Category: Uncategorized

In the rapidly changing landscape of cybersecurity, ensuring compliance with rigorous standards like FIPS 140-3 is essential for organizations in sensitive sectors such as government, finance, and healthcare. By integrating FIPS-certified cryptography into Mozilla’s Network Security Services (NSS) library through the PKCS#11 standard—an API for cryptographic operations—we are contributing to a broader goal of achieving FIPS 140-3 compliance across an entire Linux distribution.

Firefox employs the NSS library for its cryptographic functions. The NSS library utilizes the PKCS#11 standard—a widely adopted application programming interface (API) that enables secure cryptographic operations—to interact with its default cryptographic library, freebl.

The Role of FIPS Certification

FIPS certification ensures that cryptographic implementations meet rigorous security standards set by the National Institute of Standards and Technology (NIST). Achieving FIPS compliance is vital for organizations requiring high-security assurance, as it validates the integrity and reliability of cryptographic operations. wolfCrypt has attained FIPS 140-3 certification, making it a robust choice for environments where security cannot be compromised.

Integrating wolfCrypt into NSS

To integrate wolfCrypt into NSS, we substitute the default softokn-freebl library with wolfPKCS11. This enables NSS to utilize wolfCrypt’s FIPS-certified algorithms through the PKCS#11 interface, allowing applications to leverage secure cryptographic functions seamlessly and efficiently. By utilizing the PKCS#11 interface, we are able to provide a binary drop-in replacement without modifying anything outside of configuration files. You can follow our progress over at the nss feature branch in the wolfPKCS11 repository at github.

Benefits Beyond Firefox

This initiative is part of a larger effort to provide FIPS-certified cryptography across entire Linux distributions. Similar projects include integrating wolfCrypt with libraries such as libgcrypt and GnuTLS. These efforts aim to create a uniform cryptographic layer, reducing complexity and potential vulnerabilities associated with managing multiple cryptographic libraries.

For more information or to explore how your organization can benefit from integrating wolfCrypt FIPS, contact our team at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

We’re excited to announce our ongoing work integrating wolfCrypt with GnuTLS! Unlike traditional approaches that require extensive application rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level, we’re creating a seamless path for applications to leverage wolfCrypt’s powerful cryptographic capabilities without changing a single line of their application code. Our development strategy focuses on progressive implementation, tackling core cryptographic operations first and methodically expanding to cover the complete security spectrum. This approach means organizations can benefit from enhanced security immediately, with more capabilities rolling out steadily. For teams working in regulated environments requiring FIPS certification, this integration offers a remarkable advantage and immediate access to wolfCrypt’s FIPS 140-3 certified algorithms without the typical development and certification marathon.

What makes this integration particularly significant is GnuTLS’s central role in secure communications infrastructure. Our approach aims to transform what would typically be a massive certification challenge into a straightforward library update, allowing organizations to achieve FIPS compliance without disrupting their existing architecture. For Linux distribution maintainers, this integration will eliminate the traditional compromise between security and compatibility when deploying certified cryptography. Certificate validation and protocol handling will continue through the familiar GnuTLS interface while benefiting from wolfCrypt’s certified implementation underneath. Our goal is to help reduce the time needed for certification processes, enabling organizations to more efficiently deploy secure communications in regulated environments without compromising on compatibility or performance.

Take a more in depth look here: https://github.com/wolfssl/gnutls-wolfssl

For more details or questions about this effort, please reach out to facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfCrypt Python, a Python wrapper for wolfSSL’s cryptographic library wolfCrypt, now has supported Python APIs that can utilize the PQC algorithms ML-KEM and ML-DSA.

The ML-KEM (Module Lattice-based Key Encapsulation Mechanism) APIs provide quantum-resistant key exchange with three parameter sets (512/768/1024). The implementation includes key generation, encapsulation, decapsulation, and key import/export functionality.

The ML-DSA (Module Lattice-based Digital Signature Algorithm) APIs provide quantum-resistant digital signatures with three parameter sets (44/65/87). Features include key generation, signing, and verification.

Using the Python API, you can try out the PQC algorithm quickly with little effort. The following links show information to start the PQC trials with wolfCrypt Python.

• Installation guide: https://github.com/wolfSSL/wolfcrypt-py/blob/master/README.rst
• Examples: https://github.com/wolfSSL/wolfcrypt-py/blob/master/docs/asymmetric.rst
• Source code: https://github.com/wolfSSL/wolfcrypt-py/blob/master/wolfcrypt/ciphers.py

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now