RECENT BLOG NEWS
Or sign up to receive weekly email notifications containing the latest news from wolfSSL.
In addition, wolfSSL now has a support-specific blog page dedicated to answering some of the more commonly received support questions.
The release of wolfSSL version 4.2.0 is now available!
Many exciting new features were added in this release along with optimizations and some fixes. wolfSSL has spent 10,000 hours worth of engineering on creating the code for this release. We’ve added new features, ports, and made it more robust. For a full list of fixes, optimizations, and recommendations check out our README on GitHub (https://github.com/wolfSSL/wolfssl) or the ChangeLog.md in the main download from www.wolfssl.com. We suggest that all users keep up to date with wolfSSL versions to get access to new features, optimizations, and minor fixes. We also have a list of higher severity fixes in the bottom of the README/ChangeLog to help answer any questions on security related fixes and changes. Feel free to reach out to us at facts (at) wolfssl.com with any questions regarding the release.
This is a list of the notable exciting new features in wolfSSL version 4.2.0:
- Over 198 OpenSSL compatibility API’s added
- This includes the support for many open source projects such as NGINX (https://www.nginx.com/)
- The additions make it easier to migrate projects from OpenSSL to wolfSSL and keep support for FIPS active
- Apache (https://www.apache.org/) port added for compiling with wolfSSL using –enable-apachehttpd
- Port for using wolfSSL with OpenVSwitch (https://openvpn.net/community-resources/ethernet-bridging/)
- Port for Renesas TSIP (https://www.renesas.com/br/en/products/software-tools/software-os-middleware-driver/security-crypto/trusted-secure-ip-driver.html)
- Visual Studio Solution for Azure Sphere Devices (MT3620 and MT3620-mini) added to the directory IDE/VS-AZURE-SPHERE
- Addition of Coldfire MCF5441X NetBurner example to the directory IDE/M68K/
- Added support for prime checking to SP math build
- Addition of DYNAMIC_TYPE_BIGINT type for tracking mp_int allocations
- Addition of wc_ecc_get_curve_params API for getting ecc_set_type params for a curve
- Adding in TLS_SHA256_SHA256 and TLS_SHA384_SHA384 TLS1.3 cipher suites (null ciphers)
- Added in PKCS7 decryption callbacks for CMS operations
- Added handling for optional ECC parameters with PKCS7 KARI
- Addition to configure.ac for FIPS wolfRand builds
- Adding the flag WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY for ignoring certificate date checks with the functions wolfSSL_CTX_load_verify_buffer_ex and wolfSSL_CTX_load_verify_locations_ex
- Support for PKCS8 keys added to the function wolfSSL_CTX_use_PrivateKey_buffer
- Support for KECCAK hashing. Build with macro WOLFSSL_HASH_FLAGS and call wc_Sha3_SetFlags(&sha, WC_HASH_SHA3_KECCAK256) before the first SHA3 update
- Addition of setting secure renegotiation at CTX level
- Addition of KDS (NXP Kinetis Design Studio) example project to directory IDE/KDS/ (https://www.nxp.com/design/designs/design-studio-integrated-development-environment-ide:KDS_IDE)
- Support for Encrypt-Then-MAC to TLS 1.2 and below
- Added a new build option for a TITAN session cache that can hold just over 2 million session entries (–enable-titancache)
- Synchronous Quick Assist Support for Sniffer
- Added Support for SiFive HiFive Unleashed board
- Support for Google WebRTC added in to compatibility layer build (https://webrtc.org/)
- Additional Sniffer features; IPv6 sniffer support, Fragment chain input, Data store callback, Various statistics tweaks and other Sniffer fixes
We have the best tested crypto and a goal to release code without any bugs or issues, but being human, some do slip through. In our effort to be as transparent as possible this is a list of fixes that we feel users should be aware of when considering whether to update to the latest wolfSSL version:
- Fix for sanity check on reading TLS 1.3 pre-shared key extension. This fixes a potential for an invalid read when TLS 1.3 and pre-shared keys is enabled. Users without TLS 1.3 enabled are unaffected. Users with TLS 1.3 enabled and HAVE_SESSION_TICKET defined or NO_PSK not defined should update wolfSSL versions. Thanks to Robert Hoerr for the report.
- Fix for potential program hang when ocspstapling2 is enabled. This is a moderate level fix that affects users who have ocspstapling2 enabled(off by default) and are on the server side. In parsing a CSR2 (Certificate Status Request v2 ) on the server side, there was the potential for a malformed extension to cause a program hang. Thanks to Robert Hoerr for the report.
- Two moderate level fixes involving an ASN.1 over read by one byte. CVE-2019-15651 is for a fix that is due to a potential one byte over read when decoding certificate extensions. CVE-2019-16748 is for a fix on a potential one byte overread with checking certificate signatures. This affects builds that do certificate parsing and do not have the macro NO_SKID defined.Thanks to Yan Jia and the researcher team from Institute of Software, Chinese Academy of Sciences for the report.
- High level fix for DSA operations involving an attack on recovering DSA private keys. This fix affects users that have DSA enabled and are performing DSA operations (off by default). All users that have DSA enabled and are using DSA keys are advised to regenerate DSA keys and update wolfSSL version. ECDSA is NOT affected by this and TLS code is NOT affected by this issue. This affects a very small percentage of users (~ less than 1%). Thanks to Ján Jan?ár for the report.
For additional vulnerability information visit the vulnerability page at https://www.wolfssl.com/docs/security-vulnerabilities/
Love from wolfSSL <3
In the latest release of wolfSSL, we have added a new port for using wolfSSL with OpenVSwitch. OpenVSwitch is a multilayer switch to provide switching for hardware virtualization environments. With wolfSSL support, users can now build OpenVSwitch with the configure option
The addition of OpenVSwitch is available in wolfSSL 4.2.0, which can be downloaded here.
Changes made to OpenVSwitch for wolfSSL compatibility can be found on the OpenVSwitch GitHub.
For more information about the compatibility layer, building with OpenVSwitch, or any additional questions, contact us at email@example.com.
We have added in support for the open source project WebRTC (https://webrtc.org/) in wolfSSL release 4.2.0. This is a project that allows real time communication (RTC) with IoT, mobile and web browsers. Many additional API where added to the wolfSSL compatibility layer in order to plug wolfSSL into WebRTC instead of OpenSSL. Some of those additional API added are:
For questions about the use of wolfSSL with WebRTC contact us at firstname.lastname@example.org.
The option to have a massive TITAN size session cache is now available in wolfSSL 4.2.0. This can hold over 2 million session entries and works well for use in desktops and high load environments that have many long lasting session ID’s. To turn on the new session cache size use the enable option
--enable-titancache, or the macro TITAN_SESSION_CACHE if building without autoconf. This option is meant for extreme use cases where
--enable-hugecache (HUGE_SESSION_CACHE) is just not enough. It works well with systems that need over 200 new sessions per second and also need to handle numerous long lasting sessions.
For more information about the TITAN cache build contact us at email@example.com.
MQX 4.2 support (using the MFS file system and RTCS TCP/IP stack) was added as part of the wolfSSH 1.4.3 release. MQX 4.2, or “MQX Classic”, is a Real-Time Operating System (RTOS) created by NXP/Freescale and commonly used on 32-bit MCUs and MPUs from NXP. The wolfSSH SFTP MQX 4.2 port was tested and validated on a NXP K70-based platform. When compiling wolfSSH for NXP/Freescale MQX 4.2, the FREESCALE_MQX define should be used.
wolfSSH is a lightweight, portable SSHv2 implementation with support for both client and server functionalities. Including features such as SFTP and SCP, and supporting both password and public key authentication, wolfSSH is the ideal solution for SSH and file transfer requirements on embedded systems. wolfSSH is backed by the wolfCrypt cryptography library and can use features of wolfCrypt such as expansive hardware cryptography support, FIPS 140-2 validated cryptography, DO-178, and more!
wolfSSL has added in many new OpenSSL compatibility API’s in the recent release, wolfSSL 4.2.0. The compatibility layer previously was impressive with upwards of 600 hundred of the most common API used, but in the effort to make transitioning projects that currently use OpenSSL, over to using wolfSSL, we added more than 198 additional API. These API additions supported many open source projects such as building with Apache (https://www.apache.org/) and WebRTC. There were also improvements done in the last release for existing API’s and enhancements to their functionality.
There are too many new API to list all, but here are some of them:
- EVP_aes_128_gcm, EVP_aes_192_gcm, EVP_aes_256_gcm
- …. (and more)
If you have a FIPS project in jeopardy with the upcoming lapse in OpenSSL support, an easy fix is to plug in wolfSSL. Let us know if your project needs any API that we are missing by contacting us at firstname.lastname@example.org.
wolfSSH v1.4.3 has been released. This version of wolfSSH includes several fixes and new features. The primary new feature is a wolfSFTP port to MQX 4.2. Please see the change log for more details. Included are some portability fixes between versions of C compilers, a clean up of some obvious issues with the examples, and improved interoperability with PuTTY.
You can download this latest release from the wolfSSL download portal. Additional information wolfSSH can be found on the wolfSSH product page. For more information on platform support or for questions regarding wolfSSH, contact us at email@example.com. Be sure to stay up to date with our GitHub repository. Please give us a star!
wolfSSH v1.4.3 (10/31/2019)
- wolfSFTP port to MQX 4.2 (MQX/MFS/RTCS)
- Maintenance and bug fixes
- Improvements and additions to the test cases
- Fix some portability between C compilers
- Fixed an issue in the echoserver example where it would error sometimes on shutdown
- Improvement to the global request processing
- Fixed bug in the new keys message handler where it reported the wrong size in the data buffer; invalid value was logged, not used
- Fixed bug in AES initialization that depended on build settings
- Improved interoperability with puTTY
- Added user auth callback error code for too many password failures
- Improvements to the Nucleus filesystem abstraction
- Added example for an “autopilot” file get and file put with the wolfSFTP example client
As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until December 2020. The version of OpenSSL that supports FIPS goes into End Of Life and is no longer supported in December of 2019.
This means that OpenSSL users will not have a supported package for over a year. This is a big issue for companies that rely on security.
To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:
1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,
2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,
3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.
Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.
Contact us at firstname.lastname@example.org if you would like to learn more!
We love you.
Saficard is a French company specializing in solutions for healthcare payment management. One of their products is a Point-of-Sale (POS) terminal designed to accept the Vitale Card. The Vitale Card is a French health insurance card that stores social security information and allows patients to be reimbursed for healthcare costs. The card works with various smart card standards, such as: EMV, IAS-ECC, and ISO (joinup).
The French government has created strict security standards for processing healthcare bills using the Vitale Card. Among these standards are using Cryptography Message Syntax (PKCS#7) and TLS for transmitting healthcare transactions.
Saficard faced problems finding a lightweight-portable cryptography library written in C for their Point-of-Sale terminals. Their solution was using wolfSSL + wolfCrypt to implement PKCS#7 and TLS on the iWL250 terminal by Ingenico.
The NXP Memory-Mapped Cryptographic Acceleration Unit (mmCAU) is on many Kinetis and ColdFire microcontrollers. It improves symmetric AES and SHA performance as compared to our software based implementation. The v4.2.0 enhanced the MMCAU support to use multiple blocks against hardware and optimizes to avoid memory copies (memcpy) when able. This resulted in a 20-78% improvement.
- Enhancement for NXP MMCAU to process more than one block at a time.
- Added optional buffer alignment detection macro WC_HASH_DATA_ALIGNMENT to avoid memcpy.
- Added MD5 and SHA-1 support for XTRANSFORM_LEN to process blocks.
- Cleanups for consistency between algorithms and code commenting.
Improved MMCAU performance: SHA-1 by 35%, SHA-256 by 20% and MD5 by 78%.
NXP K64 MMCAU with wolfSSL v4.2.0: MD5 8 MB took 1.000 seconds, 7.910 MB/s SHA 4 MB took 1.005 seconds, 3.644 MB/s SHA-256 2 MB took 1.006 seconds, 2.306 MB/s
NXP K64 MMCAU with wolfSSL v4.1.0: MD5 4 MB took 1.004 seconds, 4.450 MB/s SHA 3 MB took 1.006 seconds, 2.670 MB/s SHA-256 2 MB took 1.008 seconds, 1.913 MB/s
Changes are in GitHub pull request #2481 and in the wolfSSL v4.2.0 release.
For more information please email us at email@example.com.
wolfSSL's embedded SSL/TLS library has included support for TLS 1.3 since early releases of the TLS 1.3 draft. Since then, wolfSSL has remained up-to-date with the TLS 1.3 specification. In this post, the major upgrades of TLS 1.3 from TLS 1.2 are outlined below:
This protocol is defined in RFC 8446. TLS 1.3 contains improved security and speed. The major differences include:
- The list of supported symmetric algorithms has been pruned of all legacy algorithms. The remaining algorithms all use Authenticated Encryption with Associated Data (AEAD) algorithms.
- A zero-RTT (0-RTT) mode was added, saving a round-trip at connection setup for some application data at the cost of certain security properties.
- Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
- All handshake messages after the ServerHello are now encrypted.
- Key derivation functions have been re-designed, with the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) being used as a primitive.
- The handshake state machine has been restructured to be more consistent and remove superfluous messages.
- ECC is now in the base spec and includes new signature algorithms. Point format negotiation has been removed in favor of single point format for each curve.
- Compression, custom DHE groups, and DSA have been removed, RSA padding now uses PSS.
- TLS 1.2 version negotiation verification mechanism was deprecated in favor of a version list in an extension.
- Session resumption with and without server-side state and the PSK-based ciphersuites of earlier versions of TLS have been replaced by a single new PSK exchange.
More information about wolfSSL and the TLS 1.3 protocol can be found here: https://www.wolfssl.com/docs/tls13/.
Additionally, please contact firstname.lastname@example.org for any questions.
- November 2019 (6)
- October 2019 (14)
- September 2019 (24)
- August 2019 (21)
- July 2019 (8)
- June 2019 (13)
- May 2019 (35)
- April 2019 (32)
- March 2019 (20)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (11)
- October 2018 (18)
- September 2018 (18)
- August 2018 (8)
- July 2018 (15)
- June 2018 (29)
- May 2018 (15)
- April 2018 (11)
- March 2018 (19)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (7)
- September 2017 (8)
- August 2017 (6)
- July 2017 (11)
- June 2017 (8)
- May 2017 (10)
- April 2017 (5)
- March 2017 (7)
- February 2017 (1)
- January 2017 (8)
- December 2016 (3)
- November 2016 (2)
- October 2016 (18)
- September 2016 (8)
- August 2016 (5)
- July 2016 (4)
- June 2016 (11)
- May 2016 (4)
- April 2016 (5)
- March 2016 (4)
- February 2016 (12)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (6)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (13)
- January 2015 (6)
- December 2014 (7)
- November 2014 (3)
- October 2014 (2)
- September 2014 (11)
- August 2014 (6)
- July 2014 (9)
- June 2014 (11)
- May 2014 (11)
- April 2014 (9)
- March 2014 (3)
- February 2014 (3)
- January 2014 (5)
- December 2013 (9)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (8)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (9)
- December 2012 (13)
- November 2012 (5)
- October 2012 (7)
- September 2012 (4)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (6)
- April 2012 (7)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (6)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (8)
- May 2011 (12)
- April 2011 (4)
- March 2011 (12)
- February 2011 (9)
- January 2011 (13)
- December 2010 (17)
- November 2010 (12)
- October 2010 (14)
- September 2010 (11)
- August 2010 (20)
- July 2010 (14)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)