Month: March 2021

wolfSSL personally invites you to our wolfSentry webinar, where we are introducing our newest product wolfSentry, a universal, dynamic, embeddable IDPS (intrusion detection and prevention system)! Join us to learn about about what an IDPS is, why you should care, and wolfSentry is the solution to all of your problems

About the webinar:

When: Mar 31, 2021 10:00 AM Pacific Time (US and Canada)
Topic: Introducing wolfSentry, an Embeddable IDPS

Register in advance for this webinar:
https://us02web.zoom.us/webinar/register/WN_-rtKcubGRCKojg2NsWsmCw

After registering, you will receive a confirmation email containing information about joining the webinar.

Please bring any questions you have, and we look forward to seeing you there!

We see a continuing adoption of wolfTPM and TPM 2.0 modules in IoT and Edge embedded systems. In addition, there is a new trend of adding wolfTPM to safety-critical systems, such as aerospace and medical products. For many years, there was no TPM 2.0 stack designed for baremetal and RTOS systems and wolfTPM changed this.

Today, we can announce that wolfTPM is also the first TPM 2.0 stack to support Physical Presence (PP). This feature allows the user to confirm TPM 2.0 operations by asserting physical input to the TPM chip and increase the level of security assurance for critical operations.

For example, TPM2_Clear is a command that returns the TPM to a factory state, destroying existing primary and storage keys, and can be safeguarded by a PP request. TPM2_Clear is typically used when onboarding a new owner of a system, e.g. second market or internal change of ownership equipment.

PP requests are satisfied by controlling a dedicated I/O pin on the TPM chip and now wolfTPM has the capability to extend the list of commands that require it. This could be used to restrict certain operations. It could also be used in existing designs to replace a mechanical switch previously used for Physical Presence.

Another new feature of wolfTPM is the ability to control extra I/O pins available on TPM modules, such as the STMicroelectronics ST33 TPM 2.0 module. The developer can use a single wolfTPM call to control additional I/O pins and pass physical signals, as sign of security or system events, to other subsystems.

For more information about TPM 2.0 Physical Presence and extra I/O support, please contact us at facts@wolfssl.com 

Some of our users have been wondering if we were doing benchmarks of our SSL/TLS and cryptography performance. Here are the results we have gathered so far: wolfSSL / wolfCrypt Benchmarking.  This page includes several reference benchmarks as well as comparisons of software versus hardware cryptography.

Let us know if we should do a different kind of benchmark at facts@wolfssl.com.

wolfSSL supports the Online Certificate Status Protocol (OCSP) [https://tools.ietf.org/html/rfc2560] as a client and OCSP stapling version 1 [https://tools.ietf.org/html/rfc6066#section-8] and 2 [https://tools.ietf.org/html/rfc6961]. OCSP is a substitute for Certificate Revocation Lists (CRL). CRLs are a list of certificates that shouldn’t be temporarily or permanently trusted. A major setback for CRLs is the time it takes for these lists to propagate. It may take up to a week [https://tools.ietf.org/html/rfc5280#section-3.3] due to CRLs being issued periodically by Certificate Authorities (CA). OCSP allows clients to verify the validity of server certificates with an OCSP responder and know in real time whether to trust a certificate or not.

OCSP stapling is a TLS extension sent by a client that instructs the server that it would like to receive certificate status information. Stapling significantly cuts down on bandwidth and on round trips needed to set up a connection. When a TLS server receives the Certificate Status Request extension from a client, it will transmit the OCSP responders complete, DER-encoded OCSP response. This relieves the client from having to ask an OCSP responder about the certificate validity and saves the OCSP responder bandwidth coming from clients of a frequently visited server.

OCSP stapling version 1 is severely limited by being able to only transmit the status information of only one certificate. Many TLS servers opt to send intermediate certificates along with its own certificate in case clients do not know the intermediate certificate chain. OCSP stapling version 1 will only save the client the trouble of confirming the status of the server’s certificate, but not of checking the intermediate certificates. OCSP stapling version 2 defines a new extension that allows “servers […] to provide status information about not only the server’s own certificate but also the status of intermediate certificates in the chain” [https://tools.ietf.org/html/rfc6961].

To compile wolfSSL with OCSP support, use the following configure options:
OCSP: --enable-ocsp
OCSP stapling: --enable-ocspstapling
OCSP stapling v2: --enable-ocspstapling2

The following API are available in wolfSSL to enable OCSP usage:

int wolfSSL_CTX_EnableOCSP(WOLFSSL_CTX*, int options);
 int wolfSSL_CTX_DisableOCSP(WOLFSSL_CTX*);
 int wolfSSL_CTX_SetOCSP_OverrideURL(WOLFSSL_CTX*, const char*);
 int wolfSSL_CTX_SetOCSP_Cb(WOLFSSL_CTX*,
 CbOCSPIO, CbOCSPRespFree, void*);
 int wolfSSL_CTX_EnableOCSPStapling(WOLFSSL_CTX*);
 int wolfSSL_CTX_DisableOCSPStapling(WOLFSSL_CTX*);
 int wolfSSL_CTX_EnableOCSPMustStaple(WOLFSSL_CTX*);
 int wolfSSL_CTX_DisableOCSPMustStaple(WOLFSSL_CTX*);

The following flow is enough to use OCSP in wolfSSL:

wolfSSL_CTX_EnableOCSP(ctx, 0);

To use OCSP stapling:

wolfSSL_CTX_EnableOCSPStapling(ctx);
 wolfSSL_UseOCSPStapling(ssl, WOLFSSL_CSR_OCSP, 0);
 wolfSSL_CTX_EnableOCSP(ctx, 0);

To use OCSP stapling version 2:

wolfSSL_CTX_EnableOCSPStapling(ctx);
 wolfSSL_UseOCSPStaplingV2(ssl, WOLFSSL_CSR2_OCSP*, 0);
 wolfSSL_CTX_EnableOCSP(ctx, 0);

* To provide status request information for intermediate certificates use WOLFSSL_CSR2_OCSP_MULTI

To allow the server to provide OCSP stapling responses use:

wolfSSL_CTX_EnableOCSP(ctx, 0);

To provide a custom OCSP responder URL use:

wolfSSL_CTX_SetOCSP_OverrideURL(ctx, ocspUrl);
 wolfSSL_CTX_EnableOCSP(ctx, WOLFSSL_OCSP_URL_OVERRIDE);

OCSP stapling version 2 can’t be used with TLS 1.3 as it has been deprecated [https://tools.ietf.org/html/rfc8446#section-4.4.2.1]. TLS 1.3 uses OCSP stapling version 1 but the certificate status is not a separate message. Instead it is included as an extension to the corresponding certificate.

To learn more about the many features of wolfSSL, email us at facts@wolfssl.com.

Support for wolfSSL has been upstreamed to the master OpenVPN branch in f6dca235ae560597a0763f0c98fcc9130b80ccf4! This means that you will be able to use wolfSSL directly in OpenVPN. wolfSSL is a lightweight and embedded SSL/TLS library that is extensively tested to provide the best security available. Using OpenVPN with wolfSSL, you can take advantage of our hardware cryptography and acceleration on many platforms.

To use OpenVPN with wolfSSL:

Compile wolfSSL with:

./configure --enable-openvpn
make
make install

Compile OpenVPN with:

./configure --with-crypto-library=wolfssl
make
make check
make install

Contact us at facts@wolfssl.com with any questions or feedback.

FIPS 140-2 requires the use of validated cryptography in the security systems implemented by federal agencies to protect sensitive information. The wolfCrypt Module is a comprehensive suite of FIPS Approved algorithms. All key sizes and modes have been implemented to allow flexibility and efficiency.

The National Institute of Standards and Technology (NIST) is sending FIPS cert #2425 into sunset June 2021. For customers who will be impacted, the wolfCrypt Cryptographic Module maintains its #3389 certificate and can be used in conjunction with the wolfSSL embedded SSL/TLS library for full TLS 1.3 client and server support. Upgrade your FIPS cert with wolfSSL to stay afloat and benefit from: 

• Algorithm support for TLS 1.3!
• New algorithms such as AES (CBC, GCM, CTR, ECB), CVL, Hash DRBG, DSA, DHE, ECDSA (key generation, sign, verify), HMAC, RSA (key generation, sign, verify), SHA-3, SHA-2, SHA-1, and Triple-DES
• Hardware encryption support for NXP’s Cryptographic Assistance and Assurance Module (CAAM), NXP Memory-Mapped Cryptographic Acceleration Unit (mmCAU), Intel’s AES-NI, and more
• Support for secure elements and TPM’s
• Interoperability with wolfBoot, wolfSSH, and wolfTPM
• Integration support for third party libraries such as strongswan, nginx, python and more

Contact us to upgrade to FIPS cert #3389 at fips@wolfssl.com. 

Additional Resources 

Learn more about wolfSSL support for FIPS cert #3389: https://www.wolfssl.com/wolfcrypt-fips-certificate-3389-3/ 

For a list of supported Operating Environments for wolfCrypt FIPS, check our FIPS page: https://www.wolfssl.com/license/fips/ 

Our FIPS Story

wolfSSL is currently the leader in embedded FIPS certificates. We have a long history in FIPS starting with wolfCrypt FIPS 140-2 Level 1 Certificate #2425 as well as wolfCrypt v4 FIPS 140-2 Level 1 Certificate #3389. wolfSSL partners with FIPS experts KeyPair to bring you FIPS consulting services, and high assurance along each step of your FIPS certification process. Additionally, wolfSSL will be the first implementation of FIPS 140-3.

wolfSSL also provides support for a wolfCrypt FIPS Ready version of the library! wolfCrypt FIPS Ready is our FIPS enabled cryptography layer code included in the wolfSSL source tree that you can enable and build. You do not get a FIPS certificate, you are not FIPS approved, but you will be FIPS Ready. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and power on self test.

wolfCrypt FIPS Ready can be downloaded from the wolfSSL download page located here: https://www.wolfssl.com/download/. More information on getting set up with wolfCrypt FIPS Ready can be found in our FIPS Ready User guide here: https://www.wolfssl.com/docs/fips-ready-user-guide/

The wolfSSL library has added support for the cisco/cjose library in version 4.4.0. cjose implements Javascript Object Signing and Encryption (JOSE) in C/C++. JOSE is a framework that allows parties to exchange transfer claims in a secure way. The cjose library has been ported to work with wolfSSL, the best tested crypto library on the market.

To build wolfSSL for cjose:

• ./configure --enable-opensslall --enable-aeskeywrap CPPFLAGS='-DHAVE_EX_DATA -DWOLFSSL_KEY_GEN'
• make
• make install

To build cjose for wolfSSL:

• Download the appropriate patch from https://github.com/wolfSSL/osp/tree/master/cjose. Choose a patch that corresponds or is closest to your version of cjose.
• patch -p1 < <path/to/downloaded/patch>
• autoreconf
• ./configure --with-wolfssl=/usr/local
• make

To verify that this build passes the tests run:

• make check

wolfSSL currently supports cjose version 0.6.1,

Feel free to contact us at facts@wolfssl.com for additional information and help with using the new features of wolfSSL.

This feature has been added in commit 0cfde0794b9c5ab1c01171745b800140ee4f8662.

S/MIME is short for Secure/Multipurpose Internet Mail Extensions, a standard for public key encryption and signing of MIME data. The S/MIME standard allows you to sign, authenticate and encrypt plaintext MIME messages. It is commonly used in email. wolfSSL now supports both “enveloped data” (application/pkcs7-mime) and “detached signature” (multipart/signed) messages.

To enable S/MIME support in wolfSSL, run ./configure with the --enable-smime flag, or add HAVE_SMIME to your user_settings.h file. Then, call wolfSSL_SMIME_read_PKCS7() with 2 parameters:

1. A BIO object containing your S/MIME message.
2. A NULL BIO pointer which will be set to the signed data in case of a multipart message.
3. This function call will give you a PKCS7 pointer, or NULL in case of an error.

If you have any questions, don’t hesitate to contact us at facts@wolfssl.com.

Please join us for our upcoming webinar with Sr. Engineer and Security Expert Daniele Lacamera!

Connected embedded systems that support remote updates of different artifacts must take into account the security risks involved. A secure boot mechanism is the best way to prevent the execution of unauthorized code. Our universal, open-source, secure bootloader, wolfBoot, takes care of authenticating and installing new valid firmware images. Due to its transport-agnostic update management, it can be combined with any secure transfer implementation to provide secure and reliable firmware updates.

In this short webinar, we explore some of the possibilities of real-life secure firmware update solutions, designed using the latest standards and best cryptography algorithms.

When: Mar 17, 2021 09:00 AM Pacific Time (US and Canada)
Topic: Webinar: Secure and reliable Firmware updates with wolfBoot

Register in advance for this webinar:
https://us02web.zoom.us/webinar/register/WN_FRms4ws6TgO8zLTe_HW21Q

After registering, you will receive a confirmation email containing information about joining the webinar.

Bring any questions you may have, and we look forward to seeing you there!

wolfSSL  supports Xilinx SoCs and FPGAs. The wolfSSL embedded SSL/TLS library can be used with FPGAs which use the MicroBlaze CPU and/or Zynq and Zynq UltraScale+ SoCs. Improved performance speeds with using the hardware crpyto can be seen. Increasing AES-GCM, RSA, and SHA3 operations performance. In addition to the performance gained a user also gets the additional security the hardware provides while executing the algorithms.

For more information contact facts@wolfssl.com