[padelsbach]

Enrollment is an Mbed specific feature (not in PSA) to specify an optional second algorithm for a given key. It is used by Zephyr hostap and ESP-IDF. Initial support is "volatile" only, meaning it is not stored on disk via psa_key_storage. That will be a follow-up PR which requires reworking the storage format.

[Copilot]

🟡 Changes recommended

Policy checks ignore the enrollment algorithm, causing valid enrollment-authorized wrapping, KEM, and one-shot AEAD operations to be rejected.

1 open issue

• Policy checks reject permitted enrollment algorithms · New

What changed in this PR

Adds opt-in support for Mbed TLS enrollment algorithms on volatile wolfPSA keys, supporting integrations such as Zephyr hostap and ESP-IDF without changing persistent storage.

Changes:

• Adds enrollment-algorithm accessors and Makefile/Zephyr configuration options.
• Extends algorithm permission checks and key-copy handling to include the secondary algorithm.
• Adds enrollment-enabled tests while retaining rejection of persistent enrollment policies.

File	Description
zephyr/​Kconfig	Adds the enrollment feature option.
zephyr/​CMakeLists.txt	Propagates the enrollment compile definition.
wolfpsa/​psa/​crypto_struct.h	Adds enrollment-algorithm accessors.
wolfpsa/​psa_key_storage.h	Declares the shared algorithm-permission helper.
test/​psa_server/​psa_enrollment_alg_test.c	Tests operations, copying, and persistent-key behavior.
test/​psa_server/​psa_api_test.c	Updates expectations for optional volatile enrollment support.
test/​Makefile	Builds and cleans the enrollment-enabled test variant.
src/​psa_mac.c	Checks both permitted MAC algorithms.
src/​psa_key_storage.c	Handles enrollment import, copying, and permission checks.
src/​psa_key_derivation.c	Accepts enrollment policies for derivation inputs.
src/​psa_cipher.c	Uses the shared algorithm-permission helper.
src/​psa_asymmetric_api.c	Checks both algorithms for asymmetric operations.
src/​psa_aead.c	Extends shared AEAD policy checks to enrollment algorithms.
Makefile	Adds the feature flag and enrollment unit-test target.
.gitignore	Ignores enrollment build artifacts and development caches.

_{Review effort: Balanced}