RECENT BLOG NEWS

So, what’s new at wolfSSL? Take a look below to check out the most recent news, or sign up to receive weekly email notifications containing the latest news from wolfSSL. wolfSSL also has a support-specific blog page dedicated to answering some of the more commonly received support questions.

FIPS-Certified WireGuard: Bringing wolfCrypt into the VPN Solution

As WireGuard continues to grow in popularity for its simplicity and efficiency in VPN deployments, security-conscious organizations are increasingly demanding solutions that adhere to stringent security standards, such as the Federal Information Processing Standard (FIPS 140-3). FIPS certification is a key requirement for governmental agencies and industries like healthcare and finance, where secure cryptographic implementations are mandatory. However, WireGuard’s default cryptographic implementations, while highly secure, are not FIPS-certified.

This is where wolfCrypt steps in. wolfCrypt is a lightweight, portable, and highly optimized cryptographic library that offers FIPS 140-3 certification, making it an ideal partner for users seeking FIPS compliance in their WireGuard deployments. With our planned integration, we’ll replace the standard crypto suite that WireGuard offers (ChachaPoly, Curve25519, Blake2s) with our own certified algorithms (AES GCM, ECC P-256, SHA-256). One thing to note here is that FIPS-ified WireGuard end-points may only communicate with other FIPS-ified end-points. But this of course is not a bug, but a feature. FIPS can only talk to FIPS.

So by leveraging our incoming integration, users can gain access to a VPN solution that is both secure and FIPS-compliant. This is especially important for industries with strict security requirements. The performance of WireGuard, combined with the certified cryptographic operations of wolfCrypt, ensures that you don’t sacrifice speed or security. In fact, with wolfCrypt’s ability to utilize hardware acceleration for AES and SHA, you might end up with a much faster WireGuard. Additionally, wolfCrypt’s small footprint makes it a practical choice for deployments in constrained environments, including IoT devices, embedded systems, and edge computing setups. You get a robust, certified security layer without bogging down performance.

Are you interested in WireGuard with wolfCrypt?

If you have questions about any of the above or need assistance, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Support for the Official Post-Quantum Standards ML-KEM and ML-DSA

Just a little while back to much fanfare, NIST-release these standards:

They are the post-quantum algorithms that are now standardized for use!! As a quick summary:

  • Kyber became ML-KEM (Module Lattice Key Encapsulation Mechanism) which is specified by NIST’s FIPS 203 document.
  • Dilithium became ML-DSA (Module Lattice Digital Signature Algorithm) which is specified by NIST’s FIPS 204 document.
  • SPHINCS+ became SLH-DSA (StateLess Hash-based Digital Signature Algorithm) which is specified by NIST’s FIPS 205 document.

ML-KEM and ML-DSA are great for general purpose use in protocols. For example, where you would use ECDH you would use ML-KEM and where you would use ECDSA you would use ML-DSA. SLH-DSA has specialized applications similar to those of LMS and XMSS. If you don’t want to deal with the statefulness of those algorithms, then SLH-DSA would be a great replacement.

Hot on the heels of this standardization announcement, we here at wolfSSL are announcing to the world that we have full implementation and support for ML-KEM and ML-DSA. You can have a look and try them out for yourself. Simply download the wolfSSL library, configure it to enable Dilithium and Kyber and run the benchmarks!

If you are interested in an implementation and support for SLH-DSA or have questions about any of the avobe, please contact us at facts@wolfSSL.com or +1 425 245 8247!

Download wolfSSL Now

Live Webinar: Everything You Ever Wanted to Know About How wolfSSL Runs on Xilinx

Explore how wolfSSL enhances security on Xilinx Devices in an upcoming webinar.

Join wolfSSL software Developer Jacob Barthelmeh in our live webinar, Everything You Ever Wanted to Know About How wolfSSL Runs on Xilinx, on October 2nd at 10am PT. Dive into the world of secure embedded systems and discover how to optimize wolfSSL for Xilinx platforms, including Versal, MPSoC UltraScale, and MicroBlaze.

Register today: Everything You Ever Wanted to Know About How wolfSSL Runs on Xilinx
Date: October 2nd | 10am PT

Jacob will guide you through building wolfSSL for Xilinx devices, highlighting the integration of wolfCrypt’s FIPS 140-3 mode, hardware acceleration ports with XilSecure, and using ARM assembly optimizations for performance improvements.

You’ll also explore how to incorporate wolfSSL into PetaLinux environments for maximum security, utilize wolfBoot on Xilinx/AMD devices, and understand how wolfSSL ports to various environments. Additionally, Jacob will showcase the use of wolfHSM with Xilinx/AMD platforms, offering valuable insights into implementing robust cryptographic security for your Xilinx devices.

This webinar will cover (agenda subject to change):

  • Building wolfSSL for Xilinx devices (Versal, MPSoC UltraScale, MicroBlaze)
  • Leveraging FIPS 140-3 mode for security compliance
  • Integrating hardware acceleration, including XilSecure
  • ARM assembly optimizations for performance
  • Using wolfSSL with PetaLinux
  • wolfBoot on Xilinx/AMD devices
  • Porting wolfSSL to other environments
  • Using wolfHSM with Xilinx/AMD

Don’t miss this opportunity to learn how wolfSSL can enhance security on your Xilinx systems. Register today to secure your spot and deepen your understanding of embedded security with wolfSSL on Xilinx platforms!

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Post-Quantum wolfHSM on Aurix Tricore

The title says it all!! If you have been paying any attention at all to us here at wolfSSL, you will know that we are very proud of our wolfHSM product that already runs on the Aurix Tricore. What we have not been focusing on is the post-quantum algorithms that work with wolfHSM. Let’s use this blog post to fix that oversight.

In this post we will be focusing on ML-KEM, ML-DSA, and especially LMS and XMSS as they are all implemented in wolfCrypt and are therefore available in wolfHSM to protect you from the oncoming quantum threat.

First of all, ML-KEM is a Key Encapsulation Mechanism and generally used for key establishment. In most protocols this means it is used ephemerally, but because of the security properties inherent in the algorithm, it can also be used statically. That means it is fine for wolfHSM to generate an ML-KEM private key and use it multiple times under the protection of the HSM core.

Naturally, as MLDSA is a general purpose post-quantum signature scheme, wolfHSM has an opportunity to help just like in the case of ECDSA or RSA.

Now, where wolfHSM provides a unique offering is LMS and XMSS. These are stateful hash-based signature schemes which are great for firmware and software signing. That said, there is a state associated with the private key and that state MUST be properly managed. A consequence of improper management is that the key pair must be revoked and all signatures encountered after the point of revocation cannot be trusted.

Software libraries that implement signing by stateful hash-based signature schemes, such as wolfSSL, must trust the application developer to properly manage the state. In the case of wolfHSM, the wolfSSL team’s expertise can come into play to ensure proper management of the state. The application developer no longer needs to be an expert in post-quantum algorithms; simply a user of them.

If you’d like to learn how wolfHSM can support your post-quantum migration or have any questions, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfSSH with X.509 Certificates

Did you know wolfSSH can use X.509 certificates in place of SSH public keys? wolfSSH supports RFC 6187, “X.509v3 Certificates for Secure Shell Authentication”. This uses wolfSSL’s certificate management for TLS, so the certificates may be checked against CRLs and OCSP.

wolfSSH has been used in applications as a server where it needed to validate some FPKI (Federal Public Key Infrastructure) profiles. It is used with clients that authenticate the user’s credentials accessed via a card reader. wolfSSH’s client can be given an X.509 certificate to authenticate the user with the server.

If you have questions about wolfSSH, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

FIPS vs FedRAMP Compliance and Requirements

The wolfSSL team has noticed an uptick in questions about FedRAMP requirements. Today, we want to cover the differences between FIPS and FedRAMP.

FIPS:

The Federal Information Processing Standards (FIPS) stipulate security requirements for cryptographic modules, which wolfSSL Inc. meets with our wolfCrypt FIPS module. NIST and the CMVP then encourage all federal programs using cryptography to follow these standards. Federal Procurement Officers (at the urging of NIST and the CMVP) then require FIPS compliance for solutions that consume cryptography and are used within the scope of their federal program(s).

FEDRAMP:

The Federal Risk and Authorization Management Program (FedRAMP) focuses on the security assessment, authorization, and continuous monitoring of cloud products and services. A prerequisite for FedRAMP is the proper implementation of a FIPS-validated cryptographic module by the cloud service provider.

Both programs aim to enhance data security but differ in scope. While FIPS focuses on cryptographic module validation and cryptography, FedRAMP ensures the overall security of cloud services, one part of which is proper implementation of FIPS validated cryptography for all cryptography running in the cloud. Beyond checking for proper FIPS implementations, FedRAMP also ensures the cloud service provider is fully compliant with NIST SP 800-53 IE: Security Controls, a NIST Risk Management Framework (RMF), service is monitored continuously, data protection methods are robust, incidents can be detected, responded to and recovered from, and more. For a complete list please refer to SP 800-53 at this [LINK].

To support wolfSSL customers, wolfSSL Inc. offers a service to fully validate any Operational Environment (OE) (IoT, embedded, FPGA, Digital Signal Processor (DSP), laptop, desktop, server blade, or cloud system). wolfSSL Inc (the vendor) will fully test and validate the OE of choice using a third-party NVLAP accredited FIPS lab (or CSTL) and get the OE listed as a CMVP-validated OE on the wolfCrypt FIPS Certificate. This is a CMVP-backed OE addition which is guaranteed to be acceptable by any federal program with a FIPS requirement, as opposed to vendor affirmation or user affirmation which often fall short of the mark. Additionally, once the primary certificate is updated with the OE of choice, a rebranded cert with the customer’s logo and letterhead can be offered including that new OE.

wolfSSL’s wolfCrypt FIPS module supports the latest FIPS 140-3 standards and holds the world’s first SP800-140Br1 FIPS 140-3 validated certificate (#4718). Our expert support team is available to assist with the proper implementation of the module on your target OE, a critical step for achieving a successful FedRAMP effort.

Beyond getting proper OE’s for FEDRAMP initiatives, wolfSSL can support customers that are either:

  1. Using an alternative OS within AWS, Azure, or Oracle cloud, or,
  2. If you are standing up your own cloud, support you with meeting the FedRAMP FIPS requirements for the operating system of your choice.

For more information on how wolfSSL can help with your FIPS or FedRAMP compliance needs, shoot us an email at fips@wolfSSL.com today!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Introducing rustls-wolfcrypt-provider: wolfCrypt for Rustls

rustls-wolfcrypt-provider integrates the wolfCrypt cryptographic library as a backend for Rustls, allowing developers to use wolfCrypt’s secure cryptographic functions with Rustls’ modern TLS stack. Currently in alpha, this library offers flexibility for those needing an alternative crypto provider, especially for projects requiring FIPS 140-3 readiness.

Other reasons to consider wolfCrypt as your Rustls provider include the following:

  1. Hardware encryption support, wolfCrypt supports hardware encryption and assembly optimizations for systems big and small. See our list of supported hardware encryption schemes.
  2. Support: we will support Rustls when used in conjunction with wolfCrypt.
  3. Consulting: If you need help making all of this work in your environment, we’ll help!

Supported Cipher Suites

TLS 1.3:

  • TLS13_CHACHA20_POLY1305_SHA256
  • TLS13_AES_128_GCM_SHA256
  • TLS13_AES_256_GCM_SHA384

TLS 1.2:

  • TLS12_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS12_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • TLS12_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS12_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS12_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  • TLS12_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

With rustls-wolfcrypt-provider, developers can combine the cryptographic strengths of wolfCrypt with the modern TLS capabilities of Rustls, supporting Rustls version 0.23.9. This integration is ideal for projects that require both strong security and the flexibility of wolfCrypt’s cryptography.

Are you interested in Rust solutions with wolfSSL integration?

If you have questions about any of the above or need assistance, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Live Webinar: Everything You Need to Know about FIPS 140-3

Join us on September 25th at 10 AM PT for an in-depth look at FIPS 140-3 with wolfSSL Senior Software Engineer, Kaleb Himes. This is your chance to get the inside scoop on how FIPS 140-3 can enhance your security!

Register Now: Everything You Need to Know about FIPS 140-3
Date: September 25th at 10am PT

This webinar will cover:

  • Basic & Benefits: Discover why FIPS 140-3 is essential for secure systems and what makes it a must-have.
  • Difference Between FIPS 140-2 and FIPS 140-3: Understand the key distinctions and improvements from FIPS 140-2.
  • wolfCrypt’s Achievement: Learn about wolfCrypt’s milestone as the first to receive the SP800-140Br1 FIPS 140-3 validated certificate (#4718).
    And much more…

Whether you’re new to FIPS 140-3, looking to deepen your knowledge or seeking FIPS 140-3 support, this webinar will provide valuable insights and practical information.

Don’t miss out on this opportunity to enhance your understanding and stay ahead in cybersecurity. Register now and secure your spot!

As always, our webinars will include Q&A sessions throughout. If you have questions on any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Strengthening RSA default minimum to 2048 bits

wolfSSL helps make the internet secure. Part of this task is continually updating our default settings to keep up with adversarial advancements. A recent article detailed the use of default RSA key sizes by an IoT manufacturer, which resulted in a 512 bit key being used for authentication. “The factoring required $70 in cloud computing costs and less than 24 hours.”

Since wolfSSL also had the default minimum set to 512 bits, we decided to update the default minimum to 2048 bits. The decision to use 2048 bit for the minimum was based on NIST recommendations and security industry best practices. This affects key generation using wc_MakeRsaKey. Testing infrastructure was also updated to be sure the smaller key sizes are still being covered by CI tests. The default RSA key size minimum can be overridden in the configuration using the RSA_MIN_SIZE macro.

For more information about using RSA in wolfSSL or have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Posts navigation

1 2 3 4 5 6 7 8 … 187 188 189

Weekly updates

Archives