wolfSSL now supports the stateful hash-based signature schemes LMS/HSS and XMSS/XMSS^MT in X.509 certificates, following RFC 9802. What’s New Both sides of the certificate lifecycle are covered: Generation – Sign certificates and CSRs with an LMS/HSS or XMSS/XMSS^MT key, encoded exactly as RFC 9802 specifies. Verification – Parse and verify certificate chains that use these […]
Read MoreMore TagCategory: wolfSSL/ wolfCrypt
wolfCrypt on the TI C2000 C28x: PQC ML-DSA/ML-KEM on a 16-bit-byte DSP
We’re excited to share that wolfCrypt now runs a full modern crypto suite on Texas Instruments’ C2000 C28x – the NIST post-quantum schemes ML-DSA (FIPS 204) and ML-KEM (FIPS 203), plus RSA, Diffie-Hellman, AES, ChaCha20-Poly1305, HMAC/HKDF, the Curve25519/Ed25519, Curve448/Ed448, and NIST P-256 elliptic-curve schemes, and the SHA-1/2/3 and SHAKE hash families – all validated on […]
Read MoreMore TagwolfSSL adds LMS and XMSS to wolfHSM
LMS and XMSS are stateful hash-based signature schemes (NIST SP 800-208) suited to long-lived firmware and code signing. wolfSSL has added support for both post-quantum cryptographic (PQC) algorithms to wolfHSM. This feature leverages the hardware security module (HSM) to securely and persistently store the “stateful” key and counter for both algorithms, as well as perform […]
Read MoreMore TagMbedOS End of Life; but wolfSSL on MbedOS lives on
MbedOS goes into End-of-Life in July this year, but as we are committed to our customers and their security, we will still support wolfSSL product on MbedOS going forward. If you’re in a pinch with CRA or other security requirements, feel free to contact us at facts@wolfssl.com, and we’ll work out a plan with you […]
Read MoreMore TagIntroducing tinytls13: A minimal TLS 1.3 build profile that fits a complete client in about 30 KB of flash.
In brief. tinytls13 is a new wolfSSL build profile for deeply constrained devices. It compiles a complete, working TLS 1.3 client in about 30.8 KB of flash on an ARM Cortex-M33, with no X.509 and no extras you did not ask for. Why we built it Secure boot, attestation, and IoT connectivity increasingly need TLS […]
Read MoreMore TagXilinx Versal Gen 2 ASU support coming to wolfSSL
wolfSSL is proud to announce that active development has started to support offloading cryptographic operations to the ASU subsystem found on the Xilinx Versal Gen 2. We are currently implementing offload support for TRNG, SHA2, SHA3, SHAKE, HMAC, AES, RSA, and ECC. This will help enable future wolfSSL projects on the Versal Gen 2 platform, […]
Read MoreMore TagWhite House EO 14412
By now, anyone who tracks security protocols has heard ad nauseum about the White House Executive Order 14412 regarding post-quantum cryptography (PQC). In case you’ve been hiding under a rock, it can be found here. The TL;DR is that all High Value Assets (HVAs) must use PQC key establishment by 2030 and PQC digital signatures […]
Read MoreMore TagPreliminary MACsec Key Agreement (MKA) Support, Built for AUTOSAR
Secure in-vehicle and industrial Ethernet is moving from “nice to have” to “required,” and MACsec (IEEE 802.1AE) is at the center of it — providing line-rate Layer 2 encryption, integrity, and replay protection directly on the wire. But MACsec doesn’t key itself. It needs a control plane to discover peers, prove liveness, elect a Key […]
Read MoreMore TagwolfSSL 5.9.2 release blog
wolfSSL 5.9.2 has been released with a broad range of new features and enhancements around Post-Quantum Cryptography, crypto callback support, our Rust wrapper, and embedded hardware support. Similar to wolfSSL 5.9.1, a large number of CVEs are addressed in this release, along with general bug fixes. Additionally, there are some security hardening behavior changes we […]
Read MoreMore TagwolfSSL vs MbedTLS – An apples-to-apples benchmark across Intel, ARM (Cortex-A and Cortex-M), and RISC-V targets.
Scope: the full wolfCrypt algorithm suite vs MbedTLS, measured the same way on four platforms (Intel x86_64, a Raspberry Pi 5 (ARMv8-A Cortex-A76), a bare-metal STM32H563 Cortex-M33, and a Microchip PolarFire SoC RISC-V U54), plus the post-quantum and extended-algorithm coverage MbedTLS does not have. wolfSSL v5.9.1, MbedTLS 3.6.6, June 2026. Method: identical sources built from […]
Read MoreMore Tag