obsproject · dsimidzija · Sep 2, 2026
diff --git a/cmake/finders/FindMbedTLS.cmake b/cmake/finders/FindMbedTLS.cmake
@@ -65,7 +65,7 @@ include(FindPackageHandleStandardArgs)
 
 find_package(PkgConfig QUIET)
 if(PKG_CONFIG_FOUND)
-  pkg_check_modules(PC_MbedTLS QUIET mbedtls mbedcrypto mbedx509)
+  pkg_check_modules(PC_MbedTLS QUIET mbedtls tfpsacrypto mbedx509)
 endif()
 
 # MbedTLS_set_soname: Set SONAME on imported library targets
@@ -235,7 +235,7 @@ if(MbedTLS_FOUND)
     set(MbedTLS_LIBRARIES ${MbedTLS_LIBRARY})
   else()
     set(MbedTLS_LIBRARIES ${MbedTLS_LIBRARY} ${MbedCrypto_LIBRARY} ${MbedX509_LIBRARY})
-    set_property(TARGET MbedTLS::mbedtls PROPERTY INTERFACE_LINK_LIBRARIES MbedTLS::mbedcrypto MbedTLS::mbedx509)
+    set_property(TARGET MbedTLS::mbedtls PROPERTY INTERFACE_LINK_LIBRARIES MbedTLS::tfpsacrypto MbedTLS::mbedx509)
   endif()
 endif()
 

diff --git a/frontend/cmake/feature-whatsnew.cmake b/frontend/cmake/feature-whatsnew.cmake
@@ -7,7 +7,7 @@ if(ENABLE_WHATSNEW AND TARGET OBS::browser-panels)
     include(cmake/feature-macos-update.cmake)
   elseif(OS_LINUX)
     set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE)
-    find_package(MbedTLS 3...<4 REQUIRED)
+    find_package(MbedTLS 4...<5 REQUIRED)
     set(CMAKE_FIND_PACKAGE_PREFER_CONFIG FALSE)
     find_package(nlohmann_json 3.11 REQUIRED)
 

diff --git a/frontend/cmake/os-windows.cmake b/frontend/cmake/os-windows.cmake
@@ -7,7 +7,7 @@ if(NOT TARGET OBS::w32-pthreads)
 endif()
 
 set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE)
-find_package(MbedTLS 3...<4 REQUIRED)
+find_package(MbedTLS 4...<5 REQUIRED)
 set(CMAKE_FIND_PACKAGE_PREFER_CONFIG FALSE)
 find_package(Detours REQUIRED)
 find_package(nlohmann_json 3.11 REQUIRED)

diff --git a/plugins/obs-outputs/CMakeLists.txt b/plugins/obs-outputs/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.28...3.30)
 
 set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE)
-find_package(MbedTLS 3...<4 REQUIRED)
+find_package(MbedTLS 4...<5 REQUIRED)
 set(CMAKE_FIND_PACKAGE_PREFER_CONFIG FALSE)
 find_package(ZLIB REQUIRED)
 find_package(jansson REQUIRED)

diff --git a/plugins/obs-outputs/librtmp/handshake.h b/plugins/obs-outputs/librtmp/handshake.h
@@ -25,17 +25,25 @@
 /* This file is #included in rtmp.c, it is not meant to be compiled alone */
 
 #if defined(USE_MBEDTLS)
-#include <mbedtls/md.h>
+#include <psa/crypto.h>
 #ifndef SHA256_DIGEST_LENGTH
 #define SHA256_DIGEST_LENGTH	32
 #endif
-typedef mbedtls_md_context_t *HMAC_CTX;
-#define HMAC_setup(ctx, key, len)	ctx = malloc(sizeof(mbedtls_md_context_t)); mbedtls_md_init(ctx); \
-  mbedtls_md_setup(ctx, mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), 1); \
-  mbedtls_md_hmac_starts(ctx, (const unsigned char *)key, len)
-#define HMAC_crunch(ctx, buf, len)	mbedtls_md_hmac_update(ctx, buf, len)
-#define HMAC_finish(ctx, dig)		mbedtls_md_hmac_finish(ctx, dig)
-#define HMAC_close(ctx)			mbedtls_md_free(ctx); free(ctx); ctx = NULL
+typedef psa_mac_operation_t HMAC_CTX;
+const psa_algorithm_t mbedtls_hmac_alg = PSA_ALG_HMAC(PSA_ALG_SHA_256);
+
+#define HMAC_setup(ctx, key, len) psa_crypto_init(); \
+    ctx = psa_mac_operation_init(); \
+    mbedtls_svc_key_id_t key_id; \
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; \
+    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE); \
+    psa_set_key_algorithm(&attributes, mbedtls_hmac_alg); \
+    psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC); \
+    psa_import_key(&attributes, key, len, &key_id); \
+    psa_mac_sign_setup(&ctx, key_id, mbedtls_hmac_alg)
+#define HMAC_crunch(ctx, buf, len)	psa_mac_update(&ctx, buf, len)
+#define HMAC_finish(ctx, dig, digestLen) psa_mac_sign_finish(&ctx, dig, SHA256_DIGEST_LENGTH, &digestLen)
+#define HMAC_close(ctx) psa_mac_abort(&ctx)
 
 #elif defined(USE_POLARSSL)
 #include <polarssl/sha2.h>
@@ -171,13 +179,17 @@ static void
 HMACsha256(const uint8_t *message, size_t messageLen, const uint8_t *key,
            size_t keylen, uint8_t *digest)
 {
+#if defined(USE_MBEDTLS)
+    size_t digestLen;
+#else
     unsigned int digestLen;
+#endif
     HMAC_CTX ctx;
 
     HMAC_setup(ctx, key, keylen);
     HMAC_crunch(ctx, message, messageLen);
 
-#if defined(USE_MBEDTLS) || defined(USE_POLARSSL) || defined(USE_GNUTLS)
+#if defined(USE_POLARSSL) || defined(USE_GNUTLS)
     digestLen = SHA256_DIGEST_LENGTH;
     HMAC_finish(ctx, digest);
 #else

diff --git a/plugins/obs-outputs/librtmp/rtmp.c b/plugins/obs-outputs/librtmp/rtmp.c
@@ -53,8 +53,7 @@
 #include <Security/Security.h>
 #endif
 
-#include <mbedtls/ctr_drbg.h>
-#include <mbedtls/md5.h>
+#include <psa/crypto.h>
 #include <mbedtls/base64.h>
 #define MD5_DIGEST_LENGTH 16
 
@@ -373,18 +372,10 @@ RTMP_TLS_Init(RTMP *r)
 {
 #ifdef CRYPTO
 #if defined(USE_MBEDTLS)
-    const char * pers = "RTMP_TLS";
     r->RTMP_TLS_ctx = calloc(1,sizeof(struct tls_ctx));
 
+    psa_crypto_init();
     mbedtls_ssl_config_init(&r->RTMP_TLS_ctx->conf);
-    mbedtls_ctr_drbg_init(&r->RTMP_TLS_ctx->ctr_drbg);
-    mbedtls_entropy_init(&r->RTMP_TLS_ctx->entropy);
-
-    mbedtls_ctr_drbg_seed(&r->RTMP_TLS_ctx->ctr_drbg,
-                          mbedtls_entropy_func,
-                          &r->RTMP_TLS_ctx->entropy,
-                          (const unsigned char *)pers,
-                          strlen(pers));
 
     RTMP_TLS_LoadCerts(r);
 #elif defined(USE_POLARSSL)
@@ -423,8 +414,6 @@ RTMP_TLS_Free(RTMP *r) {
     if (!r->RTMP_TLS_ctx)
         return;
     mbedtls_ssl_config_free(&r->RTMP_TLS_ctx->conf);
-    mbedtls_ctr_drbg_free(&r->RTMP_TLS_ctx->ctr_drbg);
-    mbedtls_entropy_free(&r->RTMP_TLS_ctx->entropy);
 
     if (r->RTMP_TLS_ctx->cacert) {
         mbedtls_x509_crt_free(r->RTMP_TLS_ctx->cacert);
@@ -2618,17 +2607,18 @@ b64enc(const unsigned char *input, int length, char *output, int maxsize)
 }
 
 #if defined(USE_MBEDTLS)
-typedef	mbedtls_md5_context MD5_CTX;
-
-#if MBEDTLS_VERSION_NUMBER >= 0x02070000 && MBEDTLS_VERSION_MAJOR < 3
-#define MD5_Init(ctx)	mbedtls_md5_init(ctx); mbedtls_md5_starts_ret(ctx)
-#define MD5_Update(ctx,data,len)	mbedtls_md5_update_ret(ctx,(unsigned char *)data,len)
-#define MD5_Final(dig,ctx)	mbedtls_md5_finish_ret(ctx,dig); mbedtls_md5_free(ctx)
-#else
-#define MD5_Init(ctx)	mbedtls_md5_init(ctx); mbedtls_md5_starts(ctx)
-#define MD5_Update(ctx,data,len)	mbedtls_md5_update(ctx,(unsigned char *)data,len)
-#define MD5_Final(dig,ctx)	mbedtls_md5_finish(ctx,dig); mbedtls_md5_free(ctx)
-#endif
+typedef	psa_hash_operation_t MD5_CTX;
+const psa_algorithm_t mbedtls_md5_alg = PSA_ALG_MD5;
+#define MD5_Init(ctx)	psa_crypto_init(); \
+    *ctx = psa_hash_operation_init(); \
+    psa_hash_setup(ctx, mbedtls_md5_alg)
+#define MD5_Update(ctx,data,len) psa_hash_update(ctx,(const uint8_t *)data,len)
+#define MD5_Final(dig,ctx)  \
+    do { \
+        size_t hash_len; \
+        psa_hash_finish(ctx, dig, sizeof(dig), &hash_len); \
+        psa_hash_abort(ctx); \
+    } while (0)
 
 #elif defined(USE_POLARSSL)
 #define MD5_CTX	md5_context

diff --git a/plugins/obs-outputs/librtmp/rtmp.h b/plugins/obs-outputs/librtmp/rtmp.h
@@ -60,8 +60,6 @@
 #endif
 
 #include <mbedtls/ssl.h>
-#include <mbedtls/ctr_drbg.h>
-#include <mbedtls/entropy.h>
 
 #define my_dhm_P \
     "E4004C1F94182000103D883A448B3F80" \
@@ -79,8 +77,6 @@
 
 typedef struct tls_ctx
 {
-    mbedtls_entropy_context entropy;
-    mbedtls_ctr_drbg_context ctr_drbg;
     mbedtls_ssl_config conf;
     mbedtls_ssl_session ssn;
     mbedtls_x509_crt *cacert;
@@ -93,7 +89,6 @@ typedef tls_ctx *TLS_CTX;
   s = malloc(sizeof(mbedtls_ssl_context));\
   mbedtls_ssl_init(s);\
   mbedtls_ssl_config_defaults(&ctx->conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);\
-  mbedtls_ssl_conf_rng(&ctx->conf, mbedtls_ctr_drbg_random, &ctx->ctr_drbg);\
   mbedtls_ssl_conf_authmode(&ctx->conf, MBEDTLS_SSL_VERIFY_REQUIRED);\
   mbedtls_ssl_setup(s, &ctx->conf)
 

diff --git a/plugins/obs-outputs/obs-outputs.c b/plugins/obs-outputs/obs-outputs.c
@@ -5,6 +5,10 @@
 #include <mbedtls/threading.h>
 #endif
 
+#if defined(USE_MBEDTLS)
+#include <psa/crypto.h>
+#endif
+
 OBS_DECLARE_MODULE()
 OBS_MODULE_USE_DEFAULT_LOCALE("obs-outputs", "en-US")
 MODULE_EXPORT const char *obs_module_description(void)
@@ -70,6 +74,10 @@ bool obs_module_load(void)
 
 void obs_module_unload(void)
 {
+#if defined(USE_MBEDTLS)
+	mbedtls_psa_crypto_free();
+#endif
+
 #ifdef _WIN32
 #ifdef MBEDTLS_THREADING_ALT
 	mbedtls_threading_free_alt();