wolfSSL has significant improvements on how we parse and encode ASN.1 data like certificates and keys.
Parsing X.509 certificates, and RSA and ECC keys is important to do correctly. In fact, vulnerabilities come from not checking the validity of the encoding correctly! Reading outside the encoded data can result in crashing of your application or device.
To simplify the code and to make it as safe as possible, templates have been introduced that describe the format of data to be parsed or encoded. Using common functions that validity check the ASN.1 structure on parsing means fewer places for bugs. It also means less code!
Extensive testing has been performed on the new code including external fuzz testing. We are now confident the new code works just as well as the original implementation.
When using configure.ac to produce a Makefile, the new template code is compiled by default. For embedded customers, you will need to define: WOLFSSL_ASN_TEMPLATE.
To use the original code, either configure with —enable-asn=original or remove the WOLFSSL_ASN_TEMPLATE define. This code will be removed in future releases for reasons of maintenance so we encourage you to try out the new template code.
If you have questions about optimizing wolfSSL please contact us at facts@wolfssl.com or or call us at +1 425 245 8247.