Month: February 2023

We are establishing a timeline to deprecate our legacy math backend, which is called “normal” or “heap” math.  It will be removed  from the wolfSSL/wolfCrypt library by the end of this year.

Currently, our library includes three different math backends that can be used to support public cryptography:

1. Normal math (integer.c) which can be enabled with –enable-heapmath or CFLAGS=-DUSE_INTEGER_HEAP_MATH
2. Fast math (tfm.c) which can be enabled with –enable-fastmath or CFLAGS=-DUSE_FAST_MATH
3. SP math** (sp_int.c, Default) which can be enabled with –enable-sp-math-all or CFLAGS=-DWOLFSSL_SP_MATH_ALL

** Note: SP math comes with MANY tunable features including combinations of fastmath with sp or sp-math and key size toggles and heap/stack tuning knobs for nearly every use-case!

You can refer to https://www.wolfssl.com/wolfssl-math-library-comparison-matrix/ to see a comparison.

The SP math has been the default configuration math backend since wolfSSL release 5.4.0  (see https://github.com/wolfSSL/wolfssl/pull/4759).

The latest version of our SP math can do everything its predecessor can and then some! It also has constant-time and cache access safe algorithm implementations to prevent side-channels. (see https://www.wolfssl.com/wolfssl-hardened-default/)

Prior to wolfSSL release 5.4.0, if you build with –disable-fastmath (or #undef USE_FAST_MATH), normal math was utilized as a default backend.

Post release 5.4.0, you were required to use  –enable-heapmath ( #define USE_INTEGER_HEAP_MATH) to be able to use the normal math. 

Additionally, we are changing the math library for our FIPS users.

1. We are moving all of our normal math customers to use Fast math for users of –enable-fips=v2 or HAVE_FIPS_VERSION <= 2
2. We are moving all of our customers to use SP math for users of –enable-fips=v5 (FIPS 140-3) or HAVE_FIPS_VERSION > 2 (Also includes fips-ready and v5-dev)

If you have not done so already, we recommend migrating to the new SP math backend as early as possible.  It offers far superior performance, security, and longevity.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL is currently the leader in embedded FIPS certificates. With current FIPS 140-2 certificate #3389 for the wolfCrypt Cryptographic Module, wolfSSL is thrilled to be the first in upcoming FIPS 140-3 certification. Join the wolfSSL team as we cover all things FIPS 140-3. There will be a live Q&A so bring all your FIPS-related questions. We will cover the current transition to FIPS 140-3, its importance for cybersecurity, as well as how wolfSSL is implementing it in our products.

Watch the webinar here: Everything You Need to Know about FIPS 140-3

FIPS 140-3 is the third revision of the Federal Information Processing Standard (FIPS) for cryptographic modules. The new revision of the standard includes an increased focus on algorithm agility, updated requirements for testing and validation, including changes to the testing methodology. wolfSSL is at the forefront of this important transition, and is working to ensure that its products continue to meet the highest standards of security and compliance.

FIPS 140-3 establishes the security requirements for cryptographic modules used by the U.S. government, as well as other organizations in the public and private sectors. By complying with the FIPS 140-3 standard, organizations can have greater confidence in the security of their cryptographic solutions, which is particularly important in today’s world where data breaches and cyber attacks are becoming more frequent and sophisticated.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The wolfSSL lightweight SSL/TLS library and underlying wolfCrypt cryptography library have included support for the NXP SE050 secure element as of November 2021. Since that time we have been increasing compatibility with SE050 along with usage of SCP03 (Secure Channel Protocol 03) authentication. We recently made a few fixes for usage of the NXP SE050 underneath SSL/TLS within wolfSSL. To help users see how to get started with TLS usage, we have also created two example client applications.

Fixes for SSL/TLS usage of the NXP SE050 have been merged into the wolfSSL master branch as of February 2023, and will be included in the next stable release of wolfSSL.

wolfSSL TLS users can now use the wolfSSL_CTX_use_PrivateKey_Id() API to instruct wolfSSL to use a private key located in the SE050 at a specific key ID. This would replace calls to wolfSSL_CTX_use_PrivateKey_file() or wolfSSL_CTX_use_PrivateKey_buffer(), giving applications enhanced security by allowing the private key to be stored (and optionally generated) inside the SE050.

#include <wolfssl/ssl.h>
int wolfSSL_CTX_use_PrivateKey_Id(WOLFSSL_CTX* ctx, const unsigned char* id, long sz, int devId);

For access to wolfSSL_CTX_use_PrivateKey_Id(), wolfSSL needs to be compiled with WOLF_PRIVATE_KEY_ID defined. This can be passed through configure via CFLAGS, for example:

./configure CFLAGS=”-DWOLF_PRIVATE_KEY_ID”
make
sudo make install

TLS Client Demos Using SE050

wolfSSL has two new example SSL/TLS client applications that demonstrate how users can leverage SE050 underneath wolfSSL’s SSL/TLS implementation. These examples are set up to be easily run on a Raspberry Pi with attached NXP EdgeLock SE050 Development Kit.

Available examples are included in the “wolfssl-examples” GitHub repository under the SE050 subdirectory and include:

1. wolfSSL SSL/TLS Client Example

This example demonstrates a simple SSL/TLS client, using hardware-based cryptography supported inside the SE050. It loads and uses a certificate and private key from C arrays/buffers. For a more advanced demo which uses the private key directly from the SE050, see the following example. For details, see the example README.md, or wolfssl_client.c.

2. wolfSSL SSL/TLS Client Example with Cert and Private Key in SE050

This example demonstrates a simple SSL/TLS client, using hardware-based cryptography supported inside the SE050. It loads and uses a certificate and private key from C arrays/buffers into the SE050, then does all private key operations inside the SE050 for the TLS private key, based on a key ID. For details, see the example README.md or wolfssl_client_cert_key.c.

Further Resources

For more details on using wolfSSL or wolfCrypt with the NXP SE050, if you have questions on any of the above, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.  The wolfSSL embedded SSL/TLS library supports up to the most current TLS 1.3 and DTLS 1.3 protocol standards, has been optimized for performance and footprint size, and also provides easy paths forward for validation and certification requirements (FIPS 140-3, FIPS 140-3 (in progress), CAVP, DO-178C).

Blog: wolfSSL NXP SE050 Support and Benchmarks
Blog: wolfSSL Support for NXP SE050 with SCP03
Documentation: wolfSSL NXP SE050 Support (README_SE050.md)
Examples: wolfSSL NXP SE050 Examples (README.md)
Dev Kits: NXP EdgeLock SE050 Development Kits
SE050 Product Page: EdgeLock SE050: Plug & Trust Secure Element Family

In a matter of days, hundreds of Open Source developers will gather in Brussels, Belgium for FOSDEM 2023. FOSDEM is a two day event organized by volunteers to promote the widespread use of Open Source software, and is considered by many to be the best open source conference in Europe [1].

wolfSSL will be attending FOSDEM this year, will have a stand in the “H” building, and will  have information about several of wolfSSL’s open source projects including the wolfSSL lightweight SSL/TLS library, wolfCrypt cryptography engine, wolfBoot Secure Boot, and cURL. We’ll have done a lot of exciting work these past few years that we would love to talk about. cURL founder and maintainer Daniel Stenberg as well as members of the wolfSSL team will be on hand to answer developers’ questions first hand. 

If you or your team is considering integrating wolfSSL or cURL with a project you can take a look at our stand schedule and talk to us. Please stop by to talk to these top experts in their field. 

Daniel Stenberg will be available to talk all things cURL. Ask Daniel about cURL security, new protocol support, Post Quantum cURL, Tiny cURL.

Daniele Lacmera, wolfSSL Senior Engineer, is on hand to talk about Secure Bootloaders, Post Quantum ciphers, and everything wolfSSL.  Ask Daniele about his newest book!

February 4th          February 5th

Hours	Engineer	Hours	Engineer
9:00	Daniele	9:00	Daniel S
9:30	Daniele	9:30	Daniel S
10:00	Daniele	10:00	Daniel S
10:30	Daniele	10:30	Daniel S
11:00	Daniele	11:00	Daniel S
11:30	Daniele	11:30	Daniel S
12:00	Daniele	12:00	Daniel S
12:30	Daniele	12:30	Daniel S
13:00	Daniele	13:00	Daniel S
13:30	Daniele	13:30	Daniele
14:00	Daniele	14:00	Daniele
14:30	Daniel S	14:30	Daniele
15:00	Daniel S	15:00	Daniele
15:30	Daniel S	15:30	Daniele
16:00	Daniel S	16:00	Daniele
16:30	Daniel S	16:30	Daniele
17:00	Daniel S	17:00	Daniele
17:30	Daniel S	17:30	Daniele
18:00	Daniel S
18:30	Daniel S
19:00	Daniel S

You can also set up a time to sit down and talk at FOSDEM, If you have questions on any of the above, contact us at facts@wolfssl.com, or call us at +1 425 245 824. We enjoy working with Open Source projects, and offer them free support from our technical staff when working with wolfSSL or cURL.

[1] https://fosdem.org/2023/about/