Zephyr: add wolfPSA as a Zephyr PSA Crypto provider

[Frauschi]

Summary

Adds a Zephyr module (modules/crypto/wolfPSA) that plugs wolfPSA into Zephyr's PSA_CRYPTO_PROVIDER_CUSTOM choice (Zephyr >= 4.3), supplying the PSA Crypto API in place of mbedTLS while reusing the wolfCrypt core compiled by the sibling wolfSSL Zephyr module. This gives Zephyr consumers (BLE host/mesh, TLS/Wi-Fi credentials, secure_storage, samples/psa/*) a wolfCrypt-backed PSA provider — and, paired with wolfCrypt FIPS, a certifiable crypto boundary that mbedTLS's PSA implementation cannot offer.

What's included

Provider wiring

• Provider selection depends on WOLFSSL (never selects it) to avoid the socket Kconfig's !WOLFSSL dependency loop; consumers set CONFIG_WOLFSSL=y.
• The PSA surface (PSA_WANT_*) is generated at CMake-configure time from the compiled wolfCrypt config intersected with what wolfPSA implements (zephyr/gen/gen-crypto-config.py + psa_want_probe.c), so it tracks the build.
• wolfPSA owns no wolfCrypt config of its own — it follows the wolfSSL module's config and coexists with the wolfSSL TLS stack in one image (no forced WOLFCRYPT_ONLY).

Persistent keys

• Backed by Zephyr secure_storage through a wolfCrypt AES-256-GCM custom ITS transform (zephyr/src/psa_its_transform_wolfcrypt.c) — encryption at rest with no Mbed TLS symbol in the image. src/psa_store_zephyr.c maps wolfPSA_Store_* onto the PSA ITS API; ZMS store backend on STM32H7 (128 KB flash sectors).

Thread safety & entropy

• Optional thread-safe key store built on wolfCrypt's portable wc_*Mutex API.
• DRBG seeding is owned by the wolfSSL module; wolfPSA requires HAVE_HASHDRBG.

Coverage

• Favors Zephyr's own provider-agnostic PSA apps run against wolfPSA (psa_consumer reuses Zephyr's tests/crypto/mbedtls_psa ztest), plus bespoke suites: key-store lock (psa_concurrency), entropy path (psa_entropy), ITS transform confidentiality/tamper/uid-binding (psa_transform), persistent keys (psa_persistent_key), key purge (psa_purge), ITS round-trip (psa_its), secure storage (psa_secure_storage), store-unavailable fail-closed stub (psa_store_unavailable), and TLS + PSA coexistence in one image (psa_tls_coexist). Ships a psa_smoke sample.

Testing

• Validated on native_sim/native/64 and hardware-validated on nucleo_h743zi (STM32H743ZI), including persistent keys stored to on-chip flash via the ZMS ITS backend.
• Adds CI testing for the module for both Zephyr V4.3 and 4.4

Notes / requirements

• Requires Zephyr >= 4.3 — CONFIG_PSA_CRYPTO_PROVIDER_CUSTOM (the provider seam) was added in Zephyr 4.3; below it the module is inert.
• Depends on the companion wolfSSL PR (Zephyr: wolfSSL module support for the wolfPSA provider and native RTOS use wolfssl#10983): native RTOS threading and the module config interface. Set CONFIG_WOLFSSL=y. Merge the wolfSSL PR first.

[Frauschi]

The Zephyr CI tests will only succeed once wolfSSL/wolfssl#10983 is merged.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #21

Scan targets checked: wolfpsa-bugs, wolfpsa-src

No new issues found in the changed files. ✅