RECENT BLOG NEWS

Remote firmware updates for embedded systems

Firmware updates are one of the most important factors to take into account very early in the process of  starting the development of any IoT project. When the software is maintained by a development team, anything that goes wrong can be fixed on the field and new features can be deployed quickly, as long as remote updates are efficient, reliable and trusted.

Products can be pushed into production earlier, offering the possibility for a different strategy that involves remote updates when new features are ready, or when defects on the current version have been fixed. For this reason, it is in general a good idea to include a firmware update mechanism since the very early phases of  your product or platform definition.

Microcontroller-based systems are quite challenging when it comes to firmware updates. On one hand, modern microcontrollers provide a wide range of features, a large choice of embedded operating systems, significantly reduced engineering costs for products based on a simpler design and the ability of running in ultra low-power environment, some even relying solely on energy-harvesting devices. On the other hand, embedded systems cannot relocate executable code at run-time. Even if a system is capable of multi-threading, threads are almost always defined at compile time, assigned a fixed stack space, and all the code is often linked together into a single executable firmware image.

Using a monolithic image makes impossible to update single components on the system without changing the layout of the code stored in flash. A bootloader can be helpful in this case.

MCU bootloaders

A classic approach for updating the firmware of a running embedded system is by using a bootloader.

Chip manufacturers often provide very simple pre-installed bootloaders, that can be used to update the partition images on a running system. A very common strategy adopted by these bootloaders is to provide a “DFU mode” as an alternative boot stage to choose, where DFU is the acronym for “device firmware update”. This mechanism often allows to update all the software stored on the target flash, using local devices such as UARTs or the DFU-USB device class specification. Pre-installed bootloaders may result helpful during the development of a few prototypes to speed up the life-cycle, or when the number of targets and their geographical location allows for manually-activated updates.

Connected devices however have a different range of challenges to deal with. Updates must be fail-safe  in order to prevent the node from being unreachable after a software failure. Security considerations arise whenever the firmware is transmitted using a public network, or over-the-air, about the authenticity and the integrity of firmware update images. How do IoT projects deal with this? Building your own bootloader may seem viable, but it may become as time and resource consuming as maintaining the firmware itself, and definitely does not help cutting down your time to market.

wolfBoot

wolfBoot is an open source secure bootloader for all microcontrollers, designed to support remote firmware updates in embedded systems. It currently supports ARM Cortex-M and RISC-V architectures, and can be integrated in embedded systems using by partitioning of the non-volatile memory available on board.

Thanks to its in-place swapping mechanism, any memory support can be used by the application to store the firmware updates. The updates are then verified and authenticated by wolfBoot after the system reboots. A copy of the old firmware, overwritten only by a validated update, is temporarily stored into the update space to provide a fall-back mechanism in case of boot failures due to a defective firmware release. The image must in fact be confirmed after a valid update.

Continue reading “Remote firmware updates for embedded systems with wolfBoot”

FIPS 140-3 has been approved, and wolfCrypt will be FIPS 140-3 validated!

On March 22, 2019 Federal Information Processing Standard (FIPS) 140-3 was approved by the Secretary of Commerce. FIPS 140-3 is an incremental advancement of FIPS 140-2, which now standardizes on the ISO 19790:2012 and ISO 24759:2017 specifications. Historically, ISO 19790 was based on FIPS 140-2, but has continued to advance since that time. FIPS 140-3 will now point back to ISO 19790 for security requirements. Keeping FIPS 140-3 as a separate standard will still allow NIST to mandate additional requirements on top of what the ISO standard contains when needed.

wolfSSL currently maintains two FIPS 140-2 certificates for the wolfCrypt Cryptographic Module: #2425 and #3389. Certificate #3389 includes algorithm support required for TLS 1.3 and can be used in conjunction with the wolfSSL embedded SSL/TLS library for full TLS 1.3 client and server support. wolfSSL intends to continue to serve our customers by taking wolfCrypt through the FIPS 140-3 validation process.

More information about wolfCrypt’s most recent FIPS 140-2 certificate (#3389) can be found here. wolfSSL also recently announced the availability of wolfSSL “FIPS Ready” releases!  To download the wolfSSL FIPS Ready release today and learn more about this exciting release, take a look at our FIPS Ready blog post.

If you are interested in a FIPS 140-3 validated version of wolfCrypt, or would like to learn how wolfSSL can help meet your FIPS requirements contact us today at fips@wolfssl.com!

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg) 

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

For more information regarding wolfSSL, wolfCrypt, cURL, support packages, or any additional questions, please contact facts@wolfssl.com.

As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until December 2020. The version of OpenSSL that supports FIPS goes into End Of Life and is no longer supported in December of 2019.

This means that OpenSSL users will not have a supported package for over a year. This is a big issue for companies that rely on security.

To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:

1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,

2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,

3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

Contact us at facts@wolfssl.com if you would like to learn more!

We love you.

Team wolfSSL

Are you looking for a DTLS 1.3 implementation? If so, wolfSSL can provide you a highly robust security solution for datagram transport based off the TLS 1.3 protocol. wolfSSL is excited to announce it will be adding support for DTLS 1.3. To learn more about wolfSSL and DTLS, TLS 1.3, or for more information on how wolfSSL can provide a security solution for your project, contact us at facts@wolfssl.com.

wolfSSL now provides support for complete RTCA DO-178C level A certification! wolfSSL will offer DO-178 wolfCrypt as a commercial off -the-shelf (COTS) solution for connected avionics applications. Adherence to DO-178C level A will be supported through the first wolfCrypt COTS DO-178C certification kit release that includes traceable artifacts for the following encryption algorithms:

• SHA-256 for message digest
• AES for encryption and decryption
• RSA to sign and verify a message.
• Chacha20_poly1305 for authenticated encryption and decryption.

The primary goal of this initial release is to provide the proper cryptographic underpinnings for secure boot and secure firmware update in commercial and military avionics. wolfSSL brings trusted, military-grade security to connected commercial and military aircraft. Avionics developers now have a flexible, compact, economical, high-performance COTS solution for quickly delivering FIPS 140-2 validated crypto algorithms can be used in DO-178 mode for combined FIPS 140-2/DO-178 consumption. The wolfCrypt cryptography library FIPS 140-2 validation certificates can be applied to DO-178 uses. 

Optimization Support

We understand that securely rebooting avionic systems has rigorous performance requirements. As such, we’re here to help with cryptographic performance optimizations through our services organization. 

To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.

wolfSSL DO-178 product page: https://www.wolfssl.com/wolfssl-support-178-dal/.

For more information, please contact facts@wolfssl.com.

As many people know, cURL is very popular in automotive systems.  cURL is used in infotainment, ADAS, entry and control systems.

Because many cURL users in automotive are interested in conforming to the MISRA C standard, wolfSSL is developing a version of cURL that conforms to MISRA and consumes our MISRA conformant cryptography.

If you are interested in a MISRA based cURL implementation, built under ASPICE, the please contact us at facts@wolfssl.com.

We love you.

We have added in support for the open source project WebRTC (https://webrtc.org/) in wolfSSL release 4.2.0. This is a project that allows real time communication (RTC) with IoT, mobile and web browsers. Many additional API where added to the wolfSSL compatibility layer in order to plug wolfSSL into WebRTC instead of BoringSSL.

Below lists some of the additional API added to the wolfSSL compatibility layer for WebRTC support:

• SSL_CIPHER_get_id
• SSL_CIPHER_get_rfc_name
• SSL_get_cipher_by_value
• X509_print_ex
• X509_NAME_add_entry_by_NID
• X509_time_adj
• X509_time_adj_ex
• DTLSv1_get_timeout
• DTLSv1_handle_timeout
• DTLSv1_set_initial_timeout_duration
• SSL_CTX_set_current_time_cb
• PEM_write_bio_RSA_PUBKEY
• PEM_read_bio_RSA_PUBKEY
• PEM_write_bio_PUBKEY
• EVP_PKEY_missing_parameters
• EVP_PKEY_cmp
• BN_is_negative
• BIO_set_retry_write

Notable advantages of choosing to build WebRTC with wolfSSL are evident through wolfSSL’s superior security implementations, including support for FIPS, PKCS#11, hardware encryption, TLSv1.3, and more. Additionally, 24×7 support and consulting services are available to help build your wolfSSL + WebRTC project.

The pull request with the latest updates for WebRTC can be found here: https://github.com/wolfSSL/wolfssl/pull/2585.
Upstream changes for WebRTC that include wolfSSL support can be found here: https://webrtc-review.googlesource.com/c/src/+/159760.

For questions about the use of wolfSSL with WebRTC, 24×7 support, or for any additional questions contact us at facts@wolfssl.com.

The wolfSSL embedded SSL/TLS library provides support for various open source projects, including Nginx. For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository.  The configure option --enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

For more information on wolfSSL + Nginx, TLS 1.3, OCSP, FIPS, or for any additional questions, contact facts@wolfssl.com.