RECENT BLOG NEWS

So, what’s new at wolfSSL? Take a look below to check out the most recent news, or sign up to receive weekly email notifications containing the latest news from wolfSSL. wolfSSL also has a support-specific blog page dedicated to answering some of the more commonly received support questions.

Everything cURL: Your Comprehensive Guide

Get ready to delve into the latest edition of Everything cURL. Daniel Stenberg, the driving force behind cURL, has meticulously crafted the most recent release.

In this comprehensive update of Everything cURL, he’ll take you on an exciting journey through the vast landscape of cURL. Discover not just the technical knowledge but also delve into the origin stories that make this tool a favorite among developers globally.

Everything cURL equips you with a collection of tools, mastering cURL command lines, options, and functionalities at a master level. Whether you seek guidance on crafting HTTP requests or wish to master cURL scripting for automation, this edition covers it all.

It’s your sign to step into the world of cURL. Explore the pages of Everything cURL and uncover the key elements necessary to elevate your development journey with this recent update.

Are you ready to embrace the future of cURL?

Dive into Everything cURL today to kickstart your journey into the world of advanced cURL commands, API usage, and more.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Protecting wolfSSH from Passive SSH Key Compromise

About the Compromise

Recently, a team led by Keegan Ryan from UCSD discovered that several implementations of the SSH protocol have been potentially leaking information about their keys and they came up with a way of exploiting it.

Every now and then, an RSA signature is made with a combination of padding and data that doesn’t verify correctly. If one saves billions of SSH signatures they can analyze the broken signatures and work out some keys.

The team released a paper [1] describing the issue and how it can be analyzed to obtain keys.

The wolfSSH Vulnerability

While wolfSSL verifies an RSA signature after producing it, and erroring out if it doesn’t verify, wolfSSH does not do this process. The compromise has not been proven against wolfSSH, the assumption is that it is possible. wolfSSH did not verify the RSA signatures after generation.

The Fix

As of wolfSSH v1.4.15, just released, we have added the verify step for RSA signatures. Luckily the time to verify an RSA signature is short compared to signing so there shouldn’t be a noticeable slowdown during the key exchange process.

References

  1. Keegan Ryan, Kaiwen He, George Arnold Sullivan, and Nadia Heninger. 2023. Passive SSH Key Compromise via Lattices. Cryptology ePrint Archive, Report 2023/1711. https://eprint.iacr.org/2023/1711.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL Using an fTPM with Xilinx FPGA Microblaze

Have you ever needed a TPM but only had an FPGA available, or needed a TPM for a project and had additional requirements that are not supported by current hardware available? wolfSSL is working on the use of a fTPM (Firmware Trusted Platform Module) running on a Xilinx FPGA Microblaze that is also capable of being used with measured boot. This is unique, in that it can benefit from the additional redundancy that naturally comes with running code on an FPGA while leveraging an existing piece of the hardware on many Xilinx boards rather than requiring additional hardware be added. Use of the fTPM for measured boot will improve sanity checks on the integrity of the boot up process by doing TPM 2.0 PCR extend operations on the initial ROM, FSBL, and partitions loaded.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Espressif RISC-V Hardware Accelerated Cryptographic Functions Up to 1000% Faster than Software

We at wolfSSL continue to embrace the IoT market and congratulate all of the Espressif staff and partners on reaching the 1 Billion Device milestone in 2023. All of those devices need serious, commercial grade security with up to 7×24 support. We are here to help you do that! Of course, wolfSSL software cryptography works on any embedded device, but we’ve also added additional hardware acceleration support to Espressif SoC devices.

Recently our wolfSSL library has been upgraded to support the cryptographic hardware acceleration capabilities on Espressif ESP32 RISC-V SoC boards, specifically the ESP32-C2, ESP32-C3 and the ESP32-C6. The feature set is parity with our ESP32 and ESP32-S2/ESP32-S3 hardware acceleration capabilities which includes SHA (hash), RSA (big number math), and AES encryption. Additional new acceleration hardware capabilities specific to the newer Espressif chipsets are actively in development.

Although we are very proud of our software implementation, no programmatic algorithm can beat the brute strength of hardware acceleration. See below for some of the benchmark performance characteristics. The difference can be up to 10 times faster than equivalent software algorithms.

For instance: The ESP32-C6 has SHA acceleration implemented in hardware for SHA, SHA-224 and SHA-256, all of which are commonly used in TLS hashes. Here’s a comparison of the differences in performance for the ESP32C6:

Taller bars represent more data hashed per second: KiB/s

Note the Espressif GitHub Issue #10423 for the latest ESP32-C6 support status. Silicon version 0.0 was used for testing and benchmarks noted above. Actual production values may differ.

See also our recent blogs:

Additional information on getting Started with wolfSSL on the Espressif environment is available on the wolfSSL GitHub repository as well as a webinar recording, Getting Started with wolfSSL on the Espressif ESP32.

Try it yourself

If you’d like to see the benchmarks on your own device, ensure you have the ESP-IDF installed and follow these steps:

cd [your workspace directory]

# Clone wolfSSL into a local directory
git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl/IDE/Espressif/ESP-IDF/examples/wolfssl_benchmark

# Set your directory for ESP-IDF, shown here for VisualDGB and WSL
WRK_IDF_PATH=/mnt/c/SysGCC/esp32/esp-idf/v5.1

# Run your ESP-IDF export.sh
. ${WRK_IDF_PATH}/export.sh
# or
. $HOME/esp/esp-idf/export.sh

# Set project target SoC
idf.py set-target esp32c3

# optionally erase your device (substitute /dev/ttyS36 with your port)
idf.py erase-flash -p /dev/ttyS36 -b 115200

# Build and flash the app onto your SoC (substitute /dev/ttyS36)
idf.py build flash -p /dev/ttyS36 -b 115200 monitor -b 115200

Benchmark metrics for the ESP32-C6, Hardware Encryption Enabled:

Chip is ESP32-C6 (revision v0.0), Crystal is 40MHz, cpu freq: 160000000 Hz (160MHz)

------------------------------------------------------------------------------
wolfSSL version 5.6.4
------------------------------------------------------------------------------
wolfCrypt Benchmark (block bytes 1024, min 1.0 sec each)
RNG                       1375 KiB took 1.005 seconds
AES-128-CBC-enc           4450 KiB took 1.004 seconds
AES-128-CBC-dec           4325 KiB took 1.004 seconds
AES-192-CBC-enc           1450 KiB took 1.014 seconds
AES-192-CBC-dec           1425 KiB took 1.010 seconds
AES-256-CBC-enc           4425 KiB took 1.001 seconds
AES-256-CBC-dec           4300 KiB took 1.001 seconds
AES-128-GCM-enc            450 KiB took 1.044 seconds
AES-128-GCM-dec            450 KiB took 1.044 seconds
AES-192-GCM-enc            425 KiB took 1.002 seconds
AES-192-GCM-dec            425 KiB took 1.002 seconds
AES-256-GCM-enc            425 KiB took 1.004 seconds
AES-256-GCM-dec            425 KiB took 1.005 seconds
GMAC Default               602 KiB took 1.000 seconds
3DES                       400 KiB took 1.051 seconds
MD5                      10775 KiB took 1.000 seconds
SHA                      12675 KiB took 1.000 seconds
SHA-224                  12625 KiB took 1.001 seconds
SHA-256                  12625 KiB took 1.001 seconds
SHA-384                   1275 KiB took 1.003 seconds
SHA-512                   1275 KiB took 1.003 seconds
SHA-512/224               1275 KiB took 1.003 seconds
SHA-512/256               1275 KiB took 1.003 seconds
SHA3-224                   925 KiB took 1.005 seconds
SHA3-256                   875 KiB took 1.008 seconds
SHA3-384                   675 KiB took 1.010 seconds
SHA3-512                   475 KiB took 1.019 seconds
SHAKE128                  1075 KiB took 1.009 seconds
SHAKE256                   875 KiB took 1.008 seconds
RIPEMD                    4325 KiB took 1.001 seconds
HMAC-MD5                 10650 KiB took 1.001 seconds
HMAC-SHA                 12475 KiB took 1.001 seconds
HMAC-SHA224              12425 KiB took 1.001 seconds
HMAC-SHA256              12425 KiB took 1.001 seconds
HMAC-SHA384               1275 KiB took 1.019 seconds
HMAC-SHA512               1275 KiB took 1.019 seconds
PBKDF2                       1 KiB took 1.005 seconds
RSA     1024  key gen         1 ops took 1.262 sec, avg 1262.000 ms
RSA     2048  key gen         1 ops took 1.680 sec, avg 1680.000 ms
RSA     2048   public         6 ops took 1.415 sec, avg 235.833 ms
RSA     2048  private         2 ops took 1.040 sec, avg 520.000 ms
ECC   [      SECP256R1]   256  key gen         4 ops took 1.290 sec, avg 322.500 ms
ECDHE [      SECP256R1]   256    agree         4 ops took 1.280 sec, avg 320.000 ms
ECDSA [      SECP256R1]   256     sign         4 ops took 1.296 sec, avg 324.000 ms
ECDSA [      SECP256R1]   256   verify         2 ops took 1.240 sec, avg 620.000 ms
CURVE  25519  key gen         4 ops took 1.276 sec, avg 319.000 ms
CURVE  25519    agree         4 ops took 1.275 sec, avg 318.750 ms
ED     25519  key gen        88 ops took 1.008 sec, avg 11.455 ms
ED     25519     sign        78 ops took 1.022 sec, avg 13.103 ms
ED     25519   verify        52 ops took 1.009 sec, avg 19.404 ms

Benchmark complete

Benchmark metrics for the ESP32-C6, Hardware Encryption Disabled:

Chip is ESP32-C6 (revision v0.0), Crystal is 40MHz, cpu freq: 160000000 Hz (160MHz)

------------------------------------------------------------------------------
wolfSSL version 5.6.4
------------------------------------------------------------------------------
wolfCrypt Benchmark (block bytes 1024, min 1.0 sec each)
RNG                        600 KiB took 1.023 seconds
AES-128-CBC-enc           1725 KiB took 1.004 seconds
AES-128-CBC-dec           1700 KiB took 1.010 seconds
AES-192-CBC-enc           1500 KiB took 1.014 seconds
AES-192-CBC-dec           1475 KiB took 1.013 seconds
AES-256-CBC-enc           1325 KiB took 1.017 seconds
AES-256-CBC-dec           1300 KiB took 1.012 seconds
AES-128-GCM-enc            475 KiB took 1.041 seconds
AES-128-GCM-dec            475 KiB took 1.042 seconds
AES-192-GCM-enc            450 KiB took 1.030 seconds
AES-192-GCM-dec            450 KiB took 1.030 seconds
AES-256-GCM-enc            425 KiB took 1.012 seconds
AES-256-GCM-dec            425 KiB took 1.012 seconds
GMAC Default               621 KiB took 1.000 seconds
3DES                       400 KiB took 1.051 seconds
MD5                      10750 KiB took 1.000 seconds
SHA                       5525 KiB took 1.002 seconds
SHA-224                   1450 KiB took 1.002 seconds
SHA-256                   1450 KiB took 1.001 seconds
SHA-384                   1275 KiB took 1.004 seconds
SHA-512                   1275 KiB took 1.003 seconds
SHA-512/224               1275 KiB took 1.003 seconds
SHA-512/256               1275 KiB took 1.003 seconds
SHA3-224                   925 KiB took 1.006 seconds
SHA3-256                   875 KiB took 1.008 seconds
SHA3-384                   675 KiB took 1.011 seconds
SHA3-512                   475 KiB took 1.019 seconds
SHAKE128                  1075 KiB took 1.009 seconds
SHAKE256                   875 KiB took 1.008 seconds
RIPEMD                    4325 KiB took 1.000 seconds
HMAC-MD5                 10650 KiB took 1.002 seconds
HMAC-SHA                  5475 KiB took 1.002 seconds
HMAC-SHA224               1450 KiB took 1.010 seconds
HMAC-SHA256               1450 KiB took 1.010 seconds
HMAC-SHA384               1275 KiB took 1.019 seconds
HMAC-SHA512               1275 KiB took 1.018 seconds
PBKDF2                       0 KiB took 1.075 seconds
RSA     1024  key gen         1 ops took 7.733 sec, avg 7733.000 ms
RSA     2048  key gen         1 ops took 28.050 sec, avg 28050.000 ms
RSA     2048   public        58 ops took 1.028 sec, avg 17.724 ms
RSA     2048  private         2 ops took 7.051 sec, avg 3525.500 ms
ECC   [      SECP256R1]   256  key gen         4 ops took 1.231 sec, avg 307.750 ms
ECDHE [      SECP256R1]   256    agree         4 ops took 1.225 sec, avg 306.250 ms
ECDSA [      SECP256R1]   256     sign         4 ops took 1.241 sec, avg 310.250 ms
ECDSA [      SECP256R1]   256   verify         2 ops took 1.178 sec, avg 589.000 ms
CURVE  25519  key gen         4 ops took 1.277 sec, avg 319.250 ms, 3.132 ops/sec
CURVE  25519    agree         4 ops took 1.276 sec, avg 319.000 ms, 3.135 ops/sec
ED     25519  key gen        87 ops took 1.001 sec, avg 11.506 ms, 86.913 ops/sec
ED     25519     sign        78 ops took 1.018 sec, avg 13.051 ms, 76.621 ops/sec
ED     25519   verify        52 ops took 1.023 sec, avg 19.673 ms, 50.831 ops/sec
Benchmark complete

Find out more

If you have any feedback, questions, or require support, please don’t hesitate to reach out to us via facts@wolfSSL.com, call us at +1 425 245 8247, or open an issue on GitHub.

Download wolfSSL Now

wolfMQTT: support for curl easy socket backend

Do you have a need for using MQTT with an http proxy? Users of libcurl know that they can leverage wolfSSL to provide TLS for their applications, and thus enjoy the advantages of both libcurl for data transport and handling http proxies, and wolfSSL for transport security. In this vein, we’ve created a new network layer interface for wolfMQTT that uses libcurl’s easy interface as an optional backend. When enabled, wolfMQTT will use the libcurl easy API (such as curl_easy_send) for the socket backend, while libcurl in turn will use wolfSSL to negotiate TLS. Currently both TLS and mTLS are supported.

You can find our newly added curl easy socket example in examples/mqttnet.c. To try it out, simply build wolfMQTT with –enable-curl. The only prerequisites for this are that wolfSSL has been built with –enable-curl, and curl built with –enable-wolfssl. Supported options with wolfMQTT’s –enable-curl include multithreading (–enable-mt), nonblocking (–enable-nonblock), and as previously mentioned TLS.

If you’re curious for more details, you can look at our updated readme and pull request.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Getting Started with wolfSSL in 2024

Welcome to our exclusive webinar, ‘Getting Started with wolfSSL in 2024’. Join us for an insightful session presented by Chris Conlon, wolfSSL Engineering Manager. Scheduled for January 4th at 9 am PT, this webinar is your gateway to mastering wolfSSL, the ultimate Embedded SSL/TLS Library for IoT device security, advanced encryption algorithms and much more.

wolfSSL has earned a reputation for high-quality, portable, and embedded security software, securing over 2 billion applications and devices.

Save the date: January 4th at 9am PT

Chris will delve into a wide array of topics:

  • Overview of TLS 1.3
  • wolfSSL package structure
  • Building wolfSSL
  • wolfCrypt Test and Benchmark Applications
  • wolfSSL basic API usage
  • Tips on debugging
    And much more

This is your chance to grasp the essential details of utilizing wolfSSL, learning its fundamentals, and discovering the best practices for leveraging wolfSSL throughout 2024.

Register today while seats are available.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

How to make your TPM talk PKCS11

wolfSSL has implemented our own PKCS11 provider library to leverage cryptographic hardware and keystores on various systems. Recently we added support for using a TPM 2.0 module with wolfTPM (see pull request #23). We believe that this functionality is particularly useful for users that have coded to the PKCS11 standard, but need to switch to a TPM or fTPM.

The wolfTPM and wolfPKCS11 libraries are both fully portable to any RTOS or embedded system, including bare-metal. The PKCS11 interface provides a standardized API set for making cryptographic calls to a hardware module. All TPM’s support RSA and ECC keys, so when using a TPM only those two asymmetric algorithms are supported.

Our example PKCS11 applications can run on any Linux or Windows that have a TPM available. If a TPM is not available you can use the TPM simulators (see SWTPM.md). We have also successfully ported it to a bare-metal STM32 target for testing.

A TPM offers physical protection of all private keys and benefits from the TPM performance when doing asymmetric operations like signing, verification or shared secrets. All communication to the TPM uses the parameter encryption feature with AES CFB mode.

If desired the PKCS11 keystore can use the TPM NV for storing the encrypted key material.

Typical implementation including TLS support:

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfMQTT Releases v1.18.0

The Christmas release of wolfMQTT, v1.18.0, is now available! This release has several bug fixes and optimizations including:

Release 1.18.0 has been developed according to wolfSSL’s development and QA process (see link below) and successfully passed the quality criteria.
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance

Check out the changelog from the download for a full list of features and fixes, or contact us at facts@wolfssl.com with any questions: https://github.com/wolfSSL/wolfMQTT/blob/master/ChangeLog.md

While you’re there, show us some love and give the wolfMQTT project a Star!

Download the latest release or clone directly from our GitHub repository today.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSH 1.4.15 Now Available!

Merry Christmas! The Christmas release of wolfSSH is here, version 1.4.15!

Version 1.4.15 brings with it a fix for a vulnerability, bug fixes, new features, and some enhancements as well! For a description of vulnerabilities fixed, please see our vulnerability page. New features in this release include a wolfSSH client application, support for OpenSSH-style keys, and Zephyr RTOS builds.

We also have a nice round of enhancements which range from better testing, improved portability, terminal enhancements (run vim or tmux!), and more!

A list of new features and enhancements from our ChangeLog is listed below. For a full list of fixes see our complete ChangeLog on GitHub.

Vulnerability Fix

  • Fixes a potential vulnerability described in the paper “Passive SSH Key Compromise via Lattices”. While the misbehavior described hasn’t been observed in wolfSSH, the fix is now implemented. The RSA signature is verified before sending to the peer.

    • Keegan Ryan, Kaiwen He, George Arnold Sullivan, and Nadia Heninger. 2023. Passive SSH Key Compromise via Lattices. Cryptology ePrint Archive, Report 2023/1711. https://eprint.iacr.org/2023/1711.

New Features

  • Added wolfSSH client application.
  • Added support for OpenSSH-style private keys, like those made by ssh-keygen.
  • Added support for the Zephyr RTOS.
  • Added support for multiple authentication schemes in the userauth callback with the error response WOLFSSH_USERAUTH_PARTIAL_SUCCESS.

Improvements

  • Allow override of default sshd user name at build.
  • Do not attempt to copy device files. The client won’t ask, and the server won’t do it.
  • Added more wolfSSHd tests.
  • Portability updates.
  • Terminal updates for shell connections to wolfSSHd, including window size updates.
  • QNX support updates.
  • Windows file support updates for SFTP and SCP.
  • Allow for longer command strings in wolfSSHd.
  • Tweaked some select timeouts in the echoserver.
  • Add some type size checks to configure.
  • Update for changes in wolfSSL’s threading wrappers.
  • Updates for Espressif support and testing.
  • Speed improvements for SFTP. (Fixed unnecessary waiting.)
  • Windows wolfSSHd improvements.
  • The functions wolfSSH_ReadKey_file() and wolfSSH_ReadKey_buffer() handle more encodings.
  • Add function to supply new protocol ID string.
  • Support larger RSA keys.
  • MinGW support updates.
  • Update file use W-macro wrappers with a filesystem parameter.
  • Fixes

    • When setting the file permissions for a file in Zephyr, use the correct permission constants.
    • Fix buffer issue in DoReceive() on some edge failure conditions.
    • Prevent wolfSSHd zombie processes.
    • Fixed a few references to the heap variable for user supplied memory allocation functions.
    • Fixed an index update when verifying the server’s RSA signature during KEX.
    • Fixed some of the guards around optional code.
    • Fixed some would-block cases when using non-blocking sockets in the examples.
    • Fixed some compile issues with liboqs.
    • Fix for interop issue with OpenSSH when using AES-CTR.

    Visit our download page or wolfSSH GitHub repository to download the release bundle, and feel free to email us at facts@wolfSSL.com or support@wolfssl.com, or call us at +1 425 245 8247 with any questions about the wolfSSH embedded SSH library or other products.

    Download wolfSSL Now

    Live Webinar: Getting Started with wolfSSL in 2024

    Welcome to our exclusive webinar, ‘Getting Started with wolfSSL in 2024’. Join us for an insightful session presented by Chris Conlon, wolfSSL Engineering Manager. Scheduled for January 4th at 9 am PT, this webinar is your gateway to mastering wolfSSL, the ultimate Embedded SSL/TLS Library for IoT device security, advanced encryption algorithms and much more.

    wolfSSL has earned a reputation for high-quality, portable, and embedded security software, securing over 2 billion applications and devices.

    Save the date: January 4th at 9am PT

    Chris will delve into a wide array of topics:

    • Overview of TLS 1.3
    • wolfSSL package structure
    • Building wolfSSL
    • wolfCrypt Test and Benchmark Applications
    • wolfSSL basic API usage
    • Tips on debugging
      And much more

    This is your chance to grasp the essential details of utilizing wolfSSL, learning its fundamentals, and discovering the best practices for leveraging wolfSSL throughout 2024.

    Register today while seats are available.

    If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

    Download wolfSSL Now

    Posts navigation

    1 2 3 4 5 6 7 8 9 185 186 187

    Weekly updates

    Archives