Using Crypto Algorithms Separately from CTaoCrypt

As you may know, CTaoCrypt is the underlying cryptography library used by the wolfSSL embedded SSL library. We’ve had several users choose to use CTaoCrypt’s crypto algorithms because they are easy to isolate and use independently of the library itself. For example, if you need to use MD5 in your own code but don’t want to write it yourself, you could extract CTaoCrypt’s MD5 implementation and use it directly in your code.

Most crypto algorithms in CTaoCrypt are contained within a source file and header file. For MD5, the relevant code would be in ./cyassl/ctaocrypt/md5.h and ./ctaocrypt/src/md5.c. Other algorithms follow the same directory and source file pattern.

If you have any questions about using CTaoCrypt’s algorithms separately, please let us know at info@yassl.com. As always, feel free to download the GPLv2-licensed source code for wolfSSL/CTaoCrypt directly from our download page and try it out for yourself.

yaSSL Embedded Web Server 1.0 is Now Available

The third release of the yaSSL Embedded Web Server is now available for download!  Changes in this release include bug fixes, updated wolfSSL support, iOS (Apple TV) build support, better Windows build support, CGI and SSI extension pattern matching and more.

The yaSSL Embedded Web Server is focused on being small, fast, and embeddable.  Features include CGI, SSI, IP restrictions, access and error log support, and SSL among others.  The wolfSSL embedded SSL library can be used to easily secure ports with SSL/TLS up to TLS 1.2, giving you a secure connection while maintaining small size and fast speed.  

If you have any questions, or would like to learn more about the yaSSL Embedded Web Server and how it can help your project, please contact info@yassl.com.

wolfSSL 2.3.0 is Now Available

Version 2.3.0 of the wolfSSL embedded SSL/TLS library has been released and is now available for download.  This release contains bug fixes and new features. Changes include the following (with details and comments for each listed below):

– AES-GCM crypto and cipher suites
– “make test” cipher suite checks
– Subject AltName processing
– Command line support for client/server examples
– Sniffer SessionTicket support
– SHA-384 cipher suites
– Verify cipher suite validity when user overrides
– CRL directory monitoring
– DTLS Cookie support, reliability coming soon

AES-GCM

The addition of AES-GCM (Galois/Counter Mode) cryptography and cipher suites brings the wolfSSL embedded SSL library one step away from being NSA Suite B compliant. The one missing element is ECC – which wolfSSL will be getting in September 2012.

wolfSSL 2.3.0 offers four different implementations of AES-GCM balancing speed versus memory consumption. If available, wolfSSL will use 64-bit or 32-bit math. For embedded applications, there is a speedy 8-bit version that uses RAM-based lookup tables (8KB per session) which is speed comparable to the 64-bit version and a slower 8-bit version that doesn`t take up any additional RAM. To enable AES with GCM in wolfSSL, configure the build with the option “–enable-aesgcm”. The configure option may be modified with the options “=word32”, “=table”, or “=small”, i.e. “–enable-aesgcm=table”.

“make test” Cipher Suite Checks

With the last few releases of wolfSSL, we’ve been working on enhancing wolfSSL’s default test cases which are executed when “make test” is issued from the wolfSSL root directory. With this release, we have added test cases for wolfSSL’s ciphers suites. The cipher suite checks iterate through wolfSSL’s SSL 3.0, TLS 1.0, 1.1, and 1.2 cipher suites (as defined in the /tests/test.conf file), verifying that each suite works correctly. When running “make test” you will now see output similar to the following for each cipher suite tested:

# server SSLv3 RC4-SHA
# client SSLv3 RC4-SHA
trying server command line[1]: SuiteTest -v 0 -l RC4-SHA
trying client command line[1]: SuiteTest -v 0 -l RC4-SHA
Client message: hello cyassl!
Server response: I hear you fa shizzle!

Subject AltName Processing

An X.509 certificate may contain a Subject Alternative Name, or “subjectAltName” extension which allows identities to be bound to the subject of the certificate. These names might be included in addition to the existing name in the Subject field of an X.509 certificate, or they may included in place of the standard Subject field of the certificate. Subject Alternative Names may take a variety of formats including an email address, DNS name, IP address, or a URI. This extension is defined in Section 4.2.1.6 of RFC 5280 (http://tools.ietf.org/html/rfc5280).

With this release, wolfSSL now processes Subject Alternative Names in certificates. wolfSSL has a new API function, wolfSSL_X509_get_next_altname() which allows retrieval of the subjectAltNames that have been processed.

Command Line Support for client/server Examples

The wolfSSL example client and server can now be run from the command line with a number of different options. These options allow users to select the Host, Port, SSL version, cipher list, certificate file, key file, CA file, toggle DTLS and pre shared keys, and more. To see the available options, run either ./examples/client/client or ./examples/server/server with the “-?” option:

./examples/client/client -?

The available options will be listed, similar to:

client 2.3.0 NOTE: All files relative to wolfSSL home dir
-? Help, print this usage
-h Host to connect to, default 127.0.0.1
-p Port to connect on, default 11111
-v SSL version [0-3], SSLv3(0) – TLS1.2(3)), default 3
-l Cipher list
-c Certificate file, default ./certs/client-cert.pem
-k Key file, default ./certs/client-key.pem
-A Certificate Authority file, default ./certs/ca-cert.pem
-b Benchmark connections and print stats
-s Use pre Shared keys
-d Disable peer checks
-g Send server HTTP GET
-u Use UDP DTLS
-m Match domain name in cert

Sniffer SessionTicket Support

wolfSSL’s Sniffer (or Inspection) functionality has been made more robust by the addition of support for TLS Session Tickets. The SessionTicket TLS extension is defined in RFC 5077 (http://tools.ietf.org/html/rfc5077). This extension enables a TLS server to resume sessions without storing per-client session information on the server side. The server encapsulates the current session state for a specific client into a ticket and forwards it to the client. That client is then able to resume a session if needed by using the previously-obtained ticket from the server.

SHA-384 Cipher Suites

With the addition of GCM support to wolfSSL, we have also added a number of SHA-384 cipher suites. New SHA-384 suites include:

TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384

Verify Cipher Suite Validity when User Overrides

wolfSSL 2.3.0 now checks to make sure that certificates and keys loaded into wolfSSL are valid for specified cipher suites chosen by the user. This added check enhances wolfSSL’s robustness and will prevent errors some users see when hand-picking cipher suites to use while not having all the correct functionality built into wolfSSL.

CRL Directory Monitoring

As you may know, we added initial support for CRL (Certificate Revocation List) with the release of wolfSSL 2.2.0 in May of this year. With this 2.3.0 release, we have added the ability to have wolfSSL actively monitor a specific CRL directory. Example usage can be seen in the wolfSSL example server (./examples/server/server.c) inside of the HAVE_CRL defines:

wolfSSL_EnableCRL(ssl, 0);
wolfSSL_LoadCRL(ssl, crlPemDir, SSL_FILETYPE_PEM, CYASSL_CRL_MONITOR |
CYASSL_CRL_START_MON);
wolfSSL_SetCRL_Cb(ssl, CRL_CallBack);

DTLS Cookie Support

wolfSSL has had DTLS support for quite some time, but we’re currently working on making it more functional and robust. With this release, wolfSSL’s DTLS implementation now supports cookies. Cookies are used in DTLS to prevent denial of service attacks. As stated in section 4.2.1 of RFC 4347 (http://tools.ietf.org/html/rfc4347):

“Datagram security protocols are extremely susceptible to a variety of denial of service (DoS) attacks. Two attacks are of particular concern:

• An attacker can consume excessive resources on the server by transmitting a series of handshake initiation requests, causing the server to allocate state and potentially to perform expensive cryptographic operations.

• An attacker can use the server as an amplifier by sending connection initiation messages with a forged source of the victim. The server then sends its next message (in DTLS, a Certificate message, which can be quite large) to the victim machine, thus flooding it.

In order to counter both of these attacks, DTLS borrows the stateless cookie technique used by Photuris (http://tools.ietf.org/html/rfc4347#ref-PHOTURIS) and IKE (http://tools.ietf.org/html/rfc4347#ref-IKE). When the client sends its ClientHello message to the server, the server MAY respond with a HelloVerifyRequest message. This message contains a stateless cookie generated using the technique of Photuris. The client MUST retransmit the ClientHello with the cookie added. The server then verifies the cookie and proceeds with the handshake only if it is valid. This mechanism forces the attacker/client to be able to receive the cookie, which makes DoS attacks with spoofed IP addresses difficult. “

We’re currently working on adding reliability to our DTLS implementation. This should be rolling out in the near future, so keep an eye on our blog for more news!

To download the open source, GPLv2-licensed version of wolfSSL 2.3.0, please visit our Download Page.  If you have any questions or comments or would like more information on commercial versions of wolfSSL, please contact us at info@yassl.com.

For build instructions, a full feature list, API reference, and more, please see the wolfSSL Manual.

wolfSSL Now Supports AES with GCM

We have added the Galois/Counter Mode for AES to wolfSSL. It adds an Authenticated Data with Associated Data (AEAD) cipher to TLS v1.2 where the cipher provides its own message authentication. The following cipher suites are available:

* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_RSA_WITH_AES_256_GCM_SHA384
* TLS_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
* TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256

We offer four different implementations balancing speed versus memory consumption. If available, it will use 64-bit or 32-bit math. For embedded SSL applications, there is a speedy 8-bit version that uses RAM-based lookup tables (8KB per session) that is speed comparable to the 64-bit version and a slower 8-bit version that doesn`t take up any additional RAM.

AES with GCM will be available in our next release. The latest sources are available in our GitHub repository. To enable AES with GCM in wolfSSL, configure the build with the option “–enable-aesgcm”. The configure option may be modified with the options “=word32”, “=table”, or “=small”, i.e. “–enable-aesgcm=table”.

We are very excited to offer this new cipher. Adding AES with GCM makes wolfSSL compatible with NSA Suite B.