wolfSSL 3.15.5 is Now Available
wolfSSL Intel SGX (#SGX) + FIPS 140-2 (#FIPS140)!
wolfSSL is pleased to announce the following addition to the wolfSSL FIPS certificate!
| Debian 8.7.0 | Intel ® Xeon® E3 Family with SGX support | Intel®x64 Server System R1304SP |
| Windows 10 Pro | Intel ® Core TM i5 with SGX support | Dell LatitudeTM 7480 |
The wolfCrypt FIPS validated cryptographic module has been validated while running inside an Intel SGX enclave and examples have been setup for both Linux and Windows environments.
Intel ® SGX (Software Guard Extensions) can be thought of as a black-box where no other application running on the same device can see inside regardless of privilege. From a security standpoint this means that even if a malicious actor were to gain complete control of a system including root privileges, that actor, no matter what they tried, would not be able to access data inside of this “black-box”.
An Intel enclave is a form of user-level Trusted Execution Environment (TEE) which can provide both storage and execution. Meaning one can store sensitive information inside and also move sensitive portions of a program or an entire application inside.
While testing, wolfSSL has placed both individual functions and entire applications inside the enclave. One of the wolfSSL examples shows a client inside the enclave with the only entry/exit points being “start_client”, “read”, and “write”. The client is pre-programmed with a peer to connect with and specific functionality. When “start_client” is invoked it connects to the peer using SSL/TLS and executes the pre-programmed tasks where the only data entering and leaving the enclave is the info being sent to and received from the peer. Other examples show placing a single cryptographic operation inside the enclave, passing in plain-text data and receiving back encrypted data masking execution of the cryptographic operations.
If you are working with SGX and need FIPS validated crypto running in an enclave contact us at fips@wolfssl.com or support@wolfssl.com with any questions. We would love the opportunity to field your questions and hear about your project!
wolfSSL FAQ page
Renesas RX Alpha Project uITRON and TINET Demo Projects
Are you curious about wolfSSL support for the uITRON RTOS? We recently added SSL/TLS server/client example projects running on top of uITRON and TINET (their network layer API). This API is incompatible with BSD, so this is also a good demo how wolfSSL can fit into a non-BSD API easily.
These demo projects are currently in the wolfSSL master branch on GitHub, and will roll into the next stable release of wolfSSL!
You can download the demo today by cloning an up to date wolfSSL package from our repository:
https://github.com/wolfssl/wolfssl
The demo files are located under “IDE/Renesas/cs+/Projects/t4_demo”. This demo is assumed to be built with AlphaProject board with Renesas RX family MPU and its default firmware or driver. It includes TINET TCP/IP compatible Renesas firmware, T4Tiny. For information on building the project, refer to the README located in the demo directory.
Renesas: https://www.renesas.com/us/en/
Renesas RX family: https://www.renesas.com/us/en/products/microcontrollers-microprocessors/rx.html
AlphaProject: https://www.apnet.co.jp/
If you are interested in using the wolfSSL embedded SSL/TLS library on this platform, contact us at support@wolfssl.com for help getting up and running! wolfSSL also supports TLS 1.3, FIPS 140-2, and integration into many different hardware cryptography implementations!
Additionally, the picture below displays the AlphaProject board with the Renesas RX family MPU itself:
wolfSSH with SFTP and SCP
wolfSSL is the Secure Socket Solution for QT
i.MX6 CAAM with Integrity OS
NXP CAU, mmCAU, and LTC Hardware Cryptography with TLS 1.3
As you may know, wolfSSL includes support for offloading cryptography operations into NXP Coldfire and Kinetis devices that include the CAU, mmCAU, or LTC hardware crypto modules. Taking advantage of these modules improves performance of both the cryptography and the SSL/TLS layer running on top of it.
Here is a quick comparison of performance between software cryptography and the hardware-based cryptography offered by the Kinetis mmCAU on a K60 TWR running at 100MHz:
Software Crypto Hardware Crypto AES 0.49 MB/s 2.71 MB/s DES 0.31 MB/s 3.49 MB/s 3DES 0.12 MB/s 1.74 MB/s MD5 4.07 MB/s 4.88 MB/s SHA-1 1.74 MB/s 2.71 MB/s SHA-256 1.16 MB/s 2.22 MB/s HMAC-SHA 1.74 MB/s 3.05 MB/s HMAC-SHA256 1.22 MB/s 2.03 MB/s
And, here are some benchmark comparisons between software and hardware cryptography offered by the LTC module on a NXP FRDM-K82F, Cortex M4 running at 150 MHz:
Software Crypto Hardware Crypto RNG 0.136 MB/s 0.939 MB/s AES enc 0.247 MB/s 12.207 MB/s AES dec 0.239 MB/s 12.207 MB/s AES-GCM 0.016 MB/s 12.207 MB/s AES-CTR 0.247 MB/s 8.138 MB/s AES-CCM 0.121 MB/s 6.104 MB/s CHACHA 0.568 MB/s 3.052 MB/s CHA-POLY 0.444 MB/s 1.878 MB/s POLY1305 2.441 MB/s 8.138 MB/s SHA 0.842 MB/s 4.069 MB/s SHA-256 0.309 MB/s 2.713 MB/s SHA-384 0.224 MB/s 0.763 MB/s SHA-512 0.216 MB/s 0.698 MB/s RSA 2048 public 147.000 ms 12.000 ms (over 1 iteration) RSA 2048 private 2363.000 ms 135.000 ms (over 1 iteration ECC 256 key generation 355.400 ms 17.400 ms (over 5 iterations) EC-DHE key agreement 352.400 ms 15.200 ms (over 5 iterations) EC-DSA sign time 362.400 ms 20.200 ms (over 5 iterations) EC-DSA verify time 703.400 ms 33.000 ms (over 5 iterations) CURVE25519 256 key generation 66.200 ms 14.400 ms (over 5 iterations) CURVE25519 key agreement 65.400 ms 14.400 ms (over 5 iterations) ED25519 key generation 25.000 ms 14.800 ms (over 5 iterations) ED25519 sign time 30.400 ms 16.800 ms (over 5 iterations) ED25519 verify time 74.400 ms 30.400 ms (over 5 iterations)
Did you know that wolfSSL also provides support for TLS 1.3? With TLS 1.3, users also have the ability to use this new protocol version for TLS connections with even better performance!
TLS 1.3 includes many improvements over TLS 1.2, including reducing the number of round trips required to perform a full handshake, repurposing the ticketing system to allow for servers to be stateless, and the removal of insecure algorithms. These changes mean better performance on Freescale/NXP CAU, mmCAU, and LTC-based devices, and lower memory usage on those devices acting as a TLS server.
To learn more about using TLS 1.3 in wolfSSL, visit our TLS 1.3 webpage today! Additionally, please feel free to contact support@wolfssl.com or visit our FAQ page for more information.