RECENT BLOG NEWS
Or sign up to receive weekly email notifications containing the latest news from wolfSSL.
In addition, wolfSSL now has a support-specific blog page dedicated to answering some of the more commonly received support questions.
2013 was an interesting year in the world of cryptography and computer security. We have seen and mitigated against attacks such as Lucky13 and watched with interest as existing technologies such as Dual_EC_DRBG have become widely regarded as insecure. wolfSSL has been happy to provide our users with timely fixes, suggestions, and new technologies to react to the changing application and communication security landscape.
wolfSSL has made significant progress in 2013 as a business and through technical advancements. As one of the key goals of wolfSSL is to be open source and transparent, highlights of our business, technical, and partner progress throughout the past year are outlined below.
Business and Company Progress
1. Successfully participated in the following events: CES 2013, RSA USA 2013, DESIGN West 2013, Interop 2013, Black Hat 2013, Microchip Masters, and ARM TechCon 2013 – giving a technical presentation on securing embedded devices at the later.
2. Completed a company name change from yaSSL to wolfSSL, better reflecting our company and culture. To us the wolf represents us well as it is a creature that communicates effectively, works well in groups, and shares with the pack.
3. Added more developers to the team, allowing us to help secure more projects, add new features, and work with partners and open source community members with higher efficiency.
4. Increased activity in onsite consulting to help customers design and validate their security architectures.
5. Experienced a dramatic increase in design wins for wolfCrypt.
6. Doubled our customer base.
7. Continued to support the open source community.
8. Added several new resale, technology, and co-marketing partnerships.
9. Launched our Kickstart consulting service package, making it easier for customers to seamlessly get CyaSSL up and running in their environment.
10. Began the FIPS validation process with CTaoCrypt / wolfCrypt
CyaSSL Technical Progress
A total of four CyaSSL releases were delivered in 2013, each with bug fixes, enhancements, and new feature additions. Highlights of these releases included:
1. A timely fix for the Lucky13 attack
2. SHA-3 finalist BLAKE2b support (a fast and low resource use hash algorithm)
3. AES-CCM-8 crypto and cipher suites
4. Ability for AES-GCM and AES-CCM to leverage Intel AES-NI
5. Camellia crypto and cipher suites
6. DTLS 1.2 support, including AEAD ciphers
7. DTLS reliability enhancements, IPv6 fixes
8. SHA-384 cipher suites
9. Persistent session and CA cache functionality
10. User atomic record layer processing callbacks
11. Public key callbacks for ECC and RSA
12. HMAC now supports SHA-512
13. New supported TLS Extensions including SNI, SEP, Maximum Fragment Length, Truncated HMAC
14. Ability to unload certs/keys for lower memory use
15. The separation of wolfCrypt from CyaSSL, giving users the ability to use wolfCrypt as a standalone cryptography engine
16. Enhanced examples, including the ability to track memory usage and better IPv6 support
17. Updated CTaoCrypt benchmark app for easier use on embedded systems
18. Updated XCode project files
19. More flexible ./configure options for enabling and disabling features
20. Bug fixes and enhancements in SSL sniffer functionality
21. Enhanced OCSP support with bug fixes and the addition of callbacks
22. Addition of the LeanPSK build option for a small 20kB build
23. Updated and expanded API documentation
24. Release of wolfSSL JNI 1.0, giving Java users a pre-built JNI wrapper around the CyaSSL lightweight SSL library
CyaSSL Porting Progress
1. Release of the CyaSSL Porting Guide
2. Support for Microchip PIC32MX and PIC32MZ and the new MPLAB Harmony development environment
3. Support for version 6 of Microchip’s TCP/IP stack
4. Cavium NITROX support
5. HP/UX support
6. STM32F2 support with hardware crypto and RNG
7. KEIL MDK-ARM and MDK5 project files complete with new CyaSSL software pack for MDK5
8. Better ThreadX support and the addition of NetX I/O callback handlers
9. Freescale Kinetis RNGB support
10. Freescale Kinetis mmCAU support
11. One of our favorite projects, Gearman, now supports CyaSSL
In summary, we had a great year! 2013 was successful for us on multiple fronts, and we look forward to serving our customers and community with ever more secure and functional software in 2014! As always, your feedback is welcome at email@example.com!
Hi! Someone told us the other day that Software Defined Networking (SDN) is stupid. No way will SDN ever replace the high end networking gear, we were told.
We were reminded of a scientific study that proved unequivocally that babies are stupid, courtesy of The Onion. But of course babies grow, and eventually have much greater capabilities, much like SDN will.
We are watching the development of Software Defined Networking (SDN) with a keen eye at wolfSSL. We already have some users and customers in SDN, and we expect more. What is more exciting is that the SDN code bases are fresh and new, and the developers of these new SDN switches are released from the legacy decisions that were made 20+ years ago, allowing for a new world of new capabilities. SDN is networking’s fresh start! Here’s to what babies can become!
wolfSSL will be presenting a session titled “Technologies and Techniques for Securing Connected Devices” at the upcoming 2014 Embedded World Conference in Nürnberg, Germany. If you are going to be attending the conference, we welcome you to come and listen to our presentation.
Technologies and Techniques for Securing Connected Devices
Time: 11:30am – 12:00pm
Speaker: Chris Conlon
Connected and smart devices, in conjunction with smart applications, are continually enabling exciting possibilities for the future. As we rely on these systems more frequently in our everyday lives, it is becoming a necessity for them to be designed and implemented with good security practices in mind.
New attacks and vulnerabilities are in the news and media on a daily basis, and as such, it is important that engineers, developers, and managers understand how to be protect applications and devices from such attacks. Security is a broad and often complex field, which can be confusing, overwhelming, and time consuming.
This presentation will introduce several security technologies and techniques for securing smart and connected devices, systems, and applications – giving attendees a good starting place and better understanding for developing secure connected devices for today and into the future. Technologies and techniques covered in this presentation will include a discussion about preventing man-in-the-middle attacks with SSL/TLS, optimizing SSL for resource-limited devices, current industry standards for device security, code signing and secure firmware updates, using hardware cryptography on devices, random number generation, and key generation and storage.
Hi! We received our Google Glass a few weeks ago. It is a fun new toy for our team!
After getting through the standard process of playing with them and getting familiar with the tools, we have decided to embark on the coding. We will port and verify a number of items on Glass, including wolfSSL lightweight TLS, wolfCrypt, and MIT Kerberos. Should be fun! Let us know if you have an interest in our wolfCrypt cryptography library running on Glass, as it will be the first of our tools that we bring to the environment.
If you have questions for us about running any of our projects on Google Glass, then don`t hesitate to email us at firstname.lastname@example.org, or simply call at +1 425 245 8247.
Are you interested on using the GSS-API with Kerberos on Android? If so, you’ll be happy to hear about wolfSSL’s port of the MIT GSS-API library to Android platform – complete with an org.ietf.jgss (RFC 5653) compatible application programming interface, CyaSSL cryptography integration, and NDK sample application.
You may have read our previous blog entries about porting the MIT Kerberos libraries and CyaSSL embedded SSL library to the Android platform (see link in Reference section, below). With this post, we wanted to take a moment to describe current availability of the Kerberos and GSS-API libraries on Android through the native NDK framework and the Java GSS-API wrapper.
1. Java GSS-API Wrapper
The addition of a Java wrapper around the native MIT GSS-API took part in two stages – a SWIG-generated (http://www.swig.org/) Java interface, which then in turn was used as a building block for a org.ietf.jgss Java API. The individual layers are visualized in the figure below. Both the SWIG layer and the Java GSS-API layer are able to be used in a Java application to access the underlying MIT Kerberos/GSS-API libraries. The SWIG layer is more tedious to use and less standardized than the Java GSS-API layer, but is closer to the C programming API of the native MIT GSS-API. We suggest that Java developers use the org.ietf.jgss Java interface over using the SWIG layer directly. As the org.ietf.jgss interface follows RFC 5653, Java developers should be able to refer to the standard Java documentation for the org.ietf.jgss package for usage instructions and class descriptions.
Source code for this project has been released under the open source MIT license, and is currently available for download on GitHub. Both the Java Generic Security Services API wrappers (SWIG and Java GSS-API), as well as example client and server applications and build instructions are located in the kerberos-java-gssapi package, at the following GitHub URL:
2. Enhanced Example Code
Included in the Java GSS-API package, we have created several example applications to help developers understand how to use this project in their own application. There are two sets of client and server examples provided. The first one is a set of client and server applications which directly use the SWIG-generated Java interface. The second set of applications is a client and server that use the more standardized Java GSS-API interface (org.ietf.jgss).
It is recommended for Java developers to use the Java GSS-API examples, as they demonstrate programming and API usage which is more common in the Java programming language. Before running any of the included examples, the development machine must first have a krb5.conf file and KDC set up correctly to match the principal names used in the examples. For more details about building and running these example applications, please see the README included in the kerberos-java-gssapi package.
3. Sample NDK Application
As one of the main goals of this project was to bring MIT Kerberos/GSS-API support to the Android platform, we have created a sample Android NDK application to serve as an example and reference to Android developers. This sample application provides a GUI wrapper around the MIT Kerberos kinit, klist, kvno, and kdestroy applications. It also provides a sample client using the Java GSS-API interface to connect and communicate with the example server application (from Section 2, above).
This package contains cross-compiled version of the MIT Kerberos libraries, and includes instructions on how to re-compile the Kerberos libraries yourself for the Android platform. For details on how to build and run this example application in the Android emulator, please see the README file located in the NDK application package.
All sources for this sample application are located in the kerberos-android-ndk package, located at the following URL:
wolfSSL looks forward to seeing what kinds of applications will use this functionality. If you have any questions, comments, or feedback, we would enjoy to hear it! Please contact us directly at email@example.com.
MIT Kerberos: http://web.mit.edu/kerberos/
Initial announcement: http://yassl.com/yaSSL/Blog/Entries/2011/11/15_Android_Kerberos_Port_using_CyaSSL_Embedded_SSL.html
It was reported yesterday in The Guardian and elsewhere that the NSA paid RSA $10M to set Dual_EC_DRBG as their default PRNG. See the news here: http://www.theguardian.com/world/2013/dec/20/nsa-internet-security-rsa-secret-10m-encryption.
As we have previously stated, we never implemented Dual_EC_DRBG in any of our products, much less set it as default, because of its suspect nature. If you`re not familiar with Dual_EC_DRBG, the background on wikipedia is here: http://en.wikipedia.org/wiki/Dual_EC_DRBG.
For even more background, here`s a great Black Hat talk by Derek Soeder, Christopher Abad, and Gabriel Acevedo from Cylance on the subject of breaking Pseudorandom Algorithms.
wolfSSL, as a long standing partner to ARM, has always been well optimized for ARM environments. One of the ways CyaSSL can be optimized for ARM platforms includes assembly optimizations for Public Key operations with the CTaoCrypt fastmath option. This translates to a speed increase when using RSA, Diffie-Hellman, DSA, or ECC.
If you dive into our code, these optimizations can be found in the asm.c source file.
When using the ./configure system, fastmath is enabled by default on 64-bit platforms. On 32-bit platforms, it can be enabled by using the “–enable-fastmath” option. In environments not using the ./configure system to build CyaSSL, fastmath can be enabled by defining USE_FAST_MATH. Since stack usage can be high when using fastmath, we recommend defining TFM_TIMING_RESISTANT as well.
If you have any questions about using CyaSSL in an ARM environment, please contact us at firstname.lastname@example.org.
We`ve been encouraged by the feedback from the community on dropping SSL 3.0 support from wolfSSL, meaning that people think we should drop it as insecure and eliminate the legacy which goes back to 1996. Many thanks to Paul Kocher, Phil Karlton, Alan Freier, and the many shoulders they were standing on for designing the SSL 3.0 protocol, but after 17 years, it is time to evolve to a TLS only world.
Practically speaking, this means that we`ll deprecate SSL 3.0 code from our tree, and only apply critical security fixes. We will of course support existing customers and open source users that need SSL 3.0 for specific reasons that are private to them.
It might be fun to think about a name for our Q1 release of wolfSSL without SSL support. Here`s some ideas: SSL Minus, SSL Minas Tirith, CaTLS defend Minas Tirith. It can go on for a while. See http://en.wikipedia.org/wiki/Minas_Tirith for reference. Oh, here`s another idea, how about wolfTLS?
Send in your ideas for the new name to email@example.com.
Hi! We`re considering the elimination of SSL 3.0 support from wolfSSL. There`s a lot of reasons to do it, including better security, cleaning up our code, and its time to move on and modernize. Anybody have an opinion? The code would still be available, but not mainline.
- September 2020 (19)
- August 2020 (11)
- July 2020 (8)
- June 2020 (14)
- May 2020 (15)
- April 2020 (14)
- March 2020 (4)
- February 2020 (24)
- January 2020 (18)
- December 2019 (7)
- November 2019 (16)
- October 2019 (14)
- September 2019 (24)
- August 2019 (21)
- July 2019 (8)
- June 2019 (13)
- May 2019 (35)
- April 2019 (31)
- March 2019 (20)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (11)
- October 2018 (18)
- September 2018 (18)
- August 2018 (8)
- July 2018 (15)
- June 2018 (29)
- May 2018 (15)
- April 2018 (11)
- March 2018 (19)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (7)
- September 2017 (8)
- August 2017 (6)
- July 2017 (11)
- June 2017 (8)
- May 2017 (10)
- April 2017 (5)
- March 2017 (7)
- February 2017 (1)
- January 2017 (8)
- December 2016 (3)
- November 2016 (2)
- October 2016 (18)
- September 2016 (8)
- August 2016 (5)
- July 2016 (4)
- June 2016 (10)
- May 2016 (4)
- April 2016 (5)
- March 2016 (4)
- February 2016 (12)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (6)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (13)
- January 2015 (6)
- December 2014 (7)
- November 2014 (3)
- October 2014 (2)
- September 2014 (11)
- August 2014 (6)
- July 2014 (9)
- June 2014 (11)
- May 2014 (11)
- April 2014 (9)
- March 2014 (3)
- February 2014 (3)
- January 2014 (5)
- December 2013 (9)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (8)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (9)
- December 2012 (13)
- November 2012 (5)
- October 2012 (7)
- September 2012 (4)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (5)
- April 2012 (7)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (6)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (8)
- May 2011 (12)
- April 2011 (4)
- March 2011 (12)
- February 2011 (8)
- January 2011 (13)
- December 2010 (17)
- November 2010 (12)
- October 2010 (14)
- September 2010 (11)
- August 2010 (20)
- July 2010 (14)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)