RECENT BLOG NEWS
wolfSSL FIPS Ready and curl (#wolfSSL #wolfCrypt #curl)
wolfSSL FIPS Ready
Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).
FIPS Ready with curl
(modified from Daniel Stenberg)
The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:
1. Download wolfSSL fips ready
2. Unzip the source code somewhere suitable:
$ cd $HOME/src $ unzip wolfssl-4.1.0-gplv3-fips-ready.zip $ cd wolfssl-4.1.0-gplv3-fips-ready
3. Build the fips-ready wolfSSL and install it somewhere suitable:
$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all $ make -sj $ make install
4. Download curl, the normal curl package.
5. Unzip the source code somewhere suitable:
$ cd $HOME/src $ unzip curl-7.66.0.zip $ cd curl-7.66.0
6. Build curl with the just recently built and installed FIPS ready wolfSSL version:
$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl $ make -sj
7. Now, verify that your new build matches your expectations by:
$ ./src/curl -V
It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!
wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.
For more information regarding wolfSSL, wolfCrypt, cURL, support packages, or any additional questions, please contact facts@wolfssl.com.
wolfSSL Visual Studio Projects for the Microsoft Azure Sphere MT3620 IoT MCU
Azure Sphere is Microsoft’s innovative ecosystem centered around IoT device security. The ecosystem includes the MT3620 IoT MCU, the Azure Sphere OS that runs on the MT3620, and a security service that brokers device-to-cloud communications.
The MT3620 has an Arm Cortex-A7 application processor, two real-time Arm Cortex-M4F I/O subsystems and a dedicated Wi-Fi subsystem. This combination allows for a diverse and flexible range of IoT use cases. What really makes the MT3620 stand out is the Microsoft Pluton security subsystem and other security related features. Pluton on the MT3620 is made up of an Arm Cortex-M4F core that is isolated from end-user accessible cores. It allows for secure boot and secure system operation. Other MT3620 security features are authentication, attestation, and over-the-air software updates.
Creating an application for the MT3620 is done with the Azure Sphere SDK Preview for Visual Studio. wolfSSL has recently released a Visual Studio solution that contains three projects for the MT3620. The three projects are a TLS encrypted client, TLS encrypted server and a cryptographic algorithm test for the wolfCrypt library.
Getting Started
- Purchase an Azure Sphere MT3620 development board.
- Setup your MT3620 device with Azure Sphere Documentation.
- Download or clone wolfSSL.
- Follow the Set Up Steps in the README.
For more information, please contact facts@wolfssl.com.
Read more about Azure Sphere.
wolfSSL with curl and tiny-curl (#curl)
wolfSSL’s embedded SSL/TLS library comes with support for many tools and libraries, one of which is curl! In addition to providing support and maintenance for curl, wolfSSL has also integrated the curl library in conjunction with Daniel Stenberg (an original author of curl and one of the founders). With this integration, wolfSSL now provides support and consulting for the curl library.
In addition, a modified version of the curl library, tiny-curl, is also available through wolfSSL. tiny-curl is a patch applied on top of curl to reduce its code size, which makes it favorable for embedded and real-time environments. Version 0.10 of tiny-curl is based on curl version 7.65.3, and is available for download from the wolfSSL download page: https://www.wolfssl.com/download/.
More information about wolfSSL and curl can be found on the curl product page: https://www.wolfssl.com/products/curl/. Details on wolfSSL support for curl and tiny-curl is also located on the support page here: https://www.wolfssl.com/products/support-packages/.
wolfSSL also provides support for the latest versions of the TLS protocol, including TLS 1.3! As such, wolfSSL is considering adding TLS 1.3 support to cURL in the future. More information about wolfSSL and TLS 1.3 can be found here: https://www.wolfssl.com/docs/tls13/.
For more information regarding wolfSSL, TLS 1.3, cURL, support packages, or any additional questions, please contact facts@wolfssl.com.
wolfSSL Security Internship Info Session and MSU Fall Career Fair
In preparation for the 2019 Fall Career Fair at MSU Bozeman, wolfSSL will be holding an info session this upcoming Thursday at Montana State University in Bozeman, MT for students interested in learning more about wolfSSL and our internship program. The session will introduce wolfSSL as a company – including background information, product lineup, work environment, and more.
We encourage any students who are interested in Internet security, SSL/TLS, cryptography, embedded security, or software development to attend! Pizza will be served.
wolfSSL Info Session
Thursday, September 26, 2019
Montana State University, Bozeman
5-6pm, Roberts Hall 210
We look forward to seeing you there! Feel free to contact chris@wolfssl.com with any questions or for more information. To learn more about the wolfSSL lightweight SSL/TLS library, visit our product page, or download the Open Source version today!
wolfSSL at ST Technology Tour – Vancouver
Come visit wolfSSL at ST Technology Tour Vancouver this year! ST Technology Tour hosts presentations, hands-on training and demos by industry experts in markets poised for rapid growth in the coming years. This event is free to attend and geared towards design engineers, purchasing decision makers, project managers, developers, technology package designers and students. Visit our booth on September 24th to speak with one of our embedded security experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!
Where wolfSSL will be located for ST Technology Tour – Vancouver:
Venue: Vancouver Marriott Pinnacle Downtown Hotel / Vancouver, BC
When: September 24th, 2019
Venue Information: https://www.st.com/content/st_com/en/campaigns/technology-tour-2019/vancouver.html
Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!
For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.
More information about ST Technology Tours can be found here: https://www.st.com/content/st_com/en/campaigns/technology-tour-2019.html
wolfSSL at Federal Identity Forum 2019 (#FedID)
Come visit wolfSSL at Federal Identify Forum! wolfSSL will be in Tampa, FL next week exhibiting at Federal Identity Forum. Visit our booth from September 24th-26th to speak with one of our embedded security experts on TLS 1.3, embedded security, embedded TLS/SSL, MQTT, SSH, curl + tiny-curl, and more!
Where wolfSSL will be located for Federal Identity Forum:
Venue: Tampa Convention Center / Tampa, FL
When: September 24th-26th, 2019
Booth #: 419
Venue Information: https://events.afcea.org/FedID19/Public/Content.aspx?ID=76721&sortMenu=101001
Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!
For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.
More information about Federal Identity Forum can be found here: https://events.afcea.org/FedID19/Public/enter.aspx
wolfSSL MQTT Sensor Network (MQTT-SN)
The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.
The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn
option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:
- Register
- Will topic and message set up
- Will topic and message update
- All QoS levels
- Variable-sized packet length field
You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.
For more information please email us at facts@wolfssl.com.
wolfSSL FIPS-Ready
With the recent release of wolfSSL 4.1.0, the wolfSSL team has also updated the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).
FIPS validation is a government certification for cryptographic modules that states the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.
Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products are in place, they can be tested using FIPS validated code with their software before committing.
wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/
For more information about wolfSSL and its FIPS Ready initiative, please contact facts@wolfssl.com.
Differences between TLS 1.2 and TLS 1.3 (#TLS13)
wolfSSL's embedded SSL/TLS library has included support for TLS 1.3 since early releases of the TLS 1.3 draft. Since then, wolfSSL has remained up-to-date with the TLS 1.3 specification. In this post, the major upgrades of TLS 1.3 from TLS 1.2 are outlined below:
TLS 1.3
This protocol is defined in RFC 8446. TLS 1.3 contains improved security and speed. The major differences include:
- The list of supported symmetric algorithms has been pruned of all legacy algorithms. The remaining algorithms all use Authenticated Encryption with Associated Data (AEAD) algorithms.
- A zero-RTT (0-RTT) mode was added, saving a round-trip at connection setup for some application data at the cost of certain security properties.
- Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
- All handshake messages after the ServerHello are now encrypted.
- Key derivation functions have been re-designed, with the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) being used as a primitive.
- The handshake state machine has been restructured to be more consistent and remove superfluous messages.
- ECC is now in the base spec and includes new signature algorithms. Point format negotiation has been removed in favor of single point format for each curve.
- Compression, custom DHE groups, and DSA have been removed, RSA padding now uses PSS.
- TLS 1.2 version negotiation verification mechanism was deprecated in favor of a version list in an extension.
- Session resumption with and without server-side state and the PSK-based ciphersuites of earlier versions of TLS have been replaced by a single new PSK exchange.
More information about wolfSSL and the TLS 1.3 protocol can be found here: https://www.wolfssl.com/docs/tls13/.
Additionally, please contact facts@wolfssl.com for any questions.
wolfSSL 24×7 Support
wolfSSL provides support on four levels, one of which is the 24×7 support level. This support level includes many key features not available on the others, such as an unlimited number of support incidents, around-the-clock support from dedicated members of the wolfSSL support team, and remains in effect for an entire year.
wolfSSL provides three other levels of paid support, which also include some of the same features provided by 24×7 support. More details on the wolfSSL support packages and levels can be viewed here: https://www.wolfssl.com/products/support-packages-options/
wolfSSL also provides support for the latest version of the TLS protocol, TLS 1.3! Read more about wolfSSL’s implementation and the protocol itself here: https://www.wolfssl.com/docs/tls13/
For more information, please contact facts@wolfssl.com.
Weekly updates
Archives
- April 2024 (25)
- March 2024 (21)
- February 2024 (18)
- January 2024 (21)
- December 2023 (20)
- November 2023 (20)
- October 2023 (23)
- September 2023 (17)
- August 2023 (25)
- July 2023 (39)
- June 2023 (13)
- May 2023 (11)
- April 2023 (6)
- March 2023 (23)
- February 2023 (7)
- January 2023 (7)
- December 2022 (15)
- November 2022 (11)
- October 2022 (9)
- September 2022 (7)
- August 2022 (12)
- July 2022 (11)
- June 2022 (15)
- May 2022 (11)
- April 2022 (14)
- March 2022 (12)
- February 2022 (22)
- January 2022 (13)
- December 2021 (13)
- November 2021 (29)
- October 2021 (15)
- September 2021 (15)
- August 2021 (13)
- July 2021 (21)
- June 2021 (19)
- May 2021 (12)
- April 2021 (13)
- March 2021 (27)
- February 2021 (29)
- January 2021 (22)
- December 2020 (21)
- November 2020 (14)
- October 2020 (7)
- September 2020 (22)
- August 2020 (11)
- July 2020 (8)
- June 2020 (14)
- May 2020 (15)
- April 2020 (14)
- March 2020 (4)
- February 2020 (24)
- January 2020 (18)
- December 2019 (7)
- November 2019 (16)
- October 2019 (14)
- September 2019 (24)
- August 2019 (21)
- July 2019 (8)
- June 2019 (13)
- May 2019 (35)
- April 2019 (31)
- March 2019 (20)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (10)
- October 2018 (18)
- September 2018 (18)
- August 2018 (8)
- July 2018 (15)
- June 2018 (29)
- May 2018 (15)
- April 2018 (11)
- March 2018 (19)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (7)
- September 2017 (8)
- August 2017 (6)
- July 2017 (11)
- June 2017 (8)
- May 2017 (10)
- April 2017 (5)
- March 2017 (7)
- February 2017 (1)
- January 2017 (8)
- December 2016 (3)
- November 2016 (2)
- October 2016 (18)
- September 2016 (8)
- August 2016 (5)
- July 2016 (4)
- June 2016 (10)
- May 2016 (4)
- April 2016 (5)
- March 2016 (4)
- February 2016 (12)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (6)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (13)
- January 2015 (6)
- December 2014 (7)
- November 2014 (3)
- October 2014 (2)
- September 2014 (11)
- August 2014 (6)
- July 2014 (9)
- June 2014 (11)
- May 2014 (11)
- April 2014 (9)
- March 2014 (3)
- February 2014 (3)
- January 2014 (5)
- December 2013 (9)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (8)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (9)
- December 2012 (13)
- November 2012 (5)
- October 2012 (7)
- September 2012 (4)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (5)
- April 2012 (7)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (6)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (8)
- May 2011 (12)
- April 2011 (4)
- March 2011 (12)
- February 2011 (8)
- January 2011 (13)
- December 2010 (17)
- November 2010 (12)
- October 2010 (14)
- September 2010 (11)
- August 2010 (20)
- July 2010 (14)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)