wolfSSL at Xilinx Developer Forum

Come visit wolfSSL at Xilinx Developer Forum this year! Xilinx Developer Forum is an event that connects industry partners, sponsors, and engineers of Xilinx with software engineers and system designers. wolfSSL will be in San Jose on October 1-2 exhibiting at Xilinx Developer Forum. Visit our booth to speak with one of our embedded security experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!

Where wolfSSL will be located for Xilinx Developer Forum:

Venue: Fairmont San Jose / San Jose, CA
When: October 1-2, 2019
Venue Informationhttp://www.cvent.com/events/2019-xdf-americas/custom-18-1865c8684fb745ceaef585f1eaa7fd26.aspx

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.

More information about Xilinx Developer Forum can be found here.

wolfSSL FIPS Ready and curl (#wolfSSL #wolfCrypt #curl)

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

For more information regarding wolfSSL, wolfCrypt, cURL, support packages, or any additional questions, please contact facts@wolfssl.com.

wolfSSL Visual Studio Projects for the Microsoft Azure Sphere MT3620 IoT MCU

Azure Sphere is Microsoft’s innovative ecosystem centered around IoT device security.  The ecosystem includes the MT3620 IoT MCU, the Azure Sphere OS that runs on the MT3620, and a security service that brokers device-to-cloud communications.

The MT3620 has an Arm Cortex-A7 application processor, two real-time Arm Cortex-M4F I/O subsystems and a dedicated Wi-Fi subsystem.  This combination allows for a diverse and flexible range of IoT use cases. What really makes the MT3620 stand out is the Microsoft Pluton security subsystem and other security related features.  Pluton on the MT3620 is made up of an Arm Cortex-M4F core that is isolated from end-user accessible cores. It allows for secure boot and secure system operation. Other MT3620 security features are authentication, attestation, and over-the-air software updates.

Creating an application for the MT3620 is done with the Azure Sphere SDK Preview for Visual Studio.  wolfSSL has recently released a Visual Studio solution that contains three projects for the MT3620. The three projects are a TLS encrypted client, TLS encrypted server and a cryptographic algorithm test for the wolfCrypt library.

Getting Started

For more information, please contact facts@wolfssl.com.

Read more about Azure Sphere.

wolfSSL with curl and tiny-curl (#curl)

wolfSSL’s embedded SSL/TLS library comes with support for many tools and libraries, one of which is curl! In addition to providing support and maintenance for curl, wolfSSL has also integrated the curl library in conjunction with Daniel Stenberg (an original author of curl and one of the founders). With this integration, wolfSSL now provides support and consulting for the curl library.

In addition, a modified version of the curl library, tiny-curl, is also available through wolfSSL. tiny-curl is a patch applied on top of curl to reduce its code size, which makes it favorable for embedded and real-time environments. Version 0.10 of tiny-curl is based on curl version 7.65.3, and is available for download from the wolfSSL download page: https://www.wolfssl.com/download/.

More information about wolfSSL and curl can be found on the curl product page: https://www.wolfssl.com/products/curl/. Details on wolfSSL support for curl and tiny-curl is also located on the support page here: https://www.wolfssl.com/products/support-packages/.

wolfSSL also provides support for the latest versions of the TLS protocol, including TLS 1.3! As such, wolfSSL is considering adding TLS 1.3 support to cURL in the future. More information about wolfSSL and TLS 1.3 can be found here: https://www.wolfssl.com/docs/tls13/.

For more information regarding wolfSSL, TLS 1.3, cURL, support packages, or any additional questions, please contact facts@wolfssl.com.

wolfSSL Security Internship Info Session and MSU Fall Career Fair

MSU info session flyer 2019

In preparation for the 2019 Fall Career Fair at MSU Bozeman, wolfSSL will be holding an info session this upcoming Thursday at Montana State University in Bozeman, MT for students interested in learning more about wolfSSL and our internship program.  The session will introduce wolfSSL as a company – including background information, product lineup, work environment, and more.

We encourage any students who are interested in Internet security, SSL/TLS, cryptography, embedded security, or software development to attend!  Pizza will be served.

wolfSSL Info Session
Thursday, September 26, 2019
Montana State University, Bozeman
5-6pm, Roberts Hall 210

We look forward to seeing you there! Feel free to contact chris@wolfssl.com with any questions or for more information. To learn more about the wolfSSL lightweight SSL/TLS library, visit our product page, or download the Open Source version today!

wolfSSL at ST Technology Tour – Vancouver

Come visit wolfSSL at ST Technology Tour Vancouver this year! ST Technology Tour hosts presentations, hands-on training and demos by industry experts in markets poised for rapid growth in the coming years. This event is free to attend and geared towards design engineers, purchasing decision makers, project managers, developers, technology package designers and students. Visit our booth on September 24th to speak with one of our embedded security experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!

Where wolfSSL will be located for ST Technology Tour – Vancouver:

VenueVancouver Marriott Pinnacle Downtown Hotel / Vancouver, BC
When: September 24th, 2019
Venue Informationhttps://www.st.com/content/st_com/en/campaigns/technology-tour-2019/vancouver.html

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.

More information about ST Technology Tours can be found here: https://www.st.com/content/st_com/en/campaigns/technology-tour-2019.html

wolfSSL at Federal Identity Forum 2019 (#FedID)

Come visit wolfSSL at Federal Identify Forum! wolfSSL will be in Tampa, FL next week exhibiting at Federal Identity Forum. Visit our booth from September 24th-26th to speak with one of our embedded security experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!

Where wolfSSL will be located for Federal Identity Forum:

Venue: Tampa Convention Center / Tampa, FL
When: September 24th-26th, 2019
Booth #: 419
Venue Informationhttps://events.afcea.org/FedID19/Public/Content.aspx?ID=76721&sortMenu=101001

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.

More information about Federal Identity Forum can be found here: https://events.afcea.org/FedID19/Public/enter.aspx

wolfSSL MQTT Sensor Network (MQTT-SN)

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

  • Register
  • Will topic and message set up
  • Will topic and message update
  • All QoS levels
  • Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

For more information please email us at facts@wolfssl.com.

wolfSSL FIPS-Ready

With the recent release of wolfSSL 4.1.0, the wolfSSL team has also updated the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS validation is a government certification for cryptographic modules that states the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.

Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products are in place, they can be tested using FIPS validated code with their software before committing.

wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/

For more information about wolfSSL and its FIPS Ready initiative, please contact facts@wolfssl.com.

Differences between TLS 1.2 and TLS 1.3 (#TLS13)

wolfSSL's embedded SSL/TLS library has included support for TLS 1.3 since early releases of the TLS 1.3 draft. Since then, wolfSSL has remained up-to-date with the TLS 1.3 specification. In this post, the major upgrades of TLS 1.3 from TLS 1.2 are outlined below:

TLS 1.3

This protocol is defined in RFC 8446. TLS 1.3 contains improved security and speed. The major differences include:

  • The list of supported symmetric algorithms has been pruned of all legacy algorithms. The remaining algorithms all use Authenticated Encryption with Associated Data (AEAD) algorithms.
  • A zero-RTT (0-RTT) mode was added, saving a round-trip at connection setup for some application data at the cost of certain security properties.
  • Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
  • All handshake messages after the ServerHello are now encrypted.
  • Key derivation functions have been re-designed, with the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) being used as a primitive.
  • The handshake state machine has been restructured to be more consistent and remove superfluous messages.
  • ECC is now in the base spec  and includes new signature algorithms. Point format negotiation has been removed in favor of single point format for each curve.
  • Compression, custom DHE groups, and DSA have been removed, RSA padding now uses PSS.
  • TLS 1.2 version negotiation verification mechanism was deprecated in favor of a version list in an extension.
  • Session resumption with and without server-side state and the PSK-based ciphersuites of earlier versions of TLS have been replaced by a single new PSK exchange.

More information about wolfSSL and the TLS 1.3 protocol can be found here: https://www.wolfssl.com/docs/tls13/.

Additionally, please contact facts@wolfssl.com for any questions.

Posts navigation

1 2 3