Author: Kajal Sapkota

Eeny, Meeny, Miny, Moe…

Do you have a favorite crypto algorithm? …or maybe just one that is important to you? 

Hash Functions: SHA2, SHA-3, RIPEMD-160, Poly1305, Blake2b, Blake2s, SipHash

Block, Stream, and Authenticated Ciphers: AES (CBC, CTR, OFB, XTS, GCM, CCM, GMAC, CMAC), Camellia, ChaCha20 and XChaCha20

Public Key Algorithms: DH, ECDH, ECDSA, RSA, ed448, ed25519, X448, X25519

Could they be running a bit faster for you?  wolfSSL has the knowledge and skills to make any algorithm perform competitively.

And don’t forget Post-Quantum algorithms!  

Post-Quantum KEM: Kyber

Post-Quantum Signature Schemes: Dilithium, FALCON, SPHINCS+

Let us know if there’s a post-quantum algorithm you would like to see supported by wolfSSL.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Deprecation of wolfSSL Normal Math Library

We are establishing a timeline to deprecate our legacy math backend, which is called “normal” or “heap” math.  It will be removed  from the wolfSSL/wolfCrypt library by the end of this year.

Currently, our library includes three different math backends that can be used to support public cryptography:

  1. Normal math (integer.c) which can be enabled with –enable-heapmath or CFLAGS=-DUSE_INTEGER_HEAP_MATH
  2. Fast math (tfm.c) which can be enabled with –enable-fastmath or CFLAGS=-DUSE_FAST_MATH
  3. SP math** (sp_int.c, Default) which can be enabled with –enable-sp-math-all or CFLAGS=-DWOLFSSL_SP_MATH_ALL

** Note: SP math comes with MANY tunable features including combinations of fastmath with sp or sp-math and key size toggles and heap/stack tuning knobs for nearly every use-case!

You can refer to https://www.wolfssl.com/wolfssl-math-library-comparison-matrix/ to see a comparison.

The SP math has been the default configuration math backend since wolfSSL release 5.4.0  (see https://github.com/wolfSSL/wolfssl/pull/4759).

The latest version of our SP math can do everything its predecessor can and then some! It also has constant-time and cache access safe algorithm implementations to prevent side-channels. (see https://www.wolfssl.com/wolfssl-hardened-default/)

Prior to wolfSSL release 5.4.0, if you build with –disable-fastmath (or #undef USE_FAST_MATH), normal math was utilized as a default backend.

Post release 5.4.0, you were required to use  –enable-heapmath ( #define USE_INTEGER_HEAP_MATH) to be able to use the normal math. 

Additionally, we are changing the math library for our FIPS users.

  1. We are moving all of our normal math customers to use Fast math for users of –enable-fips=v2 or HAVE_FIPS_VERSION <= 2
  2. We are moving all of our customers to use SP math for users of –enable-fips=v5 (FIPS 140-3) or HAVE_FIPS_VERSION > 2 (Also includes fips-ready and v5-dev)

If you have not done so already, we recommend migrating to the new SP math backend as early as possible.  It offers far superior performance, security, and longevity.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Join wolfSSL at WEST 2023

Please join the wolfSSL team at WEST 2023 at booth 2849 in San Diego, CA, February 14 - 16 2023. wolfSSL CEO Larry Stefonic, Business Directors Tim Pickering, and Steve Siderewicz, and Sr. Engineer Eric Blankenhorn will be in attendance and as always, we'd love to meet with you.

Let's arrange a time to talk about the latest wolfSSL release, advantages of using TLS 1.3, DTLS 1.3 FIPS 140-3, and DO-178. We would be thrilled to answer any of your cryptography questions.

Talk to us about:

  • wolfSSL new features
  • wolfSSL with TLS 1.3 and DTLS 1.3 over automotive and aviation protocols
  • wolfCrypt continued FIPS support - FIPS 140-2 and 140-3
  • wolfCrypt complete DO 178C DAL A support
  • wolfCrypt as an engine for OpenSSL
  • wolfBoot Secure Bootloader
  • wolfSSL MQTT-SN and latest version
  • wolfTPM
  • wolfSSH

https://www.westconference.org/WEST23/Public/enter.aspx

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247. We can't wait to see you.

DTLSv1.3: A Look to the Future – Upcoming Features in WolfSSL

Last year, we were thrilled to announce our support for DTLSv1.3 - we are the first to have a working implementation. 2023 promises to be just as exciting for DTLSv1.3 as 2022 as we already have a number of features planned for the coming months.

One of the things we are focusing on is better support for Connection IDs. This feature allows you to maintain a secure TLS session even if the IP address of the peers changes. While wolfSSL already supports Connection IDs, we're working on making it easier to use.

Another area we're focusing on is post-quantum cryptography in DTLSv1.3. As DTLSv1.3 reuses our TLS stack, it already supports post-quantum crypto out of the box. However, there are some edge cases where keys are too big to be used in our DTLSv1.3 implementation, but we're working on a solution to overcome this issue.

We're also looking to improve our server's stateless handling of connections, and our listening API to better match the use cases for DTLS. Additionally, we are working to improve performance and memory usage and increase our testing coverage.

Do you have any thoughts on our roadmap? Is there something important to you that is missing? If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Looking for Post-Quantum Features

2023 has just begun and a new year means new features for wolfSSL products. We want to hear from you.  What kind of post-quantum features are you looking for?  Here are some products we are thinking of updating:

  • wolfSSL: hybrid authentication schemes.
  • wolfSSL: support for post-quantum algorithms on more embedded platforms.
  • wolfSSL: stateful-hash based signature schemes.
  • wolfSSH: x25519 with Kyber hybrid key exchange.
  • wolfCLU: support for generation of PKI certificate chains with post-quantum algorithms.
  • wolfMQTT: support for more post-quantum algorithms.
  • wolfBoot: post-quantum authentication of firmware images.
  • wolfJNI: enable post-quantum TLS 1.3 from Java.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

 

Join us at Fosdem 2023

In a matter of days, hundreds of Open Source developers will gather in Brussels, Belgium for FOSDEM 2023. FOSDEM is a two day event organized by volunteers to promote the widespread use of Open Source software, and is considered by many to be the best open source conference in Europe [1].

wolfSSL will be attending FOSDEM this year, will have a stand in the “H” building, and will  have information about several of wolfSSL’s open source projects including the wolfSSL lightweight SSL/TLS library, wolfCrypt cryptography engine, wolfBoot Secure Boot, and cURL. We’ll have done a lot of exciting work these past few years that we would love to talk about. cURL founder and maintainer Daniel Stenberg as well as members of the wolfSSL team will be on hand to answer developers’ questions first hand. 

If you or your team is considering integrating wolfSSL or cURL with a project you can take a look at our stand schedule and talk to us. Please stop by to talk to these top experts in their field. 

Daniel Stenberg will be available to talk all things cURL. Ask Daniel about cURL security, new protocol support, Post Quantum cURL, Tiny cURL.

Daniele Lacmera, wolfSSL Senior Engineer, is on hand to talk about Secure Bootloaders, Post Quantum ciphers, and everything wolfSSL.  Ask Daniele about his newest book!

February 4th          February 5th

Hours Engineer Hours Engineer
9:00 Daniele 9:00 Daniel S
9:30 Daniele 9:30 Daniel S
10:00 Daniele 10:00 Daniel S
10:30 Daniele 10:30 Daniel S
11:00 Daniele 11:00 Daniel S
11:30 Daniele 11:30 Daniel S
12:00 Daniele 12:00 Daniel S
12:30 Daniele 12:30 Daniel S
13:00 Daniele 13:00 Daniel S
13:30 Daniele 13:30 Daniele
14:00 Daniele 14:00 Daniele
14:30 Daniel S 14:30 Daniele
15:00 Daniel S 15:00 Daniele
15:30 Daniel S 15:30 Daniele
16:00 Daniel S 16:00 Daniele
16:30 Daniel S 16:30 Daniele
17:00 Daniel S 17:00 Daniele
17:30 Daniel S 17:30 Daniele
18:00 Daniel S
18:30 Daniel S
19:00 Daniel S

You can also set up a time to sit down and talk at FOSDEM, If you have questions on any of the above, contact us at facts@wolfssl.com, or call us at +1 425 245 824. We enjoy working with Open Source projects, and offer them free support from our technical staff when working with wolfSSL or cURL.

[1] https://fosdem.org/2023/about/

wolfBoot support for the STM32C0

We are adding wolfBoot support for the new STM32C0. This is a low cost MCU similar to the STM32G0 based on a Cortex-M0 (48MHz). It is a very low cost general purpose 32-bit MCU with up to 32KB flash and 12KB RAM.

Our wolfBoot secure bootloader is the only solution available for this platform thanks to our small code size. Most STM32 parts are supported with wolfBoot out of the box. See our video series with ST for a tutorial on using wolfBoot: https://www.wolfssl.com/st-wolfboot-video-series/

See the STM32C0 announcement from ST: https://www.st.com/en/microcontrollers-microprocessors/stm32c0-series.html

We will be demonstrating this at our booth during Embedded World 2023 in Nuremberg, Germany March 14-16.

Features:

  • Written in C for bare-metal use
  • Small footprint to run on small embedded devices
  • Memory safety (no malloc/free)
  • Support for on-board or external SPI flash
  • Simple partitioning and header scheme
  • Abstracted HAL design for CPU speed and flash
  • Bootloader handles swapping and loading of partitions
  • Key tools for key generation/import and signing
  • Encrypted updates
  • Delta updates (only differences)

Signature algorithms supported:

  • ECC (SECP256R1,SECP384R1)
  • RSA (2048/3072/4096)
  • ED25519
  • ED448

Firmware image integrity using hash digest:

  • SHA2-256
  • SHA2-384
  • SHA3-384

Flexible partition scheme determined at build-time:

  • Bootloader (10-30KB)
  • Application
  • Update
  • Swap (1 sector)
  • And custom partition ID's

Reliable Firmware update mechanism:

  • Independent from the update transport mechanism
  • Fallback to a previous version when the update fails
  • Resume interrupted swap operations during update, in case of power failure

Support for STM hardware crypto acceleration:

KEMTLS Experimentation Via wolfSSL

A new, exciting paper has been released by Ruben Gonzalez from Neodyme AG and Thom Wiggers from Radboud University. They compare post-quantum algorithms in TLS 1.3 and KEMTLS.  KEMTLS is a newly proposed modification to the TLS 1.3 protocol that would eliminate the need for signing operations during a handshake protocol.  Note that a long term KEM public key would be embedded into a leaf certificate so the certificate chain would still need to be verified with a signature scheme.  The team did the work of modifying wolfSSL to support KEMTLS in their own fork of wolfSSL. Their paper can be found at https://eprint.iacr.org/2022/1712 .

The paper concludes that KEMTLS would allow for lower memory consumption.  However, there was no clear winner with regards to handshake times.  In some situations, post-quantum TLS 1.3 was faster, while in other cases KEMTLS did better.  If you are curious about it, please do download the paper.

We would like to thank the authors for the following words:

"WolfSSL is designed to be memory efficient and fast on embedded systems. On top, it already supports TLS 1.3 and has a clean implementation of TLS’s state machine. ...WolfSSL’s crypto provider, called WolfCrypt, has a clean API that can be extended easily."

Here at wolfSSL, we appreciate it when our code quality is noticed.

Are you curious about any other protocols? Our wolfSSL library also supports DTLS 1.2 and recently support for DTLS 1.3 was added.  We support SSH, MQTT and SCEP via our wolfSSH, wolfMQTT and wolfSCEP products. If you are curious, don't be shy! The full source code for all of these products are available for download under open source licenses at https://www.github.com/wolfSSL/. If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Rust Crate for Post-Quantum TLS 1.3 and wolfSSL

Are you on the bleeding edge of software development and cryptographic protocols? Then you'll appreciate the work that our friends at ExpressVPN have done by creating a rust crate for wolfSSL with bindings into our API.  They have even created a special feature flag called "postquantum" which enables our integration with liboqs. In fact, this feature will automatically bring in the oqs-sys rust crate making the whole setup as simple as could be!

For more details and instructions on how to proceed, please see https://crates.io/crates/wolfssl-sys/ .

Are you interested in more rust bindings?  Are you thinking of using wolfSSL in your rust application? Then we would love to have a conversation with you! If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

 

DTLS 1.3 support for Post-Quantum Cryptography

Do you want to start using wolfSSL’s DTLS 1.3 implementation?   Want to go even further? 

A great reason to start using our DTLS 1.3 stack is that it also supports post-quantum KEMs, Hybrid KEMs and post-quantum signature schemes.  When it comes time to move to post-quantum standards, support for them will likely come in the newest protocol standards only, so you might as well go to DTLS 1.3 as soon as you can and make sure that post-quantum algorithms and artifacts won’t be a challenge for your system. 

Got questions about the DTLS 1.3 or post-quantum cryptography? If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.  

Posts navigation

1 2 3 4 5 6 7 8 9 10 … 22 23 24