Month: January 2020

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the –enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

• Register
• Will topic and message set up
• Will topic and message update
• All QoS levels
• Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

For more information please email us at facts@wolfssl.com.

In the latest wolfSSL releases, we have added 200+ new API to our OpenSSL compatibility layer. Many of these new API were added for providing support for Apache HTTP Server. We are excited to announce that as of version 4.2.0, wolfSSL now provides support for the Apache web server with the enable option --enable-apachehttpd. This means you can now build Apache with the latest, most robust security provided by the wolfSSL SSL/TLS and wolfCrypt libraries.

If you are interested in building Apache httpd with wolfSSL, please contact us at facts@wolfssl.com for a version of Apache that is compatible.

For comparison between wolfSSL and OpenSSL, visit https://www.wolfssl.com/docs/wolfssl-openssl/.

From the early days of the wolfSSL library, we have provided example clients and servers with wolfSSL. These examples have showed how easy it is to use wolfSSL in various configurations. We also use them to help test the library. Over the years we’ve added new features available with TLS to our examples, and our examples have grown a little complicated.

Enter the wolfSSL Examples GitHub repository. We tasked some of our interns, with little to no experience with the wolfSSL library, to write some example clients and servers that set up and test various types of connections. They give you a bare-bones simple demonstration on how to set up a client or server using wolfSSL. We also have examples showing off how to use some features of the library like the certificate manager. Check them out! As always, if you have questions or suggestions, please reach out at facts@wolfssl.com.

To help out with customers who want to update the wolfSSL library without needing to change their application, wolfSSL Inc is striving to maintain application binary compatibility with a subset of our API. As of wolfSSL v4.3.0, the following functions will be compatible across all releases of wolfSSL moving forward:

wolfSSL_accept	wolfSSL_check_domain_name
wolfSSL_Cleanup	wolfSSL_connect
wolfSSL_CTX_free	wolfSSL_CTX_GetDevId
wolfSSL_CTX_load_verify_locations	wolfSSL_CTX_new
wolfSSL_CTX_SetDevId	wolfSSL_CTX_SetEccSignCb
wolfSSL_CTX_SetMinVersion	wolfSSL_CTX_set_session_cache_mode
wolfSSL_CTX_set_timeout	wolfSSL_CTX_set_verify
wolfSSL_CTX_use_certificate_chain_file	wolfSSL_CTX_use_certificate_file
wolfSSL_CTX_use_PrivateKey_file	wolfSSL_CTX_UseSNI
wolfSSL_flush_sessions	wolfSSL_free
wolfSSL_get_error	wolfSSL_get_peer_certificate
wolfSSL_GetRNG	wolfSSL_get_session
wolfSSL_get_sessionID	wolfSSL_Init
wolfSSL_new	wolfSSL_pending
wolfSSL_read	wolfSSL_SetDevId
wolfSSL_set_fd	wolfSSL_set_session
wolfSSL_set_timeout	wolfSSL_shutdown
wolfSSL_UseALPN	wolfSSL_UseSNI
wolfSSL_use_certificate_chain_file	wolfSSL_use_certificate_file
wolfSSL_use_PrivateKey_file	wolfSSL_write
wolfSSL_X509_free	wolfSSL_X509_get_next_altname
wolfSSL_X509_get_issuer_name	wolfSSL_X509_get_subject_name
wolfSSL_X509_load_certificate_file	wolfSSL_X509_NAME_oneline
wolfSSL_X509_notAfter	wolfSSL_X509_notBefore
wolfTLSv1_2_client_method	wolfTLSv1_2_server_method
wolfTLSv1_3_client_method	wolfTLSv1_3_server_method
wolfCrypt_Init	wolfCrypt_Cleanup
wc_ecc_free	wc_ecc_import_x963
wc_ecc_init_ex	wc_ecc_key_free
wc_ecc_key_new	wc_ecc_make_key_ex
wc_RNG_GenerateBlock	wc_rng_new
wc_ecc_sign_hash	wc_rng_free
wc_InitRng	wc_ecc_make_key
wc_ecc_check_key	wc_ecc_init
wc_ecc_fp_free	wc_ecc_shared_secret
wc_ecc_size	wc_ecc_sig_size_calc
wc_ecc_sig_size	wc_ecc_ctx_new
wc_ecc_ctx_free	wc_ecc_ctx_reset
wc_ecc_encrypt	wc_ecc_decrypt
wc_ecc_sign_hash	wc_ecc_verify_hash
wc_InitCert	wc_MakeSelfCert
wc_MakeCert	wc_SignCert
wc_MakeCertReq	wc_SetIssuer
wc_SetSubject	wc_SetSubjectRaw
wc_GetSubjectRaw	wc_SetAltNames
wc_SetIssuerBuffer	wc_SetIssuerRaw
wc_SetSubjectBuffer	wc_SetAltNamesBuffer
wc_SetDatesBuffer	wc_SetCert_Free
wc_DerToPem	wc_EccKeyToDer
wc_EccPrivateKeyDecode	wc_EccPublicKeyDecode
wc_EccPublicKeyToDer	wc_ecc_export_x963
wc_ecc_export_x963_ex	wc_ecc_import_private_key
wc_ecc_rs_to_sig	wc_ecc_import_raw
wc_ecc_export_private_only	wc_GetErrorString
wc_ChaCha20Poly1305_Decrypt	wc_ChaCha20Poly1305_Encrypt
wc_CertNew	wc_CertFree

We have added some testing to our already extensive testing plan to verify these functions do not change.

Given that the security landscape is an always changing surface, we want to make sure you are able to upgrade wolfSSL as easily as possible. There will always be some new attack on the protocol or a cipher and keeping wolfSSL up to date in your product is important to us, and for everyone. If you have questions about wolfSSL’s ABI compatibility, please email us at facts@wolfssl.com.

The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release wolfSSL 4.3.0, we have updated the support for the open source project WebRTC to branch m79 (https://webrtc.org/). This is a project that allows real time communication (RTC) with IoT, mobile and web browsers. Many additional API where added to the wolfSSL compatibility layer in order to plug wolfSSL into WebRTC instead of BoringSSL.

Notable advantages of choosing to build WebRTC with wolfSSL are evident through wolfSSL’s superior security implementations, including support for FIPS, PKCS#11, hardware encryption, TLSv1.3, and more. Additionally, 24×7 support and consulting services are available to help build your wolfSSL + WebRTC project.

The pull request with the latest updates for WebRTC can be found here:
https://github.com/wolfSSL/wolfssl/pull/2585

Upstream changes for WebRTC that include wolfSSL support can be found here:
https://webrtc-review.googlesource.com/c/src/+/159760

Download and learn more about wolfSSL 4.3.0 here:
https://www.wolfssl.com/products/wolfssl/

For questions about the use of wolfSSL with WebRTC, 24×7 support, or for any additional questions contact us at facts@wolfssl.com.

The holiday release of wolfSSL, version 4.3, is now available! This release has fantastic new features, optimizations, and bug fixes. Some of the exciting new features that were added to the wolfSSL library are summarized below:

• The addition of –enable-libwebsockets option for support of libwebsockets build was added in the release!
• Updated support of NGINX 1.15.0 and in addition to that we added support for NGINX version 1.16.1.
• Updates to RSA-PSS salt lengths. Macro WOLFSSL_PSS_SALT_LEN_DISCOVER allows for discovering the salt length. Passing RSA_PSS_SALT_LEN_DISCOVER value into wc_RsaPSS_Verify_ex attempts to discover salt length and can use larger salt lengths.
• wolfSSL is constantly expanding the OpenSSL compatibility API to help people migrate from OpenSSL to wolfSSL. In this release the API wolfSSL_CertManagerGetCerts and wolfSSL_X509_STORE_GetCerts were added for retrieving certificates.
• wolfSSL has an optimized math library for single precision operations. Greatly speeds up some set key sizes with RSA, ECC, and DH operations. In this release support for 4096-bit RSA/DH operations was added!
• Last release (v4.2.0) we came out with support for Google WebRTC, in this release we updated that support to branch m79.
• We added new FREESCALE_MQX_5_0 macro for MQX 5.0 support
• Some users that make use of the OpenSSL compatibility layer like to trim down the bloat while keeping certain API’s. In this release the additional build flag of –disable-errorqueue was added so that the extra error queue is disabled with –enable-opensslextra builds.
• And more…. (check out the README from the download for a full list)

Continue reading “wolfSSL Version 4.3.0 is Now Available!”

With each release of the wolfSSL embedded SSL/TLS library, new improvements and feature additions are always included. The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release wolfSSL 4.3.0, we are happy to say we have improved our support for Nginx. wolfSSL has updated support for Nginx 1.15.1 and added support for Nginx 1.16.1.

For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository. The configure option –enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

For more information on wolfSSL + Nginx, TLS 1.3, OCSP, FIPS, or for any additional questions, contact facts@wolfssl.com.

As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until mid 2021. The version of OpenSSL that supports FIPS is now in End Of Life and is no longer supported.

This means that OpenSSL users will not have a supported FIPS Object Module for over a year. This is a big issue for companies that rely on security! If there is a bug in the FIPS Object Module, you will need to fix it and revalidate on your own.

To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:

1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,
2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,
3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

Finally, we will be submitting our FIPS 140-3 module to NIST in September 2020, which is the earliest available date for submissions.

Contact us at facts@wolfssl.com if you would like to learn more!

We love you.

Team wolfSSL