On Yocto Linux Scarthgap, the wolfSSL endpoint process peaks at 10–13 KB of heap + stack, compared with 750–790 KB for OpenSSL, for an ECDHE P-256 / ECDSA P-256 / AES-128-GCM connection. These figures apply in both directions and to both TLS 1.2 and TLS 1.3. On OpenWRT using uclient-fetch to grab 100k of data, […]
Read MoreMore TagCategory: wolfSSL/ wolfCrypt
SSH Extended Key Usage and OID Collision Mitigation in wolfSSL 5.9.4
With the release of wolfSSL 5.9.4, Extended Key Usage (EKU) support for SSH X509 certificates was added. Under RFC 6187, two SSH key purposes are specified: id-kp-secureShellClient (1.3.6.1.5.5.7.3.21) and id-kp-secureShellServer (1.3.6.1.5.5.7.3.22). Previously the default ASN.1 template parser omitted SSH purposes and neither parser recognized the server purpose; both are now fully parsed. Builds configured with […]
Read MoreMore TagMbed TLS After April 2027: What It Means for Your Product
If your product runs Mbed TLS today, 2027 brings a decision. In October 2026 the Mbed TLS team announced that its current maintainers will stop working on the TLS and X.509 libraries in April 2027, one month after the 3.6 LTS branch reaches end of life. Mbed TLS has served embedded developers well for many […]
Read MoreMore TagTuning wolfSSL for Cortex-M: Build Options for Speed and Code Size
A wolfSSL build for Cortex-M defaults to the smallest public key math, which is also the slowest. Three configuration changes made a full TLS 1.3 handshake ten times faster, from 2800 ms down to 262 ms, and left the image smaller at the same time. Every figure below was measured on a NUCLEO-U385RG-Q (STM32U385, Cortex-M33). […]
Read MoreMore TagwolfSSL on the Silicon Labs EFR32 Secure Element
wolfSSL now offloads cryptography to the Silicon Labs EFR32 Series 2 Secure Element through wolfCrypt crypto callbacks. Define WOLFSSL_SILABS_CRYPTOCB, and your application code does not change. This covers wolfCrypt and TLS together. Because operations route by device id rather than by a compile time hook, the same offload serves a direct wolfCrypt API call and […]
Read MoreMore TagHardware Crypto for the Nuvoton NuMicro M2354
wolfSSL now runs its cryptography on the hardware accelerators of the Nuvoton NuMicro M2354, an Arm Cortex-M23 microcontroller with TrustZone. Hashing, AES, RSA, and elliptic curve operations move off the CPU and onto the chip’s CRPT engine. Offloads SHA-1 through SHA-512, AES in ECB, CBC and CTR modes, AES-GCM and AES-CCM authenticated encryption, RSA, ECDSA […]
Read MoreMore TagwolfSSL supports the S32K3 ACE Accelerator
wolfSSL now supports offloading AES-ECB and AES-CMAC operations on S32K3 family devices equipped with the ACE accelerator. This accelerator is featured specifically on the S32K388 and S32K389. The ACE accelerator provides a significant speedup compared to our software implementation and the native HSE operations available on the S32K3. This means you can keep your keys […]
Read MoreMore TagwolfSSL 5.9.4 Release Blog
wolfSSL 5.9.4 is now available with new cryptographic algorithms, expanded post-quantum support, new hardware ports, significant assembly performance work, and a number of vulnerability fixes. Users are always recommended to stay up to date with wolfSSL releases. In this release the use cases affected by high severity reports are: trusted peer certificates (WOLFSSL_TRUST_PEER_CERT, including builds […]
Read MoreMore TagHigh-Entropy Random Numbers from Oscillator Jitter on C2000 C28x
The LAUNCHXL-F28P55X (TMS320F28P550SJ) features a 150 MHz C28x DSP from TI’s C2000 real-time control family. Designed for motor drives, solar inverters, EV chargers, and digital power supplies, it lacks a hardware TRNG. However, it provides three independent clock sources: two on-chip RC oscillators (INTOSC1 and INTOSC2) and the crystal driving the PLL. Using the chip’s […]
Read MoreMore TagBringing wolfSSL in line with RFC 9846
RFC 9846, published in July 2026, obsoletes RFC 8446 as the specification for TLS 1.3. It is a minor revision in that it is backward compatible, but it tightens a number of requirements that were previously advisory. At wolfSSL, we are working hard on implementing the specification. No KeyUpdate while sending early data. Section 5.5 […]
Read MoreMore Tag