RECENT BLOG NEWS

The Netflix Tech Blog recently shared how Netflix is leveraging TLS 1.3 for faster and more secure connections.  They concluded:

“From the security analysis, we are confident that TLS 1.3 improves communication security over TLS 1.2. From the field test, we are confident that TLS 1.3 provides us a better streaming experience.

At the time of writing this article, the Internet is experiencing higher than usual traffic and congestion. We believe saving even small amounts of data and round trips can be meaningful and even better if it also provides a more secure and efficient streaming experience.

Therefore, we have started deploying TLS 1.3 on newer consumer electronics devices and we are expecting even more devices to be deployed with TLS 1.3 capability in the near future.”

The wolfSSL embedded SSL/TLS library was one of the first TLS libraries to implement support for TLS 1.3, and we are happy to see successful adoption stories like this!

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Earlier this month, we worked on adding MQTT support to cURL which is now available as “experimental” in the latest curl 7.70.0 release! For full details of the current integration, see Daniel Stenberg’s blog post titled “CURL + MQTT = TRUE“.

We’re curious how our users want to use MQTT in cURL, and we want to hear your feedback to help direct our future cURL+MQTT plans! We think MQTT support could be helpful for a variety of use cases ranging from service techs that require a tool to help test and develop MQTT-based solutions, to easily scripting MQTT commands.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL Inc is proud to announce the release of wolfSSL v4.4.0, the embedded TLS library for devices, IoT, and the cloud. Included in the release are:

• Qualcomm Hexagon SDK support. The Hexagon SDK is used for building code to run on DSP processors. Use of the Hexagon toolchain to offload ECC verify operations has been added to wolfSSL. This can free up the main CPU for other operations or lead to future optimizations with HVX on some algorithms that use vector operations. The Makefile for building with the Hexagon toolchain and a README with more information can be found in the directory wolfssl-4.4.0/IDE/HEXAGON.
• Apache 2.4.39 support. Use wolfSSL with Apache’s mod_ssl. Apache is the most commonly used web server in the world. You can now use wolfSSL as a part of your Apache installation. You can benefit from wolfSSL’s world class support. Ask us for more information.
• OpenVPN support. Use wolfSSL with OpenVPN. OpenVPN is one of the top VPN products on the market. wolfSSL can secure your connections.
• Renesas Synergy S7G2 support. Are you prototyping a new embedded application with a Renesas Synergy S7G2 board? wolfCrypt can take advantage of its on-board cryptography hardware. Offload AES, RSA, SHA, and GHASH to the hardware. See our benchmarks page to see the comparison of the software crypto and the hardware acceleration.
• Curve448, X448, and Ed448 support. We at wolfSSL like to stay on top of progressive ciphers. Curve448 is an efficient to calculate elliptic curve. It offers 224-bits of security and works well with ECDH key agreement.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

ACVP stands for (Automated Cryptographic Validation Protocol) and it is the upcoming protocol that will be used for FIPS validation. It makes testing cryptographic algorithms and modules more efficient than the current method and more automated. There are three main parts to ACVP – a server, a proxy, and a client.

• The server side handles requests for test vectors and requests for validation among other requests. This side is operated by a FIPS lab or by NIST themselves.
• A proxy with ACVP can be used to communicate to offline systems and handle transferring information from the system being tested to the server. Often an ACVP client is used instead.
• The last part being a client, which is most relevant to users who are wanting to get their cryptography FIPS validated. An ACVP client is directly hooked up to the module to be tested and then communicates with the ACVP server to send requests for test vectors, responses of the results from running those tests, and requests for algorithm validation. There are multiple pieces required to build a ACVP client in order to complete a validation process, some of the large portions of the effort go into
  • JSON parsing / creation for communication with a ACVP server
  • HTTPS GET / POST / PUT / DELETE messages used for securely transporting information
  • 2 factor authentication with TOTP (Time-Based One-Time Password Algorithm)
  • Plugging in the test harness that runs crypto operations

Ultimately an ACVP client communicates with the server to validate cryptographic operations. This includes creating, or referencing meta data such as; vendor, OE, and module information. A simplified message flow for getting an algorithm validated is as follows:

wolfSSL is in the process of developing our own ACVP client based off of the current draft (draft-fussell-acvp-spec-01). Having many algorithms already completing the validation process through the NIST operated ACVP Demo server. Where our test vendor information can be seen publicly listed on the demo site here (https://demo.acvts.nist.gov/home).

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

More information from NIST’s website about the ACVP project can be found here:
https://csrc.nist.gov/Projects/Automated-Cryptographic-Validation-Testing.

The spring release of wolfSSL, v4.4.0, is now available! This release has many new features, optimizations, and bug fixes. Some of the new features we added to the wolfSSL embedded SSL/TLS library include:

• Qualcomm Hexagon SDK support.
• DSP builds to offload ECC verify operations.
• Certificate Manager callback support.
• New APIs for running updates to ChaCha20/Poly1305 AEAD.
• Support for use with the Apache web server.
• Add support for IBM s390x.
• PKCS8 support for ED25519.
• OpenVPN support.
• Add P384 curve support to SP.
• Add BIO and EVP API.
• Add AES-OFB mode.
• Add AES-CFB mode.
• Add Curve448, X448, and Ed448.
• Add Renesas Synergy S7G2 build and hardware acceleration.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfBoot can use the wolfTPM 2.0 software interface in bare metal environments and take advantage of your pre-existing TPM silicon, including Microchip’s ATTPM20P, ST33TP*, Infineon SLB9670 and Nations Tech Z32H330TC modules.

Measured Boot uses the TPM Platform Configuration Registers (PCR)? to determine if the boot parameters remain the same. The PCR’s allow SHA-1 or SHA-256? hash reset, update and read. There are typically 24 of these PCR’s available.

wolfTPM and wolfBoot support use in a bare-metal environment with no external dependencies. This enables reduced code size, minimal attack surfaces and ease of maintenance.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL is excited to announce a new partnership with French company AC6, creator of System Workbench for Linux, a development tool to simplify building, debugging and maintaining Linux-based embedded systems.

For years, wolfSSL has improved our support for Linux, whether by adding new ports for Intel SGX on Linux, compatibility for Microsoft Window’s Linux subsystem, and continuing to support Linux OEs with new developments such as our DO-178C certification kit.

Now we are partnering with AC6 in the creation and deployment of highly secure Linux images. To learn more, check out their website and stay tuned for upcoming webinars as we roll out the collaboration.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL now provides support for complete RTCA DO-178C level A certification! wolfSSL will offer DO-178 wolfCrypt as a commercial off -the-shelf (COTS) solution for connected avionics applications. Adherence to DO-178C level A will be supported through the first wolfCrypt COTS DO-178C certification kit release that includes traceable artifacts for the following encryption algorithms:

• SHA-256 for message digest
• AES for encryption and decryption
• RSA to sign and verify a message.
• Chacha20_poly1305 for authenticated encryption and decryption.

The primary goal of this initial release is to provide the proper cryptographic underpinnings for secure boot and secure firmware update in commercial and military avionics. wolfSSL brings trusted, military-grade security to connected commercial and military aircraft. Avionics developers now have a flexible, compact, economical, high-performance COTS solution for quickly delivering FIPS 140-2 validated crypto algorithms can be used in DO-178 mode for combined FIPS 140-2/DO-178 consumption. The wolfCrypt cryptography library FIPS 140-2 validation certificates can be applied to DO-178 uses. 

Optimization Support

We understand that securely rebooting avionic systems has rigorous performance requirements. As such, we’re here to help with cryptographic performance optimizations through our services organization. 

To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.

wolfSSL DO-178 product page: https://www.wolfssl.com/wolfssl-support-178-dal/.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg) 

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The C# wrapper bundled with wolfSSL can be used in conjunction with Mono to run C# projects on platforms other than Windows! Mono provides users with an easy way to cross platforms with C# applications. To get things started when using wolfSSL, first compile the easy to use Visual Studio example in the wolfssl-X.X.X/wrapper/CSharp directory, then transport the “DLL Debug” folder, that gets created after a successful build, to any platform with Mono. After compiling and transporting the folder the executable can be run with the command “mono wolfSSL-TLS-Server.exe” from inside the “DLL Debug” folder.

Server Using wolfSSL C# Wrapper with Mono on MacOS:

$ mono wolfSSL-TLS-Server.exe
Calling ctx Init from wolfSSL
Finished init of ctx .... now load in cert and key
Ciphers : TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-CCM-SHA256:TLS13-AES128-CCM-8-SHA256:TLS13-SHA256-SHA256:TLS13-SHA384-SHA384
…
…
Started TCP and waiting for a connection
Connection made wolfSSL_accept 
SSL version is TLSv1.3
SSL cipher suite is TLS13-AES128-GCM-SHA256
hello wolfssl!
freeing ssl handle
freeing ctx handle

Client Connecting to Server:

$ ./examples/client/client -v 4
peer's cert info:
 issuer : /C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 subject: /C=US/ST=Montana/L=Bozeman/O=wolfSSL/OU=Support/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 serial number:01 
SSL version is TLSv1.3
SSL cipher suite is TLS_AES_128_GCM_SHA256
SSL curve name is SECP256R1
Session timeout set to 500 seconds
Client Random : C10258AEC4862BD98BC6E3DEFB59A1BBBC28FA064FA571515A367DEE4FC61DBE
ERROR: Unable to print out session
Hello, this is the wolfSSL C# wrapper

Using the C# wrapper from wolfSSL provides access to FIPS certified code, DTLS, TLS 1.3, and many crypto performance improvements such as AES-NI and ARM hardware accelerations.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.