Month: February 2024

CPU-Accelerated Cryptography on OpenWRT Using wolfSSL

OpenWRT is a customizable open-source firmware for wireless routers and embedded devices, offering extensive flexibility and control over network configurations. For those looking to enhance their device’s security capabilities with efficient cryptographic operations, integrating wolfSSL with CPU acceleration presents an excellent option. This setup is optimized for devices compatible with x86 and armv8 architectures, ensuring enhanced performance where it matters most.

Setting Up wolfSSL with CPU Acceleration

When configuring OpenWRT, incorporating wolfSSL with CPU acceleration is straightforward.

  1. Initiate the Configuration Process: Begin with the make menuconfig command to open the OpenWRT configuration menu and select a compatible target device. This assumes you have already met all prerequisites, such as having the correct version of OpenWRT and necessary development tools installed on your system.
  2. Navigate to wolfSSL Options: From the top menu of the OpenWRT Configuration, make your way to wolfSSL by selecting Libraries → SSL. Here, you will encounter two options: libwolfssl and libwolfsslcpu-crypto. For CPU-accelerated cryptography, select libwolfsslcpu-crypto and ensure that libwolfssl is deselected (See Image). If you do not see libwolfsslcpu-crypto your target device may be incompatible or set up wrong in OpenWRT.
  3. Configure wolfSSL Library Settings: Proceed to the wolfSSL Library Configuration submenu to customize the options compatible with the libwolfsslcpu-crypto package.
  4. Save Your Configuration: This will make sure your OpenWRT build environment will compile with wolfSSL’s CPU-accelerated cryptography enabled, enhancing the performance capabilities of your device.

Why CPU Acceleration?

Leveraging CPU acceleration for cryptographic functions with wolfSSL not only improves encryption and decryption speeds but also optimizes processor load, making your device more efficient. To see the advantages of using your compatible device with wolfSSL’s CPU acceleration consider enabling the benchmark package seen in the figure above, and run it when you are in the final image for the device via a call on the command line for wolfssl-benchmark. Share your results with us on X @wolfSSL!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Migrating from OpenSSL to wolfSSL in 2024

Join us for an informative webinar “Migrating from OpenSSL to wolfSSL” led by wolfSSL Software Developer, Jacob, on February 29th at 10am PT. Jacob will guide you through the seamless transition from OpenSSL to wolfSSL, introducing the wolfCrypt FIPS 140-3 module to meet OpenSSL FIPS requirements, along with the revolutionary wolfEngine and wolfProvider technologies tailored to fulfill specific requirements for OpenSSL 1.x and 3.x.

Watch the webinar here: Migrating from OpenSSL to wolfSSL

Sneak Peek of the webinar:

  • Exploring wolfSSL compatibility layer
  • Implementing wolfSSL to replace OpenSSL
  • Live demonstration of a simple application migration
  • Showcasing major projects successfully migrated to wolfSSL
  • Insights into the future of the compatibility layer
    And much more!

This webinar offers a unique opportunity to discover how wolfSSL can unleash the full potential of your projects. Jacob will elaborate on leveraging wolfSSL products to seamlessly meet OpenSSL requirements, including FIPS compliance and compatibility with OpenSSL 1.x and 3.x. Don’t miss out on this chance to learn why migrating to wolfSSL is advantageous and how we can simplify your journey.

Watch it now!

As always, our webinars will include Q&A sessions throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Comparing wolfSSL vs OpenSSL

How does OpenSSL Compare with wolfSSL?

There are a lot of different metrics to compare when choosing between two TLS libraries. Some of those include heap usage and performance.

Heap Usage:

For heap usage wolfSSL can be significantly smaller — using 100’s of kilobytes less to handle an incoming TLS connection. The following is comparisons collected using a simple server example that was unaltered and linked against the two different TLS libraries. The same cipher suite ECDHE-RSA-AES256-GCM-SHA384 was used for all connections. The graphs were generated using Valgrinds massif tool.

OpenSSL 3.0.0 Used 800+Kb

OpenSSL 1.1.1 Used 200+ Kb

wolfSSL 5.2.0 Used 38.1 Kb
./configure –enable-opensslextra

wolfSSL 5.2.0 configured for a smaller build used 27.1 Kb
./configure –enable-opensslextra –enable-sp-math-all=small –enable-sp=small

Performance:

Both TLS implementations have assembly optimizations done for hardware commonly used in desktops. Such as Intel’s AVX or AESNI instructions and ARMv8’s crypto extensions. In many cases wolfSSL is slightly faster on those platforms. With embedded platforms like STM32F7 and PIC32MZ, only wolfSSL has hardware acceleration support. Independently done webserver stress tests making use of available optimizations in each of the TLS implementations have shown that wolfSSL can more than double the number of connections per second achieved when compared with OpenSSL version 1.1.1.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL SSL/TLS Support for NXP SE050

The wolfSSL lightweight SSL/TLS library and underlying wolfCrypt cryptography library have included support for the NXP SE050 module since November 2021. Since that time we have been increasing compatibility with SE050 along with usage of SCP03 (Secure Channel Protocol 03) authentication. To help users get started with TLS usage, we also have two example client applications available for use and reference.

wolfSSL TLS users can use the wolfSSL_CTX_use_PrivateKey_Id() API to instruct wolfSSL to use a private key located in the SE050 at a specific key ID. This would replace calls to wolfSSL_CTX_use_PrivateKey_file() or wolfSSL_CTX_use_PrivateKey_buffer(), giving applications enhanced security by allowing the private key to be stored (and optionally generated) inside the SE050 module.

#include <wolfssl/ssl.h>
int wolfSSL_CTX_use_PrivateKey_Id(WOLFSSL_CTX* ctx, const unsigned char* id,
    long sz, int devId);

For access to wolfSSL_CTX_use_PrivateKey_Id(), wolfSSL needs to be compiled with WOLF_PRIVATE_KEY_ID defined. This can be passed through configure via CFLAGS, for example:

cd wolfssl-X.X.X
./configure <options> CFLAGS=”-DWOLF_PRIVATE_KEY_ID”
make
sudo make install

TLS Client Demos Using SE050

wolfSSL has two example SSL/TLS client applications that demonstrate how users can leverage SE050 underneath wolfSSL’s SSL/TLS implementation. These examples are set up to be easily run on a Raspberry Pi environment with attached NXP EdgeLock SE050 Development Kit.

Available examples are included in the “wolfssl-examples” GitHub repository under the SE050 subdirectory and include:

  1. wolfSSL SSL/TLS Client Example

    This example demonstrates a simple SSL/TLS client, using hardware-based cryptography supported inside the SE050. It loads and uses a certificate and private key from C arrays/buffers. For a more advanced demo which uses the private key directly from the SE050, see the following example. For details, see the example README.md, or wolfssl_client.c file.

  2. wolfSSL SSL/TLS Client Example with Cert and Private Key in SE050

    This example demonstrates a simple SSL/TLS client, using hardware-based cryptography supported inside the SE050. It loads and uses a certificate and private key from C arrays/buffers into the SE050, then does all private key operations inside the SE050 for the TLS private key, based on a key ID. For details, see the example README.md or wolfssl_client_cert_key.c.

Resources

For more details on using wolfSSL or wolfCrypt with the NXP SE050, see one of the following links or email us at facts@wolfSSL.com. The wolfSSL embedded SSL/TLS library supports up to the most current TLS 1.3 and DTLS 1.3 protocol standards, has been optimized for performance and footprint size, and also provides easy paths forward for validation and certification requirements (FIPS 140-3, FIPS 140-3 (in progress), CAVP, DO-178C).

Blog: wolfSSL NXP SE050 Support and Benchmarks
Blog: wolfSSL Support for NXP SE050 with SCP03
Documentation: wolfSSL NXP SE050 Support (README_SE050.md)
Examples: wolfSSL NXP SE050 Examples (README.md)
Dev Kits: NXP EdgeLock SE050 Development Kits
SE050 Product Page: EdgeLock SE050: Plug & Trust Secure Element Family

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfBoot support for the Xilinx Zynq UltraScale+ MPSoC

wolfBoot support for the Xilinx UltraScale+ was added in 2020 and is a direct U-Boot replacement for improved security.

wolfBoot provides enhanced features compared to U-Boot such as:

  • Firmware integrity and signature verification on each boot
    • Image integrity checking SHA2-256 or SHA3-384.
    • Validation of the signature using ECC P256/P384, RSA (2048-bit or 3072-bit), ED25519 and LMS or XMSS.
  • Multiple boot partition support
    • Rollback to last known working or fail-safe “golden” image on failure
  • TPM 2.0 Support
    • Measured Boot (PCR’s)
    • Sealing secret to unlock or decrypt a storage device
  • Root of trust options
    • Onboard eFUSES
    • Public key embedded in wolfBoot partition
    • TPM 2.0 NV (supported with wolfTPM)
  • Delta/Differential updates using bentley-mcilroy scheme
  • Encrypted updates using AES CFB or ChaCha20/Poly1305

Additional wolfBoot Features:

  • QSPI, SDMC and eMMC boot support
  • ELF (32 and 64) loader support
  • FDT (Flattened Device Tree) support for fixups
  • AARCH64 EL1/EL3 support

We have included a full example for building with Xilinx SDK and integrating into the FSBL chain of trust. Also creation of the flash boot.bin image with boot.bif and bootgen.

Tested support with bare-metal, QNX, GreenHills Integrity OS and Linux/Fedora.
24×7 support available

Links:

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL bare-metal and non-blocking cryptography in 2024

One of the unique wolfSSL features is the ability to run wolfSSL on bare-metal without any Real-Time Operating System (RTOS). Supporting bare-metal has always been a requirement for our libraries from initial development. Having a pure C code base, no external dependencies, portable design and modular build options enables this feature and provides a tiny build size. This is a huge differentiator compared to libraries like OpenSSL that won’t even build without a POSIX layer. The build options to enable bare-metal are (–disable-filesystem –enable-singlethreaded) or (SINGLE_THREADED and NO_FILESYSTEM).

Another unique feature of wolfSSL is our support for managing and handling longer asymmetric math computations, which may have non-deterministic execution times. We achieve this by dividing the workload into smaller chunks, allowing the CPU time to perform other tasks concurrently. We call this feature non-blocking cryptography. We support it for RSA, ECC (256/384/521) and Curve25519. Our goal is to limit any blocking on an embedded target to a maximum of 1ms. We used a generic Cortex M4 at 100MHz as our reference. This functionality, for example, allows you to service real-time events while performing a TLS handshake or signature validation. We take pride in being the only open source TLS/Cryptographic library supporting this non-blocking cryptography feature.

From the caller’s perspective, non-blocking cryptography appears much like a non-blocking socket, where the API will return a FP_WOULDBLOCK status and requires being called again. This capability is supported both through the TLS API’s and wolfCrypt directly.

For additional information, please consult the related documentation links and pull request provided below:

If you have questions on any of the above, please contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Download wolfSSL Now

Live Webinar: wolfHSM – wolfSSL and Automotive Hardware Security Modules (HSMs)

Welcome! Join us for one of our most popular wolfSSL webinars, “wolfHSM: wolfSSL and Automotive Hardware Security Modules (HSMs)” scheduled for February 22nd at 10am PT, presented by wolfSSL Software Engineer, Bill. As vehicles have evolved into digital systems over the years, evaluating automotive cybersecurity has become a key aspect of automotive safety.

Watch the webinar here: wolfHSM: wolfSSL and Automotive Hardware Security Modules (HSMs)

Sneak peek of the webinar:

    • Automotive HSM Features
    • wolfHSM Functional Design
    • wolfHSM Applicability to Standards
    • wolfHSM Hardware Ports and Plans
    • wolfHSM Demo
    • wolfHSM Future Targets

And much more

If you are seeking solutions to enhance your automotive security system, seize this opportunity to delve into the fundamental and advanced features of wolfHSMs. Discover the comprehensive capabilities that wolfSSL products can offer. Bring all your questions related to Automotive HSMs, as Bill is ready to address your questions!

Watch now!

As always, our webinars will include Q&A sessions throughout the webinar. If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Post-Quantum Hybrid Solutions

Here at wolfSSL, when it comes to post-quantum algorithms, we are careful to provide conservative approaches. We are aware that these algorithms are new and developments are still on-going as cryptographers continue analyzing these algorithms. As such, we always encourage hybridizing with conventional algorithms. Here are the hybrids we offer:

Hybrid Key exchange via concatenation in TLS 1.3 and DTLS 1.3

  • ECDHE P-256 Kyber Level 1
  • ECDHE P-384 Kyber Level 3
  • ECDHE P-521 Kyber Level 5

Hybrid authentication via dual key/sig certificates in TLS 1.3

  • ECDSA P-256 and Dilithium Level 2
  • ECDSA P-384 and Dilithium Level 3
  • ECDSA P-521 and Dilithium Level 5
  • ECDSA P-256 and Falcon Level 1
  • ECDSA P-521 and Falcon Level 5
  • RSA-3072 and Dilithium Level 2
  • RSA-3072 and Falcon Level 1

MQTT protocol relies on TLS, so wolfMQTT has support for everything above.

ECDHE P-256 hybridized with Kyber Level 1 in wolfSSH

  • ecdh-nistp256-kyber-512r3-sha256-d00@openquantumsafe.org

Go ahead and try them out today!

And finally, we are also developing support for X25519 in wolfSSH. Soon to come after that will be X25519 hybridized with Kyber in wolfSSH. Let your voice be heard! Let us know if you want to try this out. The more interest there is out there, the higher it will rise in priority!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

ARMv9 Security Extensions with wolfCrypt FIPS, wolfSSL, and wolfBoot

Hi! Are you interested in leveraging wolfSSL products with an ARMv9 device? Do you need FIPS on an ARMv9 device?

We are here to help, and will be initiating support for the ARMv9 primitives to maximize security and performance for our users. Some of the things we’ll leverage include:

  • Random Number Generator instructions (AArch64)
  • General Matrix Multiply (GEMM) instructions (AArch64)
  • Atomic 64-byte load and stores to accelerators (AArch64)

If you’d like to discuss or have questions about any of the above, please email us at facts@wolfSSL.com, or call us at +1 425 245 8247.

Download wolfSSL Now

wolfBoot support for the STM32C0 in 2024

We have added wolfBoot support for the new STM32C0. This is a low cost MCU similar to the STM32G0 based on a Cortex-M0 (48MHz). It is a very low cost general purpose 32-bit MCU with up to 32KB flash and 12KB RAM.

Our wolfBoot secure bootloader is the only solution available for this platform thanks to our small code size. Most STM32 parts are supported with wolfBoot out of the box.

The default STM32C0 configuration uses RSA 2048-bit and SHA2-256 and is less than 10KB. This leaves 10KB for the application partition, 10KB for the update partition and one 2KB sector for swap.

STM32C0 documentation and build steps can be found here.

See our video series with ST for a tutorial on using wolfBoot.

wolfBoot Features:

  • Written in C for bare-metal use
  • Small footprint to run on small embedded devices
  • Memory safety (no malloc/free)
  • Support for on-board or external SPI flash
  • Simple partitioning and header scheme
  • Abstracted HAL design for CPU speed and flash
  • Bootloader handles swapping and loading of partitions
  • Key tools for key generation/import and signing
  • Encrypted updates
  • Delta updates (only differences)

Signature algorithms supported:

  • ECC (SECP256R1,SECP384R1)
  • RSA (2048/3072/4096)
  • ED25519
  • ED448
  • Post Quantum LMS and XMSS

Firmware image integrity using hash digest:

  • SHA2-256
  • SHA2-384
  • SHA3-384

Flexible partition scheme determined at build-time:

  • Bootloader (10-30KB)
  • Application
  • Update
  • Swap (1 sector)
  • And custom partition ID’s

Reliable Firmware update mechanism:

  • Independent from the update transport mechanism
  • Fallback to a previous version when the update fails
  • Resume interrupted swap operations during update, in case of power failure

Support for STM hardware crypto acceleration:

  • STM32 HASH/AES/PKA
  • ST33TP* TPM 2.0 using wolfTPM
  • STSAFE

If interested in trying our wolfBoot on the STM32C0 or curious about post-quantum signature support in wolfBoot please contact facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2