Month: November 2024

Changes In wolfSSL for ARM Thumb-2 Builds

With wolfSSL release 5.7.4 we added the macro WOLFSSL_ARMASM_THUMB2. This macro can be defined to enable Thumb-2 ARM instruction optimizations and replaces the previous attempted autodetect on the macros __arm__ and __thumb__. Giving users complete control over which ARM assembly optimizations are compiled and used.

When building for Thumb-2 the source files beginning with thumb2-* should additionally be compiled in. If WOLFSSL_ARMASM_THUMB2 is not used then the armv8-32-* files will be used. These files are located in wolfcrypt/src/port/arm/.

The benefit of now having WOLFSSL_ARMASM_THUMB2 is that users can place all files in wolfcrypt/src/port/arm/ to be compiled and use the macro gate for selecting if the Thumb-2 section is optionally compiled or ARM32 implementation is. The armv8-32- code is very similar to the thumb2- code, but Thumb-2 is smaller in size.

For assistance with ARM optimization builds contact us at support@wolfSSL.com.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfSSL Inc. announces Rock-solid curl: long term supported curl releases

Rock-Solid curl: long term supported curl releases

EDMONDS, Wash., Nov. 11, 2024 /PRNewswire-PRWeb/ — wolfSSL INC. (Headquarters: Edmonds, Washington, USA), a vendor specialized in cryptography and network security, announces Rock Solid curl long term supported curl releases. Each release branch will be supported for 5 years. Only security fixes and important stability bug fixes will be merged into the branches, no new features or surprises. Rock-solid curl is available exclusively to all existing support customers released under the same distribution model as normal curl, (or a commercial license). Rock-solid curl is meant to greatly reduce the risk of regressions and yet be a safe and secure solution with full support. For the companies who want this extra level of attention. An even smoother ride. The release schedule for Rock-solid curl release branches are roughly every 18-24 months.

Rock-solid curl 8.9.2 is the first long-term support curl version. As the version number implies, it is based on the curl 8.9.1 release that shipped in July, with two security fixes and a small number of stability patches applied. All current customers under contract will receive the release.

Daniel Stenberg, the original author of curl, has been part of the wolfSSL team since 2019 and will be the primary support for the Rock-solid curl project. Daniel will provide the releases, and most of the patching and the back-porting of what is deemed necessary. Nothing changes with or happens to the original curl project and the regular curl releases because of this, the curl license remains the same. The curl releases and the release cadence remain intact. Support customers help fund the project by allowing us to pay developers.

Downloads and all Rock-solid curl information is hosted on the dedicated rock-solid.curl.dev site, separate from the open source project on curl.se.

On curl

Born in the late 1990s, curl is a client-side Internet transfer engine. Installed in over twenty billion instances it serves virtually everything that is internet connected: phones, tablets, cars, television sets, printers, medical devices, game consoles, helicopters on other planets, etc and it is an embedded component in a significant share of our most used and beloved apps, tools, games and services.

curl is the fruit and outcome from hard work by thousands of volunteers and is completely free and Open Source. The curl project is independent. It is not part of any umbrella organization or foundation and it is not owned nor controlled by any company.

curl is secure, fast and feature-rich. It is a defacto standard and key infrastructure.

About wolfSSL

wolfSSL focuses on providing lightweight and embedded security solutions with an emphasis on speed, size, portability, features, and standards compliance. With its SSL/TLS products and crypto library, wolfSSL is supporting high security designs in automotive, avionics and other industries. In avionics, wolfSSL has support for complete RTCA DO-178C level A certification. In automotive, it supports MISRA-C capabilities. For government consumers, wolfSSL has a strong history in FIPS 140-2/3, with upcoming Common Criteria support. wolfSSL supports industry standards up to the current TLS 1.3 and DTLS 1.3, is up to 20 times smaller than OpenSSL, offers a simple API, an OpenSSL compatibility layer, is backed by the robust wolfCrypt cryptography library, and much more. Our products are open source, giving customers the freedom to look under the hood. wolfSSL has a mean time to release a fix for vulnerabilities of less than 36 hours, offers commercial support up to 24/7, and has the best tested cryptography and the largest team of software engineers dedicated to crypto in the market today.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Partner Webinar: wolfSSL and Infineon Technologies: Bringing TPM’s to the embedded MCU market

Enhance the security of your embedded projects by integrating TPM 2.0 technology from wolfSSL and Infineon Technologies. Join us in this informative webinar, where we’ll explore the advantages of using the wolfTPM library and Infineon Technologies’s SLB9672 (SPI) / SLB9673 (I2C) modules. Learn how these solutions provide secure key management, seamless firmware updates, and robust hardware security protection for embedded systems.

Register Now: wolfSSL and Infineon Technologies: Bringing TPM’s to the embedded MCU market
Date: November 13th | 9 AM PT

wolfTPM is the only library designed specifically for embedded systems, providing stable APIs across platforms, including bare-metal environments. Infineon Technologies further strengthens security by offering a public firmware update process for their TPMs, utilizing Post-Quantum resistant XMSS for long-term product support—an industry-leading feature that simplifies security maintenance across product life cycles.

In this webinar, you’ll discover how TPM 2.0 modules deliver critical security features, including secure storage, measured boot, and protection against side-channel attacks and physical tampering. The live demo will showcase the TPM firmware update on the PSoC6 with SLB9673, demonstrating how easily you can manage TPM updates in the field.

Webinar Agenda:

  • The benefits of using TPM 2.0 modules in embedded systems
  • How to simplify TPM integration using wolfTPM and Infineon Technologies’s SLB9672 (SPI) / SLB9673 (I2C) modules
  • Why Infineon Technologies stands out as the only TPM vendor that supports public firmware updates using Post-Quantum XMSS, providing long-term product security
  • Real-world applications of TPM
  • Live Demo on TPM firmware update process on the PSoC6 with SLB9673

Don’t miss out on this opportunity to gain expert knowledge and ask questions directly to the engineers! Register today and learn how to elevate the security of your embedded MCU projects with wolfSSL and Infineon Technologies.

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Live Webinar in the Asia Pacific Time Zone: Post-Quantum Cryptography Update

Learn about the latest developments in NIST Post-Quantum Cryptography (PQC) Standards and CNSA 2.0. As the world prepares for the quantum computing era, understanding these standards is crucial for ensuring robust security protocols. wolfSSL Senior Software Developer Anthony Hu will guide you through their implications for cryptographic practices and share insights into wolfSSL’s journey in PQC. We’ll discuss our commitment to adopting quantum-resistant algorithms and the steps we’re taking to stay ahead of emerging threats.

Register Today: Post-Quantum Cryptography Update – Tailored for the Asia Pacific Time Zone
Date: November 12th | 7 PM PT / November 13th | 12 PM JST
This webinar is scheduled to accommodate participants in the Asia Pacific Time Zone.

Explore key exchange mechanisms by comparing NIKE and KEM, and see how ECC stacks up against ML-DSA and ML-KEM in performance metrics and efficiencies in a post-quantum world. Discover wolfSSL’s PQC readiness through ongoing migration efforts and partnerships with industry leaders to advance PQC standards.

This webinar will cover:

  • NIST PQC Standards and CNSA 2.0 Updates
  • wolfSSL’s PQC Journey: History and Current Status
  • Comparing Key Exchange Mechanisms: NIKE vs. KEM
  • Performance Benchmarking: ECC vs. ML-DSA and ML-KEM
  • wolfSSL’s PQC Readiness, Migration Strategies, and Quantum-Resistant Solutions
  • Collaborative Efforts in the PQC Landscape: Partnering with Industry Leaders
  • Challenges and Barriers to PQC Migration

Don’t miss this opportunity to equip yourself with the knowledge essential for the evolving cryptographic landscape! Register Now!

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfMQTT Releases v1.19.1

wolfSSL is proud to announce the release of wolfMQTT v1.19.1!

This release fixes an issue in the Espressif example and corrects some documentation issues.

Release 1.19.1 has been developed according to wolfSSL’s development and QA process and successfully passed the quality criteria.

Check out the ChangeLog from the download for a full list of features and fixes, or contact us at facts@wolfSSL.com with any questions. While you’re there, show us some love and give the wolfMQTT project a Star!

Download the latest release or clone directly from our GitHub repository.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Switching to wolfCrypt’s Implementations of Post-Quantum Algorithms

Have you been trying out post-quantum algorithms in wolfSSL’s products? As you probably know, here at wolfSSL we have a step-wise approach to post-quantum algorithm integration:

  1. Define an API in wolfCrypt.
  2. Do an integration with an existing reference implementation (ie.: liboqs, PQM4, hash-sigs liblms, xmss-reference).
  3. Use these APIs in higher level libraries and products (ie.: wolfssl, wolfssh, wolfmqtt, wolfboot) to implement features.
  4. Invest the time and effort to write and optimize our own production grade implementation of the algorithm.

For LMS, XMSS, ML-KEM and ML-DSA the time has finally come to switch to using wolfSSL’s implementations of these algorithms. It’s very simple to do so. If you are using any of the following configure-time flags simply remove them from your configure command-line:

--with-liblms
--with-libxmms
--with-liboqs

Then ensure you are enabling the relevant algorithm that you are interested in. Relevant flags are:

--enable-xmss
--enable-lms
--enable-dilithium
--enable-kyber

Once this is done, you will be using our professionally optimized and tested implementations of post-quantum algorithms.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfTPM release: v3.6.0

We are proud to announce the next release of wolfTPM that includes minor bug fixes and some exciting new features. The v3.6.0 release is incremental and part of our quarterly release schedule. Each release goes through additional testing including tests on actual TPM 2.0 hardware.

This release includes minor bug fixes and new features such as:

  • Provisioning the initial device (IDevID) and initial attestation (IAK)
    • New key templates and examples
    • New build option –enable-provisioning or WOLFTPM_PROVISIONING
  • Improved support for parsing for all TPM2_GetCapability capabilities
  • Improved the TPM TLS examples for use with WOLFTPM_MFG_IDENTITY
  • New TPM2_Certify example
  • New wolfTPM2_CreatePrimaryKey_ex API for creation ticket
  • Tested support with Nations NS350 TPM

The minor issues fixed are:

  • Issue with TPM2_GetRCString and RC_WARN error codes (broken in v3.4.0)
  • Issue with TPM2_SetupPCRSel on some PCR selection edge cases
  • Improved building without ECC or RSA or file system

The new v3.6.0 release can be downloaded on our website or on GitHub.com/wolfssl/woltpm

If you have questions about ay of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Java JSSE Support for DTLS 1.3

wolfSSL is exploring adding DTLS support, up to the current DTLS 1.3 level, to our Java JSSE provider, wolfJSSE. Are you interested in using DTLS 1.3 from Java? If so, we would like to hear more about your desired use case!

DTLS 1.3 is the latest version of the Datagram TLS (DTLS) standard, which builds upon the progressive changes of TLS 1.3. The native C implementation of the wolfSSL SSL/TLS library has supported DTLS 1.3 since June 2022 with the 5.4.0 release. Native wolfSSL supports DTLS 1.0, 1.2, and 1.3.

If you’re just learning about DTLS, a few helpful resources include our blog about What’s new in DTLS 1.3, DTLS 1.3 Benchmarks, and DTLS 1.3 Examples and Use Cases. We also have a nice webinar on “DTLS 1.3 Training” up on our YouTube channel.

If you’re interested in using DTLS from Java, reach out and let us know your preferred use case, JDK implementation, and platform at facts@wolfSSL.com.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Do you need post quantum versions of Apache, NGINX, Lighttpd, cURL, or stunnel?

Our wolfSSL library has several post-quantum algorithms built in, but on their own, they aren’t always useful. How else can the PQC algorithms be used in production? Well, one of our areas of expertise is getting other open-source projects working with wolfSSL and then getting those integrations using post-quantum algorithms. We have post-quantum integrations with multiple web servers, a web client, and a secure tunneling solution. Read on to learn more!

For a more heavy-duty and reliable web server with professional production-ready code, we have a post-quantum integration with Apache.

For a lighter-weight yet fully featured and dependable alternative, you can turn to our post-quantum enabled Nginx integration.

Our wolfSSL library excels in constrained environments as does Lighttpd. For the most bare bones environments, our lighttpd post-quantum integration is likely the right choice.

And for the client side, we have also made the cURL web client quantum-safe! See this video for instructions on how to build.

If you’ve got an application where making changes is difficult due to legacy software, we’ve got our post-quantum integration with stunnel to make your migration a breeze.

Go ahead and try out these open source integrations! We are eager for your feedback, and happy to support your efforts Whether it be as part of a hackathon or as an experiment to understand feasibility or to gather benchmarking data, trying out these integrations is a great step in your plan for migration to post-quantum algorithms.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfBoot release: v.2.3.0

wolfBoot 2.3.0 has finally been released! The universal secure bootloader extends its support to new platforms, improves existing ports, and introduces new groundbreaking features that set the pace to defining secure-boot for the next generation of embedded systems.

A New Era of Secure Boot with ML-DSA and Hybrid Authentication

The introduction of quantum resistant algorithms in the latest releases of wolfSSL has accelerated the integration of asymmetric cryptography in our secure boot solution. In 2023, wolfBoot v2.0.0 expanded its signature verification algorithms to include the hash-based stateful signatures LMS (+HSS) and XMSS (^MT). wolfBoot v2.3.0 further extends these options by introducing ML-DSA, as specified in FIPS-204, for verifying the authenticity of firmware and other critical components. Support for ML-DSA in wolfBoot is currently available in three variants: ML-DSA-44, ML-DSA-65 and ML-DSA-87, corresponding to NIST security category 2, 3 and 5, respectively.

Hybrid Authentication: Post-Quantum Meets Classic Cryptography

One of the most anticipated features in WolfBoot 2.3.0 is its support for hybrid authentication, a method that combines Post-Quantum Cryptography (PQC) algorithms with traditional cryptographic techniques like ECC and RSA. This hybrid approach strengthens security by combining the resilience of PQC, which resists quantum attacks, with the well-established reliability of classic algorithms. Pairing PQC algorithms with ECC521 offers a path toward CNSA 2.0 compliance, a set of guidelines for systems demanding the highest levels of security.

Hybrid authentication in WolfBoot secures the boot process by signing and validating boot images with a combination of PQC and traditional cryptography. This dual-layer protection approach ensures that even if one algorithm becomes vulnerable, the other remains resilient, offering a future-proof strategy for embedded systems as quantum computing capabilities grow.

Boot time optimization and performance monitoring

Thanks to the newly introduced assembly optimization for ARM in wolfCrypt, image verification times have been dramatically reduced. These ARM optimizations are now enabled by default on all Cortex-M devices.
New benchmark tools have been added to our continuous integration environment, to ensure that we can constantly monitor boot time, footprint size, runtime memory usage and other performance indicators.

Improved keystore and keyvault management

Starting with wolfBoot 2.3.0, it is now possible to store public keys of different sizes in the same trust anchor. This is a crucial feature to allow double signature verification in hybrid mode, or when integrating heterogeneous components in the boot chain, involving more than one cipher at a time.

PKCS11 key vault storage drivers have also been improved, and can now reliably store keys in non-volatile memories, ensuring compatibility with wolfPKCS11.

Hardware support

In this version, the following new targets have been added to the list of hardware platforms we support:

  • Infineon AURIX TriCore TC3xx
  • Microchip AT-SAMA5D3
  • Nordic nRF5340

Moreover, the support for some of the existing ports has been improved and stabilized. During the development of wolfBoot v. 2.3.0 we mostly worked on the following targets:

  • NXP i.MX-RT family: the capabilities have been extended, including the support for built-in High-Assurance Boot (HAB) mechanism, provided by the manufacturer. Flash interaction has improved, and DCACHE invalidation has been fine-tuned to increase performance
  • Renesas RX: improvements introduced for this family of microcontrollers include the introduction of a full-flash erase operation, a more efficient flash management and support for boot-time IRQ.
  • Raspberry Pi: added UART driver

Find out more about wolfBoot

Join our webinar “What’s new in wolfBoot” on November 21, 2024 to discover more details about wolfBoot 2.3.0 and our real-life scenarios for post-quantum cryptography adoption.

If you want to share your secure-boot experience with us or ask us anything on this topic, reach out via email at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2 3