Month: August 2019

wolfSSL MQTT Sensor Network (MQTT-SN)

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

  • Register
  • Will topic and message set up
  • Will topic and message update
  • All QoS levels
  • Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL with #curl and #tiny-curl

wolfSSL’s embedded SSL/TLS library comes with support for many tools and libraries, one of which is curl! In addition to providing support and maintenance for curl, wolfSSL has also integrated the curl library in conjunction with Daniel Stenberg (an original author of curl and one of the founders). With this integration, wolfSSL now provides support and consulting for the curl library.

In addition, a modified version of the curl library, tiny-curl, is also available through wolfSSL. tiny-curl is a patch applied on top of curl to reduce its code size, which makes it favorable for embedded and real-time environments. Version 0.10 of tiny-curl is based on curl version 7.65.3, and is available for download from the wolfSSL download page: https://www.wolfssl.com/download/.

More information about wolfSSL and curl can be found on the curl product page: https://www.wolfssl.com/products/curl/. Details on wolfSSL support for curl and tiny-curl is also located on the support page here: https://www.wolfssl.com/products/support-packages/.

wolfSSL also provides support for the latest versions of the TLS protocol, including TLS 1.3! As such, wolfSSL is considering adding TLS 1.3 support to cURL in the future. More information about wolfSSL and TLS 1.3 can be found here: https://www.wolfssl.com/docs/tls13/.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL FIPS-Ready

With the recent release of wolfSSL 4.1.0, the wolfSSL team has also updated the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS validation is a government certification for cryptographic modules that states the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.

Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products are in place, they can be tested using FIPS validated code with their software before committing.

wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL MQTT Sensor Network (MQTT-SN)

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

  • Register
  • Will topic and message set up
  • Will topic and message update
  • All QoS levels
  • Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL FIPS-Ready

With the recent release of wolfSSL 4.1.0, the wolfSSL team has also updated the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS validation is a government certification for cryptographic modules that states the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.

Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products are in place, they can be tested using FIPS validated code with their software before committing.

wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfCrypt as an engine for OpenSSL

As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until December 2020. The version of OpenSSL that supports FIPS goes into End Of Life and is no longer supported in December of 2019.

This means that OpenSSL users will not have a supported package for over a year. This is a big issue for companies that rely on security.

To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:

1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,

2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,

3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL

wolfSSH 1.4.2 Release

wolfSSH Version 1.4.2 Has Been Released!!

This version of wolfSSH includes some new feature additions and fixes.

Additional features and code changes added to wolfSSH include:

  • Added example server with Renesas CS+ port
  • Add structure size print out option -z to example client when the macro WOLFSSH_SHOW_SIZES is defined
  • Additional automated tests of wolfSSH_CTX_UsePrivateKey_buffer and fix for call when key is already loaded
  • Refactoring done to internal handling of packet assembly
  • Add client side public key authentication support
  • Support added for global requests
  • Addition of WS_USER_AUTH_E error returned when user authentication callback returns WOLFSSH_USERAUTH_REJECTED

Fixes added in the release include :

  • GCC 8 build warning fixes
  • Fix for warning with enums used with SFTP and set socket type
  • Fix for initializing UserAuthData to all zeros before use
  • Fix for SFTP “LS” operation when setting the default window size to 2048
  • Fix for NULL dereference warning, rPad/sPad initialization and SFTP check on want read. Thanks to GitHub user LinuxJedi for the reports
  • Remove void cast on variable not compiled in with single threaded builds

You can download the latest release here: https://www.wolfssl.com/download/

Additional information on wolfSSH can be found on the wolfSSH product page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Differences between TLS 1.2 and TLS 1.3 (#TLS13)

wolfSSL's embedded SSL/TLS library has included support for TLS 1.3 since early releases of the TLS 1.3 draft. Since then, wolfSSL has remained up-to-date with the TLS 1.3 specification. In this post, the major upgrades of TLS 1.3 from TLS 1.2 are outlined below:

TLS 1.3

This protocol is defined in RFC 8446. TLS 1.3 contains improved security and speed. The major differences include:

  • The list of supported symmetric algorithms has been pruned of all legacy algorithms. The remaining algorithms all use Authenticated Encryption with Associated Data (AEAD) algorithms.
  • A zero-RTT (0-RTT) mode was added, saving a round-trip at connection setup for some application data at the cost of certain security properties.
  • Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
  • All handshake messages after the ServerHello are now encrypted.
  • Key derivation functions have been re-designed, with the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) being used as a primitive.
  • The handshake state machine has been restructured to be more consistent and remove superfluous messages.
  • ECC is now in the base spec  and includes new signature algorithms. Point format negotiation has been removed in favor of single point format for each curve.
  • Compression, custom DHE groups, and DSA have been removed, RSA padding now uses PSS.
  • TLS 1.2 version negotiation verification mechanism was deprecated in favor of a version list in an extension.
  • Session resumption with and without server-side state and the PSK-based ciphersuites of earlier versions of TLS have been replaced by a single new PSK exchange.

More information about wolfSSL and the TLS 1.3 protocol can be found here: https://www.wolfssl.com/docs/tls13/.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Quantum Safe wolfSSL

wolfSSL, in partnership with Security Innovation, has support for the “Quantum-safe hybrid” ciphersuite. Having this ciphersuite supported in the wolfSSL embedded TLS library allows two parties to use any existing ciphersuite and “quantum-safe” any traffic protected by that ciphersuite. Adding in the quantum resistant section to the master secret increases protection against attackers who record the traffic and later develop quantum computers.

The super-fast NTRU algorithm, featuring efficient key generation, encryption, and decryption, is a quantum computer resistant algorithm currently being used with the quantum-safe ciphersuite. By using a one-time NTRU key to encrypt extra secret material, the handshake allows users to continue using their existing ciphersuites (which may be necessary for certificate support or because they have regulations that require it) while at the same time benefiting from the true long-term security that NTRU gives. Because NTRU is fast, the additional processing load from the use of this ciphersuite is low.

To view and use the quantum safe handshake extensions, first download and install NTRU (an Open Source version can be found at https://github.com/NTRUOpenSourceProject/ntru-crypto). Then download the most recent version of wolfSSL  (https://www.wolfssl.com/download/) and compile using ./configure –with-ntru –enable-qsh. The draft for QSH is located here https://tools.ietf.org/html/draft-whyte-qsh-tls13-00.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL MQTT Sensor Network (MQTT-SN)

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

  • Register
  • Will topic and message set up
  • Will topic and message update
  • All QoS levels
  • Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Posts navigation

1 2