RECENT BLOG NEWS

Users of Micrium secured by wolfSSL rejoice! We recently added support for Micrium to utilize the hardware RNG of STM32 platforms. Also we updated the port to include the application configuration to take advantage of TCP IP settings in the Micrium network headers.

Micrium users can take advantage of wolfSSL’s best-tested security library, including support for TLS 1.3. and DTLS 1.3. For instructions on how to build and integrate the examples on your projects or to see the benchmark results, please see the README located in “IDE/ECLIPSE/MICRIUM”. For any questions or help getting wolfSSL up and running in your environment, please contact us at support@wolfssl.com.

As always, if you have questions on any of the above, please contact us at facts@wolfSSL.com, or call us at +1 425 245 8247.

Download wolfSSL

Exciting news for Linux Kernel Module developers and developers who are interested in diving into Linux Kernel Module. Join us for a webinar on Linux Kernel Mode hosted by wolfSSL Engineer Daniel Pouzzner.

Watch the webinar here: Linux Kernel Mode

After wolfSSL 4.6.0 introduced initial support for building as a Linux kernel module, and providing native wolfCrypt and wolfSSL APIs to other kernel modules in December 2020, wolfSSL Linux Kernel Module support has grown by leaps and bounds, with new support for public key(PK) cryptographic acceleration, FIPS 140-3, accelerated crypto in IRQ handlers, portability improvements, and overall feature completeness.

wolfSSL engineer, Daniel Pouzzner, will showcase how wolfSSL Linux Kernel Mode can enhance your projects. It is your opportunity to learn knowledge and technical skills. Watch it now!

As always we will have a Q&A Session following the webinar.

If you have questions on any of the above, please contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Download wolfSSL

wolfSSL 5.6.3 adds support for Renesas TSIP v1.17 and extends some of the TLS handshake operations to use this cryptographic accelerator. TSIP v1.17 adds the ability to handle CertificateVerify messages over TLS. This feature is used for both validation and generation of messages exchanged with the server. Of course, both TLS1.2 and 1.3 can handle both ECC and RSA certificates.

Example applications for Renesas RX series MCUs with Renesas IDE e2studio project files are provided in the wolfSSL package, included in the /IDE/Renesas/e2studio/RXxx folders. Detailed instruction manuals written both in English and Japanese will help you get started with wolfSSL on these platforms quickly.

If you have any questions or want to know more details, lease contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Download wolfSSL

Commercial-grade encryption tools are essential in every developer’s programming toolbox. We are excited to announce a live webinar presented by Jim aka gojimmypi, wolfSSL Engineer, where he will discuss Espressif products.

Watch the webinar here: Getting Started with wolfSSL on the Espressif ESP32

Recently, we announced the first availability of the wolfSSL embedded encryption libraries in the ESP Registry located at components.espressif.com. If you are looking to enhance the security system in your projects or products, this is your opportunity to learn the fundamentals of our security solutions and how they integrate seamlessly with Espressif’s tech. Watch it now!

As always, our webinars will include Q&A sessions throughout the webinar.

If you have questions on any of the above, please contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Download wolfSSL

We have extended wolfSSL’s Renesas Secure Crypto Engine (SCE) support to include a crypt-only build for the Renesas RA6M4. wolfSSL already supports Renesas SCE for TLS communication. In addition to our existing TLS support, the SCE driver can be used for standalone cryptographic operations. Using this mode, users are able to gain not only the performance benefit but also a smaller footprint by enabling only necessary cryptography operations. This use case was added for RA6M4 support in wolfBoot.

To enable this use case, define the macro:

WOLFSSL_RENESAS_SCEPROTECT_CRYPTONLY

wolfSSL crypt-only SCE mode currently supports SHA2-256, RSA 1024/2048 bit encryption/decryption, and RSA 1024/2048 bit sign/verify.

Please contact us at facts@wolfssl.com, or call us at +1 425 245 8247 with any questions, or for help integrating wolfSSL products into your project!

Download wolfSSL

There is a common theme in all wolfSSL products which is that they basically involve two parties. For wolfSSL, wolfSSH, wolfMQTT and cURL libraries there is a server and a client. For wolfBoot, you have the boot loader and firmware provider. For wolfTPM you have the user and the TPM. For wolfSentry you have the system and the intruder.

Soon, things are going to be different. With the new MLS (Messaging Layer Security) there will be multiple parties (Alice, Bob, Carol, Dean, Emily, etc., etc.). We’re talking decentralized (serverless) end-to-end security that scales with forward secrecy and post-compromise security. It is widely acknowledged that wolfSSL is a leader in cryptographic protocols, so with the new RFC 9420 finally set to “Standards Track” status we’re starting to see some interest!

With our new implementation of Encrypted ClientHello (ECH), we have implemented Hybrid Public Key Encryption (HPKE) and so we are well on our way to an implementation for MLS which also requires HPKE.

MLS is a natural choice for suppliers of communications infrastructure to governments because it scales! That makes wolfCrypt’s FIPS certification a potential game changer. With our tried and tested FIPS 140-2 as well as our impending FIPS 140-3 certification, wolfCrypt FIPS can make an MLS implementation attractive to government vendors today and well into the future.

But wait, how far into the future? Until a cryptographically relevant quantum computer comes into existence. Do you have requirements to keep your communications protected for several years into the future? Then you must have been thinking about post-quantum algorithms. The NSA has. They’ve come out with their CNSA 2.0 guidance and wolfSSL is listening. We already support LMS, Dilithium, Kyber and all the symmetric ciphers and hash algorithms required by it. Would you like to see a post-quantum MLS?

Here is a short list of open source implementations that we know about:

• MLSpp (C++) (Status: RFC)
• OpenMLS (Rust) (Status: RFC)
• go-mls (Go) (Status: RFC in progress)

What if wolfCrypt is the cryptographic implementation underneath these libraries? We even have a golang wrapper.

Do you have a use case for MLS? Do you need FIPS? How long do you need to keep your communications confidential? Please reach out to us here at facts@wolfssl.com, or call us at +1 425 245 8247 to help us understand your needs!

Download wolfSSL

We’re happy to announce that we have added wolfBoot support for the Renesas RA6M4! The Renesas RA6M4 group uses a high-performance Arm Cortex-M33 core with TrustZone. The RA6M4 is supported by an open and flexible ecosystem concept – the Flexible Software Package (FSP), built on FreeRTOS – and is expandable to use other RTOS and middleware.

wolfBoot is a portable secure bootloader solution that offers firmware authentication and firmware update mechanisms. Due to its minimalistic design and tiny HAL API, wolfBoot is completely independent from any OS or bare-metal application.

By adding wolfBoot support for the RA6M4, it demonstrates how simple secure firmware updates can be accomplished on this target with wolfBoot, and in doing so can also leverage the Renesas SCE. A sample application has been developed which securely updates firmware v1 to new image v2. Both sample firmware versions behave the same except displaying the version of the image (v1 or v2). This example is compiled with Renesas e2Studio and runs on the RA6M4 target board. Detailed steps to run the example can be found here: https://github.com/wolfSSL/wolfBoot/blob/master/IDE/Renesas/e2studio/RA6M4/Readme.md

To run the example with SCE support enabled, you can find the Readme located here: https://github.com/wolfSSL/wolfBoot/blob/master/IDE/Renesas/e2studio/RA6M4/Readme_wSCE.md

wolfBoot currently supports Renesas SCE crypto acceleration for SHA256 and RSA.

If you are interested in trying wolfBoot on the RA6M4, or are interested in having us expand algorithm support, please contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Today we are happy to announce the availability of an Ada/SPARK binding that enables Ada applications to use post-quantum TLS 1.3 encryption through the wolfSSL embedded SSL/TLS library.

It opens the door to obtaining FIPS 140-3 and DO-178C certifications for Ada and Spark applications that use TLS for their encrypted communications and also makes them quantum-safe.

Check out the Ada/SPARK binding on GitHub here: https://github.com/wolfSSL/wolfssl/tree/master/wrapper/Ada

The Ada port is suitable for anything from IoT, embedded systems to Desktop and Cloud systems.

Contact us at facts@wolfssl.com, or call us at +1 425 245 8247 with any questions, comments, or suggestions.

wolfBoot v1.16 has been released. This version introduces a key component to facilitate staging on microprocessor-based embedded systems: an optional safe ELF format parser. The support for PowerPC architecture has been improved, now allowing the complete staging from RAM. The support for NXP P1021 has been extended, as well as for Renesas RA6M4 and RX72N.
Here is a summary of the most relevant changes:

Support for ELF parsing

By default, wolfBoot handles binary files, which allow the execution in place (XIP), on constrained embedded systems, and avoids copying the code in RAM. On large systems, however, it is now possible to sign and transfer executable files in ELF32 or ELF64 format, allowing for a more complex structure of symbols being mapped on different regions, or relocated at runtime.

Improvements on PowerPC architecture support

The support for PowerPC systems has been extended to allow complete boot from volatile memory using a first stage loader. The bare metal application or OS image can be compiled into a position-independent binary file which will be loaded to RAM by wolfBoot to complete the verification and run from RAM. The DDR memory initialization has also been re-engineered so that the bootloader can remap its stack at runtime immediately after the DDR RAM is initialized.

Extended support for NXP P1021

The support for NXP P1021 platform has been extended to support the drivers necessary to access TPM 2.0 devices, via wolfTPM, through the eSPI bus. Furthermore, it is now possible to use the TPM device as the root of trust for this target. Support for the QUICC Engine and multi-processor spin table. Fixed some minor issues on the eLBC NAND driver.

Extended support for Renesas microcontroller bases devices

Both RA6M4 and RX72N ports and example projects have been updated, and the documentation has been extended to cover the new features. In particular, we added the possibility to enable hardware acceleration using SCE and TSIP drivers from wolfCrypt.

Find out more about wolfBoot! Download the source code and documentation from our download page], or clone the repository from github. If you have any questions, comments or suggestions, send us an email at facts@wolfssl.com, or call us at +1 425 245 8247.

The latest wolfSentry release, version 1.4, adds advanced traffic attribute filters and controls, allowing field-configurable stateful routes for DNS and other connectionless protocols, and transparent port scanner detection and defenses.

Event handlers can be configured to restrict matches to traffic with specified attributes, such as inbound or outbound connection initiation or closure, binding of a socket, or attempt to send to an unreachable destination. An event handler can furthermore designate attributes to be set or cleared whenever a match implicates the event – “derogatory” or “commendable” flags, a “port_reset” flag to explicitly generate a reset reply, or any of 8 available user-defined flags in any combination.

An auxiliary event handler can now be associated with a primary event handler, for use when a new rule is dynamically added. The aux event can specify rule flags to be set and/or cleared in the newly generated rule, including wildcarding of any combination of match fields, designation of the traffic direction(s) to which the new rule will apply, and initial penalty boxing or green-listing.

Finally, a new built-in action handler, “%track-peer-v1”, creates new rules according to the filters and directives in the event definitions, as described above.

With these facilities, in concert with the fine-grained integration with lwIP, wolfSentry field configuration now has the expressive power to define port scan detection and defenses, automatic pinhole rule insertions, and other flexible stateful tracking use cases. All of these capabilities are available through JSON configuration, and can be updated, extended, or removed, at any time without system restart.

The latest wolfSentry release is available at https://github.com/wolfSSL/wolfsentry, with native in-tree support for FreeRTOS-newlib-nano on ARM with full lwIP integration. Other ports include POSIX (e.g. Linux), DeOS, and MacOS X. Let us know if you would like it on another platform. Our current porting plans include Green Hills IntegrityOS, VxWorks, LynxOS, PetaLinux,TRON/ITRON/µITRON, QNX, PikeOS and NuttX. Clone it now, and make test!

Contact us at facts@wolfssl.com, or call us at +1 425 245 8247 with any questions or for help getting started with wolfSentry in your project!