Build fails during TF-M stage due to prerequisites missing with Firmware SDK enabled

Description

Enabling CONFIG_GOLIOTH_FIRMWARE_SDK
with the following other options in the config:

#Golioth enable:
CONFIG_GOLIOTH_FIRMWARE_SDK=y
CONFIG_MBEDTLS_LEGACY_CRYPTO_C=y
CONFIG_MBEDTLS_ECP_C=y

Playing around with AI to try and find the missing kConfig options has not proven fruitful. And I don’t appear to be missing anything that is in any of the examples.

Any advise would be greatly appreciated

Expected Behavior

Build should suceed as when the SDK is disabled

Actual Behavior

Code continouly gets hung up at same location during the build process.

Environment

Working on NRF Connect v3.1.1, with firmware sdk V0.21.1
On a NRF 9160 MCU running on a custom board

Logs and Console Output

In file included from C:/ncs/v3.1.1/modules/crypto/oberon-psa-crypto/include/mbedtls/build_info.h:192,
from C:/ncs/v3.1.1/modules/crypto/oberon-psa-crypto/include/psa/build_info.h:18,
from C:/ncs/v3.1.1/modules/crypto/oberon-psa-crypto/include/psa/crypto_platform.h:32,
from C:/ncs/v3.1.1/modules/crypto/oberon-psa-crypto/include/psa/crypto.h:16,
from C:/ncs/v3.1.1/modules/tee/tf-m/trusted-firmware-m/interface/include/tfm_crypto_defs.h:15,
from C:/ncs/v3.1.1/modules/tee/tf-m/trusted-firmware-m/interface/src/tfm_crypto_api.c:12:
C:/ncs/v3.1.1/modules/crypto/mbedtls/include/mbedtls/check_config.h:333:2: error: #error “MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites”
333 | #error “MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites”
| ^~~~~
C:/ncs/v3.1.1/modules/crypto/mbedtls/include/mbedtls/check_config.h:344:2: error: #error “MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites”
344 | #error “MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites”
| ^~~~~

Additional Information

Full Kconfig is as follows:
#MCUBoot
CONFIG_MCUMGR=y
CONFIG_UART_MCUMGR=y
CONFIG_ZCBOR=y
CONFIG_IMG_MANAGER=y

#C library stuff
CONFIG_NEWLIB_LIBC_NANO=n
CONFIG_NEWLIB_LIBC=y
CONFIG_NEWLIB_LIBC_FLOAT_PRINTF=y
CONFIG_CBPRINTF_FP_SUPPORT=y
CONFIG_CJSON_LIB=y

#General Stuff
CONFIG_COMMON_LIBC_MALLOC=y
CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=32768
CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=1024

#Other Stuff so far
CONFIG_PM_DEVICE=y
CONFIG_POSIX_API=y

#Shell Stuff
CONFIG_SHELL=y
CONFIG_SHELL_BACKEND_SERIAL=y

#I2C Stuff
CONFIG_I2C=y
CONFIG_RTC=y
CONFIG_RTC_ALARM=y
CONFIG_RTC_PCF8523=y

#SPI Stuff
CONFIG_SPI=y

#Flash Stuff
CONFIG_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_STREAM_FLASH=y
CONFIG_NVS=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_MPU_ALLOW_FLASH_WRITE=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
CONFIG_MCUBOOT_IMG_MANAGER=y
CONFIG_IMG_MANAGER=y

#Logging
CONFIG_LOG=y
CONFIG_LOG_BACKEND_UART=n
CONFIG_NRF_MODEM_LOG=y

#Networking
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_DNS_RESOLVER=y
CONFIG_NET_SHELL=n
CONFIG_NET_IPV4=y
CONFIG_NET_IPV6=y
CONFIG_NET_IPV6_NBR_CACHE=n
CONFIG_NET_IPV6_MLD=n
CONFIG_NRF_MODEM_LIB=y
CONFIG_NET_CONNECTION_MANAGER=y
CONFIG_NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE=1024
CONFIG_LTE_LINK_CONTROL=y
CONFIG_MODEM_INFO=y
CONFIG_SNTP=y
#These should be adjusted they are taken from somewhere else!

PSM & eDRX enable

CONFIG_LTE_LC_EDRX_MODULE=y
CONFIG_LTE_LC_PSM_MODULE=y
CONFIG_LTE_LC_MODEM_SLEEP_MODULE=y
CONFIG_LTE_LC_TAU_PRE_WARNING_MODULE=y
CONFIG_LTE_EDRX_REQ=y
CONFIG_LTE_PSM_REQ=y
CONFIG_LTE_PSM_REQ_RPTAU=“00000001” # 10 Minutes checkin interval
#CONFIG_LTE_PSM_REQ_RPTAU=“00000110” # 60 Minutes checkin interval
CONFIG_LTE_PSM_REQ_RAT=“00000011” # 6 sec active time
#CONFIG_LTE_PSM_REQ_RAT=“00000101” # 10 sec active time
CONFIG_LTE_LC_TAU_PRE_WARNING_NOTIFICATIONS=y
CONFIG_LTE_LC_TAU_PRE_WARNING_THRESHOLD_MS=60000
CONFIG_LTE_LC_MODEM_SLEEP_NOTIFICATIONS=y
CONFIG_LTE_LC_MODEM_SLEEP_NOTIFICATIONS_THRESHOLD_MS=60000
#inncreased sysworkq size, due to LTE connectivity
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048

#Golioth enable:
CONFIG_GOLIOTH_FIRMWARE_SDK=y
CONFIG_MBEDTLS_LEGACY_CRYPTO_C=y
CONFIG_MBEDTLS_ECP_C=y

#Configurations for TTC Installation
CONFIG_MODBUS=y
CONFIG_MODBUS_ROLE_SERVER=y

#Debug
CONFIG_DEBUG=y
CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_COREDUMP=y
CONFIG_AT_SHELL=y

Hey @CMabon,

From the error messages, it looks like mbedTLS sanity checks are firing because a DHE ciphersuite mode is enabled, but not all of its prerequisites are.

For Golioth, you don’t need DHE-RSA or DHE-PSK key exchange modes, so you can safely disable them with:

CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=n
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=n

As a reference point, it’s also worth checking the minimal project configuration used in our examples for nRF9160 DK, which is often the quickest way to sanity-check and track down config issues like this.