Category: Uncategorized

wolfSSL has extended its PKCS7 capabilities to better handle indefinite length encodings, particularly in streaming scenarios. While basic support for indefinite length verification existed, recent updates have refined the wc_PKCS7_VerifySignedData() API to process multipart and indefinite length content more efficiently in a streaming manner.(wolfSSL)

Key Enhancements

• Streaming Verification: The wc_PKCS7_VerifySignedData() function now supports verifying PKCS7 data with indefinite lengths without requiring the entire content to be buffered in memory.
• Improved Decoding: Enhancements in decoding functions allow for better handling of BER-encoded PKCS7 structures with indefinite lengths.

Example Usage

The wolfssl-examples repository provides practical demonstrations of these enhancements. For instance, the pkcs7-stream-verify example illustrates how to verify PKCS7 signed data in a streaming context:

PKCS7 pkcs7;
byte buffer[BUFFER_SIZE];
int ret;

// Initialize PKCS7 structure
wc_PKCS7_Init(&pkcs7, NULL, INVALID_DEVID);

// Set up certificate and key
pkcs7.cert = cert;
pkcs7.certSz = certSz;
pkcs7.privateKey = key;
pkcs7.privateKeySz = keySz;

// Begin streaming verification
ret = wc_PKCS7_VerifySignedData(&pkcs7, buffer, bufferSz);
if (ret != 0) {
    // Handle error
}

// Continue processing as needed

This approach allows applications to process and verify large or streaming PKCS7 data efficiently, without the need to load the entire content into memory.

Benefits

• Efficiency: Reduces memory usage by processing data in chunks.
• Flexibility: Supports a wider range of PKCS7 encoding scenarios, including those using indefinite lengths.
• Standards Compliance: Aligns with BER encoding standards for PKCS7 structures.(GitHub)

These enhancements make wolfSSL more adaptable for applications requiring secure, real-time data processing.

If you have questiona about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

The NXP EdgeLock SE050 is a popular secure element providing a strong root of trust for IoT devices, known for its “Plug & Trust” simplicity. wolfSSL has consistently supported the SE050, enabling robust hardware-based security for TLS, cloud onboarding, and data protection. However, managing cryptographic keys on secure elements during development can often be a cumbersome task.
With the release of wolfSSL 5.8.0, we’re excited to introduce enhancements that significantly streamline the developer experience with the NXP SE050, most notably a new feature for automatic key deletion.

Simplifying Key Management with Automatic Key Deletion

During development and testing, developers frequently create and discard numerous cryptographic keys. On the SE050, these keys occupy persistent storage slots. Without careful manual cleanup, the keystore can quickly fill up, leading to errors and slowing down progress.
The Solution: WOLFSSL_SE050_AUTO_ERASE
A key improvement in wolfSSL 5.8.0. is the introduction of the WOLFSSL_SE050_AUTO_ERASE preprocessor define. When wolfSSL is compiled with this option, any key generated on or loaded into the SE050 via wolfSSL will be automatically erased from the secure element when the corresponding wolfCrypt key object in your application is freed (e.g., via wc_ecc_free()).
Benefits for Developers:

• Faster Iteration: Experiment freely without worrying about manual SE050 key cleanup.
• Simplified Testing: Automated tests that generate keys on the SE050 become more robust, as the risk of a full keystore is minimized.
• Reduced Clutter: Keeps the SE050 keystore clean from temporary development keys.
• Focus on Application Logic: Spend more time on your core application and less on SE050 housekeeping during development.

This feature is a significant quality-of-life improvement, making the powerful SE050 even more accessible, especially during rapid prototyping and testing phases.

Complementary SE050 Refinements

Alongside this key management enhancement, wolfSSL 5.8.0 also includes other refinements to our SE050 implementation. While the automatic key deletion is a highlight for developer workflow, these additional contributions are vital for the overall stability and performance of wolfSSL’s SE050 support, ensuring a polished and reliable experience.

Why These Enhancements Matter

These improvements in wolfSSL 5.8.0 underscore our commitment to providing security solutions that are not only robust but also developer-friendly. By reducing friction in the development process, we empower you to build secure applications more efficiently.

Getting Started

1. Download wolfSSL 5.8.0: Get the latest release from our download page.
2. Enable Automatic Key Deletion: Compile wolfSSL with the WOLFSSL_SE050_AUTO_ERASE define. For example, using autoconf: ./configure –with-se050 CFLAGS=”-DWOLFSSL_SE050_AUTO_ERASE” This is an opt-in feature, ideal for development and testing builds.
3. Consult Documentation: For full details on SE050 integration, refer to the README_SE050.md in the wolfSSL source (wolfcrypt/src/port/nxp/) and our examples in the wolfssl-examples repository.

Conclusion

The SE050 enhancements in wolfSSL 5.8.0, especially the automatic key deletion feature, make integrating hardware security with NXP’s SE050 smoother and more efficient. wolfSSL continues to provide cutting-edge security that is easy for developers to use.

• Explore the Code: Dive into the source code for these new SE050 enhancements on the wolfSSL GitHub repository: (https://github.com/wolfSSL/wolfssl).
• Contact Us: For questions, email us at facts@wolfssl.com or visit our support forums.

We’re excited for you to try these new features and experience a more streamlined SE050 development workflow!
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Elliptic curve cryptography (ECC) is increasingly popular in secure communications, and secp256k1—famous for its use in Bitcoin and Blockchains—is a widely used curve. This blog post will walk you through building wolfSSL with support for secp256k1, generating an ECC certificate using that curve, and using it in a TLS connection with wolfSSL’s example client and server.

---

Step 1: Build wolfSSL with secp256k1 Support

Start by cloning the wolfSSL repository and building it with custom curve and certificate generation support:

# Download wolfssl from https://www.wolfssl.com/download/
cd wolfssl
./configure --enable-ecccustcurves=all --enable-keygen --enable-certgen --enable-certreq --enable-certext
make
sudo make install

---

Step 2: Generate a secp256k1 Certificate

Next, use the certgen example from wolfSSL’s examples repository.

git clone https://github.com/wolfssl/wolfssl-examples
cd wolfssl-examples/certgen

Modify the example for secp256k1

In certgen_example.c, modify the key generation line to explicitly use secp256k1:

- ret = wc_ecc_make_key(&rng, 32, &newKey);
+ ret = wc_ecc_make_key_ex(&rng, 32, &newKey, ECC_SECP256K1);

Add Key Output in PEM Format

To write the private key to a file, add the following block after certificate generation (be sure to add in proper error checks):

derBufSz = wc_EccKeyToDer(&newKey, derBuf, LARGE_TEMP_SZ);
pemBufSz = wc_DerToPem(derBuf, derBufSz, pemBuf, LARGE_TEMP_SZ, ECC_PRIVATEKEY_TYPE);
if (pemBufSz < 0) goto exit;

file = fopen("newCert.key", "wb");
if (!file) goto exit;
ret = (int)fwrite(pemBuf, 1, pemBufSz, file);
fclose(file);

Build and Run

make
./certgen_example

You should now have newCert.pem and newCert.key files using a secp256k1 key.

---

Step 3: Configure Client/Server for secp256k1

Go back to the wolfssl directory and modify the client example to explicitly support the secp256k1 curve:

+++ b/examples/client/client.c
@@ -3707,6 +3707,9 @@
     #endif
+
+    wolfSSL_CTX_UseSupportedCurve(ctx, WOLFSSL_ECC_SECP256K1);
+
 #if defined(HAVE_SUPPORTED_CURVES)

Run the Server and Client

Use the generated cert/key with the server, and run the client with a trusted CA cert:

./examples/server/server -d -c newCert.pem -k newCert.key

./examples/client/client -A ./certs/ca-ecc-cert.pem

If everything is set up correctly, you'll see output like:

SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256K1
I hear you fa shizzle!

---

You’ve just built wolfSSL with support for custom ECC curves, generated a certificate using secp256k1, and successfully used it in a TLS session. This setup is great for anyone integrating Bitcoin-style cryptography into embedded or resource-constrained systems using wolfSSL.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

We are excited to announce the creation of mcwolf, a new project that brings a Classic McEliece post-quantum cryptographic algorithm implementation and integration to wolfSSL. We would like to thank Daniel J. Bernstein for the integration work that went into mcwolf.

The mcwolf project is a series of scripts and patches against wolfSSL that adds support for Classic McEliece, a code-based post-quantum cryptographic algorithm that is deployed in various applications (see https://mceliece.org) and is under consideration for standardization by ISO. The project uses the official vec implementation of Classic McEliece, providing a portable solution that can be optimized for various platforms. This implementation vectorizes across 64-bit integers.

The project’s page can be found here.

Why Classic McEliece?

Post-quantum cryptographic algorithms like Classic McEliece are designed to resist attacks from both classical and quantum computers, ensuring long-term security for sensitive data.

Classic McEliece is particularly known for its:

• Strong security foundations based on the well-studied McEliece cryptosystem with a long pedigree dating back to 1978
• Relatively small ciphertext sizes compared to other post-quantum KEMs

Technical Details

The mcwolf project has several notable characteristics:

• Uses the official vec implementation of Classic McEliece, which is portable across platforms
• Includes comprehensive testing, with the same code being extensively tested in SUPERCOP and libmceliece

The implementation supports various parameter sets for Classic McEliece, including:

• mceliece348864
• mceliece348864pc
• mceliece460896
• mceliece460896pc
• mceliece6688128
• mceliece6688128pc
• mceliece6960119
• mceliece6960119pc
• mceliece8192128
• mceliece8192128pc

How to Build mcwolf

Building mcwolf is straightforward. Go to https://cr.yp.to/2025/20250426-mcwolf/notes.html and download the build script. Mark it as executable and run the script on your linux machine. You need curl, python3, git, autoconf, libtool and generic gcc build tools already installed.

The mcwolf implementation includes tests that are integrated into the existing testing framework. Here is some expected output:

 ...
 MCELIECE348864 test passed!
 MCELIECE460896 test passed!
 MCELIECE6688128 test passed!
 MCELIECE6960119 test passed!
 MCELIECE8192128 test passed!
 ...
------------------------------------------------------------------------------
  wolfSSL version 5.8.0
 ------------------------------------------------------------------------------
 Math: ??????Multi-Precision: Wolf(SP) word-size=64 bits=4096 sp_int.c
 wolfCrypt Benchmark (block bytes 1048576, min 1.0 sec each)
 mceliece 348864  key gen   	100 ops took 4.492 sec, avg 44.922 ms, 22.261 ops/sec
 mceliece 348864	encap 	18100 ops took 1.005 sec, avg 0.056 ms, 18007.073 ops/sec
 mceliece 348864	decap  	6500 ops took 1.005 sec, avg 0.155 ms, 6466.727 ops/sec
 mceliece 460896  key gen   	100 ops took 14.307 sec, avg 143.068 ms, 6.990 ops/sec
 mceliece 460896	encap  	9800 ops took 1.005 sec, avg 0.103 ms, 9751.777 ops/sec
 mceliece 460896	decap  	2200 ops took 1.009 sec, avg 0.459 ms, 2180.508 ops/sec
 mceliece 6688128  key gen   	100 ops took 30.491 sec, avg 304.906 ms, 3.280 ops/sec
 mceliece 6688128	encap  	5900 ops took 1.007 sec, avg 0.171 ms, 5856.450 ops/sec
 mceliece 6688128	decap  	2000 ops took 1.001 sec, avg 0.500 ms, 1998.431 ops/sec
 mceliece 6960119  key gen   	100 ops took 27.325 sec, avg 273.249 ms, 3.660 ops/sec
 mceliece 6960119	encap  	6300 ops took 1.008 sec, avg 0.160 ms, 6248.913 ops/sec
 mceliece 6960119	decap  	2100 ops took 1.022 sec, avg 0.487 ms, 2055.315 ops/sec
 mceliece 8192128  key gen   	100 ops took 35.826 sec, avg 358.255 ms, 2.791 ops/sec
 mceliece 8192128	encap  	5500 ops took 1.001 sec, avg 0.182 ms, 5495.955 ops/sec
 mceliece 8192128	decap  	2100 ops took 1.044 sec, avg 0.497 ms, 2010.617 ops/sec

Conclusion

The mcwolf implementation brings another post-quantum cryptographic KEM to wolfSSL, helping to future-proof security-critical applications against the threat of quantum computing. We encourage the wider community to try out the mcwolf project!

From the wolfSSL team, we give our heart-felt thanks to Daniel J. Bernstein! Thank you Daniel!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now