wolfSSL Upcoming Webinar: Why We Rule: High Performance using Single Precision (SP) Math in wolfSSL

wolfSSL is excited to announce that we will be hosting a webinar on March 25th, 2020. This webinar will cover how to utilize wolfSSL to its fullest potential by exploring the capabilities of Single Precision (SP) Math presented by Senior Software Engineer, Sean Parkinson.

When: March 25th, 2020 11:00 AM Pacific Time
Topic: High Performance using Single Precision (SP) Math in wolfSSL

If you are interested, please register in advance for this webinar:
https://zoom.us/webinar/register/WN_Z2TqBLezTeSAX3WjeZg36A

After registering, you will receive a confirmation email containing information about joining the webinar.

We hope to see you there!

Contact us at facts@wolfssl.com with any questions about the webinar or the wolfSSL embedded SSL/TLS library.  Did you know that wolfSSL also supports TLS 1.3?

wolfSSL Upcoming Webinar: cURL Roadmap Call

wolfSSL is excited to announce that we will be hosting a webinar on March 26th, 2020. wolfSSL engineer and cURL founder Daniel Stenberg will be talking about the future of cURL, latest news, and future plans for cURL.

When: March 26th, 2020 11:00 AM Pacific Time
Topic: cURL Roadmap Call

If you are interested, please register in advance for this webinar:
https://zoom.us/webinar/register/WN_ksLN9wOFTC6y31n_CXYSNg

After registering, you will receive a confirmation email containing information about joining the webinar.

We hope to see you there!

Please contact us at facts@wolfssl.com with any questions about the webinar, the wolfSSL embedded SSL/TLS library, cURL, or tinycurl!

CURL WRITE-OUT JSON

Author: Daniel Stenberg (cross posted from daniel.haxx.se)

This is not a command line option of the week post, but I feel a need to tell you a little about our brand new addition!

–write-out [format]

This option takes a format string in which there are a number of different “variables” available that let’s a user output information from the previous transfer. For example, you can get the HTTP response code from a transfer like this:

curl -w 'code: %{response_code}'
https://example.org >/dev/null

There are currently 34 different such variables listed and described in the man page. The most recently added one is for JSON output and it works like this:

%{json}

It is a single variable that outputs a full json object. You would for example invoke it like this when you get data from example.com:

curl --write-out '%{json}' https://example.com -o saved

That command line will spew some 800 bytes to the terminal and it won’t be very human readable. You will rather take care of that output with some kind of script/program, or if you want an eye pleasing version you can pipe it into jq and then it can look like this:

{
    "url_effective": "https://example.com/",
    "http_code": 200,
    "response_code": 200,
    "http_connect": 0,
    "time_total": 0.44054,
    "time_namelookup": 0.001067,
    "time_connect": 0.11162,
    "time_appconnect": 0.336415,
    "time_pretransfer": 0.336568,
    "time_starttransfer": 0.440361,
    "size_header": 347,
    "size_request": 77,
    "size_download": 1256,
    "size_upload": 0,
    "speed_download": 0.002854,
    "speed_upload": 0,
    "content_type": "text/html; charset=UTF-8",
    "num_connects": 1,
    "time_redirect": 0,
    "num_redirects": 0,
    "ssl_verify_result": 0,
    "proxy_ssl_verify_result": 0,
    "filename_effective": "saved",
    "remote_ip": "93.184.216.34",
    "remote_port": 443,
    "local_ip": "192.168.0.1",
    "local_port": 44832,
    "http_version": "2",
    "scheme": "HTTPS",
    "curl_version": "libcurl/7.69.2 GnuTLS/3.6.12 zlib/1.2.11 brotli/1.0.7 c-ares/1.15.0 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) nghttp2/1.40.0 librtmp/2.3"
}

The JSON object

It always outputs the entire object and the object may of course differ over time, as I expect that we might add more fields into it in the future.

The names are the same as the write-out variables, so you can read the –write-out section in the man page to learn more.

Ships?

The feature landed in this commit. This new functionality will debut in the next pending release, likely to be called 7.70.0, scheduled to happen on April 29, 2020.

Credits

This is the result of fine coding work by Mathias Gumz.

wolfSSL Support for DO-178 DAL A

wolfSSL now provides support for complete RTCA DO-178C level A certification! wolfSSL will offer DO-178 wolfCrypt as a commercial off -the-shelf (COTS) solution for connected avionics applications. Adherence to DO-178C level A will be supported through the first wolfCrypt COTS DO-178C certification kit release that includes traceable artifacts for the following encryption algorithms:

  • SHA-256 for message digest
  • AES for encryption and decryption
  • RSA to sign and verify a message.
  • Chacha20_poly1305 for authenticated encryption and decryption.

The primary goal of this initial release is to provide the proper cryptographic underpinnings for secure boot and secure firmware update in commercial and military avionics. wolfSSL brings trusted, military-grade security to connected commercial and military aircraft. Avionics developers now have a flexible, compact, economical, high-performance COTS solution for quickly delivering FIPS 140-2 validated crypto algorithms can be used in DO-178 mode for combined FIPS 140-2/DO-178 consumption. The wolfCrypt cryptography library FIPS 140-2 validation certificates can be applied to DO-178 uses. 

Optimization Support

We understand that securely rebooting avionic systems has rigorous performance requirements. As such, we’re here to help with cryptographic performance optimizations through our services organization. 

To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.

wolfSSL DO-178 product page: https://www.wolfssl.com/wolfssl-support-178-dal/.

For more information, please contact facts@wolfssl.com.

 

 

wolfSSL FIPS Ready and curl (#wolfSSL #wolfCrypt #curl)

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

For more information regarding wolfSSL, wolfCrypt, cURL, support packages, or any additional questions, please contact facts@wolfssl.com.

 

wolfSSL + Nginx

The wolfSSL embedded SSL/TLS library provides support for various open source projects, including Nginx. For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository.  The configure option --enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

For more information on wolfSSL + Nginx, TLS 1.3, OCSP, FIPS, or for any additional questions, contact facts@wolfssl.com.

Check out our Webinar on Secure Boot!

In 2019, there were 30 billion IoT connected devices which brings forth the necessity of establishing reliable security measures in order to protect devices. This pushed for the development of secure bootloaders. Microcontroller-based embedded devices run into several issues including the unsafe environment, rush to connectivity, as well as the lack of standards on remote updates. wolfSSL’s secure bootloader, wolfBoot, provides security solutions and enables open security standards on microcontroller-based embedded systems.

wolfBoot is the Open Source secure bootloader for virtually any 32-bit microcontroller. It can be integrated with other bootloaders, has multi-slot partitioning of the programming flash, as well as support for updates from an external SPI flash. wolfBoot also leverages wolfSSL’s underlying wolfCrypt module to provide authentication for running the firmware.

To watch the Webinar, view:
?https://www.youtube.com/watch?v=u5sP31WHy_o&t=939s

More about wolfCrypt: ?https://wolfssl.com/products/wolfCrypt/
More about wolfBoot:? https://www.wolfssl.com/products/wolfboot/

Contact us at facts@wolfssl.com with any questions about wolfBoot or the wolfSSL embedded SSL/TLS library.  wolfSSL also supports TLS 1.3, FIPS 140-2, and DO-178!