zephyr PSA examples

[PabEmilio]

Hello,

I'm trying to run MCUboot with PSA and MbedTLS on Zephyr OS, but I'm getting a "key import failed -135" error when using ED25519 signature verification. Everything works fine without PSA, but fails when I enable:

CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
CONFIG_BOOT_ED25519_PSA=y
CONFIG_MBEDTLS_BUILTIN=y

Error logs:
[0:0:0.248,0] ed25519_psa: ED25519 key import failed -135
[0:0:0.285,0] mcuboot: Image in the primary slot is not valid!

Full boot log:
*** Booting MCUboot v2.2.0-115-g82bd4a76b284 ***
*** Using Zephyr OS build v4.2.0-1-gf8fec8b5f863 ***
[0:0:0.38,0] mcuboot: Starting bootloader
[0:0:0.13,0] mcuboot: context_boot_go: context_boot_go
[0:0:0.20,0] mcuboot: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x1
[0:0:0.29,0] mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[0:0:0.38,0] mcuboot: Boot source: none
[0:0:0.43,0] mcuboot: Image index: 0, Swap type: none
[0:0:0.49,0] mcuboot: boot_validate_slot: boot_validate_slot: slot 0, expected_swap_type 0
[0:0:0.58,0] mcuboot: bootutil_img_validate: bootutil_img_validate: flash area 0x800c46c
[0:0:0.67,0] mcuboot: bootutil_img_hash: bootutil_img_hash
[0:0:0.100,0] mcuboot: bootutil_tlv_iter_begin: bootutil_tlv_iter_begin: type 65535, prot == 0
[0:0:0.109,0] mcuboot: bootutil_img_validate: bootutil_img_validate: TLV off 64376, end 64516
[0:0:0.119,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: searching for 65535 (65535 is any) starting at 64376 ending at 64516
[0:0:0.132,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: TLV 16 found at 64380 (size 32)
[0:0:0.142,0] mcuboot: bootutil_img_validate: bootutil_img_validate: EXPECTED_HASH_TLV == 16
[0:0:0.152,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: searching for 65535 (65535 is any) starting at 64412 ending at 64516
[0:0:0.165,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: TLV 1 found at 64416 (size 32)
[0:0:0.175,0] mcuboot: bootutil_img_validate: bootutil_img_validate: EXPECTED_KEY_TLV == 1
[0:0:0.184,0] mcuboot: bootutil_find_key: bootutil_find_key
[0:0:0.191,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: searching for 65535 (65535 is any) starting at 64448 ending at 64516
[0:0:0.204,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: TLV 36 found at 64452 (size 64)
[0:0:0.215,0] mcuboot: bootutil_img_validate: bootutil_img_validate: EXPECTED_SIG_TLV == 36
[0:0:0.224,0] mcuboot: bootutil_verify_sig: bootutil_verify_sig: ED25519 key_id 0
[0:0:0.232,0] mcuboot: bootutil_verify: bootutil_verify: ED25519 key_id 0
[0:0:0.240,0] ed25519_psa: ED25519_verify: ED25519_verify: PSA implementation
[0:0:0.248,0] ed25519_psa: ED25519 key import failed -135
[0:0:0.255,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: searching for 65535 (65535 is any) starting at 64516 ending at 64516
[0:0:0.268,0] mcuboot: bootutil_tlv_iter_next: bootutil_tlv_iter_next: TLV 65535 not found
[0:0:0.277,0] mcuboot: Image in the primary slot is not valid!
[0:0:0.285,0] mcuboot: main: Left boot_go with success == 0
[0:0:0.291,0] mcuboot: Unable to find bootable image

Setup:

• Board: Nucleo-H563 (STM32H563ZI)
• Using root-ed25519.pem key from mcuboot repo
• Image signed with imgtool

Questions:

1. Are there any missing configurations for PSA with ED25519 on Zephyr?
2. Are there any working examples of MCUboot with PSA and ED25519 on Zephyr?

Any suggestions or examples would be greatly appreciated.

Thank you for your help,
Best regards,