The recent addition of a TLS transport to the wolfHSM project provides improved transport-level protection for POSIX-based communications and was included with the latest release.
Previously, when wolfHSM was used over POSIX transports (such as TCP sockets on a local system), security largely depended on controlling access to that transport. If an attacker could access the socket or underlying IPC mechanism, they could potentially observe or tamper with messages exchanged between the wolfHSM client and server. TCP POSIX transports were largely created for examples and tests, and actual deployments of wolfHSM used controlled transports such as restricted shared memory for communication between the wolfHSM client and server.
While this model can work in tightly controlled environments, it assumes that the transport itself is already trusted. There was no built in cryptographic enforcement of confidentiality or peer authentication at the provided POSIX transport layer.
The Solution: TLS Over Transport
PR #227 introduces TLS on top of the existing POSIX transport layer. Instead of assuming the channel is secure, wolfHSM now has the option to:
- Encrypt traffic between client and server
- Authenticate peers using either mutual certificate-based TLS or PSK (Pre-Shared Key)
- Leverage wolfSSL’s TLS implementation for a tightly integrated solution
This change means that even if an attacker gains access to the underlying transport mechanism, they cannot read or modify the traffic without the appropriate cryptographic credentials. Giving a POSIX transport example that shifts “transport access equals trust” to explicit, cryptographic trust establishment. The benefits include:
- Protection against man-in-the-middle attacks
- Strong peer authentication
- Confidentiality and integrity of HSM commands and responses over TLS
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now