txt
@@ -0,0 +1,10 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) verifier confirmation output to the PSA PAKE
+     API: once both key shares have been exchanged, the key schedule
+     (K_main, K_confirmP, K_confirmV, K_shared per RFC 9383 Section 3.3-3.4) is
+     derived, and psa_pake_output() now accepts the PSA_PAKE_STEP_CONFIRM
+     message on the verifier (server) side, returning the confirmation MAC
+     confirmV. Supported for the HMAC confirmation profile
+     (PSA_ALG_SPAKE2P_HMAC
+     and PSA_ALG_SPAKE2P_MATTER) over the P-256/P-384/P-521 ciphersuites.
+     Resolves Mbed-TLS/mbedtls#9352.
diff --git a/ChangeLog.d/spake2p-verifier-key-share.txt b/ChangeLog.d/spake2p-verifier-key-share.txt
@@ -0,0 +1,7 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) Verifier setup and key-share output to the PSA
+     PAKE API: psa_pake_setup() now accepts a SPAKE2+ public-key registration
+     record (w0||L) for the server (Verifier) role, and psa_pake_output()
+     produces the server PSA_PAKE_STEP_KEY_SHARE message (shareV = y*P + w0*N).
+     Supported on the NIST P-256, P-384 and P-521 curves. Resolves part of
+     #9347 (Verifier key share).
diff --git a/ChangeLog.d/spake2p-verifier-transcript-hash.txt b/ChangeLog.d/spake2p-verifier-transcript-hash.txt
@@ -0,0 +1,7 @@
+Features
+   * Add the SPAKE2+ (RFC 9383) verifier transcript hash and peer key-share
+     input to the PSA PAKE API: psa_pake_input() now accepts the
+     PSA_PAKE_STEP_KEY_SHARE message for a SPAKE2+ operation, and the
+     transcript TT (RFC 9383 Section 3.3) is accumulated over the fields
+     derivable from the exchanged shares (Context, idProver, idVerifier, M, N,
+     shareP, shareV). Resolves Mbed-TLS/mbedtls#9349.
diff --git a/core/check_crypto_config.h b/core/check_crypto_config.h
@@ -108,4 +108,38 @@
 #error "PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS defined, but not all prerequisites"
 #endif
 
+#if (defined(PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_BASIC) || \
+    defined(PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_IMPORT) || \
+    defined(PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_EXPORT)) && \
+    !defined(PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY)
+#error "PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_xxx defined, but not all prerequisites"
+#endif
+
+#if defined(PSA_WANT_ALG_SPAKE2P_HMAC) && \
+    !(defined(PSA_WANT_ALG_HMAC) && \
+    defined(PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY) && \
+    (defined(PSA_WANT_ECC_SECP_R1_256) || \
+    defined(PSA_WANT_ECC_SECP_R1_384) || \
+    defined(PSA_WANT_ECC_SECP_R1_521)))
+#error "PSA_WANT_ALG_SPAKE2P_HMAC defined, but not all prerequisites"
+#endif
+
+#if defined(PSA_WANT_ALG_SPAKE2P_CMAC) && \
+    !(defined(PSA_WANT_ALG_CMAC) && \
+    defined(PSA_WANT_KEY_TYPE_AES) && \
+    defined(PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY) && \
+    (defined(PSA_WANT_ECC_SECP_R1_256) || \
+    defined(PSA_WANT_ECC_SECP_R1_384) || \
+    defined(PSA_WANT_ECC_SECP_R1_521)))
+#error "PSA_WANT_ALG_SPAKE2P_CMAC defined, but not all prerequisites"
+#endif
+
+#if defined(PSA_WANT_ALG_SPAKE2P_MATTER) && \
+    !(defined(PSA_WANT_ALG_HMAC) && \
+    defined(PSA_WANT_ALG_SHA_256) && \
+    defined(PSA_WANT_ECC_SECP_R1_256) && \
+    defined(PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY))
+#error "PSA_WANT_ALG_SPAKE2P_MATTER defined, but not all prerequisites"
+#endif
+
 #endif /* TF_PSA_CRYPTO_CHECK_CRYPTO_CONFIG_H */