Skip to content

subsys: jwt: remove JWT_SIGN_RSA_LEGACY #99802

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+11 −80
Open

subsys: jwt: remove JWT_SIGN_RSA_LEGACY #99802

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c9ac953
jwt: remove support for legacy RSA crypto
valeriosetti Nov 21, 2025
c7ac9a4
tests: subsys: jwt: remove tests for legacy RSA support
valeriosetti Nov 21, 2025
955e592
doc: migration-guide: add note for JWT_SIGN_RSA_LEGACY removal
valeriosetti Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions doc/releases/migration-guide-4.4.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,13 @@ Networking
Other subsystems
****************

JWT
===

* Previously deprecated ``CONFIG_JWT_SIGN_RSA_LEGACY`` is removed. This removal happens before
the usual deprecation period of 2 releases because it has been agreed (see :github:`97660`)
that Mbed TLS is an external module, so normal deprecation rules do not apply in this case.

Modules
*******

Expand Down
7 changes: 1 addition & 6 deletions subsys/jwt/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,6 @@

zephyr_library()
zephyr_library_sources(jwt.c)

zephyr_library_sources_ifdef(CONFIG_JWT_SIGN_RSA_LEGACY jwt_legacy_rsa.c)

if(CONFIG_JWT_SIGN_RSA_PSA OR CONFIG_JWT_SIGN_ECDSA_PSA)
zephyr_library_sources(jwt_psa.c)
endif()
zephyr_library_sources(jwt_psa.c)

zephyr_library_link_libraries_ifdef(CONFIG_MBEDTLS mbedTLS)
11 changes: 0 additions & 11 deletions subsys/jwt/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,6 @@ choice
help
Select which algorithm to use for signing JWT tokens.

config JWT_SIGN_RSA_LEGACY
bool "Use RSA signature (RS-256). Use Mbed TLS as crypto library [DEPRECATED]"
depends on ENTROPY_NODE_ENABLED
select DEPRECATED
select MBEDTLS
select MBEDTLS_MD_C
select MBEDTLS_RSA_C
select MBEDTLS_PKCS1_V15
select MBEDTLS_PKCS1_V21
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED

config JWT_SIGN_RSA_PSA
bool "Use RSA signature (RS-256). Use PSA Crypto API."
select PSA_CRYPTO
Expand Down
4 changes: 2 additions & 2 deletions subsys/jwt/jwt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

#include "jwt.h"

#if defined(CONFIG_JWT_SIGN_RSA_PSA) || defined(CONFIG_JWT_SIGN_RSA_LEGACY)
#if defined(CONFIG_JWT_SIGN_RSA_PSA)
#define JWT_SIGNATURE_LEN 256
#else /* CONFIG_JWT_SIGN_ECDSA_PSA */
#define JWT_SIGNATURE_LEN 64
Expand Down Expand Up @@ -143,7 +143,7 @@ static int jwt_add_header(struct jwt_builder *builder)
* Use https://www.base64encode.org/ for update
*/
const char jwt_header[] =
#if defined(CONFIG_JWT_SIGN_RSA_PSA) || defined(CONFIG_JWT_SIGN_RSA_LEGACY)
#if defined(CONFIG_JWT_SIGN_RSA_PSA)
/* {"alg":"RS256","typ":"JWT"} */
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9";
#else /* CONFIG_JWT_SIGN_ECDSA_PSA */
Expand Down
56 changes: 0 additions & 56 deletions subsys/jwt/jwt_legacy_rsa.c
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion tests/subsys/jwt/src/jwt-test-private.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*
*/

#if defined(CONFIG_JWT_SIGN_RSA_PSA) || defined(CONFIG_JWT_SIGN_RSA_LEGACY)
#if defined(CONFIG_JWT_SIGN_RSA_PSA)

/* To generate the key in the correct format use the following command:
* $ openssl genrsa 2048 | openssl rsa -outform DER | xxd -i
Expand Down
4 changes: 0 additions & 4 deletions tests/subsys/jwt/testcase.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,6 @@ tests:
# source.
- CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG=y
- CONFIG_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG_ALLOW_NON_CSPRNG=y
libraries.encoding.jwt.rsa.legacy:
filter: CSPRNG_ENABLED
extra_configs:
- CONFIG_JWT_SIGN_RSA_LEGACY=y
libraries.encoding.jwt.rsa.psa:
extra_configs:
- CONFIG_JWT_SIGN_RSA_PSA=y
Expand Down