The Top 5 Build Options for Security in wolfSSL

Here at wolfSSL, we love giving the community and our customers lots of choices and options. That said, for the vast majority of our user base, all the options we are discussing in this post should be enabled to maximize your security and minimize your adversary’s opportunities.

#define WOLFSSL_HARDEN_TLS 112 or –enable-harden-tls=112

enables the following algorithms at the following key lengths
  DH: at least 2048 bit keys
  RSA: at least 2048 bit keys
  ECC: at least 224 bit keys

#define WOLFSSL_HARDEN_TLS 128 or –enable-harden-tls=128

  Disables 3DES ciphersuites
  DH: at least 3072 bit keys
  RSA: at least 3072 bit keys
  ECC: at least 256 bit keys

#define NO_OLD_TLS or –diable-oldtls

This disables older protocols that are inherently insecure. The only protocols that are built are (D)TLS 1.2 and 1.3.

#define HAVE_ALPN or –enable-alpn

This helps to ensure that the right application is processing the connection. Please see RFC document for more details about how to use this TLS extension.

#define WOLFSSL_CIPHER_TEXT_CHECK or –enable-maxstrength

Add in extra checks after the processing of ciphertext input in order to mitigate glitching attacks.

#define WC_RSA_BLINDING or –enable-harden

RSA blinding involves transforming the input just before the RSA private key operations using some random data. After the operation, the reverse of the transform is performed giving the desired output. This prevents an adversary from gaining knowledge about the private key as they don’t know the random data that was used to determine the transform and therefore do not know the true input into the RSA private key operation.

#define TFM_TIMING_RESISTANT #define ECC_TIMING_RESISTANT or –enable-harden

These allow for constant time implementations of the math used in private key operations to mitigate timing attacks.

Oops, looks like we went a bit over 5! Want even more? Thinking about turning some of these off to get performance gains or reduce memory usage? Send a message to to start a conversation about it!

If you have questions about any of the above, please contact us at or +1 425 245 8247.

Download wolfSSL Now