RECENT BLOG NEWS
wolfSSL Asymmetric Cryptography Support
One of the software libraries that is provided by wolfSSL includes the wolfCrypt crypto engine. wolfCrypt includes support for single-precision math, ECC, extensive list of supported ciphers, key/certificate generation, and also Asymmetric cryptography! Asymmetric cryptography differs from regular (synchronous) cryptography that instead of using a singular shared key, they will use a key-value pair. Popular algorithms where this is found include RSA, DH, and ECC - which are algorithms supported and implemented by wolfSSL!
wolfSSL's implementation of these Asymmetric algorithms can also be tuned based on the user's needs as well. For example, if a user requires the same security offered by these algorithms in combination with high performance fast encryption, wolfSSL has the options (or corresponding macro definitions) --enable-fastmath and --enable-fast-rsa available for use. Additionally, if a user needs to improve protection against attacks targeting implementations of these algorithms, wolfSSL has options to improve the security of its implementations of these Asymmetric algorithms. The options for these improvements are --enable-maxstrength and --enable-harden. These options can also be enabled by adding their corresponding defines within the settings file that is in use by the system, and are listed below:
- --enable-fastmath corresponds with USE_FAST_MATH
- --enable-fast-rsa has many different defines that would be used for many different devices, as hardware encryption and architecture comes in to play. It also requires the user have fast RSA libraries in place. Please contact support@wolfssl.com for assistance with enabling this.
- --enable-maxstrength corresponds with WOLFSSL_MAX_STRENGTH
- --enable-harden corresponds with TFM_TIMING_RESISTANT, ECC_TIMING_RESISTANT, and WC_RSA_BLINDING if using rng.
For more information about wolfSSL or wolfCrypt's implementation of various algorithms, please contact facts@wolfssl.com.
wolfSSL DTLS Session Export
The wolfSSL embedded SSL/TLS library supports features not only pertaining to TLS, but DTLS as well! A prime example of a DTLS feature supported by wolfSSL is DTLS session exporting. This allows for serializing and sending a DTLS session immediately after the handshake has been completed. The ability to export the session after a handshake is established has many practical use cases in IoT and embedded environments.
In establishing and maintaining a DTLS connection the handshake portion is the most resource intensive. With this additional feature it is possible to offload the handshake onto a more powerful system, serialize and export it after the handshake is completed, and then have throughput handled by a more resource constrained device.
For more information about wolfSSL and DTLS, or just wolfSSL, please contact facts@wolfssl.com.
wolfSSL also supports TLS 1.3! More information can be found here: https://www.wolfssl.com/docs/tls13/
wolfSSL Adds Support for the Deos Safety Critical RTOS
Are you a user of Deos? If so, you will be happy to know that wolfSSL recently added support for Deos RTOS and added TLS client/server examples to the wolfSSL embedded SSL/TLS library for Deos!
Deos is an embedded RTOS used for safety-critical avionics applications on commercial and military aircraft. Certified to DO-178C DAL A, the time and space partitioned RTOS features deterministic real-time response and employs patented “slack scheduling” to deliver higher CPU utilization. DO-178C DAL A refers to a specification that is required for software to be used in aerospace software systems.
The Deos port in wolfSSL is activated by using the "WOLFSSL_DEOS" macro. For instructions on how to build and run the examples on your projects, please see the “<wolfssl-root>/IDE/ECLIPSE/DEOS/README” file. This support is currently located in our GitHub master branch, and will roll into the next stable release of wolfSSL as well.
wolfSSL provides support for the latest and greatest version of the TLS protocol, TLS 1.3! Using the wolfSSL port with your device running Deos will allow your device to connect to the internet in one of the most secure ways possible.
For more information, please contact facts@wolfssl.com.
Resources
The most recent version of wolfSSL can be downloaded from our download page, here: https://www.wolfssl.com/download/
wolfSSL GitHub repository: https://github.com/wolfssl/wolfssl.git
wolfSSL support for TLS 1.3: https://www.wolfssl.com/docs/tls13/
Deos RTOS homepage: https://www.ddci.com/category/deos/
wolfBoot – wolfSSL’s Secure Bootloader
wolfBoot is wolfSSL's own implementation of a secure bootloader that leverages wolfSSL's underlying wolfCrypt module to provide signature authentication for the running firmware.
The role of a secure bootloader is to effectively prevent the loading of malicious or unauthorized firmware on the target. Additionally, wolfBoot provides a fail-safe update mechanism, that can be interrupted at any time, and resumed at next boot.
wolfBoot is designed to be a portable, OS-agnostic, secure bootloader solution for all 32-bit microcontrollers, relying on wolfCrypt for firmware authentication.
Due to its minimalist design and the tiny Hardware Abstraction Layer (HAL) API, wolfBoot is completely independent of any OS or bare-metal application, and can be easily ported and integrated into existing embedded software solutions.
wolfBoot provides the basis for secure firmware update (OTA) management at boot time, cutting down the development effort needed to implement and validate the required mechanisms to handle the updates. It reduces the development effort to just receiving the image using a secure channel within the application/OS. We recommend using wolfSSL to encrypt the firmware transfer over TLS, to avoid eavesdropping. Once the image is transferred and stored into the update partition, wolfBoot takes care of the update procedure at the next boot.
Remote updates that would lead to a faulty firmware are automatically reverted by wolfBoot after the first 'test' boot, by restoring the original firmware image whenever the update has failed to boot properly. This mechanism protects the target device from accidental updates on the field.
wolfBoot can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/
More about boot loaders can be found here: https://en.wikipedia.org/wiki/Booting#BOOT-LOADER
More about wolfSSL: https://www.wolfssl.com/products/wolfssl/
More about wolfCrypt: https://www.wolfssl.com/products/wolfCrypt/
Additionally, wolfSSL will be at ICMC in a couple of weeks! Be sure to stop by booth #103 and say hello!
Contact facts@wolfssl.com for any questions or for more information
wolfSSH Version 1.4.0 Now Available
Version 1.4.0 of the wolfSSH SSHv2 server library has been released! Many new and exciting features were added to wolfSSH with this release. Some of the new additions include: support for port forwarding, client side pseudo terminal support, enhancements for non blocking use, AES-CTR cipher support, and support for SFTP on windows.
This release also includes fixes and enhancements to existing features. Some of the fixes include resolving GCC-7 warnings and fixes for example use cases when wolfSSL ECC caching is turned on.
A full list of notable addition and fixes is as follows:
- SFTP support for time attributes
- TCP port forwarding feature added (--enable-fwd)
- Example TCP port forwarding added to /examples/portfwd/portfwd
- Fixes to SCP, including default direction set
- Fix to match ID during KEX init
- Add check for window adjustment packets when sending large transfers
- Fixes and maintenance to Nucleus port for file closing
- Add enable all option (--enable-all)
- Fix for --disable-inline build
- Fixes for GCC-7 warnings when falling through switch statements
- Additional sanity checks added from fuzz testing
- Refactor and fixes for use with non blocking
- Add extended data read for piping stderr
- Add client side pseudo terminal connection with ./examples/client/client -t
- Add some basic Windows terminal conversions with wolfSSH_ConvertConsole
- Add wolfSSH_stream_peek function to peek at incoming SSH data
- Change name of internal function from SendBuffered to wolfSSH_SendPacket to avoid clash with wolfSSL
- Add support for SFTP on Windows
- Use int types for arguments in examples to fix Raspberry Pi build
- Fix for fail case with leading 0’s on MPINT
- Default window size (DEFAULT_WINDOW_SZ) lowered from ~ 1 MB to ~ 16 KB
- Disable examples option added to configure (--disable-examples)
- Callback function and example use added for checking public key sent
- AES CTR cipher support added
- Fix for freeing ECC caches with examples
- Renamed example SFTP to be examples/sftpclient/wolfsftp
The most up-to-date versions of wolfSSH and other wolfSSL products can be found on the wolfSSL download page here: https://www.wolfssl.com/download/.
For more information about wolfSSH or the changes incorporated into the 1.4.0 release, please contact facts@wolfssl.com.
wolfSSL at ICMC 2019
wolfSSL is at ICMC this year! The International Cryptographic Module Conference (ICMC) attracts hundreds of cryptographic professionals from across the Pacific to address the unique challenges faced by the people who develop, produce, test, specify, and use cryptographic modules, with an emphasis on FIPS 140-2, ISO/IEC 19790 and Common Criteria standards. For 2019, ICMC will be held in Vancouver, BC.
Where ICMC will be held for 2019:
Venue: JW Mariott Parq Vancouver
wolfSSL Booth #: 103
When: May 15-16
Directions: https://icmconference.org/?page_id=7194
Additionally, wolfSSL founder and CTO Todd Ouska will be on the panel for the track session "Panel on TLS: The Problems in Moving to 1.3". Stop by the Cambie space to learn more about the problems in upgrading to the newest version of TLS (Friday, May 17th, at 10:30am)
Stop by our booth to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!
For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.
More information about ICMC can be found here: https://icmconference.org.
wolfSSL FIPS-Ready
With the release of wolfSSL 4.0.0, the wolfSSL team has also released a new product: the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).
FIPS validation is a government certification for cryptographic modules that states that the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.
Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products in place can be tested FIPS validated code with their software before committing.
wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/
For more information about wolfSSL and its FIPS Ready initiative, please contact facts@wolfssl.com.
Building WebSocket++ with wolfSSL Support
wolfSSL can now be used to replace OpenSSL in WebSocket++!
WebSocket++ is a header only C++ library that implements RFC6455 The WebSocket Protocol. It allows integrating WebSocket client and server functionality into C++ programs and uses interchangeable network transport modules including one based on raw char buffers, one based on C++ iostreams, and one based on Asio (either via Boost or standalone). End users can write additional transport policies to support other networking or event libraries as needed.
Since wolfSSL is compatible with Asio and Boost.Asio (see Asio blog post), it can be used to replace OpenSSL for cryptographic and TLS purposes when building WebSocket++ with Asio or Boost.Asio.
To build WebSocket++, enter the following commands from the root directory of your WebSocket++ download.
$ cmake .
$ make
$ sudo make install
Now install the wolfSSL compatible versions of Asio or Boost.Asio and build it with wolfSSL (see blog post).
You should now be able to compile and execute programs with WebSocket++ and wolfSSL. Just make sure to link all of the necessary libraries (asio and wolfSSL) and their include paths when compiling.
To run the WebSocket++ unit tests with wolfSSL you will need the wolfSSL modified version of WebSocket++. Please contact facts@wolfssl.com if you want us to send you the source code.
To run the Ctest tests, execute the following commands from the root directory of the wolfSSL modified WebSocket++ download.
$ cmake -DBUILD_TESTS=ON -DBUILD_EXAMPLES=ON -DWOLFSSL=/path/to/wolfSSL/install .
$ ctest .
If you want to run more thorough tests with wolfSSL and WebSocket++ you will need to download and install scons. You should then be able to execute the scons tests with the following commands.
$ export BOOST_ROOT=$WORKSPACE/boost_1_67_0
$ export WOLFSSL_PATH=/path/to/wolfSSL/install
$ scons
$ scons test
For more information or help with getting WebSocket++ and wolfSSL into your project, please contact us at facts@wolfssl.com.
wolfSSL at NXP Tech Days – Seattle
wolfSSL is at NXP Tech Days's Seattle event this year! NXP Technology Days is a deep-dive, technical training program for engineers designing solutions with embedded technology. This one-day event offers hands-on workshops and technical lectures over multiple markets enabling attendees to customize a schedule that is most relevant to their training needs.
Where NXP Tech Days will be for Seattle:
Venue: Meydenbauer Center, Bellevue, WA 98004
When: May 7th, 2019
Directions: https://www.meydenbauer.com/parking-directions/
Stop by to hear more about the wolfSSL embedded SSL/TLS library, the wolfCrypt encryption engine, to meet the wolfSSL team, or to get some free stickers and swag!
For more information about wolfSSL, its products, or future events, please contact facts@wolfssl.com.
More information about NXP Tech Days and the Seattle Agenda can be found here: https://www.nxp.com/support/training-events/nxp-technology-days:NXP-TECH-DAYS.
wolfCrypt FIPS Certificate #3389
The National Institute of Standards and Technology (NIST) has completed the validation of the wolfCrypt module version 4 for an updated Federal Information and Processing Standards (FIPS) 140-2 certificate in addition to its previous FIPS 140-2 certificate. This new certificate includes updated and more secure algorithms added to the wolfCrypt module's boundary, some of which are listed further below.
FIPS 140-2 is a government standard that specifies a software module is compatible and allowed to be used in government systems. This includes such areas as drone software, government databases, and other high-security/high-power uses.
The new FIPS 140-2 validation has certificate #3389. The Operating Environments (OEs) tested are Ubuntu Linux (16.04) and Windows 10 on Intel Core i5 processors. Full details about the OEs can be found on the CSRC certificate page. Additionally, the certificate also includes the following algorithms: AES (CBC, GCM, CTR, ECB), CVL, Hash DRBG, DSA, DHE, ECDSA (key generation, sign, verify), HMAC, RSA (key generation, sign, verify), SHA-3, SHA-2, SHA-1, and Triple-DES.
For more information about wolfSSL, wolfCrypt, or our FIPS 140-2 validations, please view our resources below.
- wolfSSL FIPS page: https://www.wolfssl.com/license/fips/
- wolfSSL product page: https://www.wolfssl.com/products/wolfssl/
- wolfCrypt product page: https://www.wolfssl.com/products/wolfcrypt/
Other information can be obtained, or questions can also be answered by contacting facts@wolfssl.com.
wolfSSL will also be attending ICMC this year! More information about ICMC can be found here: https://icmconference.org
Weekly updates
Archives
- March 2024 (11)
- February 2024 (18)
- January 2024 (21)
- December 2023 (20)
- November 2023 (20)
- October 2023 (23)
- September 2023 (17)
- August 2023 (25)
- July 2023 (39)
- June 2023 (13)
- May 2023 (11)
- April 2023 (6)
- March 2023 (23)
- February 2023 (7)
- January 2023 (7)
- December 2022 (15)
- November 2022 (11)
- October 2022 (9)
- September 2022 (7)
- August 2022 (12)
- July 2022 (11)
- June 2022 (15)
- May 2022 (11)
- April 2022 (14)
- March 2022 (12)
- February 2022 (22)
- January 2022 (13)
- December 2021 (13)
- November 2021 (29)
- October 2021 (15)
- September 2021 (15)
- August 2021 (13)
- July 2021 (21)
- June 2021 (19)
- May 2021 (12)
- April 2021 (13)
- March 2021 (27)
- February 2021 (29)
- January 2021 (22)
- December 2020 (21)
- November 2020 (14)
- October 2020 (7)
- September 2020 (22)
- August 2020 (11)
- July 2020 (8)
- June 2020 (14)
- May 2020 (15)
- April 2020 (14)
- March 2020 (4)
- February 2020 (24)
- January 2020 (18)
- December 2019 (7)
- November 2019 (16)
- October 2019 (14)
- September 2019 (24)
- August 2019 (21)
- July 2019 (8)
- June 2019 (13)
- May 2019 (35)
- April 2019 (31)
- March 2019 (20)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (10)
- October 2018 (18)
- September 2018 (18)
- August 2018 (8)
- July 2018 (15)
- June 2018 (29)
- May 2018 (15)
- April 2018 (11)
- March 2018 (19)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (7)
- September 2017 (8)
- August 2017 (6)
- July 2017 (11)
- June 2017 (8)
- May 2017 (10)
- April 2017 (5)
- March 2017 (7)
- February 2017 (1)
- January 2017 (8)
- December 2016 (3)
- November 2016 (2)
- October 2016 (18)
- September 2016 (8)
- August 2016 (5)
- July 2016 (4)
- June 2016 (10)
- May 2016 (4)
- April 2016 (5)
- March 2016 (4)
- February 2016 (12)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (6)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (13)
- January 2015 (6)
- December 2014 (7)
- November 2014 (3)
- October 2014 (2)
- September 2014 (11)
- August 2014 (6)
- July 2014 (9)
- June 2014 (11)
- May 2014 (11)
- April 2014 (9)
- March 2014 (3)
- February 2014 (3)
- January 2014 (5)
- December 2013 (9)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (8)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (9)
- December 2012 (13)
- November 2012 (5)
- October 2012 (7)
- September 2012 (4)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (5)
- April 2012 (7)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (6)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (8)
- May 2011 (12)
- April 2011 (4)
- March 2011 (12)
- February 2011 (8)
- January 2011 (13)
- December 2010 (17)
- November 2010 (12)
- October 2010 (14)
- September 2010 (11)
- August 2010 (20)
- July 2010 (14)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)