STM32H573 Secure Manager: PSA Crypto Issues with TLS 1.3

[MarioM]

Hello everyone,

I am trying to use TLS 1.3 with Mbed TLS on an STM32H573 through the Secure Manager’s Global PSA API.

At the moment, I am seeing the following errors:

psa_sign_hash() / psa_sign_message()
→ PSA_ERROR_NOT_PERMITTED

psa_generate_key() / psa_import_key()
→ PSA_ERROR_GENERIC_ERROR

The persistent ECC keys are provisioned with the required signing permissions, and both the Secure Manager and the non-secure application start correctly.

Some TLS 1.3 HKDF operations had to be implemented locally because the PSA Crypto API version in use is 1.0 and does not provide separate HKDF-Extract and HKDF-Expand algorithms.

My questions are:

• Are persistent ECC keys supported with psa_sign_hash() through the Global PSA API?
• Does the Secure Manager support volatile keys with psa_generate_key() and psa_import_key()?
• Are additional permissions or a Secure Module required?
• Is there a support matrix or an official TLS 1.3 example for this setup?
• Does anyone have experience with Secure Manager and MbedTLS 1.3, or with configuring Secure Manager for TLS 1.3?

Thank you!