Month: August 2019

wolfSSL, in partnership with Security Innovation, has support for the “Quantum-safe hybrid” ciphersuite. Having this ciphersuite supported in the wolfSSL embedded TLS library allows two parties to use any existing ciphersuite and “quantum-safe” any traffic protected by that ciphersuite. Adding in the quantum resistant section to the master secret increases protection against attackers who record the traffic and later develop quantum computers.

The super-fast NTRU algorithm, featuring efficient key generation, encryption, and decryption, is a quantum computer resistant algorithm currently being used with the quantum-safe ciphersuite. By using a one-time NTRU key to encrypt extra secret material, the handshake allows users to continue using their existing ciphersuites (which may be necessary for certificate support or because they have regulations that require it) while at the same time benefiting from the true long-term security that NTRU gives. Because NTRU is fast, the additional processing load from the use of this ciphersuite is low.

To view and use the quantum safe handshake extensions, first download and install NTRU (an Open Source version can be found at https://github.com/NTRUOpenSourceProject/ntru-crypto). Then download the most recent version of wolfSSL  (https://www.wolfssl.com/download/) and compile using ./configure –with-ntru –enable-qsh. The draft for QSH is located here https://tools.ietf.org/html/draft-whyte-qsh-tls13-00.

For more information, please contact facts@wolfssl.com.

 

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

• Register
• Will topic and message set up
• Will topic and message update
• All QoS levels
• Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

For more information please email us at facts@wolfssl.com.

A new update to the asynchronous version of wolfSSL v4.1.0 has been released. With this release comes bug fixes and new features included in the wolfSSL v4.1.0 release.

In addition to all the wolfSSL v4.1.0 fixes, the asynchronous version also includes the following:

• Fixes for memory stability on QuickAssist:
  
  • Fix for possible issue with QAT NUMA allocations failing and causing downstream issues.
  • Fix to only call NUMA free if actually NUMA type.
  • Fix to not use NUMA types for in/out if QAT cipher and hashing are disabled.
  • Fix to resolve issue with repeated calls to IntelQaRsaPublicFree. The pPublicKey variable is a pointer and is cleared with XMEMSET(opData.
  • Cleanup for non-NUMA alloc case.
  • Updates to README.md for Intel QAT.
• Updates to Cavium Nitrox README.md.

For more information on wolfSSL Async, download the flyer here.

If interested in evaluating our asynchronous versions of wolfSSL or wolfCrypt please email us at facts@wolfssl.com.

With the recent release of wolfSSL 4.1.0, the wolfSSL team has also updated the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS validation is a government certification for cryptographic modules that states the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.

Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products are in place, they can be tested using FIPS validated code with their software before committing.

wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/

For more information about wolfSSL and its FIPS Ready initiative, please contact facts@wolfssl.com.

wolfTPM version 1.6 has been released (08/01/2019) and is available for download! This release includes improvements for compatibility, chip detection, initialization options and small stack support. This version adds new wrapper API’s for PCR extend as well as support for using HMAC with an existing key.

A full list of the release notes are listed below:

• Fix for wolfCrypt init/cleanup issue with reference count. (PR #75)
• Fix to restore existing TPM context after calling wolfTPM2_Test. (PR #74)
• Fix to resolve handling of unsupported ECC curves with the TPM module and ECDHE. (PR #69)
• Fix for wolfTPM2_SetCommand to ensure auth is cleared. (PR #69)
• Added --enable-smallstack build options for reducing stack usage. (PR #73)
• Added support for keeping an HMAC key loaded. (PR #72)
• Added API unit test framework. (PR #71)
• Added new wrapper API wolfTPM2_OpenExisting for accessing device that’s already started. (PR #71)
• Added new wolfTPM2_ExtendPCR wrapper. (PR #70)
• Added crypto callback flags for FIPS mode and Use Symmetric options. (PR #69)
• Added WOLFTPM_DEBUG_TIMEOUT macro for debugging the timeout checking. (PR #69)
• Added support for ST33 TPM2_SetMode command for disabling power saving. (PR #69)
• Improvements for chip detection, compatibility and startup performance (PR #67)
• Added support for XPRINTF.
• Fix printf type warnings.
• Moved the TPM hardware type build macro detection until after the user_settings.h include.
• Optimization to initialize Mutex and RNG only when use is required.
• Added missing stdio.h for printf in examples.
• Added new API’s TPM2_SetActiveCtx, TPM2_ChipStartup, TPM2_SetHalIoCb and TPM2_Init_ex.
• Allowed way to indicate BOOL type already defined.
• Added C++ support.
• Added new API wolfTPM2_Test for testing for TPM and optionally returning capabilities. (PR #66)
• Added way to include generated wolftpm/options.h (or customized one) using WOLFTPM_USER_SETTINGS. (PR #63)

You can download the latest release here: https://www.wolfssl.com/download/

Additional information on wolfTPM can be found on the wolfTPM product page.

For more information on platform support or for questions regarding wolfTPM, contact us at facts@wolfssl.com.

wolfSSL is exhibiting at Black Hat USA this week at Mandalay Bay in Las Vegas, NV! Stop by our booth (#1347) today or tomorrow (August 7th & 8th) to talk with our experts about TLS 1.3, embedded security, embedded SSL/TLS, MQTT, SSH, curl, and more!

If you would like to set up a specific meeting time either on or off the show floor, send us an email at facts@wolfssl.com.

wolfMQTT v1.3.0 has been released (08/01/2019) and is available for download. With this release comes multithread support with the enable option --enable-mt, various fixes and improvements to examples, and more.

A full list of wolfMQTT 1.3.0 release notes are listed below:

• Fix fwpush example to use filename option -f. (PR #117)
• Added multiple thread support using --enable-mt or WOLFMQTT_MULTITHREAD. (PR #115)
• Fix for MQTT_DATA_TYPE_BINARY data length encoded twice. (PR #112)
• Fix to clear local structures for subscribe and unsubscribe ACK’s. (PR #112)
• Fix for SN_Encode_Unsubscribe using wrong data type for topic name ID. (PR #110)
• Add WOLFSSL_USER_SETTINGS to VS project files. (PR #109)
• Fixes for using RTCS in mqttnet.c socket example code. (PR #108)
• Fix MQTT-SN decode publish parsing and QoS2 response. (PR #107)
• Make MqttSocket_TlsSocket callbacks public. (PR #104)
• Improved the disconnect network error callback example. (PR #102)
• Add MQTT context information to socket callback examples. (PR #101)
• Initialize subscribe state to MQTT_MSG_BEGIN. (PR #99)
• Fix for Harmony possible circular include issue. (PR #98)

You can download the latest release here: https://www.wolfssl.com/download/

wolfMQTT Product Page

For more information on wolfMQTT, contact us at facts@wolfssl.com.

Author: Daniel Stenberg

Without much fanfare or fireworks we put together and shipped a fresh new version of tiny-curl. We call it version 0.10 and it is based on the 7.65.3 curl tree.

tiny-curl is a patch set to build curl as tiny as possible while still being able to perform HTTPS GET requests and maintaining the libcurl API. Additionally, tiny-curl is ported to FreeRTOS.

Changes in 0.10

• The largest and primary change is that this version is based on curl 7.65.3, which brings more features and in particular more bug fixes compared to tiny-curl 0.9.
• Parts of the patches used for tiny-curl 0.9 was subsequently upstreamed and merged into curl proper, making the tiny-curl 0.10 patch much smaller.

Download

As before, tiny-curl is an effort that is on a separate track from the main curl. Download tiny-curl from wolfssl.com!

wolfSSL will be attending and exhibiting at Microchip MASTERs 2019 this week! Come visit the wolfSSL in Phoenix from Tuesday, August 6th through Friday, August 9th to speak with one of our embedded security experts.

Where wolfSSL will be located for Microchip MASTERs 2019:

Venue: JW Marriot Desert Ridge Resort / Phoenix, AZ
When: August 6-9, 2019
Directions: https://secure.microchip.com/usmasters/faq.aspx

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.

More information about Microchip MASTERs can be found here: https://secure.microchip.com/usmasters/home.aspx

Come visit wolfSSL at Black Hat USA! wolfSSL will be exhibiting next week in Las Vegas at Mandalay Bay. Stop by our booth on August 7th & 8th to talk to one of our experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!

Where wolfSSL will be located for Black Hat USA:

Venue: Mandalay Bay / Las Vegas, NV
Booth #: 1347
When: August 3-8, 2019
Directions: https://www.blackhat.com/us-19/travel.html

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.

More information about Black Hat USA 2019 can be found here: https://www.blackhat.com/us-19/