Month: September 2019

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg) 

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Azure Sphere is Microsoft’s innovative ecosystem centered around IoT device security.  The ecosystem includes the MT3620 IoT MCU, the Azure Sphere OS that runs on the MT3620, and a security service that brokers device-to-cloud communications.

The MT3620 has an Arm Cortex-A7 application processor, two real-time Arm Cortex-M4F I/O subsystems and a dedicated Wi-Fi subsystem.  This combination allows for a diverse and flexible range of IoT use cases. What really makes the MT3620 stand out is the Microsoft Pluton security subsystem and other security related features.  Pluton on the MT3620 is made up of an Arm Cortex-M4F core that is isolated from end-user accessible cores. It allows for secure boot and secure system operation. Other MT3620 security features are authentication, attestation, and over-the-air software updates.

Creating an application for the MT3620 is done with the Azure Sphere SDK Preview for Visual Studio.  wolfSSL has recently released a Visual Studio solution that contains three projects for the MT3620. The three projects are a TLS encrypted client, TLS encrypted server and a cryptographic algorithm test for the wolfCrypt library.

Getting Started

• Purchase an Azure Sphere MT3620 development board.
• Setup your MT3620 device with Azure Sphere Documentation.
• Download or clone wolfSSL.
• Follow the Set Up Steps in the README.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Read more about Azure Sphere.

wolfSSL’s embedded SSL/TLS library comes with support for many tools and libraries, one of which is curl! In addition to providing support and maintenance for curl, wolfSSL has also integrated the curl library in conjunction with Daniel Stenberg (an original author of curl and one of the founders). With this integration, wolfSSL now provides support and consulting for the curl library.

In addition, a modified version of the curl library, tiny-curl, is also available through wolfSSL. tiny-curl is a patch applied on top of curl to reduce its code size, which makes it favorable for embedded and real-time environments. Version 0.10 of tiny-curl is based on curl version 7.65.3, and is available for download from the wolfSSL download page: https://www.wolfssl.com/download/.

More information about wolfSSL and curl can be found on the curl product page: https://www.wolfssl.com/products/curl/. Details on wolfSSL support for curl and tiny-curl is also located on the support page here: https://www.wolfssl.com/products/support-packages/.

wolfSSL also provides support for the latest versions of the TLS protocol, including TLS 1.3! As such, wolfSSL is considering adding TLS 1.3 support to cURL in the future. More information about wolfSSL and TLS 1.3 can be found here: https://www.wolfssl.com/docs/tls13/.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

In preparation for the 2019 Fall Career Fair at MSU Bozeman, wolfSSL will be holding an info session this upcoming Thursday at Montana State University in Bozeman, MT for students interested in learning more about wolfSSL and our internship program.  The session will introduce wolfSSL as a company – including background information, product lineup, work environment, and more.

We encourage any students who are interested in Internet security, SSL/TLS, cryptography, embedded security, or software development to attend!  Pizza will be served.

wolfSSL Info Session
Thursday, September 26, 2019
Montana State University, Bozeman
5-6pm, Roberts Hall 210

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The MQTT Sensor Network standard provides a lightweight networking protocol perfectly suited for low cost, low power hardware. The protocol allows using small topic identifiers in place of the full topic name when sending and receiving publish data.

The wolfMQTT SN Client implementation is based on the OASIS MQTT-SN v1.2 specification. The SN API is configured with the --enable-sn option. There is a separate API for the sensor network API, which all begin with the “SN_” prefix. The wolfMQTT SN Client operates over UDP, which is distinct from the wolfMQTT clients that use TCP. The following features are supported by the wolfMQTT SN Client:

• Register
• Will topic and message set up
• Will topic and message update
• All QoS levels
• Variable-sized packet length field

You can download the latest release of wolfMQTT from our website or clone the repository from GitHub.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

With the recent release of wolfSSL 4.1.0, the wolfSSL team has also updated the wolfSSL FIPS Ready library. This product features new, state of the art concepts and technology. In a single sentence, wolfSSL FIPS Ready is a testable and free to download open source embedded SSL/TLS library with support for FIPS validation, with FIPS enabled cryptography layer code included in the wolfSSL source tree. To further elaborate on what FIPS Ready really means, you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS validation is a government certification for cryptographic modules that states the module in question has undergone thorough and rigorous testing to be certified. FIPS validation specifies that a software/encryption module is able to be used within or alongside government systems. The most recent FIPS specification is 140-2, with various levels of security offered (1-5). Currently, wolfCrypt has FIPS 140-2 validation with certificates #2425 and #3389. When trying to get software modules FIPS validated, this is often a costly and time-consuming effort and as such causes the FIPS validated modules to have high price tags.

Since the majority of wolfSSL products use the wolfCrypt encryption engine, this also means that if wolfSSH, wolfMQTT (with TLS support), wolfBoot, and other wolfSSL products are in place, they can be tested using FIPS validated code with their software before committing.

wolfSSL FIPS Ready can be downloaded from the wolfSSL download page, here: https://www.wolfssl.com/download/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL provides support on four levels, one of which is the 24×7 support level. This support level includes many key features not available on the others, such as an unlimited number of support incidents, around-the-clock support from dedicated members of the wolfSSL support team, and remains in effect for an entire year.

wolfSSL provides three other levels of paid support, which also include some of the same features provided by 24×7 support. More details on the wolfSSL support packages and levels can be viewed here: https://www.wolfssl.com/products/support-packages-options/

wolfSSL also provides support for the latest version of the TLS protocol, TLS 1.3! Read more about wolfSSL’s implementation and the protocol itself here: https://www.wolfssl.com/docs/tls13/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until December 2020. The version of OpenSSL that supports FIPS goes into End Of Life and is no longer supported in December of 2019.

This means that OpenSSL users will not have a supported package for over a year. This is a big issue for companies that rely on security.

To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:

1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,

2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,

3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL

At wolfSSL we try to be progressive with our support of new cryptography technology. We were the first TLS implementation to support DTLS v1.2 and we were the first embedded TLS implementation to support TLS v1.3.

There has been a lot of buzz in the media recently about “post-quantum” cryptography. This is mostly about which public key algorithms we will use in the near future. Soon, a large enough quantum computer will be built that can run Shor’s algorithm. It will almost instantaneously find factors for really large numbers, like RSA keys or points on elliptic curves. This is a serious problem for network security that is a matter of when it will happen, not if. We will need new algorithms that don’t depend on multiplying large numbers.

One contender for the future of public key cryptography immune to Shor’s algorithm and quantum computers is in the field of lattice mathematics. There exists a set of algorithms based on the work done by Security Innovation and their algorithm NTRU. You can configure wolfSSL to take advantage of Security Innovation’s NTRU library.

To take advantage of NTRU and other quantum safe public key operations in TLS, some extensions have been proposed for inclusion with TLS v1.3 and TLS v1.2 for Quantum Safe Hybrid, or QSH. These allow one to use one-time quantum-safe key pairs in addition to existing certificates.

The future on the cryptography landscape is scary and exciting. We at wolfSSL Inc want to help you navigate these dangers with cutting edge technologies like NTRU and other quantum computing safe algorithms.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.