wolfSSL is adding verification-only LMS support to wolfProvider for OpenSSL applications. LMS is a stateful hash-based signature system standardized in RFC 8554 and NIST SP 800-208, making it useful for long-lived signing hierarchies and post-quantum verification. The integration accepts OpenSSL-compatible raw XDR public keys and uses wolfCrypt’s LMS verification APIs underneath the provider interface. What […]
Read MoreMore TagCategory: Post-Quantum
wolfProvider Adds SLH-DSA Post-Quantum Signatures
wolfSSL is adding SLH-DSA support to wolfProvider, bringing the FIPS 205 stateless hash-based signature standard to OpenSSL applications. The integration uses wolfCrypt underneath wolfProvider, so applications can use SLH-DSA through the OpenSSL provider interface while retaining wolfSSL’s portable cryptographic implementation. What is Included All 12 SLH-DSA SHA2 and SHAKE parameter sets. Key management, import/export, signing, […]
Read MoreMore TagwolfTPM Adds Post Quantum Support for the SealSQ QVault TPM
The quantum clock is ticking, and the root of trust is where the countdown matters most. Today we are excited to announce that wolfTPM now supports the SealSQ QVault TPM, one of the first TPM 2.0 modules to implement post-quantum cryptography in silicon. With this integration you can generate and use ML-DSA (FIPS 204) signatures […]
Read MoreMore TagwolfConnect: a Post-Quantum Private Network for Embedded Systems
We are pleased to announce wolfConnect, a post-quantum Private Network written in C on top of wolfCrypt. wolfConnect transparently establishes end-to-end, post-quantum-encrypted tunnels to any server that advertises support, with no changes to the applications riding on top. It is a re-implementation of the PQConnect protocol presented at NDSS 2025, derived from the upstream 1.2.3 […]
Read MoreMore TagwolfSSL Now Supports SLH-DSA End to End, and Builds Post-Quantum Only
wolfSSL now supports SLH-DSA (SPHINCS+, FIPS 205) across the whole stack: key generation and signing in wolfCrypt, certificate handling in the ASN.1 layer, and now entity authentication in the TLS 1.3 and DTLS 1.3 handshake. An SLH-DSA leaf key can sign the CertificateVerify message and an SLH-DSA peer certificate can verify one, for both server […]
Read MoreMore TagwolfSSL Adds FrodoKEM Post-Quantum Key Encapsulation
wolfSSL is pleased to announce support for FrodoKEM in wolfCrypt. FrodoKEM joins ML-KEM (FIPS 203), ML-DSA (FIPS 204), LMS/HSS and XMSS/XMSS^MT in our growing post-quantum portfolio, and it fills a specific gap: a conservative, unstructured-lattice KEM for users who want their quantum-safe key exchange to rest on a different hardness assumption. Why FrodoKEM? ML-KEM is […]
Read MoreMore TagwolfJSSE and wolfJCE Now Support Post-Quantum Cryptography
Post-quantum cryptography (PQC) support has been added to wolfSSL’s Java providers! wolfJSSE, our JSSE provider built on the wolfSSL embedded SSL/TLS library, and wolfJCE, our JCE provider built on the wolfCrypt encryption engine, now include the NIST-standardized post-quantum algorithms along with the stateful hash-based signature schemes: ML-KEM (FIPS 203) key encapsulation with parameter sets ML-KEM-512, […]
Read MoreMore TagPost-Quantum Signatures for Signed Messages: ML-DSA in PKCS#7
wolfSSL’s PKCS#7/CMS implementation has long produced and verified SignedData with the signature algorithms you’d expect — RSA and ECDSA. It now speaks post-quantum as well: PKCS#7 SignedData can be signed and verified using ML-DSA, the Module-Lattice-Based Digital Signature Algorithm standardized by NIST in FIPS 204 (formerly CRYSTALS-Dilithium). The encoding follows the conventions the IETF LAMPS […]
Read MoreMore TagWhite House EO 14412
By now, anyone who tracks security protocols has heard ad nauseum about the White House Executive Order 14412 regarding post-quantum cryptography (PQC). In case you’ve been hiding under a rock, it can be found here. The TL;DR is that all High Value Assets (HVAs) must use PQC key establishment by 2030 and PQC digital signatures […]
Read MoreMore TagMerkle Tree Certificates
If you’re part of the Web PKI community and haven’t heard of Merkle Tree Certificates then you must have been hiding under a rock for the past year! These are the new format of certificates that are being pushed by Google and Cloudflare to solve the issue of large public keys and signatures in ML-DSA […]
Read MoreMore Tag