wolfCrypt Rust Wrappers: Secure and Efficient Cryptography in Rust
We are thrilled to announce a significant enhancement to the wolfSSL repository: the addition of Rust wrappers for wolfCrypt! This integration, available now in our official wolfSSL GitHub repository, allows developers to leverage the robust cryptographic primitives of wolfCrypt directly within their Rust applications, benefiting from Rust’s safety, performance, and modern language features.
Why Rust
Rust has rapidly gained popularity for its focus on safety, particularly memory safety, without sacrificing performance. Its strong type system and ownership model prevent common programming errors like null pointer dereferences and data races, making it an ideal choice for building secure and reliable software. Cryptographic implementations, in particular, demand the highest levels of correctness and security, which align perfectly with Rust’s design principles.
Introducing wolfCrypt Rust Wrappers
The new Rust wrappers provide a safe and idiomatic interface to wolfCrypt’s comprehensive suite of cryptographic algorithms. Rust wrapper development is an ongoing effort and more functionality is planned. Initially Rust wrappers are targeting the wolfCrypt FIPS API. Currently, developers can now easily integrate features such as:
- Asymmetric Cryptography: RSA and ECC
- Symmetric Ciphers: AES
- Hashing: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128, SHAKE256
- Key Exchange: Diffie-Hellman, ECDH
- Random Number Generation: FIPS 140-2 certified random number generator (RNG)
More Rust wrappers for functionality such as HMAC, CMAC, KDF, Ed25591, and Ed448, and more are planned.
Key Benefits
- Memory Safety,/strong>: Rust’s ownership and borrowing system eliminates common memory-related vulnerabilities that plague C/C++ implementations, such as buffer overflows and use-after-free errors.
- Thread Safety: The Rust type system prevents data races, ensuring that cryptographic operations are safe in multi-threaded environments.
- Performance: wolfCrypt is renowned for its small footprint and high performance, and these characteristics are preserved when used through the Rust wrappers.
- Ease of Use,/strong>: The wrappers are designed to be intuitive and follow Rust’s best practices, making it straightforward for Rust developers to incorporate powerful cryptography into their projects.
- FIPS 140-2 Compliance: Leverage wolfCrypt’s FIPS 140-2 validated cryptographic modules directly from Rust.
Getting Started
Integrating the wolfCrypt Rust wrappers into your project is simple. You can find the necessary files and detailed instructions within the wolfSSL GitHub repository in the wrapper/rust directory.
Example Usage
Here’s a sneak peek at how easy it is to use the new wrappers (specific API details can be found in the repository).
RNG
use wolfssl::wolfcrypt::random::RNG;
fn main() {
// Create a RNG instance.
let mut rng = RNG::new().expect("Failed to create RNG");
// Generate a single random byte value.
let byte = rng.generate_byte().expect("Failed to generate a single byte");
// Generate a random block.
let mut buffer = [0u32; 8];
rng.generate_block(&mut buffer).expect("Failed to generate a block");
}
SHA-256
use wolfssl::wolfcrypt::sha::SHA256;
fn main() {
// Create a SHA256 instance.
let mut sha = SHA256::new().expect("Error with new()");
// Feed input data (can be called multiple times).
sha.update(b"input").expect("Error with update()");
// Retrieve the final SHA-256 hash.
let mut hash = [0u8; SHA256::DIGEST_SIZE];
sha.finalize(&mut hash).expect("Error with finalize()");
}
ECC
use wolfssl::wolfcrypt::random::RNG;
use wolfssl::wolfcrypt::ecc::ECC;
fn main () {
let mut rng = RNG::new().expect("Failed to create RNG");
// Generate a new ECC key.
let mut ecc = ECC::generate(32, &mut rng).expect("Error with generate()");
let hash = [0x42u8; 32];
let mut signature = [0u8; 128];
// Sign a hash with the ECC key.
let signature_length = ecc.sign_hash(&hash, &mut signature, &mut rng).expect("Error with sign_hash()");
let signature = &signature[0..signature_length];
}
Community and Support
We encourage the Rust community to explore these new wrappers and provide feedback. Your contributions and insights are invaluable as we continue to improve and expand our offerings. If you encounter any issues or have suggestions, please open an issue or submit a pull request on our GitHub repository.
What’s Next?
wolfSSL is committed to enhancing the security and usability of our products across various platforms and languages. The introduction of Rust wrappers is a testament to this commitment. We plan to continue expanding the functionality and improving the developer experience for our Rust users.
Stay tuned for more updates and exciting developments from wolfSSL!
Useful Links
If you have any questions, please contact us at facts@wolfssl.com, or call us at +1 425 245 8247. We look forward to seeing what you build with wolfCrypt and Rust!
Download wolfSSL Now
Live Webinar: How to Secure AMD Xilinx Platforms with wolfSSL
Build faster, boot safer, and secure your Xilinx designs against tomorrow’s threats.
Join wolfSSL senior software engineer Jacob Barthelmeh for a live walkthrough of how wolfSSL brings high-assurance cryptography and post-quantum protection to AMD Xilinx platforms. Learn how wolfBoot establishes a secure boot chain, how wolfHSM provides hardware-rooted key management, and how wolfCrypt delivers FIPS 140-3 validated and CNSA 2.0-aligned post-quantum algorithms for long-term security. Whether you’re developing for aerospace, defense, or industrial systems, discover how wolfSSL combines performance, portability, and certification-ready protection for AMD Xilinx devices.
Register Now: How to Secure AMD Xilinx Platforms with wolfSSL
Date: October 29 | 9 AM PT
What this webinar will cover:
- Building wolfSSL for Xilinx Devices — Optimize builds and enable hardware acceleration
- Integration with PetaLinux — Configure, package, and deploy wolfSSL efficiently
- wolfBoot for Secure Boot — Authenticate firmware and enforce a trusted boot chain
- wolfHSM Overview — Implement hardware-backed key storage and crypto offload
- PQC & CNSA 2.0 Readiness — Integrate ML-KEM, ML-DSA, LMS, and XMSS for quantum-safe protection
- FIPS 140-3 Validated wolfCrypt — Meet compliance requirements for regulated environments
Register now to learn how wolfSSL delivers quantum-ready, certifiable security for AMD Xilinx platforms.
As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
wolfSSH 1.4.21 Released
Version 1.4.21 of wolfSSH is now available! This update includes a critical security fix, improved interoperability, and enhancements for embedded and hardware-backed key use cases.
Security Updates
This release addresses two security issues:
- CVE-2025-11625: Fixed a client-side host verification bypass that could expose credentials (PR#840).
- CVE-2025-11624: Fixed an SFTP server stack overflow triggered by malformed input. Thanks to Stanislav Fort of Aisle Research for the report
Feature Additions
- TPM key authentication for hardware-based identity protection.
- ED25519 key generation support added to the API.
- Curve25519 alias compatibility with curve25519-sha256@libssh.org for improved interoperability.
- Keyboard-interactive authentication can now be enabled at build time (–enable-keyboard-interactive).
- AES-CBC is now disabled by default, shifting focus toward stronger default cipher suites.
- Added Microchip ATSAMV71Q21B example with harmony filesystem integration.
This version refines FATFS support, enhances user authentication handling, and improves SFTP and rekeying operations. Post quantum hybrid support was also touched up along with numerous Coverity findings, warning cleanups, and minor API consistency fixes.
Users of the wolfSSH client code or SFTP server should upgrade, particularly those relying on host verification.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
Xilinx Accelerated Crypto with FIPS
It’s already possible to use ARMv8 crypto extensions with FIPS 140-3 using PAA (Processor Algorithm Acceleration) but did you know that we have researched using Xilinx/AMD’s hardened crypto with wolfSSL while being FIPS certified? Many benefits can come from using Xilinx/AMD’s hardened crypto accelerators, for example it free’s up the CPU to be used for other operations and it also comes with additional side channel hardening. Leveraging these benefits in projects where FIPS 140-3 certification is required would be useful. If curious about a hybrid FIPS certification that can make use of the CSU, or newer ASU, while having a FIPS 140-3 certification contact us at facts@wolfssl.com.
Join our upcoming webinar “How to Secure AMD Xilinx Platforms with wolfSSL” on October 29 at 9 AM PT to learn how to leverage AMD/Xilinx’s hardened crypto with FIPS 140-3 certification for enhanced performance and security.
Register now!
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
Updated Xilinx/AMD Versal Benchmarks
There are three build options for crypto operations when using wolfSSL on Xilinx/AMD Ultrascale+ devices. The lightweight wolfSSL library can use a software only implementation, make use of the ARMv8 crypto extensions along with custom ARM assembly, or offload the operation to the CSU. Each has its trade offs. Recently wolfSSL has made improvements to the ARMv8 optimizations for use with AES-GCM operations.
- Offloading to the CSU (labeled here as the hardened option) free’s up the CPU for other operations and it leverages the hardening available which provides enhancements like additional protections against DPA (differential power analysis)
- ARMv8 crypto extensions is very performant for smaller block sizes and can be taken through a FIPS OE with use of PAA (Processor Algorithm Acceleration)
The following tables are raw numbers of the throughput collected. Collecting the performance on even larger block sizes would show that Xilinx/AMD hardened crypto accelerators continue on linearly until reaching their maximum. The hardened numbers were collected previously using FreeRTOS, the software and ARMv8 were collected while running on Petalinux with the latest wolfSSL version 5.8.2. A VMK180 Versal board was used.
| Algorithm | Hardened – MB/s | Block Size |
| AES-256-GCM-enc-no_AAD | 0.19188 | 16 |
| AES-256-GCM-enc-no_AAD | 6.324667 | 528 |
| AES-256-GCM-enc-no_AAD | 12.254902 | 1024 |
| AES-256-GCM-enc-no_AAD | 49.01886 | 4112 |
| AES-256-GCM-enc-no_AAD | 89.60888 | 7696 |
| AES-256-GCM-enc-no_AAD | 181.00591 | 15888 |
| AES-256-GCM-enc-no_AAD | 350.444225 | 32768 |
| AES-256-GCM-enc-no_AAD | 633.100698 | 65535 |
| Algorithm | Software – MB/s | Block Size |
| AES-256-GCM-enc-no_AAD | 15.0984 | 16 |
| AES-256-GCM-enc-no_AAD | 31.0764 | 528 |
| AES-256-GCM-enc-no_AAD | 31.5839 | 1024 |
| AES-256-GCM-enc-no_AAD | 32.0214 | 4112 |
| AES-256-GCM-enc-no_AAD | 32.0883 | 7696 |
| AES-256-GCM-enc-no_AAD | 32.1052 | 15888 |
| AES-256-GCM-enc-no_AAD | 32.1038 | 32768 |
| AES-256-GCM-enc-no_AAD | 32.1293 | 65535 |
| Algorithm | ARMv8 – MB/s | Block Size |
| AES-256-GCM-enc-no_AAD | 120.862503 | 16 |
| AES-256-GCM-enc-no_AAD | 633.607939 | 528 |
| AES-256-GCM-enc-no_AAD | 715.517677 | 1024 |
| AES-256-GCM-enc-no_AAD | 776.28316 | 4112 |
| AES-256-GCM-enc-no_AAD | 783.198307 | 7696 |
| AES-256-GCM-enc-no_AAD | 793.405041 | 15888 |
| AES-256-GCM-enc-no_AAD | 793.122663 | 32768 |
| AES-256-GCM-enc-no_AAD | 797.332681 | 65535 |
For RSA operations the following chart shows performance differences using a 4096 bit key for private key operations. SP stands for Single Precision.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
wolfHSM DMA Feature Addition
wolfHSM provides a client-server model for interacting with HSM’s to do cryptographic operations and currently supports multiple transport mediums: TCP, POSIX shared memory (SHM), and DMA (direct memory access). It gives the option of using wolfCrypt with it’s FIPS 140-3 certification instead of a hardware HSM to take advantage of something like a secure trustzone. This abstraction also makes it easy for developing an application that can make use of any HSM backend without needing to make changes to the application when switching the HSM used.
Recently an additional feature was added for DMA operations with the POSIX shared memory transport. Instead of copying data from the shared memory buffer, wolfHSM can now pass an offset into the SHM buffer by making use of wolfSSL’s static memory feature on the client side and translating the offset into the shared memory region into a pointer on the server side. This reduces redundant memory copies and improves throughput. New `wh_dma.c` and `wh_dma.h` files were introduced to provide offset translation, validation, and hooks for cache handling or memory safety checks. These changes give developers better performance by avoiding unnecessary `memcpy` operations while taking advantage of wolfCrypt FIPS 140-3 certified security.
Along with the feature addition, the POSIX examples were enhanced to take an argument for selecting a transport medium type and the benchmarking tool was also enhanced similarly.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call +1 425 245 8247.
Download wolfSSL Now
Live Webinar: The wolfCrypt Linux Kernel Module: FIPS Full Crypto Stack Replacement
Bring FIPS 140-3 validated cryptography directly into the Linux kernel.
In this webinar, wolfSSL Senior Software Engineer Daniel Pouzner introduces the libwolfssl FIPS-compliant Linux Kernel Module (libwolfssl.ko), a plug-and-play replacement for the kernel crypto stack. Learn how it delivers FIPS-validated algorithms, hardware acceleration, and post-quantum readiness for applications such as LUKS/dm-crypt, VPN, MACsec, and TLS offload.
Register Now: The wolfCrypt Linux Kernel Module: FIPS Full Crypto Stack Replacement
Date: October 22 | 9 AM PT
Discover how wolfSSL extends its proven cryptographic engine to kernel space, integrating with WolfGuard VPN and transforming Linux randomness sources into SP 800-90B compliant DRBGs.
What You’ll Learn:
- Enable FIPS 140-3 validated cryptography directly in the Linux kernel
- Accelerate performance with hardware support and post-quantum algorithms (ML-KEM, ML-DSA)
- Replace the kernel crypto stack for LUKS, VPN, MACsec, and TLS offload
- Integrate FIPS-certified randomness and DRBG sources across the system
Register now to see how wolfSSL enables a fully FIPS-compliant, post-quantum-ready Linux environment.
As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
FIPS 140-3 Enabled Linux Authentication & System Services with GnuTLS-wolfSSL
wolfSSL is thrilled to announce that critical enterprise security and system services can now achieve FIPS 140-3 compliance through our GnuTLS-wolfSSL integration. This breakthrough comes from our ongoing work integrating wolfSSL’s FIPS 140-3 certified cryptography (wolfCrypt) into GnuTLS, enabling a true drop-in solution for Linux applications.
For enterprises in government, defense, finance, healthcare, and other regulated industries, this eliminates a major hurdle to deploying essential security infrastructure that must meet federal compliance standards.
What We’ve Built
Unlike traditional approaches requiring extensive rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level with wolfCrypt’s certified cryptographic operations, applications gain FIPS 140-3 compliance without changing a single line of their code. Simply rebuild with our patched GnuTLS library, and your entire security infrastructure achieves FIPS compliance.
We’re continuously validating this integration through CI/CD testing against 17 applications, testing target versions, latest releases, and master branches to ensure rock-solid compatibility. Our fork is now debianized, making deployment as simple as installing a standard Debian package.
Enterprise Applications Now FIPS-Ready
OpenLDAP – The industry-standard directory services platform for authentication and authorization across enterprise networks.
Samba – Provides Windows-compatible file sharing, print services, and Active Directory integration for mixed Linux/Windows environments.
dirmngr – The GnuPG component handling certificate and CRL management for cryptographic operations.
TPM2-tools – Utilities for interacting with Trusted Platform Module 2.0 hardware for secure key storage and attestation.
rsyslog – High-performance system logging with TLS support for secure remote log transmission.
fwupd – The Linux firmware update daemon that securely manages firmware updates across hardware components.
How We Enable FIPS Compliance
These applications rely on GnuTLS for secure authentication, encrypted communications, certificate validation, and cryptographic operations. By integrating wolfSSL’s FIPS 140-3 certified wolfCrypt module into GnuTLS, we deliver a true drop-in solution. Depending on the algorithms your application uses, you may need no code changes at all, just rebuild with our patched library and achieve FIPS compliance across your enterprise security stack.
The debianized package makes deployment straightforward: install our GnuTLS-wolfSSL package on your Debian-based system, and your enterprise services automatically benefit from FIPS-certified cryptography.
Questions?
Take a more in-depth look at our integration on the wolfSSL GitHub, if you need support we are more than happy to help you out, you can email us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
FIPS 140-3 Enabled Linux Network Infrastructure with GnuTLS-wolfSSL
wolfSSL is thrilled to announce that core network infrastructure applications can now achieve FIPS 140-3 compliance through our GnuTLS-wolfSSL integration. This breakthrough comes from our ongoing work integrating wolfSSL’s FIPS 140-3 certified cryptography (wolfCrypt) into GnuTLS, enabling a true drop-in solution for Linux applications.
For developers and system administrators in government, defense, finance, healthcare, and other regulated industries, this eliminates a critical barrier to deploying secure network infrastructure that must meet federal compliance standards.
What We’ve Built
Unlike traditional approaches requiring extensive rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level with wolfCrypt’s certified cryptographic operations, applications can gain FIPS 140-3 compliance without changing a single line of their code. Simply rebuild with our patched GnuTLS library, and your entire networking stack achieves FIPS compliance.
We’re continuously validating this integration through CI/CD testing against 17 applications, testing target versions, latest releases, and master branches to ensure rock-solid compatibility. Our fork is now debianized, making deployment as simple as installing a standard Debian package.
Network Applications Now FIPS-Ready
chrony – The widely-deployed NTP implementation for time synchronization across Linux systems, critical for distributed infrastructure and audit logging.
NetworkManager – The standard Linux network connection manager that handles everything from WiFi to VPN connections in modern distributions.
libnice – Implements ICE protocol for NAT traversal, essential for WebRTC and real-time communication applications.
curl & wget – The ubiquitous data transfer utilities now gain a clear path to FIPS compliance for secure communications.
How We Enable FIPS Compliance
These applications rely on GnuTLS for TLS connections, certificate handling, and cryptographic operations. By integrating wolfSSL’s FIPS 140-3 certified wolfCrypt module into GnuTLS, we deliver a true drop-in solution. Depending on the algorithms your application uses, you may need no code changes at all, just rebuild with our patched library and achieve FIPS compliance across your network infrastructure.
The debianized package makes deployment straightforward: install our GnuTLS-wolfSSL package on your Debian-based system, and your network applications automatically benefit from FIPS-certified cryptography.
Questions?
Take a more in-depth look at our integration on the wolfSSL GitHub, if you need support we are more than happy to help you out, you can email us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
FIPS 140-3 Enabled Linux Desktop & Media Applications with GnuTLS-wolfSSL
wolfSSL is thrilled to announce that desktop, development, and media applications can now achieve FIPS 140-3 compliance through our GnuTLS-wolfSSL integration. This breakthrough comes from our ongoing work integrating wolfSSL’s FIPS 140-3 certified cryptography (wolfCrypt) into GnuTLS, enabling a true drop-in solution for Linux applications.
For developers and organizations in government, defense, finance, healthcare, and other regulated industries, this eliminates barriers to deploying user-facing applications and specialized libraries that must meet federal compliance standards.
What We’ve Built
Unlike traditional approaches requiring extensive rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level with wolfCrypt’s certified cryptographic operations, applications gain FIPS 140-3 compliance without changing a single line of their code. Simply rebuild with our patched GnuTLS library, and your entire application stack achieves FIPS compliance.
We’re continuously validating this integration through CI/CD testing against 17 applications, testing target versions, latest releases, and master branches to ensure rock-solid compatibility. Our fork is now debianized, making deployment as simple as installing a standard Debian package.
Desktop & Media Applications Now FIPS-Ready
glib-networking – The GNOME network stack that provides TLS support for countless GTK-based applications across Linux desktops.
libvnc – Enables VNC client and server functionality for remote desktop access and support tools.
libvte – The terminal emulator widget library used by GNOME Terminal and other popular Linux terminal applications.
libcups – The Common Unix Printing System library that handles secure printing operations across networks.
libcamera – Modern camera support library for Linux systems, handling secure camera data streams.
QPDF – PDF manipulation library for viewing, editing, and transforming PDF documents securely.
libjcat – Archive verification library used by fwupd and other tools for validating signed package integrity.
RTMP – Real-Time Messaging Protocol implementation for secure streaming media applications.
How We Enable FIPS Compliance
These applications rely on GnuTLS for TLS connections, certificate handling, secure communications, and cryptographic operations. By integrating wolfSSL’s FIPS 140-3 certified wolfCrypt module into GnuTLS, we deliver a true drop-in solution. Depending on the algorithms your application uses, you may need no code changes at all, just rebuild with our patched library and achieve FIPS compliance across your desktop and media applications.
The debianized package makes deployment straightforward: install our GnuTLS-wolfSSL package on your Debian-based system, and your applications automatically benefit from FIPS-certified cryptography.
Questions?
Take a more in-depth look at our integration on the wolfSSL GitHub, if you need support we are more than happy to help you out, you can email us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now