Here at wolfSSL, we love giving the community and our customers lots of choices and options. That said, for the vast majority of our user base, all the options we are discussing in this post should be enabled to maximize your security and minimize your adversary’s opportunities.
#define WOLFSSL_HARDEN_TLS 112 or –enable-harden-tls=112
enables the following algorithms at the following key lengths
DH: at least 2048 bit keys
RSA: at least 2048 bit keys
ECC: at least 224 bit keys
#define WOLFSSL_HARDEN_TLS 128 or –enable-harden-tls=128
Disables 3DES ciphersuites
DH: at least 3072 bit keys
RSA: at least 3072 bit keys
ECC: at least 256 bit keys
#define NO_OLD_TLS or –diable-oldtls
This disables older protocols that are inherently insecure. The only protocols that are built are (D)TLS 1.2 and 1.3.
#define HAVE_ALPN or –enable-alpn
This helps to ensure that the right application is processing the connection. Please see RFC document for more details about how to use this TLS extension.
#define WOLFSSL_CIPHER_TEXT_CHECK or –enable-maxstrength
Add in extra checks after the processing of ciphertext input in order to mitigate glitching attacks.
#define WC_RSA_BLINDING or –enable-harden
RSA blinding involves transforming the input just before the RSA private key operations using some random data. After the operation, the reverse of the transform is performed giving the desired output. This prevents an adversary from gaining knowledge about the private key as they don’t know the random data that was used to determine the transform and therefore do not know the true input into the RSA private key operation.
#define TFM_TIMING_RESISTANT #define ECC_TIMING_RESISTANT or –enable-harden
These allow for constant time implementations of the math used in private key operations to mitigate timing attacks.
Oops, looks like we went a bit over 5! Want even more? Thinking about turning some of these off to get performance gains or reduce memory usage? Send a message to support@wolfSSL.com to start a conversation about it!
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now