Some of our users have been wondering if we were doing benchmarks of our SSL/TLS and cryptography performance. Here are the results we have gathered so far: wolfSSL / wolfCrypt Benchmarking. This page includes several reference benchmarks as well as comparisons of software versus hardware cryptography.
Let us know if we should do a different kind of benchmark at facts@wolfssl.com.
To the benefit of our end users and customers, wolfSSL completed yet another year of successful growth in our technology advancement, our business, and our personnel. Our build out of the company is on track and we expect another banner year in 2018! Our advancement is outlined in detail below, but particular attention should be paid to some key improvements:
We are fortunate to be able to provide all of the above, and more, to our users! It is with great zeal that we develop and deliver our products, because we think it is important to the market to have a high quality, independent provider of crypto. Thank you all for your trust.
Team wolfSSL
Securing two billion connections and counting
A total of six releases of the wolfSSL embedded TLS library were delivered in 2017, each with bug fixes, enhancements, and new feature additions. Highlights of these releases included:
You’ll undoubtedly notice one the themes for this year was the early adoption of TLS 1.3 because the smaller footprint, less resource use, reduction of latency, and frankly better security. The other two themes that may not be so obvious is our focus on Hardware Based Security Enclaves or Elements to provide secure key storage, and our work on Asynchronous Crypto which passes off asymmetric operations to network acceleration cards like Cavium Nitrox and Intel QuickAssist.
The wolfSSL team participated in a total of 32 events in 2017, which was up from 20 in 2016! As part of these events we were in 22 cities, 10 US states, and 6 countries! The events we participated this last year included:
To see upcoming events that wolfSSL will be attending, check out our upcoming events page.
In summary, we had a great year! 2017 was successful for us on multiple fronts, and we look forward to serving our customers and community with ever more secure and functional software in 2018! As always, your feedback is welcome at facts@wolfssl.com!
It has been 4 years since the TLS v1.3 specification came out with Draft 1 and it looks like it has been finalized! With the release of Draft 24 the last of the WG comments have been addressed. Now the IESG will review the document and it is expected that it will soon be ratified as an RFC.
wolfSSL has updated its TLS v1.3 code to include support for Draft 22 and 23. Draft 24 is not significantly different and with the highly anticipated release of the RFC, we are looking forward to finalizing the TLS v1.3 code.
The last time we discussed TLS v1.3 the specification was at Draft 21. Since then a number of changes have been made to deal with middlebox incompatibilities.
Middleboxes are devices that sit between the client and the server that typically inspect, filter or act as a proxy. They are a necessary part of the Internet ecosystem. Inspection middleboxes are used to monitor network traffic and to collect statistics. Filters attempt to detect and remove undesirable network traffic that is malformed or malicious. Proxy-servers are used to terminate TLS connections to better manage the network traffic and spread load.
Middleboxes include embedded devices that are updated by changes to the firmware. Therefore updates are seldom made and the TLS v1.3 specification had to be modified to work with the deployed systems.
Mozilla performed a customer test with their browser connecting to a controlled website supporting Draft 18. The results (https://www.ietf.org/mail-archive/web/tls/current/msg25091.html) were that TLS v1.3 Draft 18 failed 2.91% of the time compared to TLS v1.2 failure rate of 1.58%. This was statistically significant. After some compatibility changes the failure rate fell to 1.63%. It was clear the changes were needed.
The changes required include:
It was first assumed that middleboxes would inspect ClientHello messages and pretty much ignore the responses like ServerHello and HelloRetryRequest messages. This didn’t work out in the real world. Therefore some of the ServerHello changes from TLS v1.2 had to be undone. All required changes are now available in wolfSSL.
Further optional compatibility changes are specified. This includes sending a ChangeCipherSpec before any encrypted data, thus the previous requirement to ignore these messages. wolfSSL has the ability to enable these with the use of the define: WOLFSSL_TLS13_MIDDLEBOX_COMPAT.
A more extensive test was performed by Mozilla after Draft 22 was released. The results (https://www.ietf.org/mail-archive/web/tls/current/msg25179.html) were:
It is clear that the Draft 22 changes are working.
Draft 23 renumbered the KeyShare extension to allow for compatibility with CANON printers that were based on BSAFE and added a separate extension for negotiating certificate signatures.
wolfSSL by default supports Draft 23 but can be configured to support Draft 22 with: –enable-tls13-draft22. Also, for backwards compatibility for early adopters, Draft 18 support can be configured with: –enable-tls13-draft18.
If you have any questions or issues with wolfSSL’s TLS 1.3 implementation, please email us at facts@wolfssl.com, or our support team at support@wolfssl.com.
MySQL (#mysql) currently comes bundled with yaSSL to provide an option for SSL/TLS connections when using a database. A patch for securing MySQL with the wolfSSL embedded SSL/TLS library is available for MySQL version 8.0.0 here https://github.com/wolfSSL/mysql-patch.
Along with an increased level of security comes the potential to use progressive features offered by wolfSSL – such as TLS 1.3 and ChaCha20 / Poly1305 AEAD cipher suites (ex: ECDHE-RSA-CHACHA20-POLY1305). Another great feature is that wolfSSL cryptography is FIPS 140-2 validated! The change from yaSSL to wolfSSL will fit nicely into both Open Source and commercial applications, as it is dual licensed under both GPLv2 and standard commercial license terms.
For more information about the port, or to provide us feedback, contact us at facts@wolfssl.com!
wolfSSL is a growing company looking to add a top notch embedded systems software engineer to our organization. wolfSSL develops, markets and sells the leading Open Source embedded SSL/TLS protocol implementation, wolfSSL. Our users are primarily building devices or applications that need security. Other products include wolfCrypt embedded cryptography engine, wolfMQTT client library, and wolfSSH.
Currently, we are seeking to add a senior level C software engineer with 5-10 years experience interested in a fun company with tremendous upside. Backgrounds that are useful to our team include networking, security, and hardware optimizations. Assembly experience is a plus. Experience with encryption software is a plus. RTOS experience is a plus. Experience with hardware-based cryptography is a plus.
Operating environments of particular interest to us include Linux, Windows, Embedded Linux and RTOS varieties (VxWorks, QNX, ThreadX, uC/OS, MQX, FreeRTOS, etc). Experience with mobile environments such as Android and iOS is also a plus, but not required.
Location is flexible. For the right candidate, we’re open to this individual working from virtually any location.
To apply or discuss, please send your resume and cover letter to facts@wolfssl.com.
