Announcing wolfHSM Integration with wolfBoot
We’re excited to announce that wolfBoot now supports integration with wolfHSM, bringing enhanced security features to our best-in-class secure bootloader solution on supported platforms. This enhancement positions wolfBoot as an even stronger tool for automotive and industrial applications with the highest security requirements.
What are wolfBoot and wolfHSM?
wolfBoot is our open-source, portable, OS-agnostic secure bootloader solution for 32-bit microcontrollers and beyond. It ensures that only authenticated firmware can run on your embedded device, providing a root of trust for your application..
wolfHSM is our generic Hardware Security Module (HSM) firmware framework, providing a unified API for secure cryptography, object storage, and key management on HSM coprocessors. wolfHSM enables applications to easily leverage a platform’s hardware-based root of trust and provides a streamlined abstraction for offloading all cryptography to the HSM coprocessor through the wolfCrypt API.
wolfHSM Integration with wolfBoot
By integrating wolfHSM with wolfBoot, we’ve enhanced the security capabilities of our already secure bootloader with the following features:
- Secure Key Storage: Cryptographic keys are now stored securely on the wolfHSM server, never accessible to wolfBoot or user applications.
- Remote Cryptographic Operations: All cryptographic operations are offloaded as remote procedure calls to the wolfHSM server. Hardware acceleration for cryptographic algorithms is included when supported by the platform.
- Flexible Key Management: Keys can be updated or rotated on the wolfHSM server without requiring a wolfBoot update.
Supported Platforms
Currently, wolfBoot supports using wolfHSM on the following platforms:
- wolfBoot simulator (using wolfHSM POSIX TCP transport)
- Infineon AURIX TC3xx (shared memory transport)
More platforms are in development. Don’t see your platform here? Reach out to us at facts@wolfSSL.com and we can discuss adding support!
Getting Started
To get started with wolfBoot + wolfHSM:
- Check out the wolfHSM integration documentation for an overview of the configuration options and HAL requirements.
- Consult your platform-specific wolfHSM documentation for instructions on configuring the wolfHSM server.
- To test wolfHSM + wolfBoot using the simulator, simply follow the instructions here to build wolfBoot with wolfHSM support and run it against our example wolfHSM server.
Give it a try and let us know what you think!
If you have any questions about wolfBoot or wolfHSM, please reach out via email at facts@wolfSSL.com or call us at +1 425 245 8247 and we will be happy to assist you!
Download wolfSSL Now
wolfSSL JNI/JSSE 1.14.0 Now Available
wolfSSL JNI/JSSE 1.14.0 is now available for download! This release contains a number of bug fixes, changes and new features to help better support usage from applications and 3rd party frameworks that consume wolfJSSE internally.
wolfSSL JNI/JSSE allows for easy use of the native wolfSSL SSL/TLS library from Java. The thin JNI wrapper can be used for direct JNI calls into native wolfSSL, or the JSSE provider (wolfJSSE) can be registered as a Java Security provider for seamless integration underneath the Java Security API. wolfSSL JNI/JSSE provides TLS 1.3 support and can also support running on top of wolfCrypt FIPS 140-2 and 140-3 validated modules.
Changes in this release are summarized below, but please see ChangeLog.md for a full list. Watch for individual future blogs on some of these topics as well for a more in depth description.
New JNI and JSSE Functionality:
- Addition of a new WKS KeyStore type to better facilitate FIPS compliance where needed
- Performance and scalability improvement with the use of native poll() set as default over select()
- Support for using RSA-PSS based certificates in TLS connections
- Addition of LDAPS endpoint identification verification to X509ExtendedTrustManager
- Two new JNI wrapped methods for native “wolfSSL_SessionIsSetup()” and “wolfSSL_SESSION_dup()”
JSSE System/Security Property Support:
- wolfjsse.debugFormat=JSON – a new System property to support outputting debug logs in JSON format, which can be more friendly for some log collection mechanisms
- wolfjsse.clientSessionCache.disabled – a new Security property to disable the Java client-side session cache, which will prevent session resumption from occurring
JSSE Changes:
- Native memory leak fixes, related to calls to wolfSSL_get_peer_certificate()
- Optimizations to allow for easier and more efficient garbage collection
- SSLEngine fixes for session storage, unwrap() FINISHED state transitions, HandshakeStatus when receiving TLS 1.3 session tickets after the handshake, correctly closing inbound on ALPN protocol name errors, and closure when fatal alerts are received
- SSLSocket fixes for end of stream handling in InputStream read() calls
- Fixes to throw expected or correct exceptions for several cases
- SSLSession getPeerCertificates() returns correct X509Certificate array
- Fixes around SSLSocket closure in a few different use cases
- Client-side session resumption is now keyed on the cipher suite and protocol in addition to host and port
- Build compatibility has been fixed with the older Android API 24, removing method calls not available in that SDK version
- A potential deadlock on close() between SSLSocket and the associated InputStream read() or OutputStream write() calls has been fixed
Exchange Changes:
- The Host String has been added into the HTTP GET request in the example ClientJSSE when used with the “-g” command line option
- JNI-only threaded client/server example applications have been added which can be helpful for seeing or debugging session resumption at the JNI-only level
- A basic RMI example client and server have been added, which can useful for reference and testing wolfJSSE over RMI
Testing Changes:
- Facebook Infer is now run on all GitHub pull requests using GitHub Actions
- TLS 1.0 and 1.1 JUnit tests are now run even if those protocols are disabled in the system “java.security” file, as long as native wolfSSL support has been compiled in
- Android Gradle builds are now tested on all GitHub pull requests using GitHub Actions
wolfSSL JNI/JSSE 1.14.0 can be downloaded from the wolfSSL download page, and an updated version of the wolfSSL JNI/JSSE User Manual can be found here. For any questions, or to get help using wolfSSL products in your projects, contact us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now
Getting Started with wolfSSL using Visual Studio 2022
It’s never been easier to get started with wolfSSL on Microsoft Windows using Visual Studio 2022!
New VS2022-specific project and solutions files have been created for both the wolfssl/wolfcrypt core library, as well as the test and benchmark examples. These files are available immediately on GitHub and are included in the recent release.
For long term customers and backward-compatibility, we’ve had older versions of Visual Studio that generally would update to whatever latest version might be installed. See our blog post here.
Now with the new VS 2022 files, no more manual adjustments are needed. The project files work immediately out of the box. Just open the project file and click the run button.
Let’s say you’ve just cloned the latest version of wolfSSL from GitHub in your C:\workspace directory:
git clone https://github.com/wolfSSL/wolfssl
The test and benchmark examples also include a vcxproj.user file that aids in pointing the working directory of the project to the root-level wolfSSL to easily find the compiled binary.
To get started with the examples, simply navigate to the wolfCrypt benchmark directory:
C:\workspace\wolfssl\wolfcrypt\benchmark
and open either the benchmark-VS2022.vcxproj project or benchmark-VS2022.sln solution files in Visual Studio 2022.
If you happen to be one of the Windows developers that also uses WSL, you may occasionally see an oddity in Visual Studio’s equivalent of git status as compared to the result from the WSL prompt. The issue is the way Windows might handle file permissions that differ between Windows and Linux when the same file system is shared (e.g. C:\workspace vs /mnt/c/workspace), causing Visual Studio to detect modified files even though there’s no apparent text change. One way to fix this is with this git command:
git config core.fileMode false
Visual Studio may need to be re-launched if it was already already running when the command was entered in a WSL prompt.
When using wolfSSL on Windows, it is a common practice to use a user_settings.h file. There’s an example in the wolfssl/IDE/WIN directory:
https://github.com/wolfSSL/wolfssl/blob/master/IDE/WIN/user_settings.h
The wolfCrypt Benchmark and wolfCrypt Test applications can also be used as reference examples.
Note the beginning of the benchmark.c file. It uses a common pattern of including the wolfssl library:
#ifdef HAVE_CONFIG_H
#include
#endif
#ifndef WOLFSSL_USER_SETTINGS
#include
#endif
#include /* also picks up user_settings.h */
It is important to define the c-compiler preprocessor definition: WOLFSSL_USER_SETTINGS
The #include <wolfssl/wolfcrypt/settings.h> should be listed before any other wolfSSL headers are included. The user_settings.h is included in the settings.h file. The user_settings.h should never be explicitly included in any other source code header.
Beyond the Benchmark and Test Examples
Do you have a project and you’d like to add the wolfssl library? Right-click on the solution file and select “Add – Existing Project…”:
Navigate to the root directory of your wolfSSL source code and add the wolfssl-VS2022.vcxproj file to your solution.
Be sure to also add a reference to each project that will use the wolfssl library. Right click on “references” and add check the “wolfssl” project:
Depending on the directory structure and relative location of the project, the path to the wolfssl source code headers will likely need to be added to the Additional Include Directories. The typical example will be at least for the root directory:
C:/workspace/wolfssl
And oftentimes the user_settings.h as well, shown here in the example IDE/Win directory:
C:/workspace/wolfssl/IDE/Win
The example property page would look like this:
That’s it! Simply build and run the project.
Reorganization Coming Soon
Visual Studio project and solution files will soon be moved to the .\IDE\VS2010.\IDE\VS2022 directories.
The FIPS-related builds currently interspersed in other directories will soon be consolidated and moved to a new .\IDE-FIPS directory. See PR #8126.
For more information:
Post Quantum
Do you have code that can be upgraded to Post Quantum? See our recent blog.
FIPS Certified!
When you are ready to move on to the next step, wolfSSL will be there for you! Need to have your project NIST Certified? Recently we announced that wolfSSL is the First in the World to offer FIPS 140–3 Automated Submission with our NIST Certificate #4718.
For more details, see our blog What is FIPS (long version).
Find out more:
If you have any feedback, questions, or require support, please don’t hesitate to reach out to us via facts@wolfSSL.com, call us at +1 425 245 8247, or open an issue on GitHub.
Download wolfSSL Now
curl with FIPS 140-3 wolfSSL
cURL is a popular open-source project that is used to transfer data between client and server with URLs through various protocols. It is widely utilized and often serves as the backbone for data transfer and communication between systems. curl (the command line tool) and libcurl (the library underneath) both provide support for secure communication by leveraging SSL/TLS libraries, the FIPS 140-3 certified wolfSSL library being one of them.
With the wolfCrypt FIPS 140-3 module, wolfSSL provides and makes use of an array of cryptographic algorithms that are rigorously tested and validated under NIST’s CMVP (Cryptographic Module Validation Program). When leveraged with cURL, the result is a FIPS 140-3 compliant build with the full feature set and utility that cURL users have come to expect, in addition to the cryptographic assurance that can help them meet security standards and requirements.
Additionally, there is also the tinycurl library, designed for smaller systems and more embedded use cases. tinycurl has the same capability to utilize FIPS wolfSSL.
Are you interested in curl with FIPS 140-3 wolfSSL? Contact us!
If you have questions about any of the above or need assistance, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now
Versal Support
Did you know that wolfSSL has been ported to and tested on Xilinx Versal hardware? There is support also in wolfSSL to make use of the Xilinx hardened crypto, enhancing both security and performance. Xilinx hardened crypto has accelerated crypto operations (SHA3-384 / AES-GCM / RSA / ECDSA) available on Ultrascale+ devices and is available for use with the latest and greatest Versal boards. wolfSSL makes these calls using the API from Xilinx’s XilSecure library (https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_services/xilsecure) and with the addition of Versal there was minor changes to the existing calls to make use of the new features available (ECC / RNG / AES-GCM with AAD). When benchmarking we saw well over a Gigabyte per second with AES-GCM operations in our demo and improvements in performance of RSA, ECDSA, and SHA3-384 over software only implementations.
A previous white paper going into the setup and use of wolfSSL on older Ultrascale+ devices with Xilinx hardened crypto can be found here (https://docs.xilinx.com/v/u/en-US/wp512-accel-crypto). The support for Versal along with a README can be found in the wolfSSL bundle located in IDE/XilinxSDK/.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
Changes In wolfSSL for ARM Thumb-2 Builds
With wolfSSL release 5.7.4 we added the macro WOLFSSL_ARMASM_THUMB2. This macro can be defined to enable Thumb-2 ARM instruction optimizations and replaces the previous attempted autodetect on the macros __arm__ and __thumb__. Giving users complete control over which ARM assembly optimizations are compiled and used.
When building for Thumb-2 the source files beginning with thumb2-* should additionally be compiled in. If WOLFSSL_ARMASM_THUMB2 is not used then the armv8-32-* files will be used. These files are located in wolfcrypt/src/port/arm/.
The benefit of now having WOLFSSL_ARMASM_THUMB2 is that users can place all files in wolfcrypt/src/port/arm/ to be compiled and use the macro gate for selecting if the Thumb-2 section is optionally compiled or ARM32 implementation is. The armv8-32- code is very similar to the thumb2- code, but Thumb-2 is smaller in size.
For assistance with ARM optimization builds contact us at support@wolfSSL.com.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
wolfSSL Inc. announces Rock-solid curl: long term supported curl releases
Rock-Solid curl: long term supported curl releases
EDMONDS, Wash., Nov. 11, 2024 /PRNewswire-PRWeb/ — wolfSSL INC. (Headquarters: Edmonds, Washington, USA), a vendor specialized in cryptography and network security, announces Rock Solid curl long term supported curl releases. Each release branch will be supported for 5 years. Only security fixes and important stability bug fixes will be merged into the branches, no new features or surprises. Rock-solid curl is available exclusively to all existing support customers released under the same distribution model as normal curl, (or a commercial license). Rock-solid curl is meant to greatly reduce the risk of regressions and yet be a safe and secure solution with full support. For the companies who want this extra level of attention. An even smoother ride. The release schedule for Rock-solid curl release branches are roughly every 18-24 months.
Rock-solid curl 8.9.2 is the first long-term support curl version. As the version number implies, it is based on the curl 8.9.1 release that shipped in July, with two security fixes and a small number of stability patches applied. All current customers under contract will receive the release.
Daniel Stenberg, the original author of curl, has been part of the wolfSSL team since 2019 and will be the primary support for the Rock-solid curl project. Daniel will provide the releases, and most of the patching and the back-porting of what is deemed necessary. Nothing changes with or happens to the original curl project and the regular curl releases because of this, the curl license remains the same. The curl releases and the release cadence remain intact. Support customers help fund the project by allowing us to pay developers.
Downloads and all Rock-solid curl information is hosted on the dedicated rock-solid.curl.dev site, separate from the open source project on curl.se.
On curl
Born in the late 1990s, curl is a client-side Internet transfer engine. Installed in over twenty billion instances it serves virtually everything that is internet connected: phones, tablets, cars, television sets, printers, medical devices, game consoles, helicopters on other planets, etc and it is an embedded component in a significant share of our most used and beloved apps, tools, games and services.
curl is the fruit and outcome from hard work by thousands of volunteers and is completely free and Open Source. The curl project is independent. It is not part of any umbrella organization or foundation and it is not owned nor controlled by any company.
curl is secure, fast and feature-rich. It is a defacto standard and key infrastructure.
About wolfSSL
wolfSSL focuses on providing lightweight and embedded security solutions with an emphasis on speed, size, portability, features, and standards compliance. With its SSL/TLS products and crypto library, wolfSSL is supporting high security designs in automotive, avionics and other industries. In avionics, wolfSSL has support for complete RTCA DO-178C level A certification. In automotive, it supports MISRA-C capabilities. For government consumers, wolfSSL has a strong history in FIPS 140-2/3, with upcoming Common Criteria support. wolfSSL supports industry standards up to the current TLS 1.3 and DTLS 1.3, is up to 20 times smaller than OpenSSL, offers a simple API, an OpenSSL compatibility layer, is backed by the robust wolfCrypt cryptography library, and much more. Our products are open source, giving customers the freedom to look under the hood. wolfSSL has a mean time to release a fix for vulnerabilities of less than 36 hours, offers commercial support up to 24/7, and has the best tested cryptography and the largest team of software engineers dedicated to crypto in the market today.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
Partner Webinar: wolfSSL and Infineon Technologies: Bringing TPM’s to the embedded MCU market
Enhance the security of your embedded projects by integrating TPM 2.0 technology from wolfSSL and Infineon Technologies. Join us in this informative webinar, where we’ll explore the advantages of using the wolfTPM library and Infineon Technologies’s SLB9672 (SPI) / SLB9673 (I2C) modules. Learn how these solutions provide secure key management, seamless firmware updates, and robust hardware security protection for embedded systems.
Register Now: wolfSSL and Infineon Technologies: Bringing TPM’s to the embedded MCU market
Date: November 13th | 9 AM PT
wolfTPM is the only library designed specifically for embedded systems, providing stable APIs across platforms, including bare-metal environments. Infineon Technologies further strengthens security by offering a public firmware update process for their TPMs, utilizing Post-Quantum resistant XMSS for long-term product support—an industry-leading feature that simplifies security maintenance across product life cycles.
In this webinar, you’ll discover how TPM 2.0 modules deliver critical security features, including secure storage, measured boot, and protection against side-channel attacks and physical tampering. The live demo will showcase the TPM firmware update on the PSoC6 with SLB9673, demonstrating how easily you can manage TPM updates in the field.
Webinar Agenda:
- The benefits of using TPM 2.0 modules in embedded systems
- How to simplify TPM integration using wolfTPM and Infineon Technologies’s SLB9672 (SPI) / SLB9673 (I2C) modules
- Why Infineon Technologies stands out as the only TPM vendor that supports public firmware updates using Post-Quantum XMSS, providing long-term product security
- Real-world applications of TPM
- Live Demo on TPM firmware update process on the PSoC6 with SLB9673
Don’t miss out on this opportunity to gain expert knowledge and ask questions directly to the engineers! Register today and learn how to elevate the security of your embedded MCU projects with wolfSSL and Infineon Technologies.
As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
Live Webinar in the Asia Pacific Time Zone: Post-Quantum Cryptography Update
Learn about the latest developments in NIST Post-Quantum Cryptography (PQC) Standards and CNSA 2.0. As the world prepares for the quantum computing era, understanding these standards is crucial for ensuring robust security protocols. wolfSSL Senior Software Developer Anthony Hu will guide you through their implications for cryptographic practices and share insights into wolfSSL’s journey in PQC. We’ll discuss our commitment to adopting quantum-resistant algorithms and the steps we’re taking to stay ahead of emerging threats.
Register Today: Post-Quantum Cryptography Update – Tailored for the Asia Pacific Time Zone
Date: November 12th | 7 PM PT / November 13th | 12 PM JST
This webinar is scheduled to accommodate participants in the Asia Pacific Time Zone.
Explore key exchange mechanisms by comparing NIKE and KEM, and see how ECC stacks up against ML-DSA and ML-KEM in performance metrics and efficiencies in a post-quantum world. Discover wolfSSL’s PQC readiness through ongoing migration efforts and partnerships with industry leaders to advance PQC standards.
This webinar will cover:
- NIST PQC Standards and CNSA 2.0 Updates
- wolfSSL’s PQC Journey: History and Current Status
- Comparing Key Exchange Mechanisms: NIKE vs. KEM
- Performance Benchmarking: ECC vs. ML-DSA and ML-KEM
- wolfSSL’s PQC Readiness, Migration Strategies, and Quantum-Resistant Solutions
- Collaborative Efforts in the PQC Landscape: Partnering with Industry Leaders
- Challenges and Barriers to PQC Migration
Don’t miss this opportunity to equip yourself with the knowledge essential for the evolving cryptographic landscape! Register Now!
As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
wolfMQTT Releases v1.19.1
wolfSSL is proud to announce the release of wolfMQTT v1.19.1!
This release fixes an issue in the Espressif example and corrects some documentation issues.
Release 1.19.1 has been developed according to wolfSSL’s development and QA process and successfully passed the quality criteria.
Check out the ChangeLog from the download for a full list of features and fixes, or contact us at facts@wolfSSL.com with any questions. While you’re there, show us some love and give the wolfMQTT project a Star!
Download the latest release or clone directly from our GitHub repository.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now