Comparing wolfSSL vs OpenSSL

How does OpenSSL Compare with wolfSSL?

There are a lot of different metrics to compare when choosing between two TLS libraries. Some of those include heap usage and performance.

Heap Usage:

For heap usage wolfSSL can be significantly smaller — using 100’s of kilobytes less to handle an incoming TLS connection. The following is comparisons collected using a simple server example that was unaltered and linked against the two different TLS libraries. The same cipher suite ECDHE-RSA-AES256-GCM-SHA384 was used for all connections. The graphs were generated using Valgrinds massif tool.

OpenSSL 3.0.0 Used 800+Kb

OpenSSL 1.1.1 Used 200+ Kb

wolfSSL 5.2.0 Used 38.1 Kb
./configure –enable-opensslextra

wolfSSL 5.2.0 configured for a smaller build used 27.1 Kb
./configure –enable-opensslextra –enable-sp-math-all=small –enable-sp=small

Performance:

Both TLS implementations have assembly optimizations done for hardware commonly used in desktops. Such as Intel’s AVX or AESNI instructions and ARMv8’s crypto extensions. In many cases wolfSSL is slightly faster on those platforms. With embedded platforms like STM32F7 and PIC32MZ, only wolfSSL has hardware acceleration support. Independently done webserver stress tests making use of available optimizations in each of the TLS implementations have shown that wolfSSL can more than double the number of connections per second achieved when compared with OpenSSL version 1.1.1.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL SSL/TLS Support for NXP SE050

The wolfSSL lightweight SSL/TLS library and underlying wolfCrypt cryptography library have included support for the NXP SE050 module since November 2021. Since that time we have been increasing compatibility with SE050 along with usage of SCP03 (Secure Channel Protocol 03) authentication. To help users get started with TLS usage, we also have two example client applications available for use and reference.

wolfSSL TLS users can use the wolfSSL_CTX_use_PrivateKey_Id() API to instruct wolfSSL to use a private key located in the SE050 at a specific key ID. This would replace calls to wolfSSL_CTX_use_PrivateKey_file() or wolfSSL_CTX_use_PrivateKey_buffer(), giving applications enhanced security by allowing the private key to be stored (and optionally generated) inside the SE050 module.

#include <wolfssl/ssl.h>
int wolfSSL_CTX_use_PrivateKey_Id(WOLFSSL_CTX* ctx, const unsigned char* id,
    long sz, int devId);

For access to wolfSSL_CTX_use_PrivateKey_Id(), wolfSSL needs to be compiled with WOLF_PRIVATE_KEY_ID defined. This can be passed through configure via CFLAGS, for example:

cd wolfssl-X.X.X
./configure <options> CFLAGS=”-DWOLF_PRIVATE_KEY_ID”
make
sudo make install

TLS Client Demos Using SE050

wolfSSL has two example SSL/TLS client applications that demonstrate how users can leverage SE050 underneath wolfSSL’s SSL/TLS implementation. These examples are set up to be easily run on a Raspberry Pi environment with attached NXP EdgeLock SE050 Development Kit.

Available examples are included in the “wolfssl-examples” GitHub repository under the SE050 subdirectory and include:

  1. wolfSSL SSL/TLS Client Example

    This example demonstrates a simple SSL/TLS client, using hardware-based cryptography supported inside the SE050. It loads and uses a certificate and private key from C arrays/buffers. For a more advanced demo which uses the private key directly from the SE050, see the following example. For details, see the example README.md, or wolfssl_client.c file.

  2. wolfSSL SSL/TLS Client Example with Cert and Private Key in SE050

    This example demonstrates a simple SSL/TLS client, using hardware-based cryptography supported inside the SE050. It loads and uses a certificate and private key from C arrays/buffers into the SE050, then does all private key operations inside the SE050 for the TLS private key, based on a key ID. For details, see the example README.md or wolfssl_client_cert_key.c.

Resources

For more details on using wolfSSL or wolfCrypt with the NXP SE050, see one of the following links or email us at facts@wolfSSL.com. The wolfSSL embedded SSL/TLS library supports up to the most current TLS 1.3 and DTLS 1.3 protocol standards, has been optimized for performance and footprint size, and also provides easy paths forward for validation and certification requirements (FIPS 140-3, FIPS 140-3 (in progress), CAVP, DO-178C).

Blog: wolfSSL NXP SE050 Support and Benchmarks
Blog: wolfSSL Support for NXP SE050 with SCP03
Documentation: wolfSSL NXP SE050 Support (README_SE050.md)
Examples: wolfSSL NXP SE050 Examples (README.md)
Dev Kits: NXP EdgeLock SE050 Development Kits
SE050 Product Page: EdgeLock SE050: Plug & Trust Secure Element Family

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfBoot support for the Xilinx Zynq UltraScale+ MPSoC

wolfBoot support for the Xilinx UltraScale+ was added in 2020 and is a direct U-Boot replacement for improved security.

wolfBoot provides enhanced features compared to U-Boot such as:

  • Firmware integrity and signature verification on each boot
    • Image integrity checking SHA2-256 or SHA3-384.
    • Validation of the signature using ECC P256/P384, RSA (2048-bit or 3072-bit), ED25519 and LMS or XMSS.
  • Multiple boot partition support
    • Rollback to last known working or fail-safe “golden” image on failure
  • TPM 2.0 Support
    • Measured Boot (PCR’s)
    • Sealing secret to unlock or decrypt a storage device
  • Root of trust options
    • Onboard eFUSES
    • Public key embedded in wolfBoot partition
    • TPM 2.0 NV (supported with wolfTPM)
  • Delta/Differential updates using bentley-mcilroy scheme
  • Encrypted updates using AES CFB or ChaCha20/Poly1305

Additional wolfBoot Features:

  • QSPI, SDMC and eMMC boot support
  • ELF (32 and 64) loader support
  • FDT (Flattened Device Tree) support for fixups
  • AARCH64 EL1/EL3 support

We have included a full example for building with Xilinx SDK and integrating into the FSBL chain of trust. Also creation of the flash boot.bin image with boot.bif and bootgen.

Tested support with bare-metal, QNX, GreenHills Integrity OS and Linux/Fedora.
24×7 support available

Links:

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL bare-metal and non-blocking cryptography in 2024

One of the unique wolfSSL features is the ability to run wolfSSL on bare-metal without any Real-Time Operating System (RTOS). Supporting bare-metal has always been a requirement for our libraries from initial development. Having a pure C code base, no external dependencies, portable design and modular build options enables this feature and provides a tiny build size. This is a huge differentiator compared to libraries like OpenSSL that won’t even build without a POSIX layer. The build options to enable bare-metal are (–disable-filesystem –enable-singlethreaded) or (SINGLE_THREADED and NO_FILESYSTEM).

Another unique feature of wolfSSL is our support for managing and handling longer asymmetric math computations, which may have non-deterministic execution times. We achieve this by dividing the workload into smaller chunks, allowing the CPU time to perform other tasks concurrently. We call this feature non-blocking cryptography. We support it for RSA, ECC (256/384/521) and Curve25519. Our goal is to limit any blocking on an embedded target to a maximum of 1ms. We used a generic Cortex M4 at 100MHz as our reference. This functionality, for example, allows you to service real-time events while performing a TLS handshake or signature validation. We take pride in being the only open source TLS/Cryptographic library supporting this non-blocking cryptography feature.

From the caller’s perspective, non-blocking cryptography appears much like a non-blocking socket, where the API will return a FP_WOULDBLOCK status and requires being called again. This capability is supported both through the TLS API’s and wolfCrypt directly.

For additional information, please consult the related documentation links and pull request provided below:

If you have questions on any of the above, please contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: wolfHSM – wolfSSL and Automotive Hardware Security Modules (HSMs)

Welcome! Join us for one of our most popular wolfSSL webinars, “wolfHSM: wolfSSL and Automotive Hardware Security Modules (HSMs)” scheduled for February 22nd at 10am PT, presented by wolfSSL Software Engineer, Bill. As vehicles have evolved into digital systems over the years, evaluating automotive cybersecurity has become a key aspect of automotive safety.

Mark your calendar: February 22nd | 10am PT

Sneak peek of the webinar:

  • Automotive HSM Features
  • wolfHSM Functional Design
  • wolfHSM Applicability to Standards
  • wolfHSM Hardware Ports and Plans
  • wolfHSM Demo
  • wolfHSM Future Targets
  • And much more

If you are seeking solutions to enhance your automotive security system, seize this opportunity to delve into the fundamental and advanced features of wolfHSMs. Discover the comprehensive capabilities that wolfSSL products can offer. Bring all your questions related to Automotive HSMs, as Bill is ready to address your questions!

Register Now

As always, our webinars will include Q&A sessions throughout the webinar. If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Post-Quantum Hybrid Solutions

Here at wolfSSL, when it comes to post-quantum algorithms, we are careful to provide conservative approaches. We are aware that these algorithms are new and developments are still on-going as cryptographers continue analyzing these algorithms. As such, we always encourage hybridizing with conventional algorithms. Here are the hybrids we offer:

Hybrid Key exchange via concatenation in TLS 1.3 and DTLS 1.3

  • ECDHE P-256 Kyber Level 1
  • ECDHE P-384 Kyber Level 3
  • ECDHE P-521 Kyber Level 5

Hybrid authentication via dual key/sig certificates in TLS 1.3

  • ECDSA P-256 and Dilithium Level 2
  • ECDSA P-384 and Dilithium Level 3
  • ECDSA P-521 and Dilithium Level 5
  • ECDSA P-256 and Falcon Level 1
  • ECDSA P-521 and Falcon Level 5
  • RSA-3072 and Dilithium Level 2
  • RSA-3072 and Falcon Level 1

MQTT protocol relies on TLS, so wolfMQTT has support for everything above.

ECDHE P-256 hybridized with Kyber Level 1 in wolfSSH

  • ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org

Go ahead and try them out today!

And finally, we are also developing support for X25519 in wolfSSH. Soon to come after that will be X25519 hybridized with Kyber in wolfSSH. Let your voice be heard! Let us know if you want to try this out. The more interest there is out there, the higher it will rise in priority!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

ARMv9 Security Extensions with wolfCrypt FIPS, wolfSSL, and wolfBoot

Hi! Are you interested in leveraging wolfSSL products with an ARMv9 device? Do you need FIPS on an ARMv9 device?

We are here to help, and will be initiating support for the ARMv9 primitives to maximize security and performance for our users. Some of the things we’ll leverage include:

  • Random Number Generator instructions (AArch64)
  • General Matrix Multiply (GEMM) instructions (AArch64)
  • Atomic 64-byte load and stores to accelerators (AArch64)

If you’d like to discuss or have questions about any of the above, please email us at facts@wolfSSL.com, or call us at +1 425 245 8247.

Download wolfSSL Now

wolfBoot support for the STM32C0 in 2024

We have added wolfBoot support for the new STM32C0. This is a low cost MCU similar to the STM32G0 based on a Cortex-M0 (48MHz). It is a very low cost general purpose 32-bit MCU with up to 32KB flash and 12KB RAM.

Our wolfBoot secure bootloader is the only solution available for this platform thanks to our small code size. Most STM32 parts are supported with wolfBoot out of the box.

The default STM32C0 configuration uses RSA 2048-bit and SHA2-256 and is less than 10KB. This leaves 10KB for the application partition, 10KB for the update partition and one 2KB sector for swap.

STM32C0 documentation and build steps can be found here.

See our video series with ST for a tutorial on using wolfBoot.

wolfBoot Features:

  • Written in C for bare-metal use
  • Small footprint to run on small embedded devices
  • Memory safety (no malloc/free)
  • Support for on-board or external SPI flash
  • Simple partitioning and header scheme
  • Abstracted HAL design for CPU speed and flash
  • Bootloader handles swapping and loading of partitions
  • Key tools for key generation/import and signing
  • Encrypted updates
  • Delta updates (only differences)

Signature algorithms supported:

  • ECC (SECP256R1,SECP384R1)
  • RSA (2048/3072/4096)
  • ED25519
  • ED448
  • Post Quantum LMS and XMSS

Firmware image integrity using hash digest:

  • SHA2-256
  • SHA2-384
  • SHA3-384

Flexible partition scheme determined at build-time:

  • Bootloader (10-30KB)
  • Application
  • Update
  • Swap (1 sector)
  • And custom partition ID’s

Reliable Firmware update mechanism:

  • Independent from the update transport mechanism
  • Fallback to a previous version when the update fails
  • Resume interrupted swap operations during update, in case of power failure

Support for STM hardware crypto acceleration:

  • STM32 HASH/AES/PKA
  • ST33TP* TPM 2.0 using wolfTPM
  • STSAFE

If interested in trying our wolfBoot on the STM32C0 or curious about post-quantum signature support in wolfBoot please contact facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

What is AUTOSAR and How is Crypto Used with it?

AUTOSAR stands for AUTomotive Open System ARchitecture and is a group of companies that set a standardized way for components used in the automotive industry to interface with each other. There are multiple release versions of the AUTOSAR documents and standardizations, but the ones we focus on are those that consume cryptography, and in particular how the AUTOSAR cryptography standards can consume wolfCrypt. The AUTOSAR crypto stack is made up of Crypto Service Manager, Crypto Interface, and Crypto Driver. Where the Crypto Service Manager is the highest level of abstraction and the Crypto Driver is at the lowest level, the driver being either provided by a cryptography implementation done in software or hardware or resident in an automotive HSM. wolfCrypt is callable in all of the above scenarios through the AUTOSAR abstraction API’s. One of the benefits of using AUTOSAR with wolfCrypt is seamless transition between our software encryption, our encryption calling into hardware encryption, or calling into an HSM as you re-use your higher level code in successive projects.

If you have a need for software cryptography operations that conform to the AUTOSAR specifications contact us at facts@wolfSSL.com. You can find some example code from here.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Getting Started with wolfMQTT

Welcome to the third episode of the Getting Started series! Join us for “Getting Started with wolfMQTT” on February 15th at 10 am PT, presented by wolfSSL Senior Software Engineer, Eric. Explore how wolfMQTT, a client implementation of the MQTT protocol written in C for embedded systems, can bolster your IoT security. Eric will guide you from foundational concepts to advanced features, empowering you to effectively utilize the capabilities of wolfMQTT.

In this webinar, you’ll delve into key topics including:

  • The significance of having a dedicated IoT protocol
  • An overview of the MQTT protocol
  • Specifications supported by the wolfMQTT client
  • Understanding the architecture of wolfMQTT
  • Configuration and build processes
  • Real-world wolfMQTT examples
  • Insights into future development plans

Mark your Calendar: February 15th | 10 am PT

Don’t miss this opportunity to enhance your understanding of MQTT and strengthen your security infrastructure with wolfMQTT. Reserve your seat by registering for the webinar!

As always, our webinars will include Q&A sessions throughout the webinar. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2