RECENT BLOG NEWS

wolfSSL: TLS 1.3, OpenSSL comparison

wolfSSL’s open-source SSL/TLS library is constantly updated to maintain a mature code base and adapts quickly to any standard changes. One recent change is the release of TLS 1.3 (successor of TLS 1.2 which was out for 10 years).

What is new in TLS 1.3?
TLS 1.3 brought forth numerous improvements including faster handshake times, full session encryption and new cipher suites. There are faster handshake times as there is only one RTT instead of two which enables clients to send data immediately after the first reply from the server. Full session encryption is also achieved through the use of a variety of encryption algorithms to secure data. In addition, new cipher suites considered to be stronger also come with TLS 1.3.

How are we different from OpenSSL?
There are several key differentiators between wolfSSL and OpenSSL. These include the following:

• Build size (up to 20x smaller than OpenSSL)
• Standards support: up to date on most recent standards
• Hardware acceleration
• Team of security experts
• Ease of Use designed for developers
• Portability: a long list of supported platforms
• Dual license: GPLv2 or Commercial
• 24/7 Support

To watch all the wolfSSL webinars, check out our YouTube channel:
https://www.youtube.com/channel/UCxcGPWzOnhdocvKmxqhfvPg?view_as=subscriber

To read more about the differences between TLS 1.2 and TLS 1.3 visit:
https://www.wolfssl.com/differences-between-tls-12-and-tls-13-12/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The wolfMQTT client library has an Amazon Web Services example that demonstrates securely connecting over TLS provided by the wolfSSL embedded SSL/TLS library.

We setup an AWS IoT endpoint and testing device certificate. The AWS server uses a TLS client certificate for authentication. The example is located in `/examples/aws/`.  It subscribes to `$aws/things/”AWSIOT_DEVICE_ID”/shadow/update/delta` and publishes to `$aws/things/”AWSIOT_DEVICE_ID”/shadow/update`.

Everyone deserves to have their IoT data secure, and wolfSSL provides the best libraries to accomplish that! wolfSSL supports up to TLS 1.3, FIPS 140-2, expansive support for hardware cryptography, and more!  Secure-IoT-Love from the wolfSSL team!

You can download the latest release here: https://www.wolfssl.com/download/

Or clone directly from our GitHub repository.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The team at wolfSSL has taken the core functionality of the wolfSSL embedded SSL/TLS library to the next level and implemented changes to conform to the Required and Mandatory rules from the MISRA-C:2012 Guidelines.

Currently a subset of the wolfCrypt files are checked (sha256.c, aes.c (CBC/GCM), rsa.c, random.c, sp_c64.c), let us know if your project requires other files and we can target them while expanding coverage.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The Java Secure Socket Extension (JSSE) framework supports the installation of security providers. These providers can implement a subset of the functionality used by the Java JSSE security APIs, including SSL/TLS.  We are happy to announce the availability of the wolfJSSE Provider, which wraps the native wolfSSL SSL/TLS library.  With this provider, users can leverage all the advantages of native wolfSSL from Java applications!  These advantages include TLS 1.3 support, performance optimizations, hardware cryptography support, FIPS 140-2 validation, and much more!

The wolfSSL JSSE provider (wolfJSSE) is distributed along with the wolfSSL JNI wrapper.  Version 1.5.0 is now available from the wolfSSL download page (wolfssl-jni-jsse-1.5.0.zip).  wolfJSSE has currently been tested on several JDK’s, including Oracle JDK, OpenJDK, Android OSP, and Zulu JDK.  If you would like to use wolfJSSE on a different JDK or platform, let us know at facts@wolfssl.com!

There are several example applications that ship as part of the JSSE download, including an example Client and Server, which make it easier to get up and running quickly.  The provider can be installed at runtime per application, or at the system level for all Java Security API consumers to use.

Initial benchmarking between native wolfSSL, wolfJSSE, and the default SunJSSE provider client on Mac are below:

NOTE: TLS 1.2 cipher suite used in above benchmarks: ECDHE-RSA-AES256-GCM-SHA384

To learn more, please see the following documentation pages:

wolfSSL JSSE Provider (and JNI wrapper) Product Page
wolfSSL Java JSSE Provider User Manual
Installing a JSSE Provider in Android OSP

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL is a proud partner of STMicroelectronics, and we support a great many of their products. Now we have added support for the STM32_PKA accelerator found in the STM32WB55 module.

The STM32WB55 module is is a heterogeneous dual-core MCU with a Cortex-M4 for the end-user application and a Cortex-M0 for the BLE stack. This PKA module accelerates ECC sign and verification. The measured performance is 160ms per ECC SECP256R1 verification. This option is enabled with the WOLFSSL_STM32_PKA build option and is demonstrated with our wolfBoot library.

Support added in PR 2498:
https://github.com/wolfSSL/wolfssl/pull/2498

wolfBoot implementation details can be found here.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL

wolfSSL now provides support for complete RTCA DO-178C level A certification! wolfSSL will offer DO-178 wolfCrypt as a commercial off -the-shelf (COTS) solution for connected avionics applications. Adherence to DO-178C level A will be supported through the first wolfCrypt COTS DO-178C certification kit release that includes traceable artifacts for the following encryption algorithms:

• SHA-256 for message digest
• AES for encryption and decryption
• RSA to sign and verify a message.
• Chacha20_poly1305 for authenticated encryption and decryption.

The primary goal of this initial release is to provide the proper cryptographic underpinnings for secure boot and secure firmware update in commercial and military avionics. wolfSSL brings trusted, military-grade security to connected commercial and military aircraft. Avionics developers now have a flexible, compact, economical, high-performance COTS solution for quickly delivering FIPS 140-2 validated crypto algorithms can be used in DO-178 mode for combined FIPS 140-2/DO-178 consumption. The wolfCrypt cryptography library FIPS 140-2 validation certificates can be applied to DO-178 uses. 

Optimization Support

We understand that securely rebooting avionic systems has rigorous performance requirements. As such, we’re here to help with cryptographic performance optimizations through our services organization. 

To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.

wolfSSL DO-178 product page: https://www.wolfssl.com/wolfssl-support-178-dal/.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg) 

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

With each release of the wolfSSL embedded SSL/TLS library, new improvements and feature additions are always included. The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release of wolfSSL 4.3.0, we are happy to include expansions in our OpenSSL Compatibility layer. As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until December 2020. The version of OpenSSL that supports FIPS goes into End Of Life and is no longer supported in December of 2019. As a result we are constantly expanding the OpenSSL compatibility API to help people migrate from OpenSSL to wolfSSL. In this release the API wolfSSL_CertManagerGetCerts() and wolfSSL_X509_STORE_GetCerts() were added for retrieving certificates.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL

The wolfSSL embedded SSL/TLS library provides support for various open source projects, including Nginx. For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository.  The configure option --enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

With each release of the wolfSSL embedded SSL/TLS library, new improvements and feature additions are always included. The wolfSSL team has made sure to incrementally improve and update support for our various partners. In our wolfSSL 4.3.0 holiday release, we are happy to bring improved support for MQX. wolfSSL has added new FREESCALE_MQX_5_0 macro for MQX v5 support!

For those who are unaware MQX v5 is a continuation of the MQX Classic product available under low-cost commercial licensing terms. MQX v4.2 is no longer available and has been superseded by v5. MQX v5 is backward compatible with MQX Classic and includes a multitasking RTOS kernel, a TCP/IP stack (RTCS) with Internet protocol v6 (IPv6), embedded MS-DOS file system (MFS), USB host/device stack and task-aware debugging. MQX v5 board support packages (BSPs) are available for a number of platforms, with other BSPs available upon request.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL