So, what’s new at wolfSSL? Take a look below to check out the most recent news.
Or sign up to receive weekly email notifications containing the latest news from wolfSSL.
In addition, wolfSSL now has a support-specific blog page dedicated to answering some of the more commonly received support questions.

wolfMQTT v1.3.0 Release

wolfMQTT v1.3.0 has been released (08/01/2019) and is available for download. With this release comes multithread support with the enable option --enable-mt, various fixes and improvements to examples, and more.

A full list of wolfMQTT 1.3.0 release notes are listed below:

  • Fix fwpush example to use filename option -f. (PR #117)
  • Added multiple thread support using --enable-mt or WOLFMQTT_MULTITHREAD. (PR #115)
  • Fix for MQTT_DATA_TYPE_BINARY data length encoded twice. (PR #112)
  • Fix to clear local structures for subscribe and unsubscribe ACK’s. (PR #112)
  • Fix for SN_Encode_Unsubscribe using wrong data type for topic name ID. (PR #110)
  • Add WOLFSSL_USER_SETTINGS to VS project files. (PR #109)
  • Fixes for using RTCS in mqttnet.c socket example code. (PR #108)
  • Fix MQTT-SN decode publish parsing and QoS2 response. (PR #107)
  • Make MqttSocket_TlsSocket callbacks public. (PR #104)
  • Improved the disconnect network error callback example. (PR #102)
  • Add MQTT context information to socket callback examples. (PR #101)
  • Initialize subscribe state to MQTT_MSG_BEGIN. (PR #99)
  • Fix for Harmony possible circular include issue. (PR #98)

You can download the latest release here:

wolfMQTT Product Page

For more information on wolfMQTT, contact us at


Author: Daniel Stenberg

Without much fanfare or fireworks we put together and shipped a fresh new version of tiny-curl. We call it version 0.10 and it is based on the 7.65.3 curl tree.

tiny-curl is a patch set to build curl as tiny as possible while still being able to perform HTTPS GET requests and maintaining the libcurl API. Additionally, tiny-curl is ported to FreeRTOS.

Changes in 0.10

  • The largest and primary change is that this version is based on curl 7.65.3, which brings more features and in particular more bug fixes compared to tiny-curl 0.9.
  • Parts of the patches used for tiny-curl 0.9 was subsequently upstreamed and merged into curl proper, making the tiny-curl 0.10 patch much smaller.


As before, tiny-curl is an effort that is on a separate track from the main curl. Download tiny-curl from!

wolfSSL at Microchip MASTERs 2019

wolfSSL will be attending and exhibiting at Microchip MASTERs 2019 this week! Come visit the wolfSSL in Phoenix from Tuesday, August 6th through Friday, August 9th to speak with one of our embedded security experts.

Where wolfSSL will be located for Microchip MASTERs 2019:

Venue: JW Marriot Desert Ridge Resort / Phoenix, AZ
When: August 6-9, 2019

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact

More information about Microchip MASTERs can be found here:

wolfSSL at Black Hat USA 2019

Come visit wolfSSL at Black Hat USA! wolfSSL will be exhibiting next week in Las Vegas at Mandalay Bay. Stop by our booth on August 7th & 8th to talk to one of our experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!

Where wolfSSL will be located for Black Hat USA:

Venue: Mandalay Bay / Las Vegas, NV
Booth #: 1347
When: August 3-8, 2019

Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!

For more information about wolfSSL, its products, or future events, please contact

More information about Black Hat USA 2019 can be found here:

wolfBoot v1.2 Now Available!

The wolfSSL wolfBoot Secure Bootloader version 1.2 is now available! With this release comes various improvements and updates, including additional hardware support. Below lists the release notes associated with version 1.2:

  Added support for multiple architectures
  key generation and signing tools rewritten in python for portability
  Added compile-time option to move flash-writing functions to RAM
  Introduced the possibility for the bootloader to update itself
  Fixed compile issues on macOS and WSL
  Hardware support

  •      Added RV32 RISC-V architecture
  •      Added hardware-assisted dual-bank support on STM32F76x/77x
  •      new HAL: RV32 FE310 (SiFive HiFive-1)
  •      new HAL: STM32L0
  •      new HAL: STM32G0
  •      new HAL: STM32F7
  •      new HAL: STM32WB

The latest version of wolfBoot is available for download here:

More information about boot loaders can be found here:

For more information on wolfBoot Secure Bootloader, please contact

wolfSSL with WSL (Windows Subsystem for Linux)

Microsoft has created a Linux subsystem that allows running Linux distributions on Windows 10. This blog describes the steps for building and running wolfSSL on WSL.

Installing WSL and Ubuntu 18.04:

  1. Open PowerShell as Administrator (right-click and choose “Run as Administrator”)
  2. Run the following commands:
    1. Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
    2. Invoke-WebRequest -Uri -OutFile Ubuntu.appx -UseBasicParsing
    3. Add-AppxPackage .\Ubuntu.appx
  3. Start -> Ubuntu 18.04 (should be at the top of the start menu)
  4. Installing, this may take a few minutes…
  5. Choose username and password
  6. Update Ubuntu:
    1. sudo apt update
    2. sudo apt upgrade

Building wolfSSL:

  1. Install prerequisites
    1. sudo apt-get install autoconf libtool make execstack
  2. git clone
  3. cd wolfssl
  4. ./
  5. ./configure
  6. make
  7. make check

Enabling Intel Speedups and Running Benchmarks:

  1. ./configure –enable-intelasm –enable-aesni –enable-sp –enable-sp-asm
  2. make
  3. WSL does not currently have support for the PROT_GROWSDOWN flag. Manually clear the executable stack flag in the library:
    1. execstack -c ./src/.libs/
  4. ./wolfcrypt/benchmark/benchmark

wolfTPM support for Xilinx Zynq and VxWorks

The wolfTPM library has now been tested on the Xilinx Zynq UltraScale with VxWorks. 

Testing was done using a Xilinx Zynq Pmod board with Infineon SLB9670 TPM 2.0 module. 

The TPM 2.0 module can be used for measured boot functionality and cryptographic security to extend the hardware root of trust enabled by Zynq and Zynq UltraScale+ devices.

The wolfTPM library and TPM 2.0 module can be accessed from VxWorks kernel mode and user space. 

More information on the Zynq Pmod module can be found here:

For questions please email us at

Vulnerability Disclosure: TLSv1.3 PSK extension parsing potential buffer overflow

Affected Users:

User of wolfSSL v4.0.0 are affected.

Summary of issue:

wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. The identity data field of the PSK extension of the packet contains data beyond the buffer length to be stored in the undefined memory (RAM) of the server. The size of the data is about 65 kB. Attackers could write about 65 kB of data to the RAM space on affected servers.


Users should upgrade to wolfSSL v4.1.0 


Additional details:

Patch for this vulnerability can be viewed here:

Please contact if you have any questions.

Related Items:

Vulnerability Disclosure: ECDSA signing operations and nonce size leaks

Settings that mitigate this vulnerability in affected versions (secp256r1 only, all other curves are affected):

  • –enable-sp
  • –enable-sp-asm
  • –enable-fpecc

Affected Users:

Users with long-term private ECC ECDSA keys performing ECDSA sign operations with the USE_FAST_MATH setting (–enable-fastmath).

Users who have disabled the default enabled timing resistance while also using fastmath (–disable-harden) or using normal math (–disable-fastmath) will continue to be susceptible to timing attacks including this vulnerability.


There is a potential leak of nonce sizes when performing ECDSA signing operations. The leak is considered to be difficult to exploit but it could potentially be used to recover private ECC keys in wolfSSL versions prior to release 4.1.0.


Users with long-term private ECC ECDSA keys, performing ECDSA signing operations with the fastmath library should:

  1.  update to wolfSSL version 4.1.0
  2. replace any long-term private ECC ECDSA keys.
  3. Not disable timing resistance


The research for this vulnerability is not yet publicly available, a public disclosure containing more details is currently scheduled for September 2nd 2019. CVE-2019-13628 has been reserved for when the public disclosure is made available.

Additional details:

More available upon public disclosure of research. The patch fixing this issue can be viewed at this link:

Please contact if you have any questions.

Related Items:


Differences between TLS 1.2 and TLS 1.3 (#TLS13)

wolfSSL's embedded SSL/TLS library has included support for TLS 1.3 since early releases of the TLS 1.3 draft. Since then, wolfSSL has remained up-to-date with the TLS 1.3 specification. In this post, the major upgrades of TLS 1.3 from TLS 1.2 are outlined below:

TLS 1.3

This protocol is defined in RFC 8446. TLS 1.3 contains improved security and speed. The major differences include:

  • The list of supported symmetric algorithms has been pruned of all legacy algorithms. The remaining algorithms all use Authenticated Encryption with Associated Data (AEAD) algorithms.
  • A zero-RTT (0-RTT) mode was added, saving a round-trip at connection setup for some application data at the cost of certain security properties.
  • Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
  • All handshake messages after the ServerHello are now encrypted.
  • Key derivation functions have been re-designed, with the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) being used as a primitive.
  • The handshake state machine has been restructured to be more consistent and remove superfluous messages.
  • ECC is now in the base spec  and includes new signature algorithms. Point format negotiation has been removed in favor of single point format for each curve.
  • Compression, custom DHE groups, and DSA have been removed, RSA padding now uses PSS.
  • TLS 1.2 version negotiation verification mechanism was deprecated in favor of a version list in an extension.
  • Session resumption with and without server-side state and the PSK-based ciphersuites of earlier versions of TLS have been replaced by a single new PSK exchange.

More information about wolfSSL and the TLS 1.3 protocol can be found here:

Additionally, please contact for any questions.

Posts navigation

1 2 3 4 5 6 7 8 9 101 102 103

Weekly updates


Latest Tweets