wolfSSL now sends the correct alert when a TLS 1.3 server requires the Server Name Indication (SNI) extension and the client fails to include it. Previously, the server sent a generic handshake_failure alert; it now sends the missing_extension alert defined by RFC 8446 for exactly this case. TLS 1.2 and earlier keep the existing handshake_failure […]
Read MoreMore TagCategory: Uncategorized
wolfSSL Relaxes Serial Number Validation for Root CA Certificates
wolfSSL has refined its X.509 serial number validation to better handle real-world trust stores. Previously, wolfSSL rejected any certificate with a serial number of 0. While RFC 5280 requires CAs to issue certificates with positive serial numbers, some long-standing self-signed root CA certificates in circulation were created with serial 0, and rejecting them caused otherwise […]
Read MoreMore TagDesigning Secure Automotive Platforms (APAC-Friendly Time)
Securing modern vehicles requires more than protecting network traffic. Security must extend from secure boot and software updates to in-vehicle communications, cloud connectivity, and ADAS throughout the vehicle lifecycle. This webinar shows how the technologies used to secure modern automotive platforms fit together in practice. You’ll gain a practical understanding of how automotive HSMs, secure […]
Read MoreMore TagProduction Rust Cryptography with wolfCrypt: FIPS, Post-Quantum, and High Portability
Choosing a cryptographic library for Rust means balancing more than memory safety. Production deployments require portability, compliance, stable APIs, and a library that can evolve with changing security standards. This technical webinar examines the design of the wolfssl-wolfcrypt crate, including how it interfaces with wolfCrypt, supports FIPS 140-3 validated and post-quantum cryptography, and enables a […]
Read MoreMore TagLive Webinar: Full-Linux FIPS 140-3 via wolfCrypt on Yocto Linux
Achieving FIPS 140-3 compliance on embedded Linux becomes difficult when different applications and system components rely on different cryptographic libraries. This technical webinar shows how to build a unified FIPS 140-3 architecture on Yocto Linux using wolfCrypt FIPS. You’ll see how to replace or override OpenSSL, NSS, GnuTLS, libgcrypt, and Linux kernel cryptography, then walk […]
Read MoreMore TagwolfSSL Now Available for Zephyr’s Secure Sockets Layer
We’re pleased to announce that wolfSSL can now be integrated directly into the secure sockets layer of the Zephyr RTOS. The required patches are available now in our Open Source Project (OSP) repository. What This Means These patches let you swap out mbedTLS and use wolfSSL as the TLS provider behind Zephyr’s native socket API. […]
Read MoreMore TagA Quantum Safety Net for TLS 1.3: Mandatory PSKs with Certificate Authentication
TLS 1.3 normally forces a choice: authenticate with certificates or with a pre-shared key, but not both in the same handshake. Combining them gives you a second, independent root of trust that survives even if the first one falls — and wolfSSL now supports both doing this and requiring it. The foundation is RFC 8773, […]
Read MoreMore TagPost-Quantum Cryptography in PKCS#11: ML-KEM and ML-DSA in wolfSSL and wolfPKCS11
The migration to post-quantum cryptography is now a practical requirement, with NIST’s standardization of ML-KEM (FIPS 203) and ML-DSA (FIPS 204) and timelines such as NSA’s CNSA 2.0 driving adoption. PKCS#11 is a natural place to make that move, and wolfSSL now supports it. wolfPKCS11 supports both ML-KEM, the FIPS 203 key encapsulation mechanism (formerly […]
Read MoreMore TagStateful Hash-Based Signatures (LMS and XMSS) in X.509 Certificates
wolfSSL now supports the stateful hash-based signature schemes LMS/HSS and XMSS/XMSS^MT in X.509 certificates, following RFC 9802. What’s New Both sides of the certificate lifecycle are covered: Generation – Sign certificates and CSRs with an LMS/HSS or XMSS/XMSS^MT key, encoded exactly as RFC 9802 specifies. Verification – Parse and verify certificate chains that use these […]
Read MoreMore TagwolfCrypt on the TI C2000 C28x: PQC ML-DSA/ML-KEM on a 16-bit-byte DSP
We’re excited to share that wolfCrypt now runs a full modern crypto suite on Texas Instruments’ C2000 C28x – the NIST post-quantum schemes ML-DSA (FIPS 204) and ML-KEM (FIPS 203), plus RSA, Diffie-Hellman, AES, ChaCha20-Poly1305, HMAC/HKDF, the Curve25519/Ed25519, Curve448/Ed448, and NIST P-256 elliptic-curve schemes, and the SHA-1/2/3 and SHAKE hash families – all validated on […]
Read MoreMore Tag