From 24e81e162783e5a3158cdee7dce592a28b2bebfe Mon Sep 17 00:00:00 2001
From: Szymon Janc <szymon.janc@codecoup.pl>
Date: Wed, 27 May 2026 09:53:11 +0200
Subject: [PATCH] nimble/ll: Use Mbed-TLS in LL crypto

So far TinyCRYPT library was used in LL crypto but it is no longer
being maintained. This converts code to use Mbed TLS instead.
---
 nimble/controller/pkg.yml             |  9 +--------
 nimble/controller/src/ble_ll_crypto.c | 17 +++--------------
 nimble/controller/syscfg.yml          |  3 +++
 3 files changed, 7 insertions(+), 22 deletions(-)

diff --git a/nimble/controller/pkg.yml b/nimble/controller/pkg.yml
index e5ba7b600..9f1815811 100644
--- a/nimble/controller/pkg.yml
+++ b/nimble/controller/pkg.yml
@@ -38,18 +38,11 @@ pkg.req_apis.BLE_FEM_ANTENNA:
 
 pkg.deps:
     - "@apache-mynewt-core/kernel/os"
-    - "@apache-mynewt-core/crypto/tinycrypt"
+    - "@apache-mynewt-core/crypto/mbedtls"
     - nimble
     - nimble/transport
 
-pkg.deps.TEST:
-    - "@apache-mynewt-core/crypto/mbedtls"
-
 pkg.init:
     ble_ll_init:
         - $before:ble_transport_hs_init
         - $before:ble_transport_ll_init
-
-pkg.cflags.TEST:
-    - -Irepos/mbedtls/include
-    - -Irepos/include/mbedtls
diff --git a/nimble/controller/src/ble_ll_crypto.c b/nimble/controller/src/ble_ll_crypto.c
index be3e1be3b..1fccb32a5 100644
--- a/nimble/controller/src/ble_ll_crypto.c
+++ b/nimble/controller/src/ble_ll_crypto.c
@@ -21,25 +21,14 @@
 #include <nimble/ble.h>
 #include <controller/ble_ll_crypto.h>
 #include <controller/ble_hw.h>
-#include <tinycrypt/constants.h>
-#include <tinycrypt/cmac_mode.h>
+#include <mbedtls/cmac.h>
 
 int
 ble_ll_crypto_cmac(const uint8_t *key, const uint8_t *in, int len,
                    uint8_t *out)
 {
-    struct tc_aes_key_sched_struct sched;
-    struct tc_cmac_struct state;
-
-    if (tc_cmac_setup(&state, key, &sched) == TC_CRYPTO_FAIL) {
-        return -1;
-    }
-
-    if (tc_cmac_update(&state, in, len) == TC_CRYPTO_FAIL) {
-        return -1;
-    }
-
-    if (tc_cmac_final(out, &state) == TC_CRYPTO_FAIL) {
+    if (mbedtls_cipher_cmac(mbedtls_cipher_info_from_type(MBEDTLS_CIPHER_AES_128_ECB),
+                            key, 128, in, len, out)) {
         return -1;
     }
 
diff --git a/nimble/controller/syscfg.yml b/nimble/controller/syscfg.yml
index 0f636f50f..d339fcf20 100644
--- a/nimble/controller/syscfg.yml
+++ b/nimble/controller/syscfg.yml
@@ -685,6 +685,9 @@ syscfg.vals.BLE_LL_ISO_BROADCASTER:
 syscfg.vals.'!BLE_HOST && !BABBLESIM':
     BLE_LL_HCI_VS_EVENT_ON_ASSERT: 1
 
+syscfg.vals:
+    MBEDTLS_CMAC_C: 1
+
 syscfg.restrictions:
     - BLE_TRANSPORT_LL == "native"
     - BLE_LL_PUBLIC_DEV_ADDR <= 0xffffffffffff