diff --git a/components/esp_hw_support/esp_ds.c b/components/esp_hw_support/esp_ds.c
index 632bd491ff..155d6f5d96 100644
--- a/components/esp_hw_support/esp_ds.c
+++ b/components/esp_hw_support/esp_ds.c
@@ -29,6 +29,7 @@
 #include "hal/ds_ll.h"
 #include "hal/hmac_hal.h"
 #include "hal/hmac_ll.h"
+#include "hal/sha_ll.h"
 #endif /* !CONFIG_IDF_TARGET_ESP32S2 */
 
 #if CONFIG_IDF_TARGET_ESP32S2
@@ -270,7 +271,10 @@ static void ds_acquire_enable(void)
         hmac_ll_reset_register();
     }
 
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 
     DS_RCC_ATOMIC() {
         ds_ll_enable_bus_clock(true);
@@ -288,7 +292,9 @@ static void ds_disable_release(void)
         ds_ll_enable_bus_clock(false);
     }
 
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
 
     HMAC_RCC_ATOMIC() {
         hmac_ll_enable_bus_clock(false);
@@ -445,7 +451,10 @@ esp_err_t esp_ds_encrypt_params(esp_ds_data_t *data,
         aes_ll_reset_register();
     }
 
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 
     ets_ds_data_t *ds_data = (ets_ds_data_t *) data;
     const ets_ds_p_data_t *ds_plain_data = (const ets_ds_p_data_t *) p_data;
@@ -456,7 +465,9 @@ esp_err_t esp_ds_encrypt_params(esp_ds_data_t *data,
         result = ESP_ERR_INVALID_ARG;
     }
 
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
 
     AES_RCC_ATOMIC() {
         aes_ll_enable_bus_clock(false);
diff --git a/components/esp_hw_support/esp_hmac.c b/components/esp_hw_support/esp_hmac.c
index 34df0aac4e..9facad6e03 100644
--- a/components/esp_hw_support/esp_hmac.c
+++ b/components/esp_hw_support/esp_hmac.c
@@ -21,6 +21,7 @@
 #include "hal/ds_ll.h"
 #include "hal/hmac_hal.h"
 #include "hal/hmac_ll.h"
+#include "hal/sha_ll.h"
 #include "esp_private/periph_ctrl.h"
 #endif
 
@@ -75,7 +76,10 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
         hmac_ll_reset_register();
     }
 
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 
     DS_RCC_ATOMIC() {
         ds_ll_enable_bus_clock(true);
@@ -146,7 +150,9 @@ esp_err_t esp_hmac_calculate(hmac_key_id_t key_id,
         ds_ll_enable_bus_clock(false);
     }
 
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
 
     HMAC_RCC_ATOMIC() {
         hmac_ll_enable_bus_clock(false);
diff --git a/components/esp_hw_support/include/esp_private/esp_crypto_lock_internal.h b/components/esp_hw_support/include/esp_private/esp_crypto_lock_internal.h
index ac25ad1bc1..734baea164 100644
--- a/components/esp_hw_support/include/esp_private/esp_crypto_lock_internal.h
+++ b/components/esp_hw_support/include/esp_private/esp_crypto_lock_internal.h
@@ -20,6 +20,7 @@ extern "C" {
 #define DS_RCC_ATOMIC()
 #define ECDSA_RCC_ATOMIC()
 #define AES_RCC_ATOMIC()
+#define SHA_RCC_ATOMIC()
 #else /* !SOC_RCC_IS_INDEPENDENT */
 #define MPI_RCC_ATOMIC() PERIPH_RCC_ATOMIC()
 #define ECC_RCC_ATOMIC() PERIPH_RCC_ATOMIC()
@@ -27,6 +28,7 @@ extern "C" {
 #define DS_RCC_ATOMIC() PERIPH_RCC_ATOMIC()
 #define ECDSA_RCC_ATOMIC() PERIPH_RCC_ATOMIC()
 #define AES_RCC_ATOMIC() PERIPH_RCC_ATOMIC()
+#define SHA_RCC_ATOMIC() PERIPH_RCC_ATOMIC()
 #endif /* SOC_RCC_IS_INDEPENDENT */
 
 #ifdef __cplusplus
diff --git a/components/esp_rom/include/esp32p4/rom/sha.h b/components/esp_rom/include/esp32p4/rom/sha.h
index e9a299f1fe..c4dec1f9c2 100644
--- a/components/esp_rom/include/esp32p4/rom/sha.h
+++ b/components/esp_rom/include/esp32p4/rom/sha.h
@@ -18,6 +18,11 @@ typedef enum {
     SHA1 = 0,
     SHA2_224,
     SHA2_256,
+    SHA2_384,
+    SHA2_512,
+    SHA2_512224,
+    SHA2_512256,
+    SHA2_512T,
     SHA_TYPE_MAX
 } SHA_TYPE;
 
diff --git a/components/hal/esp32/include/hal/sha_ll.h b/components/hal/esp32/include/hal/sha_ll.h
index 5740d076e8..f321c2be09 100644
--- a/components/hal/esp32/include/hal/sha_ll.h
+++ b/components/hal/esp32/include/hal/sha_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,6 +7,7 @@
 
 #include <stdbool.h>
 #include "hal/sha_types.h"
+#include "soc/dport_reg.h"
 #include "soc/hwcrypto_reg.h"
 #include "soc/dport_access.h"
 #include "hal/misc.h"
@@ -17,6 +18,40 @@ extern "C" {
 
 #define SHA_LL_TYPE_OFFSET 0x10
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    if (enable) {
+        DPORT_SET_PERI_REG_MASK(DPORT_PERI_CLK_EN_REG, DPORT_PERI_EN_SHA);
+    } else {
+        DPORT_CLEAR_PERI_REG_MASK(DPORT_PERI_CLK_EN_REG, DPORT_PERI_EN_SHA);
+    }
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_enable_bus_clock(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_enable_bus_clock(__VA_ARGS__)
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    DPORT_SET_PERI_REG_MASK(DPORT_PERI_RST_EN_REG, DPORT_PERI_EN_SHA);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERI_RST_EN_REG, DPORT_PERI_EN_SHA);
+
+    // Clear reset on secure boot also, otherwise SHA is held in reset
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERI_RST_EN_REG, DPORT_PERI_EN_SECUREBOOT);
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_reset_register(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_reset_register(__VA_ARGS__)
+
 /**
  * @brief Returns the LOAD_REG register address for the given sha type
  *
diff --git a/components/hal/esp32c2/include/hal/sha_ll.h b/components/hal/esp32c2/include/hal/sha_ll.h
index 5bb746732a..4877e4ba55 100644
--- a/components/hal/esp32c2/include/hal/sha_ll.h
+++ b/components/hal/esp32c2/include/hal/sha_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,6 +7,7 @@
 
 #include <stdbool.h>
 #include "soc/hwcrypto_reg.h"
+#include "soc/system_struct.h"
 #include "hal/sha_types.h"
 
 #ifdef __cplusplus
@@ -14,6 +15,33 @@ extern "C" {
 #endif
 
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    SYSTEM.perip_clk_en1.crypto_sha_clk_en = enable;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_enable_bus_clock(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_enable_bus_clock(__VA_ARGS__)
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    SYSTEM.perip_rst_en1.crypto_sha_rst = 1;
+    SYSTEM.perip_rst_en1.crypto_sha_rst = 0;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_reset_register(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_reset_register(__VA_ARGS__)
+
 /**
  * @brief Start a new SHA block conversions (no initial hash in HW)
  *
diff --git a/components/hal/esp32c3/include/hal/sha_ll.h b/components/hal/esp32c3/include/hal/sha_ll.h
index 8f92ef950b..4ad996b59f 100644
--- a/components/hal/esp32c3/include/hal/sha_ll.h
+++ b/components/hal/esp32c3/include/hal/sha_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,12 +7,43 @@
 
 #include <stdbool.h>
 #include "soc/hwcrypto_reg.h"
+#include "soc/system_struct.h"
 #include "hal/sha_types.h"
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    SYSTEM.perip_clk_en1.reg_crypto_sha_clk_en = enable;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_enable_bus_clock(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_enable_bus_clock(__VA_ARGS__)
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    SYSTEM.perip_rst_en1.reg_crypto_sha_rst = 1;
+    SYSTEM.perip_rst_en1.reg_crypto_sha_rst = 0;
+
+    // Clear reset on digital signature and hmac also, otherwise SHA is held in reset
+    SYSTEM.perip_rst_en1.reg_crypto_ds_rst = 0;
+    SYSTEM.perip_rst_en1.reg_crypto_hmac_rst = 0;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_reset_register(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_reset_register(__VA_ARGS__)
 
 /**
  * @brief Start a new SHA block conversions (no initial hash in HW)
diff --git a/components/hal/esp32c6/include/hal/sha_ll.h b/components/hal/esp32c6/include/hal/sha_ll.h
index 1191bfafca..ada6544337 100644
--- a/components/hal/esp32c6/include/hal/sha_ll.h
+++ b/components/hal/esp32c6/include/hal/sha_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,12 +7,35 @@
 
 #include <stdbool.h>
 #include "soc/hwcrypto_reg.h"
+#include "soc/pcr_struct.h"
 #include "hal/sha_types.h"
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    PCR.sha_conf.sha_clk_en = enable;
+}
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    PCR.sha_conf.sha_rst_en = 1;
+    PCR.sha_conf.sha_rst_en = 0;
+
+    // Clear reset on digital signature and hmac also, otherwise SHA is held in reset
+    PCR.ds_conf.ds_rst_en = 0;
+    PCR.hmac_conf.hmac_rst_en = 0;
+}
 
 /**
  * @brief Start a new SHA block conversions (no initial hash in HW)
diff --git a/components/hal/esp32h2/include/hal/sha_ll.h b/components/hal/esp32h2/include/hal/sha_ll.h
index 063159232c..0203449566 100644
--- a/components/hal/esp32h2/include/hal/sha_ll.h
+++ b/components/hal/esp32h2/include/hal/sha_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -7,12 +7,36 @@
 
 #include <stdbool.h>
 #include "soc/hwcrypto_reg.h"
+#include "soc/pcr_struct.h"
 #include "hal/sha_types.h"
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    PCR.sha_conf.sha_clk_en = enable;
+}
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    PCR.sha_conf.sha_rst_en = 1;
+    PCR.sha_conf.sha_rst_en = 0;
+
+    // Clear reset on digital signature, hmac and ecdsa also, otherwise SHA is held in reset
+    PCR.ds_conf.ds_rst_en = 0;
+    PCR.hmac_conf.hmac_rst_en = 0;
+    PCR.ecdsa_conf.ecdsa_rst_en = 0;
+}
 
 /**
  * @brief Start a new SHA block conversions (no initial hash in HW)
diff --git a/components/hal/esp32p4/include/hal/sha_ll.h b/components/hal/esp32p4/include/hal/sha_ll.h
new file mode 100644
index 0000000000..fba3b75221
--- /dev/null
+++ b/components/hal/esp32p4/include/hal/sha_ll.h
@@ -0,0 +1,200 @@
+/*
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include <stdbool.h>
+#include "hal/sha_types.h"
+#include "soc/hp_sys_clkrst_struct.h"
+#include "soc/hwcrypto_reg.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    HP_SYS_CLKRST.peri_clk_ctrl25.reg_crypto_sha_clk_en = enable;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_enable_bus_clock(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_enable_bus_clock(__VA_ARGS__)
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    HP_SYS_CLKRST.hp_rst_en2.reg_rst_en_sha = 1;
+    HP_SYS_CLKRST.hp_rst_en2.reg_rst_en_sha = 0;
+
+    // Clear reset on digital signature, hmac and ecdsa, otherwise SHA is held in reset
+    HP_SYS_CLKRST.hp_rst_en2.reg_rst_en_ds = 0;
+    HP_SYS_CLKRST.hp_rst_en2.reg_rst_en_hmac = 0;
+    HP_SYS_CLKRST.hp_rst_en2.reg_rst_en_ecdsa = 0;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_reset_register(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_reset_register(__VA_ARGS__)
+
+/**
+ * @brief Start a new SHA block conversions (no initial hash in HW)
+ *
+ * @param sha_type The SHA algorithm type
+ */
+static inline void sha_ll_start_block(esp_sha_type sha_type)
+{
+    REG_WRITE(SHA_MODE_REG, sha_type);
+    REG_WRITE(SHA_START_REG, 1);
+}
+
+/**
+ * @brief Continue a SHA block conversion (initial hash in HW)
+ *
+ * @param sha_type The SHA algorithm type
+ */
+static inline void sha_ll_continue_block(esp_sha_type sha_type)
+{
+    REG_WRITE(SHA_MODE_REG, sha_type);
+    REG_WRITE(SHA_CONTINUE_REG, 1);
+}
+
+/**
+ * @brief Start a new SHA message conversion using DMA (no initial hash in HW)
+ *
+ * @param sha_type The SHA algorithm type
+ */
+static inline void sha_ll_start_dma(esp_sha_type sha_type)
+{
+    REG_WRITE(SHA_MODE_REG, sha_type);
+    REG_WRITE(SHA_DMA_START_REG, 1);
+}
+
+/**
+ * @brief Continue a SHA message conversion using DMA (initial hash in HW)
+ *
+ * @param sha_type The SHA algorithm type
+ */
+static inline void sha_ll_continue_dma(esp_sha_type sha_type)
+{
+    REG_WRITE(SHA_MODE_REG, sha_type);
+    REG_WRITE(SHA_DMA_CONTINUE_REG, 1);
+}
+
+/**
+ * @brief Load the current hash digest to digest register
+ *
+ * @note Happens automatically on ESP32P4
+ *
+ * @param sha_type The SHA algorithm type
+ */
+static inline void sha_ll_load(esp_sha_type sha_type)
+{
+}
+
+/**
+ * @brief Sets the number of message blocks to be hashed
+ *
+ * @note DMA operation only
+ *
+ * @param num_blocks Number of message blocks to process
+ */
+static inline void sha_ll_set_block_num(size_t num_blocks)
+{
+    REG_WRITE(SHA_DMA_BLOCK_NUM_REG, num_blocks);
+}
+
+/**
+ * @brief Checks if the SHA engine is currently busy hashing a block
+ *
+ * @return true SHA engine busy
+ * @return false SHA engine idle
+ */
+static inline bool sha_ll_busy(void)
+{
+    return REG_READ(SHA_BUSY_REG);
+}
+
+/**
+ * @brief Write a text (message) block to the SHA engine
+ *
+ * @param input_text Input buffer to be written to the SHA engine
+ * @param block_word_len Number of words in block
+ */
+static inline void sha_ll_fill_text_block(const void *input_text, size_t block_word_len)
+{
+    uint32_t *data_words = (uint32_t *)input_text;
+    uint32_t *reg_addr_buf = (uint32_t *)(SHA_M_MEM);
+
+    for (int i = 0; i < block_word_len; i++) {
+        REG_WRITE(&reg_addr_buf[i], data_words[i]);
+    }
+}
+
+/**
+ * @brief Read the message digest from the SHA engine
+ *
+ * @param sha_type The SHA algorithm type
+ * @param digest_state Buffer that message digest will be written to
+ * @param digest_word_len Length of the message digest
+ */
+static inline void sha_ll_read_digest(esp_sha_type sha_type, void *digest_state, size_t digest_word_len)
+{
+    uint32_t *digest_state_words = (uint32_t *)digest_state;
+    const size_t REG_WIDTH = sizeof(uint32_t);
+
+    for (size_t i = 0; i < digest_word_len; i++) {
+        digest_state_words[i] = REG_READ(SHA_H_MEM + (i * REG_WIDTH));
+    }
+
+}
+
+/**
+ * @brief Write the message digest to the SHA engine
+ *
+ * @param sha_type The SHA algorithm type
+ * @param digest_state Message digest to be written to SHA engine
+ * @param digest_word_len Length of the message digest
+ */
+static inline void sha_ll_write_digest(esp_sha_type sha_type, void *digest_state, size_t digest_word_len)
+{
+    uint32_t *digest_state_words = (uint32_t *)digest_state;
+    uint32_t *reg_addr_buf = (uint32_t *)(SHA_H_MEM);
+
+    for (int i = 0; i < digest_word_len; i++) {
+        REG_WRITE(&reg_addr_buf[i], digest_state_words[i]);
+    }
+}
+
+/**
+ * @brief Sets SHA512_t T_string parameter
+ *
+ * @param t_string T_string parameter
+ */
+static inline void sha_ll_t_string_set(uint32_t t_string)
+{
+    REG_WRITE(SHA_T_STRING_REG, t_string);
+}
+
+/**
+ * @brief Sets SHA512_t T_string parameter's length
+ *
+ * @param t_len T_string parameter length
+ */
+static inline void sha_ll_t_len_set(uint8_t t_len)
+{
+    REG_WRITE(SHA_T_LENGTH_REG, t_len);
+}
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/components/hal/esp32s2/include/hal/sha_ll.h b/components/hal/esp32s2/include/hal/sha_ll.h
index c3de468df1..da8d2e3554 100644
--- a/components/hal/esp32s2/include/hal/sha_ll.h
+++ b/components/hal/esp32s2/include/hal/sha_ll.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -14,6 +14,40 @@
 extern "C" {
 #endif
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    if (enable) {
+        SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN1_REG, DPORT_CRYPTO_SHA_CLK_EN);
+    } else {
+        CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN1_REG, DPORT_CRYPTO_SHA_CLK_EN);
+    }
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_enable_bus_clock(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_enable_bus_clock(__VA_ARGS__)
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    SET_PERI_REG_MASK(DPORT_PERIP_RST_EN1_REG, DPORT_CRYPTO_SHA_RST);
+    CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN1_REG, DPORT_CRYPTO_SHA_RST);
+
+    // Clear reset on digital signature and hmac also, otherwise SHA is held in reset
+    CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN1_REG, DPORT_CRYPTO_DS_RST);
+    CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN1_REG, DPORT_CRYPTO_HMAC_RST);
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_reset_register(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_reset_register(__VA_ARGS__)
 
 /**
  * @brief Start a new SHA block conversions (no initial hash in HW)
diff --git a/components/hal/esp32s3/include/hal/sha_ll.h b/components/hal/esp32s3/include/hal/sha_ll.h
index 83216042ab..9a7b9ed8f3 100644
--- a/components/hal/esp32s3/include/hal/sha_ll.h
+++ b/components/hal/esp32s3/include/hal/sha_ll.h
@@ -1,19 +1,50 @@
 /*
- * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 #pragma once
 
 #include <stdbool.h>
-#include "soc/hwcrypto_reg.h"
-#include "hal/sha_types.h"
 #include "soc/dport_reg.h"
+#include "soc/hwcrypto_reg.h"
+#include "soc/system_struct.h"
+#include "hal/sha_types.h"
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+/**
+ * @brief Enable the bus clock for SHA peripheral module
+ *
+ * @param enable true to enable the module, false to disable the module
+ */
+static inline void sha_ll_enable_bus_clock(bool enable)
+{
+    SYSTEM.perip_clk_en1.crypto_sha_clk_en = enable;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_enable_bus_clock(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_enable_bus_clock(__VA_ARGS__)
+
+/**
+ * @brief Reset the SHA peripheral module
+ */
+static inline void sha_ll_reset_register(void)
+{
+    SYSTEM.perip_rst_en1.crypto_sha_rst = 1;
+    SYSTEM.perip_rst_en1.crypto_sha_rst = 0;
+
+    // Clear reset on digital signature and hmac also, otherwise SHA is held in reset
+    SYSTEM.perip_rst_en1.crypto_ds_rst = 0;
+    SYSTEM.perip_rst_en1.crypto_hmac_rst = 0;
+}
+
+/// use a macro to wrap the function, force the caller to use it in a critical section
+/// the critical section needs to declare the __DECLARE_RCC_ATOMIC_ENV variable in advance
+#define sha_ll_reset_register(...) (void)__DECLARE_RCC_ATOMIC_ENV; sha_ll_reset_register(__VA_ARGS__)
 
 /**
  * @brief Start a new SHA block conversions (no initial hash in HW)
diff --git a/components/hal/test_apps/crypto/main/CMakeLists.txt b/components/hal/test_apps/crypto/main/CMakeLists.txt
index 40667b9033..6c1febef20 100644
--- a/components/hal/test_apps/crypto/main/CMakeLists.txt
+++ b/components/hal/test_apps/crypto/main/CMakeLists.txt
@@ -49,8 +49,20 @@ if(CONFIG_SOC_SHA_SUPPORTED)
    if(NOT CONFIG_SOC_SHA_SUPPORT_PARALLEL_ENG)
       list(APPEND srcs "sha/test_sha.c"
                         "sha/sha_block.c")
+      list(APPEND priv_include_dirs "sha/include"
+                                    "$ENV{IDF_PATH}/components/mbedtls/port/include")
+
       if(CONFIG_SOC_SHA_SUPPORT_DMA)
-         list(APPEND srcs "sha/sha_dma.c")
+         list(APPEND srcs "sha/sha_dma.c"
+                           "$ENV{IDF_PATH}/components/mbedtls/port/sha/dma/sha.c")
+         list(APPEND priv_include_dirs "$ENV{IDF_PATH}/components/mbedtls/port/sha/dma/include")
+
+         if(NOT CONFIG_SOC_SHA_GDMA)
+            list(APPEND srcs "$ENV{IDF_PATH}/components/mbedtls/port/sha/dma/esp_sha_crypto_dma_impl.c")
+         else()
+            list(APPEND srcs "$ENV{IDF_PATH}/components/mbedtls/port/sha/dma/esp_sha_gdma_impl.c"
+                              "$ENV{IDF_PATH}/components/mbedtls/port/crypto_shared_gdma/esp_crypto_shared_gdma.c")
+         endif()
       endif()
    endif()
 endif()
diff --git a/components/hal/test_apps/crypto/main/ds/test_ds.c b/components/hal/test_apps/crypto/main/ds/test_ds.c
index 4d087f588f..0874ef1a65 100644
--- a/components/hal/test_apps/crypto/main/ds/test_ds.c
+++ b/components/hal/test_apps/crypto/main/ds/test_ds.c
@@ -119,6 +119,7 @@ _Static_assert(NUM_RESULTS == NUM_MESSAGES, "expected_results size should be the
 #include "hal/ds_ll.h"
 #include "hal/hmac_hal.h"
 #include "hal/hmac_ll.h"
+#include "hal/sha_ll.h"
 
 
 static void ds_acquire_enable(void)
@@ -128,7 +129,10 @@ static void ds_acquire_enable(void)
         hmac_ll_reset_register();
     }
 
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 
     DS_RCC_ATOMIC() {
         ds_ll_enable_bus_clock(true);
@@ -146,7 +150,9 @@ static void ds_disable_release(void)
         ds_ll_enable_bus_clock(false);
     }
 
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
 
     HMAC_RCC_ATOMIC() {
         hmac_ll_enable_bus_clock(false);
@@ -234,7 +240,10 @@ static esp_err_t esp_ds_encrypt_params(esp_ds_data_t *data,
         aes_ll_reset_register();
     }
 
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 
     ets_ds_data_t *ds_data = (ets_ds_data_t *) data;
     const ets_ds_p_data_t *ds_plain_data = (const ets_ds_p_data_t *) p_data;
@@ -245,7 +254,9 @@ static esp_err_t esp_ds_encrypt_params(esp_ds_data_t *data,
         result = ESP_ERR_INVALID_ARG;
     }
 
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
 
     AES_RCC_ATOMIC() {
         aes_ll_enable_bus_clock(false);
diff --git a/components/hal/test_apps/crypto/main/hmac/test_hmac.c b/components/hal/test_apps/crypto/main/hmac/test_hmac.c
index 8cbcfd2fb8..3cffb6b8af 100644
--- a/components/hal/test_apps/crypto/main/hmac/test_hmac.c
+++ b/components/hal/test_apps/crypto/main/hmac/test_hmac.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -33,6 +33,7 @@ static esp_err_t hmac_jtag_disable(void)
 #include "hal/hmac_hal.h"
 #include "hal/hmac_ll.h"
 #include "hal/ds_ll.h"
+#include "hal/sha_ll.h"
 #include "esp_private/periph_ctrl.h"
 
 #define SHA256_BLOCK_SZ 64
@@ -69,7 +70,10 @@ static esp_err_t hmac_calculate(uint32_t key_id, const void *message, size_t mes
         hmac_ll_reset_register();
     }
 
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 
     DS_RCC_ATOMIC() {
         ds_ll_enable_bus_clock(true);
@@ -130,7 +134,9 @@ static esp_err_t hmac_calculate(uint32_t key_id, const void *message, size_t mes
         ds_ll_enable_bus_clock(false);
     }
 
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
 
     HMAC_RCC_ATOMIC() {
         hmac_ll_enable_bus_clock(false);
diff --git a/components/hal/test_apps/crypto/main/sha/sha_block.h b/components/hal/test_apps/crypto/main/sha/include/sha_block.h
similarity index 100%
rename from components/hal/test_apps/crypto/main/sha/sha_block.h
rename to components/hal/test_apps/crypto/main/sha/include/sha_block.h
diff --git a/components/hal/test_apps/crypto/main/sha/sha_dma.h b/components/hal/test_apps/crypto/main/sha/include/sha_dma.h
similarity index 100%
rename from components/hal/test_apps/crypto/main/sha/sha_dma.h
rename to components/hal/test_apps/crypto/main/sha/include/sha_dma.h
diff --git a/components/hal/test_apps/crypto/main/sha/test_params.h b/components/hal/test_apps/crypto/main/sha/include/test_params.h
similarity index 91%
rename from components/hal/test_apps/crypto/main/sha/test_params.h
rename to components/hal/test_apps/crypto/main/sha/include/test_params.h
index 1b1ab9710d..a947440968 100644
--- a/components/hal/test_apps/crypto/main/sha/test_params.h
+++ b/components/hal/test_apps/crypto/main/sha/include/test_params.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  *
@@ -32,30 +32,6 @@
 
 #define BUFFER_SZ 1030 // NB: not an exact multiple of SHA block size
 
-static inline size_t block_length(esp_sha_type type)
-{
-    switch (type) {
-    case SHA1:
-    case SHA2_224:
-    case SHA2_256:
-        return 64;
-#if SOC_SHA_SUPPORT_SHA384
-    case SHA2_384:
-#endif
-#if SOC_SHA_SUPPORT_SHA512
-    case SHA2_512:
-#endif
-#if SOC_SHA_SUPPORT_SHA512_T
-    case SHA2_512224:
-    case SHA2_512256:
-    case SHA2_512T:
-#endif
-        return 128;
-    default:
-        return 0;
-    }
-}
-
 #if defined(SOC_SHA_SUPPORT_SHA1)
 
 static const unsigned char sha1_padding[64] = {
diff --git a/components/hal/test_apps/crypto/main/sha/sha_block.c b/components/hal/test_apps/crypto/main/sha/sha_block.c
index 4919359b37..ed0ebb9d24 100644
--- a/components/hal/test_apps/crypto/main/sha/sha_block.c
+++ b/components/hal/test_apps/crypto/main/sha/sha_block.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: CC0-1.0
  */
@@ -12,10 +12,35 @@
 
 #include "soc/periph_defs.h"
 #include "esp_private/periph_ctrl.h"
+#include "esp_private/esp_crypto_lock_internal.h"
 #include "hal/sha_hal.h"
-#include "hal/clk_gate_ll.h"
+#include "hal/sha_ll.h"
 #include "sha_block.h"
 
+static inline size_t block_length(esp_sha_type type)
+{
+    switch (type) {
+    case SHA1:
+    case SHA2_224:
+    case SHA2_256:
+        return 64;
+#if SOC_SHA_SUPPORT_SHA384
+    case SHA2_384:
+#endif
+#if SOC_SHA_SUPPORT_SHA512
+    case SHA2_512:
+#endif
+#if SOC_SHA_SUPPORT_SHA512_T
+    case SHA2_512224:
+    case SHA2_512256:
+    case SHA2_512T:
+#endif
+        return 128;
+    default:
+        return 0;
+    }
+}
+
 #if defined(SOC_SHA_SUPPORT_SHA1)
 
 static void sha1_update_block(sha1_ctx* ctx, esp_sha_type sha_type, const unsigned char *input, size_t ilen)
@@ -43,7 +68,10 @@ static void sha1_update_block(sha1_ctx* ctx, esp_sha_type sha_type, const unsign
 
     if ( (ilen >= 64) || local_len) {
         /* Enable peripheral module */
-        periph_ll_enable_clk_clear_rst(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(true);
+            sha_ll_reset_register();
+        }
 
         if (ctx->first_block == 0) {
             /* Writes the message digest to the SHA engine */
@@ -72,7 +100,9 @@ static void sha1_update_block(sha1_ctx* ctx, esp_sha_type sha_type, const unsign
         sha_hal_read_digest(sha_type, ctx->state);
 
         /* Disable peripheral module */
-        periph_ll_disable_clk_set_rst(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(false);
+        }
     }
 
     if ( ilen > 0 ) {
@@ -139,7 +169,10 @@ static void sha256_update_block(sha256_ctx* ctx, esp_sha_type sha_type, const un
 
     if ( (ilen >= 64) || local_len) {
         /* Enable peripheral module */
-        periph_ll_enable_clk_clear_rst(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(true);
+            sha_ll_reset_register();
+        }
 
         if (ctx->first_block == 0) {
             /* Writes the message digest to the SHA engine */
@@ -168,7 +201,9 @@ static void sha256_update_block(sha256_ctx* ctx, esp_sha_type sha_type, const un
         sha_hal_read_digest(sha_type, ctx->state);
 
         /* Disable peripheral module */
-        periph_ll_disable_clk_set_rst(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(false);
+        }
     }
 
     if ( ilen > 0 ) {
@@ -280,7 +315,10 @@ static void sha512_update_block(sha512_ctx* ctx, esp_sha_type sha_type, const un
     if ( (ilen >= 128) || local_len) {
 
         /* Enable peripheral module */
-        periph_ll_enable_clk_clear_rst(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(true);
+            sha_ll_reset_register();
+        }
 
         if (ctx->first_block && sha_type == SHA2_512T){
             sha_512_t_init_hash_block(ctx->t_val);
@@ -313,7 +351,9 @@ static void sha512_update_block(sha512_ctx* ctx, esp_sha_type sha_type, const un
         sha_hal_read_digest(sha_type, ctx->state);
 
         /* Disable peripheral module */
-        periph_ll_disable_clk_set_rst(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(false);
+        }
     }
 
     if ( ilen > 0 ) {
diff --git a/components/hal/test_apps/crypto/main/sha/sha_dma.c b/components/hal/test_apps/crypto/main/sha/sha_dma.c
index f6ffe5e72a..f0a335a7ff 100644
--- a/components/hal/test_apps/crypto/main/sha/sha_dma.c
+++ b/components/hal/test_apps/crypto/main/sha/sha_dma.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: CC0-1.0
  */
@@ -17,213 +17,9 @@
 #if SOC_SHA_SUPPORTED
 #if SOC_SHA_SUPPORT_DMA
 
-#include "soc/periph_defs.h"
-#include "esp_private/periph_ctrl.h"
-#include "hal/sha_hal.h"
-#include "hal/clk_gate_ll.h"
+#include "sha/sha_dma.h"
 #include "sha_dma.h"
 
-#if CONFIG_SOC_SHA_GDMA
-#include "esp_crypto_shared_gdma.h"
-#else
-#include "soc/crypto_dma_reg.h"
-#include "hal/crypto_dma_ll.h"
-#endif /* CONFIG_SOC_SHA_GDMA */
-
-#ifndef SOC_SHA_DMA_MAX_BUFFER_SIZE
-#define SOC_SHA_DMA_MAX_BUFFER_SIZE (3968)
-#endif
-
-const static char* TAG = "sha_dma";
-static bool s_check_dma_capable(const void *p);
-
-/* These are static due to:
- *  * Must be in DMA capable memory, so stack is not a safe place to put them
- *  * To avoid having to malloc/free them for every DMA operation
- */
-static DRAM_ATTR lldesc_t s_dma_descr_input;
-static DRAM_ATTR lldesc_t s_dma_descr_buf;
-
-#if CONFIG_SOC_SHA_GDMA
-
-static esp_err_t esp_sha_dma_start(const lldesc_t *input)
-{
-    return esp_crypto_shared_gdma_start(input, NULL, GDMA_TRIG_PERIPH_SHA);
-}
-
-#else
-
-static esp_err_t esp_sha_dma_start(const lldesc_t *input)
-{
-    crypto_dma_ll_set_mode(CRYPTO_DMA_SHA);
-    crypto_dma_ll_reset();
-
-    crypto_dma_ll_outlink_set((intptr_t)input);
-    crypto_dma_ll_outlink_start();
-
-    return ESP_OK;
-}
-
-#endif
-
-static void acquire_hardware(void)
-{
-#if SOC_AES_CRYPTO_DMA
-    periph_ll_enable_clk_clear_rst(PERIPH_SHA_DMA_MODULE);
-#elif SOC_AES_GDMA
-    periph_ll_enable_clk_clear_rst(PERIPH_SHA_MODULE);
-#endif
-}
-
-static void release_hardware(void)
-{
-#if SOC_AES_CRYPTO_DMA
-    periph_ll_disable_clk_set_rst(PERIPH_SHA_DMA_MODULE);
-#elif SOC_AES_GDMA
-    periph_ll_disable_clk_set_rst(PERIPH_SHA_MODULE);
-#endif
-}
-
-static int esp_sha_dma_process(esp_sha_type sha_type, const void *input, uint32_t ilen,
-                               const void *buf, uint32_t buf_len, bool is_first_block);
-
-/* Performs SHA on multiple blocks at a time using DMA
-   splits up into smaller operations for inputs that exceed a single DMA list
- */
-static int esp_sha_dma(esp_sha_type sha_type, const void *input, uint32_t ilen,
-                const void *buf, uint32_t buf_len, bool is_first_block)
-{
-    int ret = 0;
-    unsigned char *dma_cap_buf = NULL;
-
-    if (buf_len > block_length(sha_type)) {
-        ESP_LOGE(TAG, "SHA DMA buf_len cannot exceed max size for a single block");
-        return -1;
-    }
-
-    /* DMA cannot access memory in flash, hash block by block instead of using DMA */
-    if (!s_check_dma_capable(input) && (ilen != 0)) {
-        return 0;
-    }
-
-#if (CONFIG_SPIRAM && SOC_PSRAM_DMA_CAPABLE)
-    if (esp_ptr_external_ram(input)) {
-        Cache_WriteBack_Addr((uint32_t)input, ilen);
-    }
-    if (esp_ptr_external_ram(buf)) {
-        Cache_WriteBack_Addr((uint32_t)buf, buf_len);
-    }
-#endif
-
-    /* Copy to internal buf if buf is in non DMA capable memory */
-    if (!s_check_dma_capable(buf) && (buf_len != 0)) {
-        dma_cap_buf = heap_caps_malloc(sizeof(unsigned char) * buf_len, MALLOC_CAP_8BIT|MALLOC_CAP_DMA|MALLOC_CAP_INTERNAL);
-        if (dma_cap_buf == NULL) {
-            ESP_LOGE(TAG, "Failed to allocate buf memory");
-            ret = -1;
-            goto cleanup;
-        }
-        memcpy(dma_cap_buf, buf, buf_len);
-        buf = dma_cap_buf;
-    }
-
-    uint32_t dma_op_num;
-
-    if (ilen > 0) {
-        /* Number of DMA operations based on maximum chunk size in single operation */
-        dma_op_num = (ilen + SOC_SHA_DMA_MAX_BUFFER_SIZE - 1) / SOC_SHA_DMA_MAX_BUFFER_SIZE;
-    } else {
-        /* For zero input length, we must allow at-least 1 DMA operation to see
-         * if there is any pending data that is yet to be copied out */
-        dma_op_num = 1;
-    }
-
-    /* The max amount of blocks in a single hardware operation is 2^6 - 1 = 63
-       Thus we only do a single DMA input list + dma buf list,
-       which is max 3968/64 + 64/64 = 63 blocks */
-    for (int i = 0; i < dma_op_num; i++) {
-
-        int dma_chunk_len = MIN(ilen, SOC_SHA_DMA_MAX_BUFFER_SIZE);
-
-        ret = esp_sha_dma_process(sha_type, input, dma_chunk_len, buf, buf_len, is_first_block);
-
-        if (ret != 0) {
-            goto cleanup;
-        }
-
-        ilen -= dma_chunk_len;
-        input = (uint8_t *)input + dma_chunk_len;
-
-        // Only append buf to the first operation
-        buf_len = 0;
-        is_first_block = false;
-    }
-
-cleanup:
-    free(dma_cap_buf);
-    return ret;
-}
-
-
-/* Performs SHA on multiple blocks at a time */
-static esp_err_t esp_sha_dma_process(esp_sha_type sha_type, const void *input, uint32_t ilen,
-                                     const void *buf, uint32_t buf_len, bool is_first_block)
-{
-    int ret = 0;
-    lldesc_t *dma_descr_head = NULL;
-    size_t num_blks = (ilen + buf_len) / block_length(sha_type);
-
-    memset(&s_dma_descr_input, 0, sizeof(lldesc_t));
-    memset(&s_dma_descr_buf, 0, sizeof(lldesc_t));
-
-    /* DMA descriptor for Memory to DMA-SHA transfer */
-    if (ilen) {
-        s_dma_descr_input.length = ilen;
-        s_dma_descr_input.size = ilen;
-        s_dma_descr_input.owner = 1;
-        s_dma_descr_input.eof = 1;
-        s_dma_descr_input.buf = (uint8_t *)input;
-        dma_descr_head = &s_dma_descr_input;
-    }
-    /* Check after input to overide head if there is any buf*/
-    if (buf_len) {
-        s_dma_descr_buf.length = buf_len;
-        s_dma_descr_buf.size = buf_len;
-        s_dma_descr_buf.owner = 1;
-        s_dma_descr_buf.eof = 1;
-        s_dma_descr_buf.buf = (uint8_t *)buf;
-        dma_descr_head = &s_dma_descr_buf;
-    }
-
-    /* Link DMA lists */
-    if (buf_len && ilen) {
-        s_dma_descr_buf.eof = 0;
-        s_dma_descr_buf.empty = (uint32_t)(&s_dma_descr_input);
-    }
-
-    if (esp_sha_dma_start(dma_descr_head) != ESP_OK) {
-        ESP_LOGE(TAG, "esp_sha_dma_start failed, no DMA channel available");
-        return -1;
-    }
-
-    sha_hal_hash_dma(sha_type, num_blks, is_first_block);
-
-    sha_hal_wait_idle();
-
-    return ret;
-}
-
-static bool s_check_dma_capable(const void *p)
-{
-    bool is_capable = false;
-#if CONFIG_SPIRAM
-    is_capable |= esp_ptr_dma_ext_capable(p);
-#endif
-    is_capable |= esp_ptr_dma_capable(p);
-
-    return is_capable;
-}
-
 #if defined(SOC_SHA_SUPPORT_SHA1)
 
 static void esp_internal_sha1_update_state(sha1_ctx *ctx, esp_sha_type sha_type)
@@ -263,13 +59,13 @@ static void sha1_update_dma(sha1_ctx* ctx, esp_sha_type sha_type, const unsigned
     len = (ilen / 64) * 64;
     if ( len || local_len) {
         /* Enable peripheral module */
-        acquire_hardware();
+        esp_sha_acquire_hardware();
 
         esp_internal_sha1_update_state(ctx, sha_type);
 
         int ret = esp_sha_dma(sha_type, input, len, ctx->buffer, local_len, ctx->first_block);
         if (ret != 0) {
-            release_hardware();
+            esp_sha_release_hardware();
             return ;
         }
 
@@ -277,7 +73,7 @@ static void sha1_update_dma(sha1_ctx* ctx, esp_sha_type sha_type, const unsigned
         sha_hal_read_digest(sha_type, ctx->state);
 
         /* Disable peripheral module */
-        release_hardware();
+        esp_sha_release_hardware();
     }
 
     if ( ilen > 0 ) {
@@ -359,7 +155,7 @@ static void sha256_update_dma(sha256_ctx* ctx, esp_sha_type sha_type, const unsi
     len = (ilen / 64) * 64;
     if ( len || local_len) {
         /* Enable peripheral module */
-        acquire_hardware();
+        esp_sha_acquire_hardware();
 
         esp_internal_sha256_update_state(ctx);
 
@@ -367,7 +163,7 @@ static void sha256_update_dma(sha256_ctx* ctx, esp_sha_type sha_type, const unsi
 
         if (ret != 0) {
             /* Disable peripheral module */
-            release_hardware();
+            esp_sha_release_hardware();
             return;
         }
 
@@ -375,7 +171,7 @@ static void sha256_update_dma(sha256_ctx* ctx, esp_sha_type sha_type, const unsi
         sha_hal_read_digest(sha_type, ctx->state);
 
         /* Disable peripheral module */
-        release_hardware();
+        esp_sha_release_hardware();
     }
 
     if ( ilen > 0 ) {
@@ -466,7 +262,7 @@ static void esp_internal_sha512_update_state(sha512_ctx *ctx)
         if (ctx->mode == SHA2_512T) {
             int ret = -1;
             if ((ret = sha_512_t_init_hash_dma(ctx->t_val)) != 0) {
-                release_hardware();
+                esp_sha_release_hardware();
                 return;
             }
             ctx->first_block = false;
@@ -508,14 +304,14 @@ static void sha512_update_dma(sha512_ctx* ctx, esp_sha_type sha_type, const unsi
     if ( len || local_len) {
 
         /* Enable peripheral module */
-        acquire_hardware();
+        esp_sha_acquire_hardware();
 
         esp_internal_sha512_update_state(ctx);
 
         int ret = esp_sha_dma(ctx->mode, input, len, ctx->buffer, local_len, ctx->first_block);
 
         if (ret != 0) {
-            release_hardware();
+            esp_sha_release_hardware();
             return;
         }
 
@@ -523,7 +319,7 @@ static void sha512_update_dma(sha512_ctx* ctx, esp_sha_type sha_type, const unsi
         sha_hal_read_digest(sha_type, ctx->state);
 
         /* Disable peripheral module */
-        release_hardware();
+        esp_sha_release_hardware();
     }
 
     if ( ilen > 0 ) {
diff --git a/components/mbedtls/port/include/esp_crypto_dma.h b/components/mbedtls/port/include/esp_crypto_dma.h
index 8eadc1aa26..03cbf84ccd 100644
--- a/components/mbedtls/port/include/esp_crypto_dma.h
+++ b/components/mbedtls/port/include/esp_crypto_dma.h
@@ -17,27 +17,27 @@ extern "C"
 #endif
 
 
-#if (SOC_AES_SUPPORT_DMA) && (SOC_SHA_SUPPORT_DMA)
+#if (SOC_AES_SUPPORT_DMA) || (SOC_SHA_SUPPORT_DMA)
 
-#if (SOC_AES_GDMA) && (SOC_SHA_GDMA)
+#if (SOC_AES_GDMA) || (SOC_SHA_GDMA)
 
-#if (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AHB) && (SOC_GDMA_TRIG_PERIPH_SHA0_BUS == SOC_GDMA_BUS_AHB)
+#if (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AHB) || (SOC_GDMA_TRIG_PERIPH_SHA0_BUS == SOC_GDMA_BUS_AHB)
 #define DMA_DESC_MEM_ALIGN_SIZE 4
 typedef dma_descriptor_align4_t crypto_dma_desc_t;
-#elif (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AXI) && (SOC_GDMA_TRIG_PERIPH_SHA0_BUS == SOC_GDMA_BUS_AXI)
+#elif (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AXI) || (SOC_GDMA_TRIG_PERIPH_SHA0_BUS == SOC_GDMA_BUS_AXI)
 #define DMA_DESC_MEM_ALIGN_SIZE 8
 typedef dma_descriptor_align8_t crypto_dma_desc_t;
 #else
 #error "As we support a shared crypto GDMA layer for the AES and the SHA peripheral, both the peripherals must use the same GDMA bus"
-#endif /* (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AHB) && (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AHB) */
+#endif /* (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AHB) || (SOC_GDMA_TRIG_PERIPH_AES0_BUS == SOC_GDMA_BUS_AHB) */
 
-#elif (SOC_AES_CRYPTO_DMA) && (SOC_SHA_CRYPTO_DMA)
+#elif (SOC_AES_CRYPTO_DMA) || (SOC_SHA_CRYPTO_DMA)
 #define DMA_DESC_MEM_ALIGN_SIZE 4
 typedef dma_descriptor_align4_t crypto_dma_desc_t;
 
 #endif /* (SOC_AES_GDMA) && (SOC_SHA_GDMA) */
 
-#endif /* (SOC_AES_SUPPORT_DMA) && (SOC_SHA_SUPPORT_DMA) */
+#endif /* (SOC_AES_SUPPORT_DMA) || (SOC_SHA_SUPPORT_DMA) */
 
 
 #ifdef __cplusplus
diff --git a/components/mbedtls/port/include/esp_crypto_shared_gdma.h b/components/mbedtls/port/include/esp_crypto_shared_gdma.h
index d6e40fd0fb..d5e96d2857 100644
--- a/components/mbedtls/port/include/esp_crypto_shared_gdma.h
+++ b/components/mbedtls/port/include/esp_crypto_shared_gdma.h
@@ -27,7 +27,7 @@ extern "C" {
  *                   GDMA_TRIG_PERIPH_SHA
  * @return esp_err_t ESP_FAIL if no GDMA channel available
  */
-esp_err_t esp_crypto_shared_gdma_start(const lldesc_t *input, const lldesc_t *output, gdma_trigger_peripheral_t peripheral);
+esp_err_t esp_crypto_shared_gdma_start(const lldesc_t *input, const lldesc_t *output, gdma_trigger_peripheral_t peripheral) __attribute__((deprecated("use esp_crypto_shared_gdma_start_axi_ahb instead")));
 
 /**
  * @brief Start a GDMA transfer on the shared crypto DMA channel
diff --git a/components/mbedtls/port/sha/block/sha.c b/components/mbedtls/port/sha/block/sha.c
index 252d1c703b..1ba617190f 100644
--- a/components/mbedtls/port/sha/block/sha.c
+++ b/components/mbedtls/port/sha/block/sha.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -8,10 +8,12 @@
 
 #include "soc/soc_caps.h"
 #include "soc/periph_defs.h"
+#include "esp_private/esp_crypto_lock_internal.h"
 #include "esp_private/periph_ctrl.h"
 
 #include "sha/sha_block.h"
 #include "hal/sha_hal.h"
+#include "hal/sha_ll.h"
 
 
 static _lock_t s_sha_lock;
@@ -56,13 +58,20 @@ inline static size_t block_length(esp_sha_type type)
 void esp_sha_acquire_hardware()
 {
     _lock_acquire(&s_sha_lock); /* Released when releasing hw with esp_sha_release_hardware() */
-    periph_module_enable(PERIPH_SHA_MODULE);
+
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+        sha_ll_reset_register();
+    }
 }
 
 /* Disable SHA peripheral block and then release it */
 void esp_sha_release_hardware()
 {
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+    }
+
     _lock_release(&s_sha_lock);
 }
 
diff --git a/components/mbedtls/port/sha/dma/esp_sha_crypto_dma_impl.c b/components/mbedtls/port/sha/dma/esp_sha_crypto_dma_impl.c
index 331751f95d..c1554d45a8 100644
--- a/components/mbedtls/port/sha/dma/esp_sha_crypto_dma_impl.c
+++ b/components/mbedtls/port/sha/dma/esp_sha_crypto_dma_impl.c
@@ -12,7 +12,7 @@
 #include "hal/crypto_dma_ll.h"
 
 
-esp_err_t esp_sha_dma_start(const lldesc_t *input)
+esp_err_t esp_sha_dma_start(const crypto_dma_desc_t *input)
 {
     crypto_dma_ll_set_mode(CRYPTO_DMA_SHA);
     crypto_dma_ll_reset();
diff --git a/components/mbedtls/port/sha/dma/esp_sha_gdma_impl.c b/components/mbedtls/port/sha/dma/esp_sha_gdma_impl.c
index bf65283040..86e2056a71 100644
--- a/components/mbedtls/port/sha/dma/esp_sha_gdma_impl.c
+++ b/components/mbedtls/port/sha/dma/esp_sha_gdma_impl.c
@@ -7,7 +7,7 @@
 #include "esp_sha_dma_priv.h"
 #include "esp_crypto_shared_gdma.h"
 
-esp_err_t esp_sha_dma_start(const lldesc_t *input)
+esp_err_t esp_sha_dma_start(const crypto_dma_desc_t *input)
 {
-    return esp_crypto_shared_gdma_start(input, NULL, GDMA_TRIG_PERIPH_SHA);
+    return esp_crypto_shared_gdma_start_axi_ahb(input, NULL, GDMA_TRIG_PERIPH_SHA);
 }
diff --git a/components/mbedtls/port/sha/dma/include/esp_sha_dma_priv.h b/components/mbedtls/port/sha/dma/include/esp_sha_dma_priv.h
index fdb758fc3c..be1e4aec1b 100644
--- a/components/mbedtls/port/sha/dma/include/esp_sha_dma_priv.h
+++ b/components/mbedtls/port/sha/dma/include/esp_sha_dma_priv.h
@@ -1,21 +1,13 @@
-// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #pragma once
 
-#include "soc/lldesc.h"
 #include "soc/soc_caps.h"
+#include "esp_crypto_dma.h"
 #include "esp_err.h"
 
 #ifdef __cplusplus
@@ -30,7 +22,7 @@ extern "C" {
  *      - ESP_OK: Successfully started the DMA
  *      - ESP_ERR_INVALID_STATE: No DMA channel available
  */
-esp_err_t esp_sha_dma_start(const lldesc_t *input);
+esp_err_t esp_sha_dma_start(const crypto_dma_desc_t *input);
 
 
 #ifdef __cplusplus
diff --git a/components/mbedtls/port/sha/dma/sha.c b/components/mbedtls/port/sha/dma/sha.c
index 26d0612589..38775dfbfb 100644
--- a/components/mbedtls/port/sha/dma/sha.c
+++ b/components/mbedtls/port/sha/dma/sha.c
@@ -29,11 +29,16 @@
 #include <stdio.h>
 #include <sys/lock.h>
 
+#include "esp_dma_utils.h"
+#include "esp_private/esp_crypto_lock_internal.h"
+#include "esp_private/esp_cache_private.h"
 #include "esp_log.h"
 #include "esp_memory_utils.h"
 #include "esp_crypto_lock.h"
 #include "esp_attr.h"
-#include "soc/lldesc.h"
+#include "esp_crypto_dma.h"
+#include "esp_cache.h"
+#include "hal/dma_types.h"
 #include "soc/ext_mem_defs.h"
 #include "soc/periph_defs.h"
 
@@ -45,36 +50,20 @@
 
 #include "sha/sha_dma.h"
 #include "hal/sha_hal.h"
+#include "hal/sha_ll.h"
 #include "soc/soc_caps.h"
 #include "esp_sha_dma_priv.h"
 
-#if CONFIG_IDF_TARGET_ESP32S2
-#include "esp32s2/rom/cache.h"
-#elif CONFIG_IDF_TARGET_ESP32S3
-#include "esp32s3/rom/cache.h"
-#elif CONFIG_IDF_TARGET_ESP32C3
-#include "esp32s3/rom/cache.h"
-#elif CONFIG_IDF_TARGET_ESP32C2
-#include "esp32c2/rom/cache.h"
-#endif
-
 #if SOC_SHA_GDMA
 #define SHA_LOCK() esp_crypto_sha_aes_lock_acquire()
 #define SHA_RELEASE() esp_crypto_sha_aes_lock_release()
 #elif SOC_SHA_CRYPTO_DMA
 #define SHA_LOCK() esp_crypto_dma_lock_acquire()
 #define SHA_RELEASE() esp_crypto_dma_lock_release()
+#include "hal/crypto_dma_ll.h"
 #endif
 
 const static char *TAG = "esp-sha";
-static bool s_check_dma_capable(const void *p);
-
-/* These are static due to:
- *  * Must be in DMA capable memory, so stack is not a safe place to put them
- *  * To avoid having to malloc/free them for every DMA operation
- */
-static DRAM_ATTR lldesc_t s_dma_descr_input;
-static DRAM_ATTR lldesc_t s_dma_descr_buf;
 
 void esp_sha_write_digest_state(esp_sha_type sha_type, void *digest_state)
 {
@@ -117,27 +106,41 @@ void esp_sha_acquire_hardware()
 {
     SHA_LOCK(); /* Released when releasing hw with esp_sha_release_hardware() */
 
-    /* Enable SHA and DMA hardware */
-#if SOC_SHA_CRYPTO_DMA
-    periph_module_enable(PERIPH_SHA_DMA_MODULE);
-#elif SOC_SHA_GDMA
-    periph_module_enable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(true);
+#if SOC_AES_CRYPTO_DMA
+        crypto_dma_ll_enable_bus_clock(true);
 #endif
+        sha_ll_reset_register();
+#if SOC_AES_CRYPTO_DMA
+        crypto_dma_ll_reset_register();
+#endif
+    }
 }
 
 /* Disable SHA peripheral block and then release it */
 void esp_sha_release_hardware()
 {
-    /* Disable SHA and DMA hardware */
-#if SOC_SHA_CRYPTO_DMA
-    periph_module_disable(PERIPH_SHA_DMA_MODULE);
-#elif SOC_SHA_GDMA
-    periph_module_disable(PERIPH_SHA_MODULE);
+    SHA_RCC_ATOMIC() {
+        sha_ll_enable_bus_clock(false);
+#if SOC_AES_CRYPTO_DMA
+        crypto_dma_ll_enable_bus_clock(false);
 #endif
+    }
 
     SHA_RELEASE();
 }
 
+static bool s_check_dma_capable(const void *p)
+{
+    bool is_capable = false;
+#if CONFIG_SPIRAM
+    is_capable |= esp_ptr_dma_ext_capable(p);
+#endif
+    is_capable |= esp_ptr_dma_capable(p);
+
+    return is_capable;
+}
 
 /* Hash the input block by block, using non-DMA mode */
 static void esp_sha_block_mode(esp_sha_type sha_type, const uint8_t *input, uint32_t ilen,
@@ -162,10 +165,68 @@ static void esp_sha_block_mode(esp_sha_type sha_type, const uint8_t *input, uint
     }
 }
 
+static DRAM_ATTR crypto_dma_desc_t s_dma_descr_input;
+static DRAM_ATTR crypto_dma_desc_t s_dma_descr_buf;
 
+/* Performs SHA on multiple blocks at a time */
+static esp_err_t esp_sha_dma_process(esp_sha_type sha_type, const void *input, uint32_t ilen,
+                                     const void *buf, uint32_t buf_len, bool is_first_block)
+{
+    int ret = 0;
+    crypto_dma_desc_t *dma_descr_head = NULL;
+    size_t num_blks = (ilen + buf_len) / block_length(sha_type);
 
-static int esp_sha_dma_process(esp_sha_type sha_type, const void *input, uint32_t ilen,
-                               const void *buf, uint32_t buf_len, bool is_first_block);
+    memset(&s_dma_descr_input, 0, sizeof(crypto_dma_desc_t));
+    memset(&s_dma_descr_buf, 0, sizeof(crypto_dma_desc_t));
+
+    /* DMA descriptor for Memory to DMA-SHA transfer */
+    if (ilen) {
+        s_dma_descr_input.dw0.length = ilen;
+        s_dma_descr_input.dw0.size = ilen;
+        s_dma_descr_input.dw0.owner = 1;
+        s_dma_descr_input.dw0.suc_eof = 1;
+        s_dma_descr_input.buffer = (void *) input;
+        dma_descr_head = &s_dma_descr_input;
+    }
+    /* Check after input to overide head if there is any buf*/
+    if (buf_len) {
+        s_dma_descr_buf.dw0.length = buf_len;
+        s_dma_descr_buf.dw0.size = buf_len;
+        s_dma_descr_buf.dw0.owner = 1;
+        s_dma_descr_buf.dw0.suc_eof = 1;
+        s_dma_descr_buf.buffer = (void *) buf;
+        dma_descr_head = &s_dma_descr_buf;
+    }
+
+    /* Link DMA lists */
+    if (buf_len && ilen) {
+        s_dma_descr_buf.dw0.suc_eof = 0;
+        s_dma_descr_buf.next = (&s_dma_descr_input);
+    }
+
+#if SOC_CACHE_INTERNAL_MEM_VIA_L1CACHE
+    if (ilen) {
+        ESP_ERROR_CHECK(esp_cache_msync(&s_dma_descr_input, sizeof(crypto_dma_desc_t), ESP_CACHE_MSYNC_FLAG_DIR_C2M | ESP_CACHE_MSYNC_FLAG_UNALIGNED));
+        ESP_ERROR_CHECK(esp_cache_msync(s_dma_descr_input.buffer, s_dma_descr_input.dw0.length, ESP_CACHE_MSYNC_FLAG_DIR_C2M | ESP_CACHE_MSYNC_FLAG_UNALIGNED));
+    }
+
+    if (buf_len) {
+        ESP_ERROR_CHECK(esp_cache_msync(&s_dma_descr_buf, sizeof(crypto_dma_desc_t), ESP_CACHE_MSYNC_FLAG_DIR_C2M | ESP_CACHE_MSYNC_FLAG_UNALIGNED));
+        ESP_ERROR_CHECK(esp_cache_msync(s_dma_descr_buf.buffer, s_dma_descr_buf.dw0.length, ESP_CACHE_MSYNC_FLAG_DIR_C2M | ESP_CACHE_MSYNC_FLAG_UNALIGNED));
+    }
+#endif /* SOC_CACHE_INTERNAL_MEM_VIA_L1CACHE */
+
+    if (esp_sha_dma_start(dma_descr_head) != ESP_OK) {
+        ESP_LOGE(TAG, "esp_sha_dma_start failed, no DMA channel available");
+        return -1;
+    }
+
+    sha_hal_hash_dma(sha_type, num_blks, is_first_block);
+
+    sha_hal_wait_idle();
+
+    return ret;
+}
 
 /* Performs SHA on multiple blocks at a time using DMA
    splits up into smaller operations for inputs that exceed a single DMA list
@@ -189,10 +250,10 @@ int esp_sha_dma(esp_sha_type sha_type, const void *input, uint32_t ilen,
 
 #if (CONFIG_SPIRAM && SOC_PSRAM_DMA_CAPABLE)
     if (esp_ptr_external_ram(input)) {
-        Cache_WriteBack_Addr((uint32_t)input, ilen);
+        esp_cache_msync((void *)input, ilen, ESP_CACHE_MSYNC_FLAG_DIR_C2M | ESP_CACHE_MSYNC_FLAG_UNALIGNED);
     }
     if (esp_ptr_external_ram(buf)) {
-        Cache_WriteBack_Addr((uint32_t)buf, buf_len);
+        esp_cache_msync((void *)buf, buf_len, ESP_CACHE_MSYNC_FLAG_DIR_C2M | ESP_CACHE_MSYNC_FLAG_UNALIGNED);
     }
 #endif
 
@@ -244,63 +305,3 @@ cleanup:
     free(dma_cap_buf);
     return ret;
 }
-
-
-/* Performs SHA on multiple blocks at a time */
-static esp_err_t esp_sha_dma_process(esp_sha_type sha_type, const void *input, uint32_t ilen,
-                                     const void *buf, uint32_t buf_len, bool is_first_block)
-{
-    int ret = 0;
-    lldesc_t *dma_descr_head = NULL;
-    size_t num_blks = (ilen + buf_len) / block_length(sha_type);
-
-    memset(&s_dma_descr_input, 0, sizeof(lldesc_t));
-    memset(&s_dma_descr_buf, 0, sizeof(lldesc_t));
-
-    /* DMA descriptor for Memory to DMA-SHA transfer */
-    if (ilen) {
-        s_dma_descr_input.length = ilen;
-        s_dma_descr_input.size = ilen;
-        s_dma_descr_input.owner = 1;
-        s_dma_descr_input.eof = 1;
-        s_dma_descr_input.buf = (uint8_t *)input;
-        dma_descr_head = &s_dma_descr_input;
-    }
-    /* Check after input to overide head if there is any buf*/
-    if (buf_len) {
-        s_dma_descr_buf.length = buf_len;
-        s_dma_descr_buf.size = buf_len;
-        s_dma_descr_buf.owner = 1;
-        s_dma_descr_buf.eof = 1;
-        s_dma_descr_buf.buf = (uint8_t *)buf;
-        dma_descr_head = &s_dma_descr_buf;
-    }
-
-    /* Link DMA lists */
-    if (buf_len && ilen) {
-        s_dma_descr_buf.eof = 0;
-        s_dma_descr_buf.empty = (uint32_t)(&s_dma_descr_input);
-    }
-
-    if (esp_sha_dma_start(dma_descr_head) != ESP_OK) {
-        ESP_LOGE(TAG, "esp_sha_dma_start failed, no DMA channel available");
-        return -1;
-    }
-
-    sha_hal_hash_dma(sha_type, num_blks, is_first_block);
-
-    sha_hal_wait_idle();
-
-    return ret;
-}
-
-static bool s_check_dma_capable(const void *p)
-{
-    bool is_capable = false;
-#if CONFIG_SPIRAM
-    is_capable |= esp_ptr_dma_ext_capable(p);
-#endif
-    is_capable |= esp_ptr_dma_capable(p);
-
-    return is_capable;
-}
diff --git a/components/mbedtls/port/sha/parallel_engine/sha.c b/components/mbedtls/port/sha/parallel_engine/sha.c
index 8c025d707a..4828b9f87d 100644
--- a/components/mbedtls/port/sha/parallel_engine/sha.c
+++ b/components/mbedtls/port/sha/parallel_engine/sha.c
@@ -35,9 +35,11 @@
 #include "esp_cpu.h"
 
 #include "hal/sha_hal.h"
+#include "hal/sha_ll.h"
 #include "hal/sha_types.h"
 #include "sha/sha_parallel_engine.h"
 #include "soc/hwcrypto_periph.h"
+#include "esp_private/esp_crypto_lock_internal.h"
 #include "esp_private/periph_ctrl.h"
 
 /*
@@ -151,7 +153,10 @@ static bool esp_sha_lock_engine_common(esp_sha_type sha_type, TickType_t ticks_t
     if (engines_in_use == 0) {
         /* Just locked first engine,
            so enable SHA hardware */
-        periph_module_enable(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+            sha_ll_enable_bus_clock(true);
+            sha_ll_reset_register();
+        }
     }
 
     engines_in_use++;
@@ -174,7 +179,9 @@ void esp_sha_unlock_engine(esp_sha_type sha_type)
     if (engines_in_use == 0) {
         /* About to release last engine, so
            disable SHA hardware */
-        periph_module_disable(PERIPH_SHA_MODULE);
+        SHA_RCC_ATOMIC() {
+           sha_ll_enable_bus_clock(false);
+        }
     }
 
     portEXIT_CRITICAL(&engines_in_use_lock);
diff --git a/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in b/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in
index 719e14ba90..bb8858a602 100644
--- a/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in
+++ b/components/soc/esp32p4/include/soc/Kconfig.soc_caps.in
@@ -143,6 +143,10 @@ config SOC_MPI_SUPPORTED
     bool
     default y
 
+config SOC_SHA_SUPPORTED
+    bool
+    default y
+
 config SOC_HMAC_SUPPORTED
     bool
     default y
@@ -1019,6 +1023,26 @@ config SOC_SHA_SUPPORT_SHA256
     bool
     default y
 
+config SOC_SHA_SUPPORT_SHA384
+    bool
+    default y
+
+config SOC_SHA_SUPPORT_SHA512
+    bool
+    default y
+
+config SOC_SHA_SUPPORT_SHA512_224
+    bool
+    default y
+
+config SOC_SHA_SUPPORT_SHA512_256
+    bool
+    default y
+
+config SOC_SHA_SUPPORT_SHA512_T
+    bool
+    default y
+
 config SOC_ECDSA_SUPPORT_EXPORT_PUBKEY
     bool
     default y
diff --git a/components/soc/esp32p4/include/soc/sha_reg.h b/components/soc/esp32p4/include/soc/sha_reg.h
index 11181a16e1..888da914b3 100644
--- a/components/soc/esp32p4/include/soc/sha_reg.h
+++ b/components/soc/esp32p4/include/soc/sha_reg.h
@@ -23,6 +23,30 @@ extern "C" {
 #define SHA_MODE_V  0x00000007U
 #define SHA_MODE_S  0
 
+/** SHA_T_STRING_REG register
+ *  SHA 512/t configuration register 0.
+ */
+#define SHA_T_STRING_REG (DR_REG_SHA_BASE + 0x4)
+/** SHA_T_STRING : R/W; bitpos: [31:0]; default: 0;
+ *  Sha t_string (used if and only if mode == SHA_512/t).
+ */
+#define SHA_T_STRING    0xFFFFFFFFU
+#define SHA_T_STRING_M  (SHA_T_STRING_V << SHA_T_STRING_S)
+#define SHA_T_STRING_V  0xFFFFFFFFU
+#define SHA_T_STRING_S  0
+
+/** SHA_T_LENGTH_REG register
+ *  SHA 512/t configuration register 1.
+ */
+#define SHA_T_LENGTH_REG (DR_REG_SHA_BASE + 0x8)
+/** SHA_T_LENGTH : R/W; bitpos: [5:0]; default: 0;
+ *  Sha t_length (used if and only if mode == SHA_512/t).
+ */
+#define SHA_T_LENGTH    0x0000003FU
+#define SHA_T_LENGTH_M  (SHA_T_LENGTH_V << SHA_T_LENGTH_S)
+#define SHA_T_LENGTH_V  0x0000003FU
+#define SHA_T_LENGTH_S  0
+
 /** SHA_DMA_BLOCK_NUM_REG register
  *  DMA configuration register 0.
  */
diff --git a/components/soc/esp32p4/include/soc/sha_struct.h b/components/soc/esp32p4/include/soc/sha_struct.h
index efdd1179f4..8b52abcbc7 100644
--- a/components/soc/esp32p4/include/soc/sha_struct.h
+++ b/components/soc/esp32p4/include/soc/sha_struct.h
@@ -25,6 +25,33 @@ typedef union {
     uint32_t val;
 } sha_mode_reg_t;
 
+/** Type of t_string register
+ *  SHA 512/t configuration register 0.
+ */
+typedef union {
+    struct {
+        /** t_string : R/W; bitpos: [31:0]; default: 0;
+         *  Sha t_string (used if and only if mode == SHA_512/t).
+         */
+        uint32_t t_string:32;
+    };
+    uint32_t val;
+} sha_t_string_reg_t;
+
+/** Type of t_length register
+ *  SHA 512/t configuration register 1.
+ */
+typedef union {
+    struct {
+        /** t_length : R/W; bitpos: [5:0]; default: 0;
+         *  Sha t_length (used if and only if mode == SHA_512/t).
+         */
+        uint32_t t_length:6;
+        uint32_t reserved_6:26;
+    };
+    uint32_t val;
+} sha_t_length_reg_t;
+
 /** Type of dma_block_num register
  *  DMA configuration register 0.
  */
@@ -162,7 +189,8 @@ typedef union {
 
 typedef struct {
     volatile sha_mode_reg_t mode;
-    uint32_t reserved_004[2];
+    volatile sha_t_string_reg_t t_string;
+    volatile sha_t_length_reg_t t_length;
     volatile sha_dma_block_num_reg_t dma_block_num;
     volatile sha_start_reg_t start;
     volatile sha_continue_reg_t conti;
diff --git a/components/soc/esp32p4/include/soc/soc_caps.h b/components/soc/esp32p4/include/soc/soc_caps.h
index 031c71ae37..b41515c4a8 100644
--- a/components/soc/esp32p4/include/soc/soc_caps.h
+++ b/components/soc/esp32p4/include/soc/soc_caps.h
@@ -57,7 +57,7 @@
 #define SOC_SYSTIMER_SUPPORTED          1
 #define SOC_AES_SUPPORTED               1
 #define SOC_MPI_SUPPORTED               1
-// #define SOC_SHA_SUPPORTED               1  //TODO: IDF-7541
+#define SOC_SHA_SUPPORTED               1
 #define SOC_HMAC_SUPPORTED              1
 #define SOC_DIG_SIGN_SUPPORTED          1
 #define SOC_ECC_SUPPORTED               1
@@ -426,6 +426,11 @@
 #define SOC_SHA_SUPPORT_SHA1            (1)
 #define SOC_SHA_SUPPORT_SHA224          (1)
 #define SOC_SHA_SUPPORT_SHA256          (1)
+#define SOC_SHA_SUPPORT_SHA384          (1)
+#define SOC_SHA_SUPPORT_SHA512          (1)
+#define SOC_SHA_SUPPORT_SHA512_224      (1)
+#define SOC_SHA_SUPPORT_SHA512_256      (1)
+#define SOC_SHA_SUPPORT_SHA512_T        (1)
 
 /*--------------------------- ECDSA CAPS ---------------------------------------*/
 #define SOC_ECDSA_SUPPORT_EXPORT_PUBKEY     (1)
diff --git a/tools/ci/check_copyright_ignore.txt b/tools/ci/check_copyright_ignore.txt
index 042ae1a183..0491b31991 100644
--- a/tools/ci/check_copyright_ignore.txt
+++ b/tools/ci/check_copyright_ignore.txt
@@ -519,7 +519,6 @@ components/mbedtls/port/include/sha/sha_parallel_engine.h
 components/mbedtls/port/include/sha1_alt.h
 components/mbedtls/port/include/sha256_alt.h
 components/mbedtls/port/include/sha512_alt.h
-components/mbedtls/port/sha/dma/include/esp_sha_dma_priv.h
 components/mbedtls/port/sha/dma/sha.c
 components/mbedtls/port/sha/parallel_engine/sha.c
 components/nvs_flash/include/nvs_handle.hpp