Upcoming wolfSSL Webinar: FIPS 140-3

In case you missed it, we’re revisiting the latest on FIPS 140-3 from wolfSSL. Join us to get all the details from the experts at being first in FIPS! Bring all your FIPS questions–we’ve got you covered.

When: Thursday, July 1st, 2021 at 10:00 AM PT
Topic: Webinar – FIPS 140-3
Registration: https://us02web.zoom.us/webinar/register/WN_gMGaw43PRuStyXtqpQBEyw

wolfSSL is currently the leader in embedded FIPS certificates. With current FIPS 140-2 certificate #3389 for the wolfCrypt Cryptographic Module, wolfSSL is thrilled to be the first in upcoming FIPS 140-3 certification. Join the wolfSSL team as we cover all things FIPS 140-3. There will be a live Q&A so bring all your FIPS-related questions. We will cover the current transition to FIPS 140-3, its importance for cybersecurity, as well as how wolfSSL is implementing it in our products.

Register in advance for this webinar:
https://us02web.zoom.us/webinar/register/WN_gMGaw43PRuStyXtqpQBEyw

If you are interested in a FIPS 140-3 validated version of wolfCrypt, or would like to learn how wolfSSL can help meet your FIPS requirements, shoot us an email at fips@wolfssl.com.

Catch Daniel Stenberg at virtual MWC!

Daniel Stenberg is holding office hours at Mobile World Congress in Barcelona this Tuesday 14:00 – 16:00 (CEST). Sign on to talk libcurl latest release 7.77.0, FIPS, MQTT support, cURL TPM/HSM Integration, tinycurl, and more!

We’re in-person at MWC this year, but if you can’t be there to meet with wolfSSL at booth 1L12, you can still register for a Virtual pass to chat with our team via the digital event. 

Register for a virtual pass and download the MWC app to join in on the conversation!

 

Follow Daniel on Twitter: @bagder
Follow @wolfSSL on Twitter: @wolfSSL

U-Boot with wolfTPM

We are integrating wolfTPM into U-Boot. This will extend the TPM 2.0 capabilities in U-Boot to include signature verification and measured boot.

For many platforms we can replace U-Boot such as on the Xilinx UltraScale+ MPSoC.

Our wolfBoot allows many features including:
* Partition signature verification using ED25519, RSA and ECC
* Encryption of partitions
* Updating of partitions in the boot loader
* Measured boot with TPM 2.0 PCR registers
* Offloading to crypto coprocessors like the TPM 2.0 modules
* Version checking for updates
* Rollback on failed updates

For information on our wolfBoot TPM integration see https://www.wolfssl.com/products/wolfboot/.

If you are interested in our U-Boot wolfTPM integration please email facts@wolfssl.com.

 

Connect with wolfSSL:
Twitter
LinkedIn
Facebook

wolfSentry Operating Environments

Our first preview release of wolfSentry, the IDPS (Intrusion Detection and Prevention System) for embedded and IoT systems, has platform support for Raspberry Pi, STM32 with CubeMX, Atmel ASF and Barebox. As well as native support for Microsoft Windows and Linux.

Here at wolfSSL we are always striving to be better so we would love to hear which operating environments and platforms you would like to see supported by wolfSentry. Contact us at facts@wolfssl.com!

wolfCrypt FIPS Operating Environments

wolfSSL fans! Do you like FIPS? Do you like virtual machines? Guess what. wolfSSL`s crypto library, wolfCrypt, is validated for FIPS 140-2 and in the process of being one of the first cryptography libraries to be validated for FIPS 140-3

As wolfCrypt is commonly used in standard operating environments because of its royalty-free pricing and excellent cross platform support, wolfCrypt FIPS has been validated on a number of Operating Environments (OEs). The current validated OE list for both wolfCrypt FIPS certificates (#2425 and #3389) are listed here for reference.  

Certificate #2425 Current OE List:

Operating SystemProcessorPlatform
Linux 3.13 (Ubuntu)Intel® Core™ i7-3720QM CPU @2.60GHz x 8HP EliteBook
iOS 8.1Apple™ A8iPhone™ 6
Android 4.4Qualcomm Krait 400Samsung Galaxy S5
FreeRTOS 7.6ST Micro STM32FuTrust TS Reader
Windows 7 (64-bit)Intel® Core™ i5Sony Vaio Pro
Linux 3.0 (SLES 11 SP4, 64-bit)Intel® Xeon® E3-1225Imprivata OneSign
Linux 3.0 (SLES 11 SP4, 64-bit) on Microsoft Hyper-V 2012R2 CoreIntel® Xeon® E5-2640Dell® PowerEdge™ r630
Linux 3.0 (SLES 11 SP4, 64-bit) on VMWare ESXi 5.5.0Intel® Xeon® E5-2640Dell® PowerEdge™ r630
Windows 7 (64-bit) on VMWare ESXi 5.5.0Intel® Xeon® E5-2640Dell® PowerEdge™ r630
Android Dalvik 4.2.2NXP i.MX6 MXT?700?NC 7” touch
panel
Linux 4.1.15NXP i.MX5NX?1200 NetLinx NX
Integrated Controller
Debian 8.8Intel Xeon® 1275v3CA PAM 304L Server
Windows Server 2012R2Intel® Xeon® E5335CA Technologies
PAMHAF995
Windows 7 Professional SP1Intel® Core™ i7?2640MDell™ Latitude™ E6520
Debian 8.7.0Intel ® Xeon® E3 Family with SGX supportIntel® x64 Server System
R1304SP
Windows 10 ProIntel ® Core ™ i5 with SGX supportDell™ Latitude™ 7480
NET+OS v7.6 Digi International NS9210Sigma IV infusion pump
Linux 4.4 (SLES 12 SP3, 64?
bit) on Microsoft Hyper?V
2016 Core
Intel® Xeon® E5?2650Dell® PowerEdge™ r720
Linux 4.4 (SLES 12 SP3, 64?
bit) on VMWare ESXi 6.5.0
Intel® Xeon® E5?2403Dell® PowerEdge™ r420

Certificate #3389 Current OE List:

Operating SystemProcessorPlatform
Linux 4.4
(Ubuntu 16.04 LTS)
Intel® Core™ i5-5300U CPU @2.30GHz x 4 with
AES-NI
Intel Ultrabook 2 in 1
Linux 4.4
(Ubuntu 16.04 LTS)
Intel® Core™ i5-5300U CPU @2.30GHz x 4
without AES-NI
Intel Ultrabook 2 in 1
Windows 10 (64-bit)Intel® Core™ i5-5300U CPU @2.30GHz x 4
with AES-NI
Intel Ultrabook 2 in 1
Windows 10 (64-bit)Intel® Core™ i5-5300U CPU @2.30GHz x 4
without AES-NI
Intel Ultrabook 2 in 1
OpenRTOS v10.1.1STMicroelectronics STM32L4xSTMicroelectronics
STM32L4R9I-DISCO
(Discovery Kit)
HP Imaging &
Printing Linux 4.9
ARM Cortex-A72 with PAAHP PN 3PZ95-60002
HP Imaging &
Printing Linux 4.9
ARM Cortex-A72 without PAAHP PN 3PZ95-60002
Windows 10
Enterprise
Intel® Core™ i7-7820 @2.9GHz x 4 with AES-NIRadar FCL Package
Utility
Windows 10
Enterprise
Intel® Core™ i7-7820 @2.9GHz x 4 without AES-NIRadar FCL Package
Utility
Linux socfpga
Cyclone V
Armv7 rev 0, Cortex A-9SEL 2700 Series 24-
Port Ethernet Switch
Red Hat Enterprise
Linux Workstation
Intel (R) Xeon(R) W-2155 @3.3GHz x 20 with PAADELL Precision 5820
Red Hat Enterprise
Linux Workstation
Intel (R) Xeon(R) W-2155 @3.3GHz x 20 without
PAA
DELL Precision 5820
Fusion Embedded
RTOS 5.0
Analog Devices ADSP-BF516 (BlackFin)Classone® IP Radio
Gateway
Linux 4.12 Yocto
Standard
Freescale i.MX6 DualLite ARMv7 Cortex-A9 x2 with
PAA
Metasys® SNC Series
Network Control
Engine
Linux 4.12 Yocto
Standard
Freescale i.MX6 DualLite ARMv7 Cortex-A9 x2
without PAA
Metasys® SNC Series
Network Control
Engine

wolfSSL can easily add additional OEs to existing wolfCrypt FIPS certificates. To learn more about this process, please do not hesitate to send us an email at fips@wolfssl.com. We look forward to hearing from you.

 

Upcoming Webinar: How to Get Started with wolfSSL

Let’s get back to basics. Join us this week for a thorough look at the foundations of using wolfSSL in your project.

How to Get Started with wolfSSL: Presented by Chris Conlon
Thursday, June 24th at 10AM Pacific time (GMT-8)
Register: https://us02web.zoom.us/webinar/register/WN_QgDn_vWxTe-RNb4pprtMxw

wolfSSL is the best-tested, most secure, fastest crypto on the market with incomparable certifications and highly customizable modularity. We provide 24×7 support from a real team of Engineers. wolfSSL boasts a build size that’s up to 20x smaller than OpenSSL. This is industrial, go-to-market embedded security at the forefront of emerging standards across verticals. We were the first commercial implementation of TLS 1.3 and now we’re first in FIPS 140-3.

Join us this week as Sr. Engineer Chris Conlon presents on the core basics of starting your wolfSSL build. As always, bring your questions! See you next week.

If you have any questions about wolfSSL, please contact our support staff anytime at support@wolfssl.com or via our Zendesk portal by registering and opening a support incident at wolfssl.zendesk.com.

strongSwan + wolfSSL + FIPS!

As some may be aware, wolfSSL added support for strongSwan in April of 2019. The upstream commit can be reviewed here: https://github.com/strongswan/strongswan/pull/133

Users can test the latest development master of wolfSSL with the latest version of strongSwan using the following setup:

wolfSSL Build and Installation Steps

$ git clone https://github.com/wolfSSL/wolfssl.git

$ cd wolfssl
$ ./autogen.sh

$ ./configure --enable-opensslall --enable-keygen --enable-rsapss --enable-des3 --enable-dtls --enable-certgen --enable-certreq --enable-certext --enable-sessioncerts --enable-crl --enable-ocsp CFLAGS="-DWOLFSSL_DES_ECB -DWOLFSSL_LOG_PRINTF -DWOLFSSL_PUBLIC_MP -DHAVE_EX_DATA"

$ make
$ make check
$ sudo make install

strongSwan Build and Installation Steps

# if the following packages are not already installed:
$ sudo apt-get install flex bison byacc libsoup2.4-dev gperf

$ git clone https://github.com/strongswan/strongswan.git
$ cd strongswan
$ ./autogen.sh

# if packages are missing autogen.sh must be re-run

$ ./configure --disable-defaults --enable-pki --enable-wolfssl --enable-pem
$ make
$ make check
$ sudo make install

wolfSSL has had interest in enabling FIPS 140-2/140-3 support with strongSwan so our engineers verified everything is working with the wolfCrypt FIPS 140-2 validated Module!

The steps wolfSSL used for testing are as follows:

Testing was done using the wolfSSL commercial FIPS release v4.7.0 which internally uses the wolfCrypt v4.0.0 FIPS 140-2 validated Crypto Module. It was located in the /home/user-name/Downloads directory on the target test system, Linux 4.15 Ubuntu 18.04 LTS running on Intel(R) Xeon(R) CPU E3-1270 v6 @ 3.80GHz.

  1. wolfSSL was configured and installed with these settings:
./configure --enable-opensslall --enable-keygen --enable-rsapss --enable-des3 --enable-dtls --enable-certgen --enable-certreq --enable-certext --enable-sessioncerts --enable-crl --enable-ocsp CFLAGS="-DWOLFSSL_DES_ECB -DWOLFSSL_LOG_PRINTF -DWOLFSSL_PUBLIC_MP -DHAVE_EX_DATA -DFP_MAX_BITS=8192" --enable-ed25519 --enable-curve25519 --enable-fips=v2 --enable-intelasm --prefix=$(pwd)/../fips-install-dir
 make
 make install
  1. A custom install location was used which equated to /home/user-name/Downloads/fips-install-dir and the configuration for strongSwan accounted for this.
  2. strongSwan was cloned to /home/user-name/Downloads with “git clone https://github.com/strongswan/strongswan.git
  3. StongSwan was configured and installed with these settings:
./configure --disable-defaults --enable-pki --enable-wolfssl --enable-pem --prefix=$(pwd)/../strongswan-install-dir wolfssl_CFLAGS="-I$(pwd)/../fips-install-dir/include" wolfssl_LIBS="-L$(pwd)/../fips-install-dir/lib -lwolfssl"
 make
 make install
 make check
  1. In the make check stage of the test, it was observed that 1 test was failing.
 Passed 34 of 35 'libstrongswan' suites
 FAIL: libstrongswan_tests
 ==================
 1 of 1 test failed
 ==================
  1. Reviewing the logs it was apparent one of the RSA tests was failing.
  2. Upon further debugging it turned out the failure was a test in strongSwan that was attempting to create an RSA key size of 1536-bits.
Running case 'generate':
 DEBUG: key_sizes[_i] set to 1024
 + PASS
 DEBUG: key_sizes[_i] set to 1536
 - FAIL
 DEBUG: key_sizes[_i] set to 2048
 + PASS
 DEBUG: key_sizes[_i] set to 3072
 + PASS
 DEBUG: key_sizes[_i] set to 4096
 + PASS

wolfSSL has a function RsaSizeCheck() which in FIPS mode will specifically reject any non FIPS RSA key sizes so this failure was not only expected, but it is a good thing for those wanting to use strongSwan in FIPS mode and ensure only FIPS-validated RSA key sizes will be supported!

wolfSSL is pleased that with the latest release of wolfSSL v4.7.0 and the wolfCrypt FIPS 140-2 module validated on FIPS certificate 3389, strongSwan support is working splendidly and wolfSSL engineers will be making efforts to ensure continued support into the future!

If you have any questions about wolfSSL, wolfCrypt FIPS, or strongSwan and wolfSSL together please contact our support staff anytime at support@wolfssl.com or via our Zendesk portal by registering and opening a support incident at wolfssl.zendesk.com.

wolfSSL devkitPro Support

devkitPro is a set of tool chains for compiling to gaming platforms. This includes the Nintendo Switch, 3DS, Wii, and Gamecube. If you need cryptographic or SSL/TLS capabilities in your games then wolfSSL has support for compiling with devkitPro. wolfSSL is a very lightweight and fast SSL/TLS library that will fit perfectly in a constrained game console environment.

This blog will showcase how to compile the wolfSSL testwolfcrypt program for Wii and run it in the Dolphin Emulator. It assumes that the devkitPro was installed in /opt/.

Compile wolfSSL using the devkitPPC tool chain:

./autogen.sh
./configure CFLAGS='-DDOLPHIN_EMULATOR -DDEVKITPRO -DGEKKO -DNO_WRITEV -I/opt/devkitpro/libogc/include -mrvl -mcpu=750 -mno-eabi -MMD -MP' LDFLAGS='-L/opt/devkitpro/libogc/lib/wii -lwiiuse -lbte -logc -lm' CC=/opt/devkitpro/devkitPPC/bin/powerpc-eabi-gcc RANLIB=/opt/devkitpro/devkitPPC/bin/powerpc-eabi-ranlib --host=ppc --enable-cryptonly --disable-shared --enable-static --disable-filesystem
make

Then convert the binary to a .dol file:

/opt/devkitpro/tools/bin/elf2dol wolfcrypt/test/testwolfcrypt ../testwolfcrypt.dol

The above command places the resulting binary in the directory that contains the wolfssl directory. Navigate to this directory in the Dolphin Emulator and run it:

All tests should pass and you may close the window. If you have additional questions about support for devkitPro targets, please write to us at facts@wolfssl.com.

wolfSSL Asynchronous Release v4.7.0

The wolfSSL / wolfCrypt libraries support asynchronous (non-blocking) crypto using hardware acceleration with the Intel QuickAssist and Cavium Nitrox III/V adapters. These are PCIe devices that accelerate crypto operations. For server platforms requiring high connection rates and throughput this allows greatly increased performance.

For some performance numbers see this page: https://www.wolfssl.com/docs/intel-quickassist/

Release v4.7.0 of wolfSSL Async has bug fixes and new features including:

To find out more or get an evaluation please email facts@wolfssl.com.

BSD Kernel Mode compatibility for wolfSSL

We are in the process of adding BSD Kernel compatibility to wolfSSL. This means that our embedded SSL library would run in Kernel mode and use BSD based OE’s. The advantage of this project may include performance enhancement for device driver implementers that want SSL security. Stay tuned for more updates regarding this project. We would love to know do Kernel developers want an SSL library? Please comment!

Posts navigation

1 2