Category: Uncategorized

FIPS 140-3 Compliance for GnuTLS

We’re excited to announce the next phase in our wolfCrypt-GnuTLS integration: full FIPS 140-2 Level 2 compliance and FIPS 140-3 validation capabilities! This enhancement builds directly on our ongoing work to bring wolfCrypt’s powerful cryptographic capabilities to GnuTLS.

Unlike traditional approaches that require extensive application rewrites, our solution continues to operate entirely behind the scenes. By patching GnuTLS at the library level, we’ve created a seamless path for applications to leverage wolfCrypt’s FIPS-certified cryptographic capabilities without changing a single line of application code.

What makes this integration particularly significant is GnuTLS’s central role in secure communications infrastructure. Our approach transforms what would typically be a massive certification challenge into a straightforward library update, allowing organizations to achieve FIPS compliance without disrupting their existing architecture.

For Linux distribution maintainers, this integration eliminates the traditional compromise between security and compatibility when deploying certified cryptography. Certificate validation and protocol handling will continue through the familiar GnuTLS interface while benefiting from wolfCrypt’s certified implementation underneath.

For teams working in regulated environments requiring FIPS certification, this integration offers a remarkable advantage: immediate access to wolfCrypt’s FIPS 140-3 validated algorithms without the typical development and certification marathon. Our goal is to help reduce the time needed for certification processes, enabling organizations to more efficiently deploy secure communications in regulated environments without compromising on compatibility or performance.

Take a more in-depth look here: https://github.com/wolfssl/gnutls-wolfssl

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Open Source Secure Boot Meets Open Hardware: Announcing wolfBoot Integration with TROPIC01 Secure Element

We are excited to announce our new partnership with Tropic Square and the integration of wolfBoot with their TROPIC01 secure element. Tropic Square has developed an open architecture hardware secure element for applications, including IoT devices, crypto wallets, or any modern application that prioritizes security.

Unlike most hardware secure elements, the TROPIC01 solution is built with an open-architecture. The TROPIC01 implementation is auditable, allowing engineers to review the design to verify the security implementations and ensure there are no hidden features or backdoors.

The Tropic Square team has integrated wolfBoot with the TROPIC01 secure element, using the secure element as hardware Root-of-Trust for the secure boot process. The TROPIC01 chip provides:

  • Storage of ECC public keys for verification operation
  • Enabling secure provisioning of ECC (verification) keys
  • Enabling secure provisioning of AES (decryption) keys
  • Storing “associated” data (key values and other secrets)

What makes this integration particularly significant is that it extends the open nature of the wolfBoot solution down to the hardware level. This transparency allows users and security researchers to audit the security of the design and implementation of the solution. This approach follows Kerckhoff’s principle that a cryptosystem should be secure even if everything about it, except the secret key, is known to the attacker: As a result, users no longer have to blindly trust that the secure element is free from vulnerabilities or back doors.

The pull request adding TROPIC01 support can be found here: https://github.com/wolfSSL/wolfssl/pull/8812
The solution is available here: https://github.com/wolfssl/… or https://github.com/tropicsquare/

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: How to get FIPS 140-3 for YOUR Linux Distro

If your product is built on Linux and targets government or regulated industries, FIPS 140-3 compliance is essential.

Join us for a webinar to learn how to bring your Linux-based system into compliance using wolfCrypt, the world’s first SP800-140Br1 FIPS 140-3 validated cryptographic module.

Register Now: How to get FIPS 140-3 for YOUR Linux Distro
Date: June 18th | 9 AM PT

wolfSSL Senior Software Engineer Anthony Hu will walk through real implementation paths, challenges, and solutions highlighted by a case study on IGEL, which is integrating wolfCrypt FIPS 140-3 validated crypto into its secure Linux-based endpoint OS.

This webinar will feature implementation stories and real-world application examples, including integration strategies for OpenSSL, NSS, Libgcrypt, gnuTLS, and the Linux Kernel.

What you’ll learn:

  • Why organizations are investing in FIPS 140-3 now
  • Who benefits most from a validated crypto module
  • How to integrate wolfCrypt into common crypto backends
  • A detailed case study of IGEL’s journey to FIPS 140-3 compliance

If your team is considering FIPS 140-3 or is already deep into Linux crypto architecture, this session is for you. We’ll help you cut through the confusion and give you a concrete path forward.

Register now to secure your spot!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL: Pioneering the Next Evolution of FIPS 140-3 Security! – Part 3

While having “all the algorithms, modes, and key sizes” available is nice, sometimes it is too much. wolfSSL is pleased to offer FIPS 140-3 tailoring services.

We can take any of our larger FIPS 140-3 module(s), strip them down to just the bare essentials, and validate just the subset. Need only ECDSA (verify) and SHA-512 for secure firmware verification and authentication, no entropy, nothing? No problem! Thanks to the wolfSSL modular design, we can custom-tune and validate smaller, more precise subsets of our larger module(s) that exist today.

Unlock efficient, targeted FIPS 140-3 security without unnecessary overhead. Contact us at fips@wolfssl.com to discuss your unique requirements and explore the possibilities of a right-sized FIPS 140-3 module!

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL: Pioneering the Next Evolution of FIPS 140-3 Security! – Part 2

wolfSSL is launching new FIPS 140-3 level 2 and level 3 validation services to make achieving compliance easier than ever. Our team will test our software module on your target hardware for Level 2 and Level 3, guiding your device through the validation process with little to no burden on your team. You provide the hardware and physical elements, wolfSSL will deliver the certifiable software in any configuration you need, plus the validation expertise. Contact us today at fips@wolfSSL.com to get started on your FIPS 140-3 level 2 or level 3 validation journey.

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL: Pioneering the Next Evolution of FIPS 140-3 Security! – Part 1

Building on our legacy of FIPS 140-3 certified solutions, wolfSSL is in the planning stages of forging our full FIPS 140-3 submission. This next iteration will integrate cutting-edge post quantum cryptography, featuring ML-KEM (FIPS 203, derived from CRYSTALS-KYBER), ML-DSA (FIPS 204, derived from CRYSTALS-Dilithium), LMSS (verify), and XMSS (verify) (SP800-208, needed for NSA 2.0 Transition schedules), all securely contained within the latest FIPS 140-3 boundary.

Want to be at the forefront of this advancement? Become a Charter Member on this effort by collaborating with us while still in the planning stages! Reach out to us at fips@wolfssl.com to discuss options.

Charter Member Advantages: Ensure your Operating Environment is incorporated into the initial submission, accelerate your time-to-market by avoiding post-validation efforts to get your OE added. Time is of the essence!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: wolfSSL 2025 Roadmap

Discover What’s New in Embedded Cybersecurity in the wolfSSL 2025 Roadmap Webinar

The future of embedded cybersecurity is rapidly evolving, and wolfSSL is leading the way. Join us on June 12th at 9 AM PT for an exclusive look at the wolfSSL 2025 Roadmap, presented by wolfSSL Engineering Manager, Chris Conlon.

Register now: wolfSSL 2025 Roadmap
Date: June 12th | 9 AM PT

In this webinar, Chris will unveil major updates, new features, and strategic initiatives shaping our direction in 2025 and beyond. From FIPS 140-3 and post-quantum cryptography to evolving protocol support and deeper industry integrations, discover how wolfSSL is preparing for the next generation of embedded security.

Whether you’re securing satellites, designing safety-critical automotive systems, or implementing industrial control solutions, this webinar offers insight into the technologies that matter most to security-critical development.

Register now to secure your post!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: wolfSSL solutions for the AMD/Xilinx UltraScale+ MPSoC and Versal – Tailored for the Asia-Pacific Time Zone

Learn how to secure AMD/Xilinx UltraScale+ MPSoC Versal with wolfSSL’s high-performance cryptographic solutions.

As cybersecurity threats evolve, embedded systems require robust, high-performance cryptography. wolfSSL provides lightweight, high-speed, and FIPS 140-3 validated cryptography tailored for resource-constrained environments like AMD/Xilinx UltraScale+ MPSoC and Versal. With support for secure boot, firmware updates, and TLS 1.3, wolfSSL ensures end-to-end security while meeting key compliance standards such as DO-178 and CNSA 2.0.

Join wolfSSL Senior Software Engineer David Garske for a deep dive into best practices for securing AMD/Xilinx-based embedded systems. Learn how to implement secure boot, firmware updates, and TLS 1.3 while ensuring compliance and optimizing performance.

Register Now: wolfSSL solutions for the AMD/Xilinx UltraScale+ MPSoC and Versal – Tailored for the Asia-Pacific Time Zone
Date: June 11th | 7 PM PT / June 12th | 11 AM JST
(This webinar is tailored for the Asia-Pacific Time Zone)

What You’ll Learn:

  • wolfSSL solutions for AMD/Xilinx UltraScale+ MPSoC and Versal
  • Best practices for embedded security
  • Post-Quantum Cryptography (PQC), CNSA 2.0, and Cyber Resilience Act (CRA) updates
  • FIPS 140-3 and DO-178 compliance essentials
  • Secure boot implementation and cryptographic performance

Register now to secure your AMD/Xilinx UltraScale+ systems with wolfSSL!

As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Curve25519 Blinding Support Added in wolfSSL 5.8.0

As of wolfSSL version 5.8.0, support for Curve25519 blinding has been introduced. Although originally listed as a feature addition in the changelog, it is more accurately characterized as a mitigation for a potential side-channel vulnerability affecting specific builds. This feature offers optional hardening against power or electromagnetic (EM) analysis during Curve25519 private key operations. While such attacks are generally difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation.

When Blinding Is Applicable

Blinding is only relevant for builds that use the C implementation of Curve25519 in wolfSSL. It is not available or necessary in the following cases:

  • Assembly-optimized implementations (–enable-armasm / WOLFSSL_ARMASM, –enable-intelasm / USE_INTEL_SPEEDUP)
  • The small footprint Curve25519 build (–enable-curve25519=small / CURVE25519_SMALL)

To enable blinding in the C implementation, define the macro WOLFSSL_CURVE25519_BLINDING. For example:

bash
CopyEdit
./configure --enable-curve25519 CPPFLAGS=-DWOLFSSL_CURVE25519_BLINDING

Affected APIs

Blinding hardens operations where the private key is used with scalar multiplication, such as:

  • wc_curve25519_export_public_ex – when deriving the public key from a private key
  • wc_curve25519_make_key – during key pair generation
  • wc_curve25519_generic
  • wc_curve25519_shared_secret_ex

If you are using the C implementation on hardware where physical side-channel exposure is a concern, it’s recommended to enable blinding and regenerate private keys used in these operations. Curve25519 blinding will be enabled by default for the C implementation in future wolfSSL releases.

Acknowledgments

Thanks to Arnaud Varillon, Laurent Sauvage, and Allan Delautre from Telecom Paris for reporting this.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL Adds Support for Open Watcom Compiler

Introduction

The wolfSSL embedded SSL/TLS library has recently expanded its compatibility by adding support for the Open Watcom C/C++ compiler. This enhancement enables developers to build wolfSSL using Open Watcom across multiple platforms including Windows, Linux, and OS/2. This blog post explores the new Open Watcom support, its features, and how to leverage it in your projects.

What is Open Watcom?

Open Watcom is an open-source compiler suite derived from the commercial Watcom C/C++ compiler. It’s particularly valued for its:

  • Cross-platform capabilities (Windows, OS/2, DOS, Linux)
  • Efficient code generation
  • Strong support for legacy systems
  • Continued development by the open-source community

The compiler is especially important for maintaining and developing software for OS/2 and other legacy systems that still have active user communities.

New Features in wolfSSL for Open Watcom

The recent pull requests #8505 and #8484 have implemented several features to ensure wolfSSL works seamlessly with Open Watcom:

  1. Multi-Platform Support:
    • Windows builds
    • Linux builds
    • OS/2 builds (particularly significant as OS/2 support is rare in modern libraries)
  2. Build Configuration Options:
    • Single-threaded and multi-threaded builds
    • Static library and DLL (Dynamic Link Library) options
    • Compatibility with Open Watcom 1.9 and newer versions (2.0+)
  3. OS/2-Specific Enhancements:
    • Socket handling for OS/2 networking
    • Thread management for OS/2’s unique threading model
    • Proper mutex implementation for OS/2
  4. Technical Improvements:
    • Renamed OFFSETOF macro to WC_OFFSETOF to avoid conflicts with OS/2 headers
    • Added proper time handling functions for Open Watcom
    • Implemented conditional compilation for platform-specific code
    • Fixed socket and I/O handling for cross-platform compatibility

Use Cases and Benefits

The addition of Open Watcom support opens up several possibilities:

  1. Legacy System Integration: Integrate modern TLS security into legacy systems running OS/2 or older Windows versions.
  2. Cross-Platform Development: Develop secure applications that can be compiled for multiple platforms using a single compiler.
  3. Educational Environments: Universities and educational institutions that use Open Watcom for teaching can now incorporate wolfSSL in their security curriculum.
  4. Embedded Systems: Some embedded systems with specific requirements may benefit from Open Watcom’s efficient code generation.

Summary

The addition of Open Watcom support to wolfSSL shows our versatility by supporting this compiler across Windows, Linux, and especially OS/2 platforms. This feature enables developers working with legacy systems, educational environments, and specific embedded platforms to leverage wolfSSL’s robust security features.

The implementation includes comprehensive support for different threading models and library types, ensuring that developers have flexibility in how they integrate wolfSSL into their projects. Whether you’re maintaining legacy applications, teaching security concepts, or developing cross-platform solutions, the Open Watcom support in wolfSSL provides a valuable tool in your development arsenal.

As the security landscape continues to evolve, this enhancement ensures that even systems using older or specialized compilers can maintain modern security standards through wolfSSL’s TLS implementation.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2 3 4 5 6 7 8 9 10 … 208 209 210