RECENT BLOG NEWS

So, what’s new at wolfSSL? Take a look below to check out the most recent news, or sign up to receive weekly email notifications containing the latest news from wolfSSL. wolfSSL also has a support-specific blog page dedicated to answering some of the more commonly received support questions.

wolfSSL 5.8.0 Released

We are excited to announce that wolfSSL version 5.8.0 is now available. This release brings several important new features and improvements. Below are the key new additions:

New Features

  • Implemented various fixes to support building for Open Watcom, including OS/2 support and Open Watcom 1.9 compatibility (PR 8505, 8484).
  • Added support for STM32H7S (tested on NUCLEO-H7S3L8) (PR 8488).
  • Added support for STM32WBA (PR 8550).
  • Added Extended Master Secret Generation Callback to the –enable-pkcallbacks build (PR 8303).
  • Implemented AES-CTS (–enable-aescts) in wolfCrypt (PR 8594).
  • Added support for libimobiledevice commit 860ffb (PR 8373).
  • Initial ASCON hash256 and AEAD128 support based on NIST SP 800-232 IPD (PR 8307).
  • Added blinding option when using a Curve25519 private key by defining the macro WOLFSSL_CURVE25519_BLINDING (PR 8392).

ML-DSA and Post-Quantum Cryptography Enhancements

In line with NIST’s latest documentation, wolfSSL has updated its Dilithium implementation to ML-DSA (Module-Lattice Digital Signature Algorithm), which is fully supported in this release. Additionally, the release includes updates to further optimize ML-DSA and LMS (Leighton–Micali Signature) schemes, reducing memory usage and improving performance.

Linux Kernel Module (linuxkm) Updates

wolfSSL 5.8.0 expands support for the Linux Kernel Module (linuxkm), with several important enhancements to improve kernel-level cryptographic integration. This includes extended LKCAPI registration support for rfc4106(gcm(aes)), ctr(aes), ofb(aes), ecb(aes), and the legacy one-shot AES-GCM backend. Compatibility improvements have been added for newer kernels (?6.8), and calls to scatterwalk_map() and scatterwalk_unmap() have been updated for Linux 6.15. The release also registers ECDSA, ECDH, and RSA algorithms with the kernel crypto API and introduces safeguards for key handling, including forced zeroing of shared secrets. These changes make it possible to use more wolfSSL functionality in the kernel space.

For a full list of fixes and optimizations check out the ChangeLog.md bundled with wolfSSL. Download the latest release from the download page. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Everything You Need to Know About Automotive Cybersecurity – Tailored for the Asia-Pacific Time Zone

Strengthen your vehicle’s defenses with proven cybersecurity solutions.

Join us on July 31 at 5 PM PT / August 1 at 9 AM JST for a live automotive cybersecurity webinar, “Everything You Need to Know About Automotive Cybersecurity,” presented by Senior Software Engineer Eric Blankenhorn. This session explores the growing need for secure, connected, and software-defined vehicles. You’ll learn about wolfSSL’s approach to automotive cybersecurity, backed by real-world examples and practical integration strategies.

Register Now: Everything You Need to Know About Automotive Cybersecurity – Tailored for the Asia-Pacific Time Zone
Date: July 30 | 5 PM PT / Aug 1 | 9 AM JST
(This webinar is tailored for the Asia-Pacific Time Zone)

wolfSSL is a trusted provider of automotive-grade cybersecurity used by leading OEMs and Tier 1 suppliers. A key focus of this webinar is wolfHSM, our Hardware Security Module framework. Designed to support automotive-grade requirements, including AUTOSAR, PKCS11, and SHE, wolfHSM enables secure key storage, cryptographic operations, and secure boot, all while meeting the strict performance and safety demands of embedded automotive systems.

This webinar will cover:

  • How wolfSSL supports modern automotive cybersecurity across global markets
  • What sets wolfHSM apart, and why it’s ideal for embedded applications
  • Best practices for implementing secure firmware updates in vehicles
  • How TLS 1.3 enables safe communication from the vehicle to the cloud
  • Approaches to securing ADAS and autonomous driving systems
  • Real-world guidance on running TLS over CAN
  • How wolfSSL ensures the highest code quality through industry-leading test coverage and validation

Register now to gain practical insights into securing next-generation automotive systems with wolfSSL!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Cybersecurity Solutions for the Satellite Industry

Secure satellite communication and boot integrity with wolfSSL: FIPS 140-3, Post-Quantum, and Embedded Optimization

Join us on July 30th at 9 AM PT for the ‘Cybersecurity Solutions for the Satellite Industry’ webinar. As the industry leader in space-grade cybersecurity, wolfSSL products are deployed across satellites, delivery / rocket systems, and ground stations. Our software provides lightweight cryptographic and (D)TLS solutions optimized for satellite and aerospace systems. wolfSSL solutions also feature robust quantum-resistant cryptography, FIPS 140-3 certification, and CNSA 2.0 compliance.

Register Now: Cybersecurity Solutions for the Satellite Industry
Date: July 30 | 9 AM PT

Learn about how our companion products, such as wolfBoot, wolfTPM, and our other open source libraries, can be used to secure satellites and related systems.

This webinar will cover key areas such as integration with embedded systems, cryptographic library optimization, securing high-value projects, and addressing specialized security requirements. You’ll gain insights into military use cases, including FIPS-compliant deployments for the U.S. military, Space Force, rocket systems, and safety-critical space stations, aligned with DO-178 certification requirements.

Register now to enhance your satellite missions with wolfSSL’s trusted, industry-leading cryptographic security.

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Verifying TPM Endorsement Certificates with wolfTPM

We’re excited to share a new feature added to wolfTPM: a lightweight example for verifying TPM Endorsement Key (EK) Certificates without wolfCrypt.

The new example, `verify_ek_cert`, retrieves and verifies the EK certificate stored in the TPM’s non-volatile memory. This supports TPMs like the Infineon SLB9672/SLB9673, STMicro ST33 series, and validates their RSA-signed EK certs using the manufacturer’s public CA certificate. This is essential for secure boot, remote attestation, and provisioning in trusted systems.

Highlights:

  • Reads EK cert from NV memory (Index: 0x1C00002)
  • Parses and validates the X.509 certificate
  • Verifies hash and signature using CA public key
  • Confirms TPM identity and trustworthiness

This example uses minimal ASN.1 parsing to reduce code size and avoid dependencies on wolfCrypt. This approach is especially valuable for DO-178C certification efforts, where reducing complexity and traceability is critical. wolfTPM remains the only TPM 2.0 stack specifically designed for bare-metal environments with a minimal code footprint—ideal for embedded, safety-critical systems.

To try it:

$ git clone https://github.com/wolfSSL/wolfTPM.git
$ cd wolfTPM
$ ./configure --disable-wolfcrypt && make
$ ./examples/endorsement/verify_ek_cert

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfPKCS11 Supercharged: 42 New Mechanisms and Full NSS Backend Support Unleashes FIPS Crypto

The wolfSSL team is thrilled to announce a monumental update to wolfPKCS11, now available in the master branch on GitHub. This release transforms wolfPKCS11 into a premier, high-performance PKCS#11 provider by incorporating an incredible 42 new cryptographic mechanisms and 8 new API functions. This focused engineering effort enables wolfPKCS11 to serve as a complete and robust backend for Mozilla’s Network Security Services (NSS).

This achievement makes our vision from the “Firefox Gets FIPS 140-3 Power” post a production-ready reality. Now, any application using NSS—including Firefox, Thunderbird, and Linux server products—can be powered by our FIPS 140-3 validated wolfCrypt engine, bringing federally certified security and our signature performance and efficiency to the entire NSS ecosystem.

The Strategic Advantage: FIPS-Powered NSS

PKCS#11 is the industry-standard API for communicating with cryptographic hardware and software modules. NSS uses a PKCS#11 module to perform all its cryptographic operations. Our update provides the comprehensive support NSS requires, allowing wolfPKCS11 to act as a “drop-in” bridge to our wolfCrypt engine.

This integration provides a simple and efficient pathway to FIPS compliance for organizations in regulated industries. Instead of complex and costly application overhauls, using wolfPKCS11 with a FIPS-validated wolfCrypt backend becomes a straightforward configuration change, saving immense time and resources.

Feature Highlights: A New Level of Capability

The 42 new mechanisms expand wolfPKCS11’s capabilities to cover the full spectrum of modern cryptographic needs. Key additions include:

  • Modern Signatures: Support for the modern and provably secure RSA-PSS signature schemes (CKM_SHA256_RSA_PKCS_PSS, etc.), which are more resilient against cryptographic attacks than older standards.
  • Advanced Key Derivation: The inclusion of the HMAC-based Key Derivation Function (HKDF) and specific TLS and NSS mechanisms allows applications to offload their entire TLS key schedule to a FIPS-certified boundary.
  • Comprehensive Algorithm Support: A full suite of SHA-2 and SHA-3 hashing algorithms, along with advanced AES capabilities like CKM_AES_KEY_WRAP_PAD for secure key management, ensures broad compatibility and robust security.

In addition to new mechanisms, the 8 new API functions provide developers with advanced control for sophisticated applications. Functions like C_GetOperationState and C_SetOperationState allow for saving and restoring the progress of cryptographic operations, which is critical for resilience in embedded systems. Others, like C_VerifyRecover, add support for specialized signature schemes, ensuring comprehensive standards compliance.

Quality, Reliability, and Getting Started

This release is reinforced by significant under-the-hood improvements. A new –enable-nss compile-time option streamlines integration, and our vastly improved CI pipeline now includes extensive regression testing against the NSS suite, static analysis, and dynamic sanitizers to guarantee stability. We’ve also included numerous fixes for TPM users and improved the handling of object attributes for greater security and reliability.

The latest updates transform wolfPKCS11 into a fully-featured, highly reliable, and FIPS-capable PKCS#11 implementation. It is now uniquely positioned to bring the industry-leading performance and certified security of wolfCrypt to the entire ecosystem of applications built on NSS.

Developers are encouraged to explore these powerful new features, which are available now on the master branch of the official wolfPKCS11 GitHub repository. For hands-on examples of how to use wolfPKCS11 with NSS, please see our dedicated examples repository.

For any technical questions, please reach out to us at support@wolfssl.com. For inquiries related to FIPS 140-3 validation, commercial licensing, or questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Meet wolfSSL at Black Hat USA 2025

Join wolfSSL at Black Hat USA 2025 – August 6–7 in Las Vegas, Nevada!

Visit us at Booth #2561 to explore high-performance cryptographic solutions trusted in embedded, enterprise, and cloud systems.

As a leader in cryptography and protocols, wolfSSL delivers the most tested, most portable, and standards-compliant cryptography, securing over 5 billion connections across RTOS, embedded, and traditional platforms.

What You’ll See at Black Hat

Use code WOLFSSL to redeem:

Stop by Booth #2561 and see why leading organizations trust wolfSSL for certified, future-ready cryptography.

Contact us today to schedule a meeting with wolfSSL Team!

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

ML-KEM Versus HQC KEM

ML-KEM (Module-Lattice Key Encapsulation Mechanism) and HQC (Hamming Quasi-Cyclic) are both post-quantum cryptographic key encapsulation mechanisms (KEMs) designed to provide secure key exchange in the presence of CRQCs (Cryptographically Relevant Quantum Computers).

ML-KEM is based on the (M-LWE) Module Learning With Errors problem, which involves finding a short vector between two points in a high dimensional vector-space with special points called a lattice. HQC is based on the hardness of decoding random quasi-cyclic codes. This means matrices with columns that are shifts of the first column with some modifications. These domains of mathematics are both considered to be well studied in our modern times.

In terms of numbers, ML-KEM has smaller key sizes and ciphertext sizes when compared to HQC at the same security levels. ML-KEM is generally faster than HQC for all the KEM operations (key generation, encapsulation, decapsulation).

In terms of the status of the algorithms, ML-KEM has already been standardized by NIST, and code points for TLS 1.3 are already in draft standards at the IETF. HQC was recently picked for standardization by NIST, but NIST has yet to issue a FIPS document specifying and standardizing it.

wolfSSL’s perspective is that you should start your post-quantum migration journey today and use algorithms that are already standardized such as ML-KEM. That said, if anyone out there wants to take HQC for a spin, please let us know!! As always, wolfSSL is a customer driven organization and when we hear enough interest, we will make it happen!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Coming soon: HQC KEM

Hello there! You! We know you are out there. You learned about Hamming codes in college or university, and maybe even use them in your professional career in consumer electronics or telecommunications. Now you are wondering how simple error correcting codes can be transformed into a KEM (Key Encapsulation Mechanism) for doing secure key transport. To you, we present the quantum-safe HQC (Hamming Quasi-Cyclic) KEM.

Are you hoping to see a professional production level implementation of HQC KEM? You are in luck. We want to make one! Make sure to register your interest in a wolfCrypt implementation of HQC KEM by sending a feature request for it to facts@wolfssl.com.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Everything You Need to Know About Automotive Cybersecurity

Strengthen your vehicle’s defenses with proven cybersecurity solutions.

Join us on July 23 at 9 AM PT for a live automotive cybersecurity webinar, “Everything You Need to Know About Automotive Cybersecurity,” presented by Senior Software Engineer Eric Blankenhorn. This session explores the growing need for secure, connected, and software-defined vehicles. You’ll learn about wolfSSL’s approach to automotive cybersecurity, backed by real-world examples and practical integration strategies.

Register Now: Everything You Need to Know About Automotive Cybersecurity
Date: July 23 | 9 AM PT

wolfSSL is a trusted provider of automotive-grade cybersecurity used by leading OEMs and Tier 1 suppliers. A key focus of this webinar is wolfHSM, our Hardware Security Module framework. Designed to support automotive-grade requirements, including AUTOSAR, PKCS11, and SHE, wolfHSM enables secure key storage, cryptographic operations, and secure boot, all while meeting the strict performance and safety demands of embedded automotive systems.

This webinar will cover:

  • How wolfSSL supports modern automotive cybersecurity across global markets
  • What sets wolfHSM apart, and why it’s ideal for embedded applications
  • Best practices for implementing secure firmware updates in vehicles
  • How TLS 1.3 enables safe communication from the vehicle to the cloud
  • Approaches to securing ADAS and autonomous driving systems
  • Real-world guidance on running TLS over CAN
  • How wolfSSL ensures the highest code quality through industry-leading test coverage and validation

Register now to gain practical insights into securing next-generation automotive systems with wolfSSL!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfssl.com or +1 425 245 8247.

Download wolfSSL Now

wolfSSL 5.8.2 Now Available

wolfSSL 5.8.2 is now available! We are excited to announce the release of wolfSSL 5.8.2, packed with significant enhancements, introducing new functionalities, and refining existing features!

Important Notes for this Release

  • GPLv3 Licensing: wolfSSL has transitioned from GPLv2 to GPLv3.
  • Deprecated Feature: `–enable-heapmath` is now deprecated.
  • MD5 Disabled by Default: For enhanced security, MD5 is now disabled by default.

Key Highlights of wolfSSL 5.8.2

Vulnerability Mitigations:

  • ECC and Ed25519 Fault Injection Mitigation (Low): (Thanks to Kevin from Fraunhofer AISEC)
  • Apple Native Cert Validation Override (High – CVE-2025-7395): (Thanks to Thomas Leong from ExpressVPN)
  • Predictable `RAND_bytes()` after `fork()` (Medium – CVE-2025-7394): (Thanks to Per Allansson from Appgate)
  • Curve25519 Blinding Enabled by Default (Low – CVE-2025-7396): (Thanks to Arnaud Varillon, Laurent Sauvage, and Allan Delautre from Telecom Paris)

New Features:

  • Sniffer Enhancements: Support for multiple sessions and a new `ssl_RemoveSession()` API for cleanup.
  • New ASN.1 X509 API: `wc_GetSubjectPubKeyInfoDerFromCert` for retrieving public key information.
  • PKCS#12 Improvements: `wc_PKCS12_create()` now supports PBE_AES(256|128)_CBC key and certificate encryptions.
  • PKCS#7 Decoding: Added `wc_PKCS7_DecodeEncryptedKeyPackage()` for decoding encrypted key packages.
  • Linux Kernel Module Expansion: All AES, SHA, and HMAC functionality now implemented within the Linux Kernel Module.
  • OpenSSL Compatibility Layer Additions: New APIs for X.509 extensions and RSA PSS: `i2d_PrivateKey_bio`, `BN_ucmp`, and `X509v3_get_ext_by_NID`.
  • Platform Support: Added support for STM32N6.
  • Assembly Optimizations: Implemented SHA-256 for PPC 32 assembly.

Improvements & Optimizations:

This release includes a wide range of improvements across various categories, including:

  • Extensive Linux Kernel Module (LinuxKM) Enhancements: Numerous minor fixes, registrations, and optimizations for cryptography operations within the Linux Kernel Module.
  • Post-Quantum Cryptography (PQC) & Asymmetric Algorithms: Updates to Kyber, backward compatibility for ML_KEM IDs, fixes for LMS building and parameters, and OpenSSL format support for ML-DSA/Dilithium.
  • Build System & Portability: General build configuration fixes, improvements for older GCC versions, new CMakePresets, and default MD5 disabling.
  • Testing & Debugging: Enhanced debugging output, additional unit tests for increased code coverage, and improved benchmark help options.
  • Certificates & ASN.1: Improved handling of X509 extensions, fixed printing of empty names, and better error handling.
  • TLS/DTLS & Handshake: Corrected group handling, improved DTLS record processing, and refined TLS 1.3 key derivation.
  • Memory Management & Optimizations: Stack refactors, improved stack size with MLKEM and Dilithium, and heap math improvements.
  • Cryptography & Hash Functions: Added options to disable assembly optimizations for SipHash and SHA3, and improved Aarch64 XFENCE.
  • Platform-Specific & Hardware Integration: Explicit support for ESP32P4, public `wc_tsip_*` APIs, and enhanced PlatformIO certificate bundle support.
  • General Improvements & Refactoring: Updated libspdm, fixed PEM key formatting, and improved API accessibility for certificate failure callbacks.

wolfSSL 5.8.2 also includes some nice bug fixes, addressing issues across various modules, ensuring greater stability and reliability. For a complete and detailed list of all changes, please refer to the full release notes.

We encourage all users to upgrade to wolfSSL 5.8.2 to take advantage of these important security updates, new features, and performance enhancements. Download the latest release.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

ML-KEM Versus ML-DSA

ML-KEM (Module Lattice Key Encapsulation Mechanism) is for secure key exchange. ML-KEM enables two parties to establish a shared secret key over an insecure channel.

ML-DSA (Module Lattice Digital Signature Algorithm) is for authentication. ML-DSA allows a signer to generate a digital signature that can be verified by others, ensuring the authenticity and integrity of a message.

Both ML-KEM and ML-DSA are public key algorithms; that is to say, both have a key generation operation that generates a public key and private key.

For ML-KEM, an encapsulation operation uses the public key to generate a secret and ciphertext. The decapsulation operation uses the private key and ciphertext to get the same secret.

For ML-DSA, the private key and a message are used to generate a signature. The public key, message, and signature are used in an operation to verify that the signature of the message was generated by the corresponding private key.

The most important thing they have in common is that they are both post-quantum algorithms that have already been standardized by NIST and can be used TODAY!

In summary, ML-KEM and ML-DSA serve different purposes in cryptography, with ML-KEM focused on secure key transport and ML-DSA focused on digital signatures and authentication, but both protecting against a CRQC (Cryptographically Relevant Quantum Computer).

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2 3 4 … 205 206 207

Weekly updates

Archives