Month: June 2025

Live webinar: Open Source Secure Boot Meets Open Hardware: wolfBoot Integration with TROPIC01 Secure Element

Join us for an exciting webinar showcasing the integration of the TROPIC01 secure element with wolfBoot, bringing open source secure boot down to the hardware level.

Register Now: Open Source Secure Boot Meets Open Hardware: wolfBoot Integration with TROPIC01 Secure Element
Date: June 25th | 9 AM PT

The Tropic Square team has integrated support for the TROPIC01 secure element into wolfBoot, using it as a hardware Root-of-Trust for the secure boot process. This integration is a milestone because it extends wolfBoot’s open source transparency right down to the hardware, enabling users and security researchers to audit the entire security chain—from software to hardware.

This approach aligns with Kerckhoff’s principle, which states that a cryptosystem should remain secure even if everything about it, except the secret key, is publicly known. By opening the design and implementation, users don’t have to blindly trust that the secure element is free from vulnerabilities or backdoors.

This webinar will cover:

  • An overview of the TROPIC01 open architecture secure element and wolfBoot
  • A demo of TROPIC01 integrated into the secure boot process
  • Why “security by obscurity” fails—and how Tropic Square and wolfSSL deliver transparent, Open Source security that builds trust

Register now to learn how to build transparent, auditable, open source secure boot solutions from silicon to software.

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfTPM Support for Das U-Boot

wolfTPM now includes support for Das U-Boot, extending TPM 2.0 access to early boot stages in secure embedded systems. This port enables direct TPM communication in U-Boot environments using software SPI and provides both native and high-level APIs for flexibility.

Key Features

  • SOFT SPI Driver
  • Full TPM 2.0 command set
  • Both native API and wrapper APIs for complex TPM operations
  • Two integration paths:
    • __linux__: Uses tpm2_linux.c to communicate via standard Linux TPM interfaces
    • __UBOOT__: Direct SPI communication via tpm_io_uboot.c

U-Boot TPM Commands

The wolftpm command interface in U-Boot offers a rich set of TPM 2.0 operations. including:

  • Basic TPM control: init, startup, self_test, info
  • PCR management: pcr_extend, pcr_read, pcr_allocate, pcr_print
  • Security features: clear, change_auth, dam_reset, dam_parameters
  • Firmware management: firmware_update, firmware_cancel
  • Capability reporting: caps, get_capability

These commands allow developers to initialize, configure, and query TPM state from within U-Boot, enabling security features even before the OS loads.

Extended Functionality

While U-Boot includes basic TPM 2.0 command support through its native library, wolfTPM extends this functionality with the ability to manage firmware updates.

Firmware Management Support

wolfTPM includes dedicated commands for managing TPM firmware, allowing users to directly perform updates and control firmware behavior from the U-Boot shell:

  • firmware_update <manifest_addr> <manifest_sz> <firmware_addr> <firmware_sz>
    Performs a full firmware update on the TPM by providing a signed manifest and firmware image.</styel=”font-family:courier>
  • firmware_cancel
    Allows users to cancel or abandon an ongoing firmware update process. 

These capabilities are not present in U-Boot’s built-in TPM stack, which lacks any mechanism for managing TPM firmware or triggering a reboot of the TPM device. With wolfTPM, developers gain direct control over the TPM lifecycle, supporting scenarios like:

  • Field upgrades of TPM firmware
  • Factory provisioning with verified firmware images
  • TPM resets and recovery via startup/shutdown sequences

By leveraging wolfTPM in U-Boot, embedded developers and security teams can take full advantage of the TPM 2.0 specification—including lifecycle and provisioning flows that go beyond what standard U-Boot TPM implementations provide.

Getting Started

For detailed build instructions, configuration options, and sample usage:

Conclusion

wolfTPM’s U-Boot support is ideal for securing early boot environments with TPM 2.0 features. With a rich command-line interface, flexible APIs, and tested support for QEMU and swtpm, it’s a robust solution for TPM integration in embedded platforms.

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfTPM Support for Zephyr RTOS

wolfSSL now has support for Zephyr RTOS through a newly added wolfTPM Zephyr port. This enables easy integration of TPM 2.0 functionality in embedded projects using Zephyr, expanding the flexibility and portability of secure applications.

Below is a summary of the key features introduced in the PR#395:

Key Changes and Features

Zephyr Module Integration

wolfTPM has been added as a Zephyr module, complete with CMake and Kconfig support. This makes it simple to include TPM functionality in any Zephyr-based project using standard module inclusion through west.

Sample Applications

Two test/sample applications are included in the port:

  • wolftpm_wrap_test – tests core TPM wrapper functionality
  • wolftpm_wrap_caps – displays TPM capabilities

Both examples build and run successfully on qemu_x86, providing developers with a solid foundation to build on.

Custom Configuration Support

The module uses a user_settings.h configuration file, which can be customized or replaced as needed by developers to match project-specific requirements.

CI Integration

A new zephyr.yml GitHub CI workflow has been added to automatically build and verify the wolfTPM Zephyr samples, ensuring continued build stability and integration with upstream Zephyr changes.

Device Tree Integration

Communicating with your TPM in zephyr is as simple as setting WOLFTPM_ZEPHYR_I2C_BUS in user_settings.h to the node describing the i2c bus on your device. You can also set the speed of the i2c line with WOLFTPM_ZEPHYR_I2C_SPEED.

Getting Started

To learn more about using wolfTPM with Zephyr and how to set it up in your project, see:

Conclusion

wolfTPM now supports Zephyr RTOS, enabling robust TPM 2.0 integration in lightweight embedded systems. With CI coverage, modular design, and working samples, developers can confidently build secure applications using wolfTPM on Zephyr.

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

FIPS 140-3 Compliance for GnuTLS

We’re excited to announce the next phase in our wolfCrypt-GnuTLS integration: full FIPS 140-2 Level 2 compliance and FIPS 140-3 validation capabilities! This enhancement builds directly on our ongoing work to bring wolfCrypt’s powerful cryptographic capabilities to GnuTLS.

Unlike traditional approaches that require extensive application rewrites, our solution continues to operate entirely behind the scenes. By patching GnuTLS at the library level, we’ve created a seamless path for applications to leverage wolfCrypt’s FIPS-certified cryptographic capabilities without changing a single line of application code.

What makes this integration particularly significant is GnuTLS’s central role in secure communications infrastructure. Our approach transforms what would typically be a massive certification challenge into a straightforward library update, allowing organizations to achieve FIPS compliance without disrupting their existing architecture.

For Linux distribution maintainers, this integration eliminates the traditional compromise between security and compatibility when deploying certified cryptography. Certificate validation and protocol handling will continue through the familiar GnuTLS interface while benefiting from wolfCrypt’s certified implementation underneath.

For teams working in regulated environments requiring FIPS certification, this integration offers a remarkable advantage: immediate access to wolfCrypt’s FIPS 140-3 validated algorithms without the typical development and certification marathon. Our goal is to help reduce the time needed for certification processes, enabling organizations to more efficiently deploy secure communications in regulated environments without compromising on compatibility or performance.

Take a more in-depth look here: https://github.com/wolfssl/gnutls-wolfssl

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Open Source Secure Boot Meets Open Hardware: Announcing wolfBoot Integration with TROPIC01 Secure Element

We are excited to announce our new partnership with Tropic Square and the integration of wolfBoot with their TROPIC01 secure element. Tropic Square has developed an open architecture hardware secure element for applications, including IoT devices, crypto wallets, or any modern application that prioritizes security.

Unlike most hardware secure elements, the TROPIC01 solution is built with an open-architecture. The TROPIC01 implementation is auditable, allowing engineers to review the design to verify the security implementations and ensure there are no hidden features or backdoors.

The Tropic Square team has integrated wolfBoot with the TROPIC01 secure element, using the secure element as hardware Root-of-Trust for the secure boot process. The TROPIC01 chip provides:

  • Storage of ECC public keys for verification operation
  • Enabling secure provisioning of ECC (verification) keys
  • Enabling secure provisioning of AES (decryption) keys
  • Storing “associated” data (key values and other secrets)

What makes this integration particularly significant is that it extends the open nature of the wolfBoot solution down to the hardware level. This transparency allows users and security researchers to audit the security of the design and implementation of the solution. This approach follows Kerckhoff’s principle that a cryptosystem should be secure even if everything about it, except the secret key, is known to the attacker: As a result, users no longer have to blindly trust that the secure element is free from vulnerabilities or back doors.

The pull request adding TROPIC01 support can be found here: https://github.com/wolfSSL/wolfssl/pull/8812
The solution is available here: https://github.com/wolfssl/… or https://github.com/tropicsquare/

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: How to get FIPS 140-3 for YOUR Linux Distro

If your product is built on Linux and targets government or regulated industries, FIPS 140-3 compliance is essential.

Join us for a webinar to learn how to bring your Linux-based system into compliance using wolfCrypt, the world’s first SP800-140Br1 FIPS 140-3 validated cryptographic module.

Register Now: How to get FIPS 140-3 for YOUR Linux Distro
Date: June 18th | 9 AM PT

wolfSSL Senior Software Engineer Anthony Hu will walk through real implementation paths, challenges, and solutions highlighted by a case study on IGEL, which is integrating wolfCrypt FIPS 140-3 validated crypto into its secure Linux-based endpoint OS.

This webinar will feature implementation stories and real-world application examples, including integration strategies for OpenSSL, NSS, Libgcrypt, gnuTLS, and the Linux Kernel.

What you’ll learn:

  • Why organizations are investing in FIPS 140-3 now
  • Who benefits most from a validated crypto module
  • How to integrate wolfCrypt into common crypto backends
  • A detailed case study of IGEL’s journey to FIPS 140-3 compliance

If your team is considering FIPS 140-3 or is already deep into Linux crypto architecture, this session is for you. We’ll help you cut through the confusion and give you a concrete path forward.

Register now to secure your spot!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL: Pioneering the Next Evolution of FIPS 140-3 Security! – Part 3

While having “all the algorithms, modes, and key sizes” available is nice, sometimes it is too much. wolfSSL is pleased to offer FIPS 140-3 tailoring services.

We can take any of our larger FIPS 140-3 module(s), strip them down to just the bare essentials, and validate just the subset. Need only ECDSA (verify) and SHA-512 for secure firmware verification and authentication, no entropy, nothing? No problem! Thanks to the wolfSSL modular design, we can custom-tune and validate smaller, more precise subsets of our larger module(s) that exist today.

Unlock efficient, targeted FIPS 140-3 security without unnecessary overhead. Contact us at fips@wolfssl.com to discuss your unique requirements and explore the possibilities of a right-sized FIPS 140-3 module!

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL: Pioneering the Next Evolution of FIPS 140-3 Security! – Part 2

wolfSSL is launching new FIPS 140-3 level 2 and level 3 validation services to make achieving compliance easier than ever. Our team will test our software module on your target hardware for Level 2 and Level 3, guiding your device through the validation process with little to no burden on your team. You provide the hardware and physical elements, wolfSSL will deliver the certifiable software in any configuration you need, plus the validation expertise. Contact us today at fips@wolfSSL.com to get started on your FIPS 140-3 level 2 or level 3 validation journey.

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL: Pioneering the Next Evolution of FIPS 140-3 Security! – Part 1

Building on our legacy of FIPS 140-3 certified solutions, wolfSSL is in the planning stages of forging our full FIPS 140-3 submission. This next iteration will integrate cutting-edge post quantum cryptography, featuring ML-KEM (FIPS 203, derived from CRYSTALS-KYBER), ML-DSA (FIPS 204, derived from CRYSTALS-Dilithium), LMSS (verify), and XMSS (verify) (SP800-208, needed for NSA 2.0 Transition schedules), all securely contained within the latest FIPS 140-3 boundary.

Want to be at the forefront of this advancement? Become a Charter Member on this effort by collaborating with us while still in the planning stages! Reach out to us at fips@wolfssl.com to discuss options.

Charter Member Advantages: Ensure your Operating Environment is incorporated into the initial submission, accelerate your time-to-market by avoiding post-validation efforts to get your OE added. Time is of the essence!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: wolfSSL 2025 Roadmap

Discover What’s New in Embedded Cybersecurity in the wolfSSL 2025 Roadmap Webinar

The future of embedded cybersecurity is rapidly evolving, and wolfSSL is leading the way. Join us on June 12th at 9 AM PT for an exclusive look at the wolfSSL 2025 Roadmap, presented by wolfSSL Engineering Manager, Chris Conlon.

Register now: wolfSSL 2025 Roadmap
Date: June 12th | 9 AM PT

In this webinar, Chris will unveil major updates, new features, and strategic initiatives shaping our direction in 2025 and beyond. From FIPS 140-3 and post-quantum cryptography to evolving protocol support and deeper industry integrations, discover how wolfSSL is preparing for the next generation of embedded security.

Whether you’re securing satellites, designing safety-critical automotive systems, or implementing industrial control solutions, this webinar offers insight into the technologies that matter most to security-critical development.

Register now to secure your post!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2