SealSQ, a WISeKey company, designs secure semiconductors and hardware security products – including the VaultIC secure element family and post-quantum devices – with a focus on post-quantum-ready security.
wolfSSL now includes an in-tree port for the SealSQ VaultIC408 secure element. It offloads TLS ECC P-256 sign, verify, key generation, and ECDH to the chip through wolfSSL’s PK callbacks or the wolfCrypt crypto callback (devId) framework. The device and CA certificates are read from the chip. The private key never leaves the secure element.
Enable it with –enable-vaultic against the SealSQ VaultIC-TLS SDK. We validated it on a Raspberry Pi 5 with a VaultIC408 across full TLS 1.2 and TLS 1.3 handshakes, with the P-256 ECC work handled by the chip. The TLS 1.3 test negotiated the P-256 + ML-KEM-768 hybrid group. wolfCrypt performed the ML-KEM-768 key exchange in software, since the VaultIC408 is an ECC device with no post-quantum support.
Looking ahead: SealSQ is sampling their TPM 2.0 PQC (v1.85) module hardware and it is fully supported in wolfTPM. Also they are soon releasing a PQC version of their secure micro-controller QS7001 and we’ll be adding support for that in wolfCrypt soon.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now