So, what’s new at wolfSSL? Take a look below to check out the most recent news, or sign up to receive weekly email notifications containing the latest news from wolfSSL. wolfSSL also has a support-specific blog page dedicated to answering some of the more commonly received support questions.

CTaoCrypt on TinyOS with TinyPKC

One of our community members recently ported CTaoCrypt’s RSA and ECC code to the TinOS operating system in a project called TinyPKC ( TinyPKC was tested on 16-bit and 32-bit microcontroller platforms and should run on 8-bit platforms as well. It supports ECC key lengths from 112 bits to 521 bits and arbitrary RSA key lengths.

TinyPKC uses a subset of the CTaoCrypt functionality and provides support for the following operations:

– RSA public key encryption / private key decryption
– RSA private key signature generation / public key signature verification
– ECDSA signature generation and verification
– ECDH operations

For more information, please see the TinyPKC website and the included README in the download. Are you interested in running the wolfSSL embedded SSL library on TinyOS? If so, contact us at

yaSSL Partnership Program

yaSSL believes that business and technology partnerships are one of the keys to fostering success.  Such partnerships can come in many forms – be that business, technical, or community based, and work for both open source or commercial solutions.  To date, we have partnered with several companies, and are always looking for new partnerships.  To see a list of our current partners, please visit our Partner Page (

Are you interested in becoming a partner with yaSSL?  If so, contact us at for more information.

wolfSSL Custom I/O Setup

wolfSSL provides a mechanism to plug in your own application specific I/O routines. By default, the library uses functions that call the system’s recv() and send() functions with a file descriptor cached with the function wolfSSL_set_fd().

The prototypes for the I/O routines are:

int CBIORecv(CYASSL* ssl, char* buf, int sz, void* ctx);
int CBIOSend(CYASSL* ssl, char* buf, int sz, void* ctx);

In the default case, the network socket’s file descriptor is passed to the I/O routine in the ctx parameter. The ssl parameter is a pointer to the current session. In the receive case, buf points to the buffer where incoming cipher text should be copied for wolfSSL to decrypt and sz is the size of the buffer. In the send case, buf points to the buffer where wolfSSL has written cipher text to be sent and sz is the size of that buffer.

First you need to register your I/O callbacks with the CYASSL_CTX for your application using the functions wolfSSL_SetIORecv() and wolfSSL_SetIOSend().

wolfSSL_SetIORecv(ctx, myCBIORecv);
wolfSSL_SetIOSend(ctx, myCBIOSend);

As an example, for your application you want to control the socket for your own purposes. An example would be to have a server with a datagram socket which receives data from multiple clients or processes TLS through STDIN and STDOUT. In this case you would have four buffers:

cipher-receive encrypted data received from peer
cipher-send encrypted data to send to peer
clear-receive clear data received from wolfSSL
clear-send clear data passed to wolfSSL

Pointers to these buffers, values for their sizes, and read and write positions should be placed into a structure. This structure should be saved to the wolfSSL session with the functions wolfSSL_SetIOReadCtx() and wolfSSL_SetIOWriteCtx().

wolfSSL_SetIOReadCtx(ssl, buffer_data);
wolfSSL_SetIOWriteCtx(ssl, buffer_data);

The application receives a block of cipher text into the buffer cipher-receive. Next the application would call wolfSSL_read(ssl, buffer_data->clear_receive), causing wolfSSL to call myCBIORecv(). myCBIORecv() will be given a buffer, the size of the buffer, and the ctx, which has the cipher-receive buffer. The callback may be called many times for one call to wolfSSL_read(). If the cipher-receive buffer is empty, the callback should return -2, otherwise it should return the number of bytes copied into buf.

When the library wants to send data, like during handshaking or when wolfSSL_send() is called with some clear text, the library will call myCBIOSend(). The callback is given a buffer full of encrypted data, and the length of the encrypted data. In this example, the callback would copy this cipher text into cipher-send and return the number of bytes copied. If the cipher-send buffer isn’t big enough, the callback should return -2.

Using Cryptographic Hashes for Hash Tables

Choosing a good hash function for a hash table is difficult to say the least.  Even if you can achieve good distribution and performance for a given hash function it`s still most likely dependent on table size and the type of input.  Resizing the table or getting unexpected input can quickly turn an otherwise good choice into a bad one.  Using a cryptographic hash function reduces nearly all of the problems.  Any and all table sizes are now equally supported.  Strings, numbers, and even binary data are all valid input.  And since a change in a single bit of input has an avalanche effect on the output, uniform distribution is achieved.  Really, the only possible negative is performance.  But it`s not nearly as bad as you probably think.  

We tested 100 bytes of random data and did the test 1,000,000 times using the hash functions MD5, SHA1, and a typical MULTIPLIER type hash function.  Of course the basic hash function was the fastest at 0.66 microseconds per hash.  MD5 used 0.78 microseconds per hash while SHA1 consumed 1.02 microseconds per hash.  All in all, the small hit in performance seems well worth the gains in being able to use variable table sizes and any type of input without concern.  Testing was done using wolfSSL`s cryptography functionality in the CTaoCrypt module.

wolfSSL Training Course

Would you like to learn more about how SSL/TLS work, or more about the wolfSSL lightweight SSL library? If so, yaSSL is now offering a training course on SSL/TLS and wolfSSL. The wolfSSL training course covers details of SSL/TLS as well as the wolfSSL embedded SSL library.  Participants will have the opportunity to learn the inner workings of the SSL/TLS protocols as well as further their knowledge of the wolfSSL embedded SSL library.  Topics covered will include library design, building and getting started with wolfSSL, features, portability/customizability, certificates and keys, debugging and troubleshooting SSL, wolfSSL best practices, and details about the CTaoCrypt cryptography library.

Course Objectives:

Upon completion of the wolfSSL training course, attendees will:

– Achieve a basic understanding of how SSL/TLS work
– Learn the package and design of wolfSSL
– Effectively build wolfSSL for target platforms
– Learn effective wolfSSL debugging strategies
– Add wolfSSL to ANSI-C based client and server applications
– Learn best practices for adding wolfSSL to embedded, desktop/enterprise, or cloud applications or devices
– Develop using wolfSSL’s underlying cryptography library, CTaoCrypt

For a more detailed outline and more information on duration, scheduling, and pricing, please contact yaSSL at

wolfSSL support for Green Hills INTEGRITY RTOS

Are you interested in using the wolfSSL lightweight SSL library on the Green Hills INTEGRITY RTOS? Although wolfSSL doesn’t currently have INTEGRITY support, we would like to gauge user and community interest to help us plan our schedule for the upcoming year. If you would like to see INTEGRITY support added to wolfSSL, please let us know at

From Wikipedia, INTEGRITY “is royalty-free, POSIX-certified, and intended for use in embedded systems needing reliability, availability, and fault tolerance. It is built atop the velOSity microkernel and is intended mainly for modern 32- or 64-bit embedded system designs that support an MMU.” To learn more about INTEGRITY, please visit the Green Hills website, here:

yaSSL 2012 Annual Report

Business and Company Progress

• We doubled our customer base again this year and dramatically increased revenues, confirming the usefulness of our technology, our open source strategy, and our relevance in the emerging device security and BYOD markets.
• We have further penetrated key vertical markets, including home appliances, smart metering, sensors, M2M, gaming, VoIP, banking, and defense/military.   
• We expanded our partnerships with Synopsys, Freescale, Mentor Graphics, Intel, Microchip, ARM, Marvell, FreeRTOS, EBS Net, Cavium, and STMicroelectronicselectronics.
• We successfully participated in the following events:  CES, FOSDEM, Design West, OSCON, RSA, Black Hat, Game Developer Conference, Design East, Infosec UK, Intel Developer Forum, Intel Alliance Summit, and ARM TechCon.
• We increased the size of our team, and continue to hire top notch engineering talent.
• We continue to value and support the open source community through our free support offering for open source users.
• We released two new case studies surrounding M2M communication (Cinterion, CCww) and a new white paper with Intel about AES-NI.
• We gave presentations at FOSDEM 2012 (Technical Update), the Kerberos Consortium during RSA (Kerberos/GSS-API Android), DESIGN West (Nucleus Support), Infosecurity UK (What to look for in a SSL/TLS library), and the MySQL Meetup in Seattle (yaSSL in MySQL).
• yaSSL introduced a Japanese version of to better cater to our Japanese users and customers.
• We introduced a new three-tiered support program.

wolfSSL Technical Progress

• AES-GCM – Direct AES Galois Counter Mode support and cipher suites
• CRL – Certificate Revocation List processing with directory monitoring
• OCSP – Online Certificate Status Protocol support built in
• Lean PSK  – A low footprint, 24k, PSK TLSv1.2 build
• Reduced Memory use after handshake – Once the TLS handshake is complete, handshake resources are freed
• Lower stack memory use – Use of large static buffers eliminated
• Reliable DTLS, Cookies – DTLS cookies and full reliability now supported, no longer beta
• Unit/Suite Tests – Exposed unit API, hash, and cipher suite tests with valgrind support
• Static ECDH – Now supports several static ECDH cipher suites
• ECC client cert – Authentication with client ECC certificates now supported
• ECC released into open source – Now available on github and downloads
• SHA-384 – Direct use and cipher suites supported
• Subject AltName processing – AltNames easily retrieved from peer certificate for verification
• Sniffer SessionTicket support – Support for modern browsers using session tickets
• Command line example options – Example client and server now have several runtime options

wolfSSL Porting Progress

• FreeRTOS and FreeRTOS Windows Simulator
• SafeRTOS
• Freescale MQX/RTCS/MFS.  wolfSSL is now ported to MQX and has been tested on the Kinetis MCU.  Example CodeWarrior projects are now available in the wolfSSL download.
• Yocto/OpenEmbedded.  A new Yocto/OpenEmbedded layer is available for easy integration of wolfSSL into existing Yocto projects.
• Nucleus RTOS
• TinyOS.  Several CTaoCrypt algorithms have been ported to TinyOS

yaSSL Embedded Web Server Progress

• Release version 1.0 with bug fixes and feature enhancements
• SafeRTOS port


• MIT Java GSS-API for Android
• wolfSSL is now able to be used as a crypto provider for MIT Kerberos
• wolfSSL now supports ssmtp 2.64
• libscs now has support for wolfSSL

wolfSSL Lightweight SSL in 20 kB with Lean PSK

Are you interested in using the wolfSSL embedded SSL library in an extremely resource constrained environment? If so, you may be interested to hear that we have recently implemented a wolfSSL “Lean PSK” build which enables the wolfSSL library to be built with a footprint size of 20kB!

The “Lean PSK” build requires the use of pre-shared keys with wolfSSL, along with removing several additional features. If you are curious, or would like to learn more, please contact us at

CyaSSL Competitive Upgrade Program

One of the services that yaSSL provides is the CyaSSL Competitive Upgrade Program. With this program, yaSSL offers competitive upgrade pricing for those who wish move from an outdated, orphaned, or overpriced SSL library to the CyaSSL embedded SSL library with low cost and minimal disturbance to their code base.

Here’s an outline of the Competitive Upgrade Program:

  1. 1.You need to currently be using a commercial competitor to CyaSSL.

  2. 2.You will receive up to two weeks of on-site consulting to switch out your old SSL library with CyaSSL.  Travel expenses are not included.

  3. 3.Normally, two weeks is the right amount of time for us to make the replacement in your code and do initial testing.  Additional consulting on a replacement is available as needed.

  4. 4.You will receive the standard CyaSSL royalty free license to ship with your product.

The purpose of this program is to enable users who are currently spending too much on their embedded SSL implementation to move to CyaSSL with ease.  If you are interested in learning more, or interested in how CyaSSL compares to what you are currently using, then please contact us at

Posts navigation

1 2 3 147 148 149 150 151 152 153 173 174 175

Weekly updates