RECENT BLOG NEWS
Or sign up to receive weekly email notifications containing the latest news from wolfSSL.
In addition, wolfSSL now has a support-specific blog page dedicated to answering some of the more commonly received support questions.
wolfSSL has a command-line utility, it’s called wolfCLU. As promised, here’s a sneak peek of notable additions to wolfCLU that are coming soon:
- PKEY and certificate public key output
- Certificate request creation
- Updates to human readable text output of certificates
Download wolfCLU: https://github.com/wolfSSL/wolfssl-examples/tree/master/wolfCLU
Love it? Star us on GitHub!
In case you didn’t know, wolfSSL has a portable command line utility. You can download wolfCLU on Github today for use with the wolfSSL embedded SSL/TLS library! wolfCLU (Command Line Utility) is backed by the best-tested crypto using wolfCrypt and it can make use of FIPS builds with wolfSSL!
wolfCLU currently has the following features:
– Support for ED25519 sign and verify
– Autoconf for portability
– Encrypt a file and store it locally on your computer
– Decrypt that file after it has been encrypted, or send it via email to your friend, if he/she knows the password and algorithm used for encryption, they can then decrypt it on their computer
– Hash a single file (IE a zip archive) for verification
– Benchmark the currently configured Algorithms
– X509 parsing and print out
Download wolfCLU: https://github.com/wolfSSL/wolfssl-examples/tree/master/wolfCLU
Love it? Star us on GitHub!
We’re back! wolfSSL will be hosting a webinar on common libcurl mistakes next Thursday, June 17th, 2021. Hear from cURL author and maintainer Daniel Stenberg on the most common mistakes developers make when using libcurl, how to troubleshoot, and best practices for making your libcurl applications seamless and secure.
Common libcurl Mistakes presented by Daniel Stenberg
Thursday, June 17th, 2021 at 9AM Pacific time (GMT-8)
Register below for the upcoming live webinar from wolfSSL:
Webinar with Keyfactor: Navigating Vehicle and IoT Security
*This webinar is available on-demand.
Join us as we discuss how to use TLS/MQTT to ensure secure endpoint-to-cloud communication and learn how to secure endpoint communication with wolfSSL and MPLAB® Harmony Framework.
As always, we’re ready to tackle your questions with Security experts on-hand. In the meantime, write to us about your IoT projects at facts@wolfSSL.com!
wolfTPM is the only TPM 2.0 library designed for baremetal and embedded systems. It also has native Windows and Linux support, alongside a TPM simulator for rapid development and testing.
When it comes to choosing a TPM 2.0 dedicated chip for your project, there are multiple options: Nuvoton NPCT75x, STMicroelectronics ST33, Infineon SLB9670, Microchip ATTPM20P, etc.
Here are our highlights when using ST33 chip with wolfTPM:
- Only wolfTPM supports GPIO control for ST33
- Depending on the chip variant, a ST33 could offer up to four(4) extra GPIO
- The access to these GPIO is protected by the TPM 2.0 authorization
- Making the GPIO control offered by wolfTPM a great tool for signaling across subsystems for critical, important or security events
- wolfTPM also provides an open-source example code ready for use
- ST33 has the most Non-volatile memory storage on the market, right now
- Typically, TPM 2.0 NVRAM storage is limited, this makes ST33 stand out. Multiple certificates and keys can be stored in the ST33 non-volatile memory
- wolfTPM offers open-source examples on how to securely store secrets and keys in the TPM’s NVRAM
- Using ST33 for Automotive, Industrial, Medical and Aerospace devices with wolfTPM is easy
- Critical-safety systems often use state machines and RTOS
- Baremetal and RTOS do not provide driver for TPM 2.0
- Thanks to wolfTPM’s design, using ST33 without a driver is possible
- wolfTPM has its own internal TIS layer and direct support for I2C and SPI
- Using ST33 for IoT devices with wolfTPM is highly recommended, because our TPM 2.0 stack is lightweight. In comparison with other libraries, wolfTPM produces 20 times less code and 100 times less memory.
- Only ST33 supports AES symmetric operations for encryption and decryption by default, using TPM2_EncryptDecrypt2. Other TPM 2.0 modules support by default only AES CFB for parameter encryption.
Contact us at email@example.com if you want more information about wolfTPM or if you have any questions about using ST33 TPM 2.0 in embedded systems.
We’re actually going somewhere! Come see wolfSSL at MWC ’21 in Barcelona this month. This year’s event is hybridized, so you can join us online or in-person.
MWC ‘21: June 28th – July 1st, 2021 at Fira Barcelona Gran Via
Get a virtual pass: https://www.mwcbarcelona.com/attend/registration#tab-virtual-passes
Get a physical pass: https://www.mwcbarcelona.com/attend/registration#tab-physical-passes
Exhibition hours: 9am-7pm (M-W), 9am-4pm (Th)
wolfSSL will be at booth 1L12, with Business Directors Wolfram Kusterer and Martin Engstrom on the ground to answer all your embedded security questions. Plus, our full sales team will be on standby in the virtual booth to talk to you! Email facts@wolfSSL.com if you’d like to book a meeting ahead of the event.
If you’re new to wolfSSL, here’s how we can help you win big in mobile industry and beyond:
– wolfSSL is up to 20x smaller than OpenSSL
– First commercial implementation of TLS 1.3, with TLS 1.3 Sniffer
– First in FIPS 140-3
– Best tested, most secure, fastest crypto on the market with incomparable certifications and highly customizable modularity
– Access to 24×7 support from a real team of Engineers
– Support for the newest standards (including TLS 1.2, TLS 1.3, DTLS 1.2, and DTLS 1.3 forthcoming)
– Multi-platform, dual-licensed, royalty free, with an OpenSSL compatibility API to ease porting into existing applications which have previously used the OpenSSL package
– Full product suite including MQTT with support up to v5.0, Secure Boot, wolfSentry IDPS, SSHv2 server, TPM 2.0 portable project, Java wrappers and JSSE support, plus commercial curl support at the enterprise level.
To learn more, come meet us at MWC ’21 or email facts@wolfSSL.com.
wolfSSL is up and running and tested on Apple’s new M1 chip, and with the right options it is blazing fast! We have decided to benchmark our wolfCrypt/wolfSSL libraries on the Apple M1, to show you just how well the the M1 will perform in our standard cryptographic benchmarks.
See below for more details!
|GMAC Table 4-bit||349.384||347.843||1133.42||MB/s|
|RSA 2048 public||19270.458||19386.083||61480.153||ops/sec|
|RSA 2048 private||310.831||312.818||1855.512||ops/sec|
|DH 2048 agree||1032.402||1019.901||3984.282||ops/sec|
|ECDHE P-256 agree||1627.55||12351.73||22747.658||ops/sec|
|ECDSA P-256 sign||1570.605||9734.156||40588.639||ops/sec|
|ECDSA P-256 verify||2388.126||9321.698||22289.143||ops/sec|
|ECC P-256 key gen||1613.476||11507.204||64141.471||ops/sec|
|DH 2048 key gen||2042.726||2059.996||4098.742||ops/sec|
If you have questions on these benchmarks, or if you would like some support to help replicate them on your system, let us know at facts@wolfSSL.com or give us a call!
The i.MX RT1060 is a powerful crossover MCU implementation of the Arm Cortex-M7 core, designed and produced by NXP. This MCU contains a TRNG and a data co-processor (DCP). The latter is capable of performing AES encryption and decryption, as well as calculating SHA and SHA256 digest.
Starting from version 4.7.0, wolfSSL provides a port driver that can redirect all the AES and SHA/SHA256 operations to the DCP, which has a number of advantages over the software implementation counterparts, reducing the footprint of the compiled library, improving performance and using less power.
The DCP driver can be enabled via the compile-time flag WOLFSSL_IMXRT_DCP, which delegates all the AES and SHA/SHA256 operations to the hardware co-processor. When this option is enabled, all TLS connections using these algorithms will rely on the hardware to perform the operations.
wolfSSL can also use the TRNG present in this core as an entropy source to seed the DRBG. Support for TRNG on this board can be enabled by adding the compile-time flag FREESCALE_KSDK_2_0_TRNG.
WolfSSL is not the only component in the product family that directly benefits from the presence of these secure elements on this target platform. SSH servers and clients based on wolfSSH will automatically use the accelerators for both SHA and AES when available and compiled in. The port for i.MX-RT1060 of wolfBoot, our secure bootloader, uses the SHA256 hardware acceleration to speed up the verification of the integrity of the firmware image. A full port of wolfBoot for i.MX-RT1060 is available, and its hardware abstraction layer is distributed with wolfBoot since version 1.7.1.
i.MX-RT1060 is a popular choice as edge computing platform, often deployed in combination with a real-time operating system and TCP/IP connectivity. WolfSSL, wolfSSH, wolfBoot and wolfMQTT can be easily added to these scenarios to enable secure communication, secure remote shell and filesystem services, as well as secure boot and remote firmware updates. The extra hardware security provided by DCP and TRNG makes the i.MX-RT1060 a reliable platform to build professional grade security with the latest standards.
Ask us more information about solutions based on i.MX RT1060 and other embedded systems, contact us today at firstname.lastname@example.org.
Users can test the latest development master of wolfSSL with the latest version of strongSwan using the following setup:
wolfSSL Build and Installation Steps
$ git clone https://github.com/wolfSSL/wolfssl.git $ cd wolfssl $ ./autogen.sh $ ./configure --enable-opensslall --enable-keygen --enable-rsapss --enable-des3 --enable-dtls --enable-certgen --enable-certreq --enable-certext --enable-sessioncerts --enable-crl --enable-ocsp CFLAGS="-DWOLFSSL_DES_ECB -DWOLFSSL_LOG_PRINTF -DWOLFSSL_PUBLIC_MP -DHAVE_EX_DATA" $ make $ make check $ sudo make install
strongSwan Build and Installation Steps
# if the following packages are not already installed: $ sudo apt-get install flex bison byacc libsoup2.4-dev gperf $ git clone https://github.com/strongswan/strongswan.git $ cd strongswan $ ./autogen.sh # if packages are missing autogen.sh must be re-run $ ./configure --disable-defaults --enable-pki --enable-wolfssl --enable-pem $ make $ make check $ sudo make install
wolfSSL has had interest in enabling FIPS 140-2/140-3 support with strongSwan so our engineers verified everything is working with the wolfCrypt FIPS 140-2 validated Module!
The steps wolfSSL used for testing are as follows:
Testing was done using the wolfSSL commercial FIPS release v4.7.0 which internally uses the wolfCrypt v4.0.0 FIPS 140-2 validated Crypto Module. It was located in the
/home/user-name/Downloads directory on the target test system, Linux 4.15 Ubuntu 18.04 LTS running on Intel(R) Xeon(R) CPU E3-1270 v6 @ 3.80GHz.
- wolfSSL was configured and installed with these settings:
./configure --enable-opensslall --enable-keygen --enable-rsapss --enable-des3 --enable-dtls --enable-certgen --enable-certreq --enable-certext --enable-sessioncerts --enable-crl --enable-ocsp CFLAGS="-DWOLFSSL_DES_ECB -DWOLFSSL_LOG_PRINTF -DWOLFSSL_PUBLIC_MP -DHAVE_EX_DATA -DFP_MAX_BITS=8192" --enable-ed25519 --enable-curve25519 --enable-fips=v2 --enable-intelasm --prefix=$(pwd)/../fips-install-dir make make install
- A custom install location was used which equated to
/home/user-name/Downloads/fips-install-dirand the configuration for strongSwan accounted for this.
- strongSwan was cloned to
git clone https://github.com/strongswan/strongswan.git”
- StongSwan was configured and installed with these settings:
./configure --disable-defaults --enable-pki --enable-wolfssl --enable-pem --prefix=$(pwd)/../strongswan-install-dir wolfssl_CFLAGS="-I$(pwd)/../fips-install-dir/include" wolfssl_LIBS="-L$(pwd)/../fips-install-dir/lib -lwolfssl" make make install make check
- In the make check stage of the test, it was observed that 1 test was failing.
Passed 34 of 35 'libstrongswan' suites FAIL: libstrongswan_tests ================== 1 of 1 test failed ==================
- Reviewing the logs it was apparent one of the RSA tests was failing.
- Upon further debugging it turned out the failure was a test in strongSwan that was attempting to create an RSA key size of 1536-bits.
Running case 'generate': DEBUG: key_sizes[_i] set to 1024 + PASS DEBUG: key_sizes[_i] set to 1536 - FAIL DEBUG: key_sizes[_i] set to 2048 + PASS DEBUG: key_sizes[_i] set to 3072 + PASS DEBUG: key_sizes[_i] set to 4096 + PASS
wolfSSL has a function
RsaSizeCheck() which in FIPS mode will specifically reject any non FIPS RSA key sizes so this failure was not only expected, but it is a good thing for those wanting to use strongSwan in FIPS mode and ensure only FIPS-validated RSA key sizes will be supported!
wolfSSL is pleased that with the latest release of wolfSSL v4.7.0 and the wolfCrypt FIPS 140-2 module validated on FIPS certificate 3389, strongSwan support is working splendidly and wolfSSL engineers will be making efforts to ensure continued support into the future!
If you have any questions about wolfSSL, wolfCrypt FIPS, or strongSwan and wolfSSL together please contact our support staff anytime at email@example.com or via our Zendesk portal by registering and opening a support incident at wolfssl.zendesk.com.
At wolfSSL, we have been developing a TPM stack with customers for many years called wolfTPM, a portable, open-source TPM 2.0 stack with backward API compatibility, designed for embedded use. It is highly portable, and has native support for Linux and Windows. RTOS and bare metal environments can take advantage of a single IO callback for SPI hardware interface, no external dependencies, and compact code size with low resource usage.
wolfTPM offers API wrappers to help with complex TPM operations like attestation and examples to help with complex cryptographic processes like the generation of Certificate Signing Request (CSR) using a TPM.
Due to wolfTPM’s portability, it is generally very easy to compile on new platforms.
Here are a few reasons to use wolfTPM over other secure elements:
1) It is based on a widely accepted standard TCG TPM 2.0.
2) There are many chip vendors options and they are pin compatible.
3) Support for RSA. All TPM’s support at least RSA 2048 (the STSAFE and ATECC do not).
4) More NV storage
5) Measured Boot (PCR’s)
6) Advanced Policy management
7) Seal/unseal data based on private key or PCR state.
Contact us at firstname.lastname@example.org with any TPM, crypto questions!
Love it? Star wolfSSL on GitHub.
- July 2021 (20)
- June 2021 (19)
- May 2021 (12)
- April 2021 (12)
- March 2021 (27)
- February 2021 (29)
- January 2021 (22)
- December 2020 (21)
- November 2020 (14)
- October 2020 (7)
- September 2020 (22)
- August 2020 (11)
- July 2020 (8)
- June 2020 (14)
- May 2020 (15)
- April 2020 (14)
- March 2020 (4)
- February 2020 (24)
- January 2020 (18)
- December 2019 (7)
- November 2019 (16)
- October 2019 (14)
- September 2019 (24)
- August 2019 (21)
- July 2019 (8)
- June 2019 (13)
- May 2019 (35)
- April 2019 (31)
- March 2019 (20)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (10)
- October 2018 (18)
- September 2018 (18)
- August 2018 (8)
- July 2018 (15)
- June 2018 (29)
- May 2018 (15)
- April 2018 (11)
- March 2018 (19)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (7)
- September 2017 (8)
- August 2017 (6)
- July 2017 (11)
- June 2017 (8)
- May 2017 (10)
- April 2017 (5)
- March 2017 (7)
- February 2017 (1)
- January 2017 (8)
- December 2016 (3)
- November 2016 (2)
- October 2016 (18)
- September 2016 (8)
- August 2016 (5)
- July 2016 (4)
- June 2016 (10)
- May 2016 (4)
- April 2016 (5)
- March 2016 (4)
- February 2016 (12)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (6)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (13)
- January 2015 (6)
- December 2014 (7)
- November 2014 (3)
- October 2014 (2)
- September 2014 (11)
- August 2014 (6)
- July 2014 (9)
- June 2014 (11)
- May 2014 (11)
- April 2014 (9)
- March 2014 (3)
- February 2014 (3)
- January 2014 (5)
- December 2013 (9)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (8)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (9)
- December 2012 (13)
- November 2012 (5)
- October 2012 (7)
- September 2012 (4)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (5)
- April 2012 (7)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (6)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (8)
- May 2011 (12)
- April 2011 (4)
- March 2011 (12)
- February 2011 (8)
- January 2011 (13)
- December 2010 (17)
- November 2010 (12)
- October 2010 (14)
- September 2010 (11)
- August 2010 (20)
- July 2010 (14)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)