RECENT BLOG NEWS

So, what’s new at wolfSSL? Take a look below to check out the most recent news, or sign up to receive weekly email notifications containing the latest news from wolfSSL. wolfSSL also has a support-specific blog page dedicated to answering some of the more commonly received support questions.

FIPS 140-3 Announcement to the world

wolfSSL Inc. is very pleased to announce our wolf pack has successfully hunted down and captured the ever elusive FIPS 140-3 certificate! The world’s first automated submission (SP800-140Br1) FIPS 140-3 validated certificate #4718 posted to the NIST website on July 11th 2024, valid through July 10th, 2029!

“wolfSSL remains focused on enhancing our technologies and expanding capabilities. We are dedicated to continuous innovation in security. The advancements in our FIPS 140-3 module highlight our commitment to delivering state-of-the-art cryptographic solutions that meet the rigorous demands of today’s cybersecurity landscape.” Stated wolfSSL CTO, Todd Ouska.

We are thrilled to work with ÆGISOLVE, INC. on this journey. The wolfSSL team is grateful for the ÆGISOLVE staff’s hard-work and dedication in realizing the very first SP800-140Br1 140-3 certificate in the world! A note from the ÆGISOLVE team:

“‘AEGISOLVE is pleased to announce the world’s first SP800-140Br1 compliant FIPS 140-3 Validation Certificate for wolfSSL’s wolfCrypt module’ reported Travis Spann, Founder and President of AEGISOLVE (NVLAP Lab Code: 200802-0).

‘As a first of its kind, this is a tremendous achievement and a huge step forward for the next generation of FIPS 140-3 Validated Cryptographic Modules. Congratulations, wolfSSL!

Highlights

  • Boot Times
    • wolfCrypt FIPS 140-2, power-on times could be slower due to mandatory self-tests
    • wolfCrypt FIPS 140-3 requires self-tests only at the first algorithm use or during a slower event cycle
      • faster boot times
      • optimal power and resource consumption with careful planning!
  • Design
    • The wolfCrypt FIPS 140-3 validated module is the only commercial FIPS solution tailored for embedded
      • Emphasis on a minimal footprint, low resource use, reduced power consumption, and high performance for standard and real time systems
      • Design leads to superior scalability across devices, from mobile to server
        • 10 times more connections per device at 15-20% better performance than competing solutions.
  • OpenSSL Replacement
  • Embeddability
    • Embedded Systems (Medical, networking, sensors, security systems, etc.)
    • Extended Battery life and high performance
    • Hardware Encryption Support
    • Assembly Acceleration

Changes from the historic wolfCrypt FIPS 140-2 cert #3389 to the active wolfCrypt FIPS 140-3 cert #4718:

  • CAST (conditional algo self tests)
  • KDF-TLS, TLS v1.2 KDF and TLSv1.3 KDF
  • SSH KDF
  • AES-OFB mode
  • RSA 3072, 4096 and PSS
  • New Degraded mode of operation in the event of a CAST failure other algorithm services will remain available.

For more about what FIPS is please checkout these blogs:

For information on transitioning from 140-2 to 140-3 please checkout our blog: What is the difference between FIPS 140-2 and FIPS 140-3?

Algo cert Link
Security Policy Link
Ref: Section 2.5 Algorithms
Ref: Section 2.2 Table 6 “Tested Operational Environments – Software, Firmware, Hybrid”
Cert #4718 Link

For questions, comments or feedback please contact the wolfSSL team anytime at fips@wolfssl.com.

Download wolfSSL Now

Enhance Embedded System Security with ADI MAXQ1065 and wolfSSL

wolfSSL’s trusted partner, Analog Devices, Inc. (ADI), recently announced that integrating the MAXQ1065 with wolfSSL can significantly enhance security for IoT and embedded systems. Explore the ADI Engineer Zone blog post, Securing IoT and Embedded Systems: Integrate MAXQ1065 with wolfSSL, to discover wolfSSL’s competitive advantages and how this integration improves IoT security solutions and embedded system security applications.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Automotive Hardware Security Modules: Functionality, Design, and Applications

In the fast-evolving automotive industry, securing data integrity, confidentiality, and authenticity is crucial. Hardware Security Modules (HSMs) are essential tools, offering robust protection for cryptographic keys and processing.

Register Today: Automotive Hardware Security Modules: Functionality, Design, and Application
Date: October 7th | 8 AM PT

We invite you to an upcoming webinar, where Bill will delve into automotive HSMs. This session will cover a range of topics including:

  • Essentials of Hardware Security Modules: Understand the core principles and functionalities of HSMs.
  • Functional Design Insights: Gain insights into the design and operational aspects of advanced HSMs.
  • Applications in AUTOSAR, SHE, and PKCS11: Discover how HSMs are integrated into these key automotive standards and frameworks.
  • Hardware Porting and Support Strategies: Learn about effective strategies for porting and supporting HSMs in various hardware environments.

This webinar will also feature a demonstration on a popular microcontroller, showcasing practical applications of HSM technology.

Don’t miss this chance to enhance your understanding of automotive HSMs and their role in securing next-generation vehicles. Register now!

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

FIPS-Certified WireGuard: Bringing wolfCrypt into the VPN Solution

As WireGuard continues to grow in popularity for its simplicity and efficiency in VPN deployments, security-conscious organizations are increasingly demanding solutions that adhere to stringent security standards, such as the Federal Information Processing Standard (FIPS 140-3). FIPS certification is a key requirement for governmental agencies and industries like healthcare and finance, where secure cryptographic implementations are mandatory. However, WireGuard’s default cryptographic implementations, while highly secure, are not FIPS-certified.

This is where wolfCrypt steps in. wolfCrypt is a lightweight, portable, and highly optimized cryptographic library that offers FIPS 140-3 certification, making it an ideal partner for users seeking FIPS compliance in their WireGuard deployments. With our planned integration, we’ll replace the standard crypto suite that WireGuard offers (ChachaPoly, Curve25519, Blake2s) with our own certified algorithms (AES GCM, ECC P-256, SHA-256). One thing to note here is that FIPS-ified WireGuard end-points may only communicate with other FIPS-ified end-points. But this of course is not a bug, but a feature. FIPS can only talk to FIPS.

So by leveraging our incoming integration, users can gain access to a VPN solution that is both secure and FIPS-compliant. This is especially important for industries with strict security requirements. The performance of WireGuard, combined with the certified cryptographic operations of wolfCrypt, ensures that you don’t sacrifice speed or security. In fact, with wolfCrypt’s ability to utilize hardware acceleration for AES and SHA, you might end up with a much faster WireGuard. Additionally, wolfCrypt’s small footprint makes it a practical choice for deployments in constrained environments, including IoT devices, embedded systems, and edge computing setups. You get a robust, certified security layer without bogging down performance.

Are you interested in WireGuard with wolfCrypt?

If you have questions about any of the above or need assistance, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Support for the Official Post-Quantum Standards ML-KEM and ML-DSA

Just a little while back to much fanfare, NIST-release these standards:

They are the post-quantum algorithms that are now standardized for use!! As a quick summary:

  • Kyber became ML-KEM (Module Lattice Key Encapsulation Mechanism) which is specified by NIST’s FIPS 203 document.
  • Dilithium became ML-DSA (Module Lattice Digital Signature Algorithm) which is specified by NIST’s FIPS 204 document.
  • SPHINCS+ became SLH-DSA (StateLess Hash-based Digital Signature Algorithm) which is specified by NIST’s FIPS 205 document.

ML-KEM and ML-DSA are great for general purpose use in protocols. For example, where you would use ECDH you would use ML-KEM and where you would use ECDSA you would use ML-DSA. SLH-DSA has specialized applications similar to those of LMS and XMSS. If you don’t want to deal with the statefulness of those algorithms, then SLH-DSA would be a great replacement.

Hot on the heels of this standardization announcement, we here at wolfSSL are announcing to the world that we have full implementation and support for ML-KEM and ML-DSA. You can have a look and try them out for yourself. Simply download the wolfSSL library, configure it to enable Dilithium and Kyber and run the benchmarks!

If you are interested in an implementation and support for SLH-DSA or have questions about any of the avobe, please contact us at facts@wolfSSL.com or +1 425 245 8247!

Download wolfSSL Now

Live Webinar: Everything You Ever Wanted to Know About How wolfSSL Runs on Xilinx

Explore how wolfSSL enhances security on Xilinx Devices in an upcoming webinar.

Join wolfSSL software Developer Jacob Barthelmeh in our live webinar, Everything You Ever Wanted to Know About How wolfSSL Runs on Xilinx, on October 2nd at 10am PT. Dive into the world of secure embedded systems and discover how to optimize wolfSSL for Xilinx platforms, including Versal, MPSoC UltraScale, and MicroBlaze.

Register today: Everything You Ever Wanted to Know About How wolfSSL Runs on Xilinx
Date: October 2nd | 10am PT

Jacob will guide you through building wolfSSL for Xilinx devices, highlighting the integration of wolfCrypt’s FIPS 140-3 mode, hardware acceleration ports with XilSecure, and using ARM assembly optimizations for performance improvements.

You’ll also explore how to incorporate wolfSSL into PetaLinux environments for maximum security, utilize wolfBoot on Xilinx/AMD devices, and understand how wolfSSL ports to various environments. Additionally, Jacob will showcase the use of wolfHSM with Xilinx/AMD platforms, offering valuable insights into implementing robust cryptographic security for your Xilinx devices.

This webinar will cover (agenda subject to change):

  • Building wolfSSL for Xilinx devices (Versal, MPSoC UltraScale, MicroBlaze)
  • Leveraging FIPS 140-3 mode for security compliance
  • Integrating hardware acceleration, including XilSecure
  • ARM assembly optimizations for performance
  • Using wolfSSL with PetaLinux
  • wolfBoot on Xilinx/AMD devices
  • Porting wolfSSL to other environments
  • Using wolfHSM with Xilinx/AMD

Don’t miss this opportunity to learn how wolfSSL can enhance security on your Xilinx systems. Register today to secure your spot and deepen your understanding of embedded security with wolfSSL on Xilinx platforms!

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Post-Quantum wolfHSM on Aurix Tricore

The title says it all!! If you have been paying any attention at all to us here at wolfSSL, you will know that we are very proud of our wolfHSM product that already runs on the Aurix Tricore. What we have not been focusing on is the post-quantum algorithms that work with wolfHSM. Let’s use this blog post to fix that oversight.

In this post we will be focusing on ML-KEM, ML-DSA, and especially LMS and XMSS as they are all implemented in wolfCrypt and are therefore available in wolfHSM to protect you from the oncoming quantum threat.

First of all, ML-KEM is a Key Encapsulation Mechanism and generally used for key establishment. In most protocols this means it is used ephemerally, but because of the security properties inherent in the algorithm, it can also be used statically. That means it is fine for wolfHSM to generate an ML-KEM private key and use it multiple times under the protection of the HSM core.

Naturally, as MLDSA is a general purpose post-quantum signature scheme, wolfHSM has an opportunity to help just like in the case of ECDSA or RSA.

Now, where wolfHSM provides a unique offering is LMS and XMSS. These are stateful hash-based signature schemes which are great for firmware and software signing. That said, there is a state associated with the private key and that state MUST be properly managed. A consequence of improper management is that the key pair must be revoked and all signatures encountered after the point of revocation cannot be trusted.

Software libraries that implement signing by stateful hash-based signature schemes, such as wolfSSL, must trust the application developer to properly manage the state. In the case of wolfHSM, the wolfSSL team’s expertise can come into play to ensure proper management of the state. The application developer no longer needs to be an expert in post-quantum algorithms; simply a user of them.

If you’d like to learn how wolfHSM can support your post-quantum migration or have any questions, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfSSH with X.509 Certificates

Did you know wolfSSH can use X.509 certificates in place of SSH public keys? wolfSSH supports RFC 6187, “X.509v3 Certificates for Secure Shell Authentication”. This uses wolfSSL’s certificate management for TLS, so the certificates may be checked against CRLs and OCSP.

wolfSSH has been used in applications as a server where it needed to validate some FPKI (Federal Public Key Infrastructure) profiles. It is used with clients that authenticate the user’s credentials accessed via a card reader. wolfSSH’s client can be given an X.509 certificate to authenticate the user with the server.

If you have questions about wolfSSH, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

FIPS vs FedRAMP Compliance and Requirements

The wolfSSL team has noticed an uptick in questions about FedRAMP requirements. Today, we want to cover the differences between FIPS and FedRAMP.

FIPS:

The Federal Information Processing Standards (FIPS) stipulate security requirements for cryptographic modules, which wolfSSL Inc. meets with our wolfCrypt FIPS module. NIST and the CMVP then encourage all federal programs using cryptography to follow these standards. Federal Procurement Officers (at the urging of NIST and the CMVP) then require FIPS compliance for solutions that consume cryptography and are used within the scope of their federal program(s).

FEDRAMP:

The Federal Risk and Authorization Management Program (FedRAMP) focuses on the security assessment, authorization, and continuous monitoring of cloud products and services. A prerequisite for FedRAMP is the proper implementation of a FIPS-validated cryptographic module by the cloud service provider.

Both programs aim to enhance data security but differ in scope. While FIPS focuses on cryptographic module validation and cryptography, FedRAMP ensures the overall security of cloud services, one part of which is proper implementation of FIPS validated cryptography for all cryptography running in the cloud. Beyond checking for proper FIPS implementations, FedRAMP also ensures the cloud service provider is fully compliant with NIST SP 800-53 IE: Security Controls, a NIST Risk Management Framework (RMF), service is monitored continuously, data protection methods are robust, incidents can be detected, responded to and recovered from, and more. For a complete list please refer to SP 800-53 at this [LINK].

To support wolfSSL customers, wolfSSL Inc. offers a service to fully validate any Operational Environment (OE) (IoT, embedded, FPGA, Digital Signal Processor (DSP), laptop, desktop, server blade, or cloud system). wolfSSL Inc (the vendor) will fully test and validate the OE of choice using a third-party NVLAP accredited FIPS lab (or CSTL) and get the OE listed as a CMVP-validated OE on the wolfCrypt FIPS Certificate. This is a CMVP-backed OE addition which is guaranteed to be acceptable by any federal program with a FIPS requirement, as opposed to vendor affirmation or user affirmation which often fall short of the mark. Additionally, once the primary certificate is updated with the OE of choice, a rebranded cert with the customer’s logo and letterhead can be offered including that new OE.

wolfSSL’s wolfCrypt FIPS module supports the latest FIPS 140-3 standards and holds the world’s first SP800-140Br1 FIPS 140-3 validated certificate (#4718). Our expert support team is available to assist with the proper implementation of the module on your target OE, a critical step for achieving a successful FedRAMP effort.

Beyond getting proper OE’s for FEDRAMP initiatives, wolfSSL can support customers that are either:

  1. Using an alternative OS within AWS, Azure, or Oracle cloud, or,
  2. If you are standing up your own cloud, support you with meeting the FedRAMP FIPS requirements for the operating system of your choice.

For more information on how wolfSSL can help with your FIPS or FedRAMP compliance needs, shoot us an email at fips@wolfSSL.com today!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Introducing rustls-wolfcrypt-provider: wolfCrypt for Rustls

rustls-wolfcrypt-provider integrates the wolfCrypt cryptographic library as a backend for Rustls, allowing developers to use wolfCrypt’s secure cryptographic functions with Rustls’ modern TLS stack. Currently in alpha, this library offers flexibility for those needing an alternative crypto provider, especially for projects requiring FIPS 140-3 readiness.

Other reasons to consider wolfCrypt as your Rustls provider include the following:

  1. Hardware encryption support, wolfCrypt supports hardware encryption and assembly optimizations for systems big and small. See our list of supported hardware encryption schemes.
  2. Support: we will support Rustls when used in conjunction with wolfCrypt.
  3. Consulting: If you need help making all of this work in your environment, we’ll help!

Supported Cipher Suites

TLS 1.3:

  • TLS13_CHACHA20_POLY1305_SHA256
  • TLS13_AES_128_GCM_SHA256
  • TLS13_AES_256_GCM_SHA384

TLS 1.2:

  • TLS12_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS12_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • TLS12_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS12_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS12_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  • TLS12_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

With rustls-wolfcrypt-provider, developers can combine the cryptographic strengths of wolfCrypt with the modern TLS capabilities of Rustls, supporting Rustls version 0.23.9. This integration is ideal for projects that require both strong security and the flexibility of wolfCrypt’s cryptography.

Are you interested in Rust solutions with wolfSSL integration?

If you have questions about any of the above or need assistance, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Everything You Need to Know about FIPS 140-3

Join us on September 25th at 10 AM PT for an in-depth look at FIPS 140-3 with wolfSSL Senior Software Engineer, Kaleb Himes. This is your chance to get the inside scoop on how FIPS 140-3 can enhance your security!

Register Now: Everything You Need to Know about FIPS 140-3
Date: September 25th at 10am PT

This webinar will cover:

  • Basic & Benefits: Discover why FIPS 140-3 is essential for secure systems and what makes it a must-have.
  • Difference Between FIPS 140-2 and FIPS 140-3: Understand the key distinctions and improvements from FIPS 140-2.
  • wolfCrypt’s Achievement: Learn about wolfCrypt’s milestone as the first to receive the SP800-140Br1 FIPS 140-3 validated certificate (#4718).
    And much more…

Whether you’re new to FIPS 140-3, looking to deepen your knowledge or seeking FIPS 140-3 support, this webinar will provide valuable insights and practical information.

Don’t miss out on this opportunity to enhance your understanding and stay ahead in cybersecurity. Register now and secure your spot!

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2 3 4 … 183 184 185

Weekly updates

Archives