If you’re part of the Web PKI community and haven’t heard of Merkle Tree Certificates then you must have been hiding under a rock for the past year! These are the new format of certificates that are being pushed by Google and Cloudflare to solve the issue of large public keys and signatures in ML-DSA […]
Read MoreMore TagMonth: June 2026
wolfKeyMgr: Decrypt Internal TLS 1.3 Traffic Without Breaking It
TLS 1.3 made per-session forward secrecy the default. That is a win for privacy on the open internet, but inside your own data center it leaves monitoring, compliance, and intrusion-detection tools blind to the traffic they are meant to watch. wolfKeyMgr is wolfSSL’s answer. What wolfKeyMgr Does wolfKeyMgr is a secure key management service […]
Read MoreMore TagWhy is wolfSSL reporting so many CVEs?
Why are we reporting so many CVEs? If you follow wolfSSL, you’ve probably noticed the number of CVEs we file per release has ramped up this spring 2026. From 5.8.0 (April 2025) to 5.9.1 (April 2026) we’ve experienced nearly geometric growth in reported CVEs per wolfSSL release. So what’s going on? Should users of wolfSSL […]
Read MoreMore TagwolfCOSE vs The Field: The smallest and fastest COSE library, now with post-quantum ML-DSA at the same cost.
Scope: ES256 (P-256) COSE_Sign1 size and speed plus post-quantum ML-DSA (FIPS 204), wolfCOSE vs t_cose vs COSE-C, with cross-language and on-device results. Method: one identical operation, every library and crypto backend built from source on one machine with identical flags, dead-code eliminated. Desktop: x86_64 Intel i9-11950H, GCC 14.2. On-device: NUCLEO-H563ZI Cortex-M33 at 250 MHz. June […]
Read MoreMore TagPost-Quantum Cryptography in curl
wolfSSL continues to advance post-quantum cryptography support throughout its ecosystem, including curl when built with wolfSSL. Developers can use post-quantum and hybrid TLS 1.3 key exchange mechanisms, including ML-KEM, to help protect connections against future quantum threats. Supported Hybrid TLS 1.3 Key Exchange: SecP256r1MLKEM512 SecP384r1MLKEM768 SecP521r1MLKEM1024 SecP256r1MLKEM768 SecP521r1MLKEM1024 SecP384r1MLKEM1024 X25519MLKEM512 X25519MLKEM768 X448MLKEM768 To learn more […]
Read MoreMore TagwolfSSL vs OpenSSL: Heap Usage Comparison
When choosing a TLS library, two questions come up again and again: how much memory does it use and how fast is it. This post focuses on memory, comparing the heap usage of wolfSSL against several OpenSSL releases for an identical TLS 1.2 handshake. All numbers below were regenerated with current releases; wolfSSL 5.9.1 versus […]
Read MoreMore TagBringing the Broker to the Edge – wolfMQTT’s New Embedded MQTT Broker
What if your MQTT architecture could eliminate the gateway entirely? Most MQTT deployments rely on a cloud-hosted or gateway-based broker. But some systems need local operation, lower latency, disconnected communication, or tighter control over system resources. Join us on June 17 at 9 AM PT for a technical introduction to the new embedded MQTT broker […]
Read MoreMore TagwolfIP: Deterministic TCP/IP Without Dynamic Memory Allocation – APAC-Friendly Time
Many networking stacks make it difficult to predict memory usage, runtime behavior, and certification effort. For embedded, real-time, and safety-critical systems, that uncertainty can add complexity throughout development, testing, and deployment. Join us for a technical webinar on wolfIP, a compact TCP/IP stack designed specifically for deterministic embedded networking. wolfIP eliminates runtime memory allocation and […]
Read MoreMore TagNative HTTP Message Signatures in curl, Powered by wolfSSL – Part 3
In Part 1, we argued agents need cryptographic request authenticity. In Part 2 we surveyed the ecosystem and the adjacent tools. This post is about what we’re contributing: native RFC 9421 support at the plumbing layer — curl and libcurl, with wolfCrypt providing the Ed25519 math. Two open PRs: curl — curl/curl#21239 — httpsig: add […]
Read MoreMore TagwolfCOSE: The First COSE Implementation with ML-DSA – Production-Tested, CAVP-Validated Post-Quantum Signatures in wolfCOSE
If you are signing CBOR payloads on an embedded device and you have started worrying about “harvest now, decrypt later,” that worry now extends to signatures too. Long-lived firmware artifacts, attestation reports, supply-chain manifests: anything signed today with ECDSA or RSA can be retroactively forged by an adversary with a cryptographically relevant quantum computer. wolfCOSE […]
Read MoreMore Tag