manifest: sdk-connectedhomeip: Update revision

This commit updates the revision of Matter SDK as well as clarify how to
enable CC3xx support for samples with PSA.

Signed-off-by: Łukasz Duda <[email protected]>

Author: LuDuda

doc/nrf/protocols/matter/end_product/security.rst

@@ -120,11 +120,13 @@ This is a reference configuration that can be modified in the production firmwar
      - Trusted Firmware-M (TF-M)
 
 .. [1] The CryptoCell backend is used in parallel with the Oberon backend.
-       It is only used to implement Random Nuber Generation (RNG), and the AED keys derivation driver (only for Thread networking).
-       For all other cryptographic operations, the Oberon backend is used.
+       By default, the CryptoCell backend is used only for Random Number Generation (RNG) and the AEAD key derivation driver.
+       To enable the CryptoCell backend for additional operations, set the :kconfig:option:`CONFIG_PSA_CRYPTO_DRIVER_CC3XX` Kconfig option to true.
 
-.. [2] When the CRACEN driver is used in parallel with the Oberon driver, you need to disable specific CRACEN cryptographic operations to use the Oberon ones.
-       This is because the CRACEN driver has priority when both are enabled.
+.. [2] The CRACEN backend is used in parallel with the Oberon backend.
+       The CRACEN backend is used by default for any supported cryptographic operations.
+       For all other operations not supported by CRACEN, the Oberon backend is used.
+       To use the Oberon backend for specific cryptographic operations supported by both drivers, disable those operations in the CRACEN driver, as it takes priority when both are enabled.
        See the :ref:`nrf_security_drivers` documentation for more information.
 
 Securing production devices

samples/matter/template/sample.yaml

@@ -84,3 +84,12 @@ tests:
       - nrf54l15dk/nrf54l15/cpuapp
     platform_allow: nrf54l15dk/nrf54l15/cpuapp
     tags: sysbuild ci_samples_matter
+  sample.matter.template.cc3xx_backend:
+    sysbuild: true
+    build_only: true
+    extra_args: CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
+    integration_platforms:
+      - nrf52840dk/nrf52840
+      - nrf5340dk/nrf5340/cpuapp
+    platform_allow: nrf52840dk/nrf52840 nrf5340dk/nrf5340/cpuapp
+    tags: sysbuild ci_samples_matter

subsys/net/openthread/Kconfig

@@ -33,7 +33,7 @@ endchoice
 config OPENTHREAD_NRF_SECURITY_PSA
 	bool
 	select NRF_SECURITY
-	select MBEDTLS_ENABLE_HEAP if !OPENTHREAD_COPROCESSOR_RCP
+	select MBEDTLS_ENABLE_HEAP if (!OPENTHREAD_COPROCESSOR_RCP && !BUILD_WITH_TFM && !PSA_SSF_CRYPTO_CLIENT)
 	select MBEDTLS_TLS_LIBRARY if (OPENTHREAD_JOINER || OPENTHREAD_COMMISSIONER || OPENTHREAD_COAPS)
 	select MBEDTLS_PEM_PARSE_C if (OPENTHREAD_COAPS || OPENTHREAD_BLE_TCAT)
 	select PSA_WANT_ALG_HKDF

west.yml

@@ -161,7 +161,7 @@ manifest:
     - name: matter
       repo-path: sdk-connectedhomeip
       path: modules/lib/matter
-      revision: 973259c02f828604d060ada0ea076dbbf42ab087
+      revision: bdec5fd36f56f445c673ac14f9f09377b66ba49b
       west-commands: scripts/west/west-commands.yml
       submodules:
         - name: nlio