RECENT BLOG NEWS
Or sign up to receive weekly email notifications containing the latest news from wolfSSL.
In addition, wolfSSL now has a support-specific blog page dedicated to answering some of the more commonly received support questions.
In the latest wolfSSL releases, we have added 200+ new API to our OpenSSL compatibility layer. Many of these new API were added for providing support for Apache HTTP Server. We are excited to announce that as of version 4.2.0, wolfSSL now provides support for the Apache web server with the enable option
--enable-apachehttpd. This means you can now build Apache with the latest, most robust security provided by the wolfSSL SSL/TLS and wolfCrypt libraries.
If you are interested in building Apache httpd with wolfSSL, please contact us at email@example.com for a version of Apache that is compatible.
For comparison between wolfSSL and OpenSSL, visit https://www.wolfssl.com/docs/wolfssl-openssl/.
From the early days of the wolfSSL library, we have provided example clients and servers with wolfSSL. These examples have showed how easy it is to use wolfSSL in various configurations. We also use them to help test the library. Over the years we’ve added new features available with TLS to our examples, and our examples have grown a little complicated.
Enter the wolfSSL Examples GitHub repository. We tasked some of our interns, with little to no experience with the wolfSSL library, to write some example clients and servers that set up and test various types of connections. They give you a bare-bones simple demonstration on how to set up a client or server using wolfSSL. We also have examples showing off how to use some features of the library like the certificate manager. Check them out! As always, if you have questions or suggestions, please reach out at firstname.lastname@example.org.
To help out with customers who want to update the wolfSSL library without needing to change their application, wolfSSL Inc is striving to maintain application binary compatibility with a subset of our API. As of wolfSSL v4.3.0, the following functions will be compatible across all releases of wolfSSL moving forward:
We have added some testing to our already extensive testing plan to verify these functions do not change.
Given that the security landscape is an always changing surface, we want to make sure you are able to upgrade wolfSSL as easily as possible. There will always be some new attack on the protocol or a cipher and keeping wolfSSL up to date in your product is important to us, and for everyone. If you have questions about wolfSSL’s ABI compatibility, please email us at email@example.com.
The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release wolfSSL 4.3.0, we have updated the support for the open source project WebRTC to branch m79 (https://webrtc.org/). This is a project that allows real time communication (RTC) with IoT, mobile and web browsers. Many additional API where added to the wolfSSL compatibility layer in order to plug wolfSSL into WebRTC instead of BoringSSL.
Notable advantages of choosing to build WebRTC with wolfSSL are evident through wolfSSL’s superior security implementations, including support for FIPS, PKCS#11, hardware encryption, TLSv1.3, and more. Additionally, 24×7 support and consulting services are available to help build your wolfSSL + WebRTC project.
The pull request with the latest updates for WebRTC can be found here:
Upstream changes for WebRTC that include wolfSSL support can be found here:
Download and learn more about wolfSSL 4.3.0 here:
For questions about the use of wolfSSL with WebRTC, 24×7 support, or for any additional questions contact us at firstname.lastname@example.org.
With each release of the wolfSSL embedded SSL/TLS library, new improvements and feature additions are always included. The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release wolfSSL 4.3.0, we are happy to say we have improved our support for Nginx. wolfSSL has updated support for Nginx 1.15.1 and added support for Nginx 1.16.1.
For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.
Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository. The configure option –enable-nginx will compile the wolfSSL libraries with Nginx support.
For more information on wolfSSL + Nginx, TLS 1.3, OCSP, FIPS, or for any additional questions, contact email@example.com.
As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until mid 2021. The version of OpenSSL that supports FIPS is now in End Of Life and is no longer supported.
This means that OpenSSL users will not have a supported FIPS Object Module for over a year. This is a big issue for companies that rely on security! If there is a bug in the FIPS Object Module, you will need to fix it and revalidate on your own.
To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:
- OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,
- The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,
- You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.
Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.
Finally, we will be submitting our FIPS 140-3 module to NIST in September 2020, which is the earliest available date for submissions.
Contact us at firstname.lastname@example.org if you would like to learn more!
We love you.
Benchmark values of the wolfSSL embedded SSL/TLS library running on Xilinx boards, including the ZCU102, have been collected and are up for viewing. Our friends over at Xilinx have a white paper posted that goes into detail about the benchmark values here: https://www.xilinx.com/support/documentation/white_papers/wp512-accel-crypto.pdf. This shows how much faster applications can perform secure operations when incorporating the hardware acceleration available on Xilinx devices. It also gives a demonstration of the performance trade-offs when choosing FreeRTOS versus an embedded Linux OS.
For questions about building wolfSSL to use hardware acceleration or other general inquiries about wolfSSL, please contact us at email@example.com.
wolfSSL's embedded SSL/TLS library has included support for TLS 1.3 since early releases of the TLS 1.3 draft. Since then, wolfSSL has remained up-to-date with the TLS 1.3 specification. In this post, the major upgrades of TLS 1.3 from TLS 1.2 are outlined below:
This protocol is defined in RFC 8446. TLS 1.3 contains improved security and speed. The major differences include:
- The list of supported symmetric algorithms has been pruned of all legacy algorithms. The remaining algorithms all use Authenticated Encryption with Associated Data (AEAD) algorithms.
- A zero-RTT (0-RTT) mode was added, saving a round-trip at connection setup for some application data at the cost of certain security properties.
- Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
- All handshake messages after the ServerHello are now encrypted.
- Key derivation functions have been re-designed, with the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) being used as a primitive.
- The handshake state machine has been restructured to be more consistent and remove superfluous messages.
- ECC is now in the base spec and includes new signature algorithms. Point format negotiation has been removed in favor of single point format for each curve.
- Compression, custom DHE groups, and DSA have been removed, RSA padding now uses PSS.
- TLS 1.2 version negotiation verification mechanism was deprecated in favor of a version list in an extension.
- Session resumption with and without server-side state and the PSK-based ciphersuites of earlier versions of TLS have been replaced by a single new PSK exchange.
More information about wolfSSL and the TLS 1.3 protocol can be found here: https://www.wolfssl.com/docs/tls13/.
Additionally, please contact firstname.lastname@example.org for any questions.
wolfSSL now provides support for complete RTCA DO-178C level A certification! wolfSSL will offer DO-178 wolfCrypt as a commercial off -the-shelf (COTS) solution for connected avionics applications. Adherence to DO-178C level A will be supported through the first wolfCrypt COTS DO-178C certification kit release that includes traceable artifacts for the following encryption algorithms:
- SHA-256 for message digest
- AES for encryption and decryption
- RSA to sign and verify a message.
- Chacha20_poly1305 for authenticated encryption and decryption.
The primary goal of this initial release is to provide the proper cryptographic underpinnings for secure boot and secure firmware update in commercial and military avionics. wolfSSL brings trusted, military-grade security to connected commercial and military aircraft. Avionics developers now have a flexible, compact, economical, high-performance COTS solution for quickly delivering FIPS 140-2 validated crypto algorithms can be used in DO-178 mode for combined FIPS 140-2/DO-178 consumption. The wolfCrypt cryptography library FIPS 140-2 validation certificates can be applied to DO-178 uses.
We understand that securely rebooting avionic systems has rigorous performance requirements. As such, we’re here to help with cryptographic performance optimizations through our services organization.
To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.
wolfSSL DO-178 product page: https://www.wolfssl.com/wolfssl-support-178-dal/.
For more information, please contact email@example.com.
wolfSSL FIPS Ready
Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).
FIPS Ready with curl
(modified from Daniel Stenberg)
The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:
2. Unzip the source code somewhere suitable:
$ cd $HOME/src $ unzip wolfssl-4.1.0-gplv3-fips-ready.zip $ cd wolfssl-4.1.0-gplv3-fips-ready
3. Build the fips-ready wolfSSL and install it somewhere suitable:
$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all $ make -sj $ make install
4. Download curl, the normal curl package.
5. Unzip the source code somewhere suitable:
$ cd $HOME/src $ unzip curl-7.66.0.zip $ cd curl-7.66.0
6. Build curl with the just recently built and installed FIPS ready wolfSSL version:
$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl $ make -sj
7. Now, verify that your new build matches your expectations by:
$ ./src/curl -V
It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!
wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.
For more information regarding wolfSSL, wolfCrypt, cURL, support packages, or any additional questions, please contact firstname.lastname@example.org.
- January 2020 (17)
- December 2019 (9)
- November 2019 (16)
- October 2019 (14)
- September 2019 (24)
- August 2019 (21)
- July 2019 (8)
- June 2019 (13)
- May 2019 (35)
- April 2019 (32)
- March 2019 (20)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (11)
- October 2018 (18)
- September 2018 (18)
- August 2018 (8)
- July 2018 (15)
- June 2018 (29)
- May 2018 (15)
- April 2018 (11)
- March 2018 (19)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (7)
- September 2017 (8)
- August 2017 (6)
- July 2017 (11)
- June 2017 (8)
- May 2017 (10)
- April 2017 (5)
- March 2017 (7)
- February 2017 (1)
- January 2017 (8)
- December 2016 (3)
- November 2016 (2)
- October 2016 (18)
- September 2016 (8)
- August 2016 (5)
- July 2016 (4)
- June 2016 (11)
- May 2016 (4)
- April 2016 (5)
- March 2016 (4)
- February 2016 (12)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (6)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (13)
- January 2015 (6)
- December 2014 (7)
- November 2014 (3)
- October 2014 (2)
- September 2014 (11)
- August 2014 (6)
- July 2014 (9)
- June 2014 (11)
- May 2014 (11)
- April 2014 (9)
- March 2014 (3)
- February 2014 (3)
- January 2014 (5)
- December 2013 (9)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (8)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (9)
- December 2012 (13)
- November 2012 (5)
- October 2012 (7)
- September 2012 (4)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (6)
- April 2012 (7)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (6)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (8)
- May 2011 (12)
- April 2011 (4)
- March 2011 (12)
- February 2011 (9)
- January 2011 (13)
- December 2010 (17)
- November 2010 (12)
- October 2010 (14)
- September 2010 (11)
- August 2010 (20)
- July 2010 (14)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)