Dear Mbed TLS users,

We recently announced the release of Mbed TLS 3.6.0, starting the 3.6 long-term support branch. We intend for this to be the last 3.x feature release. Mbed TLS 3.6.x will as usual receive bug fixes (including security improvements), but no new features. This will allow the Mbed TLS team to focus on preparing the next major release, Mbed TLS 4.0, planned for 2025 (expect further updates when the timeline becomes more precise).

The main focus of Mbed TLS 4.0 is to complete the migration to PSA crypto APIs. This means that most mbedtls_xxx cryptography APIs will be removed. We expect mbedtls_x509 and mbedtls_ssl to change in relatively minor, but sometimes incompatible ways. Alongside this technical change, the crypto APIs will be published as a separate product, TF-PSA-Cryptohttps://github.com/Mbed-TLS/TF-PSA-Crypto (very early preview so far), while the X.509 and TLS libraries will continue to be called Mbed TLS.

The work on 4.0 will happen on the development branch in the mbedtls repository, so you can expect more instability than usual on that branch. The mbedtls-3.6https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-3.6 branch is available if you want the latest patches on Mbed TLS 3.6 LTS.

As usual, you can see our high-level plans in the roadmaphttps://mbed-tls.readthedocs.io/en/latest/project/roadmap/, and in more detail on GitHubhttps://github.com/Mbed-TLS/mbedtls/issues. Look for issues labeled api-breakhttps://github.com/Mbed-TLS/mbedtls/issues?q=is%3Aissue+is%3Aopen+label%3Aapi-break (note that we haven't filed issues on all topics yet). We will launch some consultations on the mbed-tls mailing listhttps://lists.trustedfirmware.org/mailman3/lists/mbed-tls.lists.trustedfirmware.org/ soon, to gather community input on some topics.

Many Thanks,

Nathan Sircombe (On behalf of the Mbed TLS development team)