RECENT BLOG NEWS

The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release wolfSSL 4.3.0, we have updated the support for the open source project WebRTC to branch m79 (https://webrtc.org/). This is a project that allows real time communication (RTC) with IoT, mobile and web browsers. Many additional API where added to the wolfSSL compatibility layer in order to plug wolfSSL into WebRTC instead of BoringSSL.

Notable advantages of choosing to build WebRTC with wolfSSL are evident through wolfSSL’s superior security implementations, including support for FIPS, PKCS#11, hardware encryption, TLSv1.3, and more. Additionally, 24×7 support and consulting services are available to help build your wolfSSL + WebRTC project.

The pull request with the latest updates for WebRTC can be found here:
https://github.com/wolfSSL/wolfssl/pull/2585

Upstream changes for WebRTC that include wolfSSL support can be found here:
https://webrtc-review.googlesource.com/c/src/+/159760

Download and learn more about wolfSSL 4.3.0 here:
https://www.wolfssl.com/products/wolfssl/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The holiday release of wolfSSL, version 4.3, is now available! This release has fantastic new features, optimizations, and bug fixes. Some of the exciting new features that were added to the wolfSSL library are summarized below:

• The addition of –enable-libwebsockets option for support of libwebsockets build was added in the release!
• Updated support of NGINX 1.15.0 and in addition to that we added support for NGINX version 1.16.1.
• Updates to RSA-PSS salt lengths. Macro WOLFSSL_PSS_SALT_LEN_DISCOVER allows for discovering the salt length. Passing RSA_PSS_SALT_LEN_DISCOVER value into wc_RsaPSS_Verify_ex attempts to discover salt length and can use larger salt lengths.
• wolfSSL is constantly expanding the OpenSSL compatibility API to help people migrate from OpenSSL to wolfSSL. In this release the API wolfSSL_CertManagerGetCerts and wolfSSL_X509_STORE_GetCerts were added for retrieving certificates.
• wolfSSL has an optimized math library for single precision operations. Greatly speeds up some set key sizes with RSA, ECC, and DH operations. In this release support for 4096-bit RSA/DH operations was added!
• Last release (v4.2.0) we came out with support for Google WebRTC, in this release we updated that support to branch m79.
• We added new FREESCALE_MQX_5_0 macro for MQX 5.0 support
• Some users that make use of the OpenSSL compatibility layer like to trim down the bloat while keeping certain API’s. In this release the additional build flag of –disable-errorqueue was added so that the extra error queue is disabled with –enable-opensslextra builds.
• And more…. (check out the README from the download for a full list)

Continue reading “wolfSSL Version 4.3.0 is Now Available!”

With each release of the wolfSSL embedded SSL/TLS library, new improvements and feature additions are always included. The wolfSSL team has made sure to improve and update support for various open source projects. This holiday release wolfSSL 4.3.0, we are happy to say we have improved our support for Nginx. wolfSSL has updated support for Nginx 1.15.1 and added support for Nginx 1.16.1.

For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository. The configure option –enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until mid 2021. The version of OpenSSL that supports FIPS is now in End Of Life and is no longer supported.

This means that OpenSSL users will not have a supported FIPS Object Module for over a year. This is a big issue for companies that rely on security! If there is a bug in the FIPS Object Module, you will need to fix it and revalidate on your own.

To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:

1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,
2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,
3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

Finally, we will be submitting our FIPS 140-3 module to NIST in September 2020, which is the earliest available date for submissions.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL

Benchmark values of the wolfSSL embedded SSL/TLS library running on Xilinx boards, including the ZCU102, have been collected and are up for viewing. Our friends over at Xilinx have a white paper posted that goes into detail about the benchmark values here: https://www.xilinx.com/support/documentation/white_papers/wp512-accel-crypto.pdf. This shows how much faster applications can perform secure operations when incorporating the hardware acceleration available on Xilinx devices. It also gives a demonstration of the performance trade-offs when choosing FreeRTOS versus an embedded Linux OS.

For questions about building wolfSSL to use hardware acceleration or other general inquiries about wolfSSL, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL now provides support for complete RTCA DO-178C level A certification! wolfSSL will offer DO-178 wolfCrypt as a commercial off -the-shelf (COTS) solution for connected avionics applications. Adherence to DO-178C level A will be supported through the first wolfCrypt COTS DO-178C certification kit release that includes traceable artifacts for the following encryption algorithms:

• SHA-256 for message digest
• AES for encryption and decryption
• RSA to sign and verify a message.
• Chacha20_poly1305 for authenticated encryption and decryption.

The primary goal of this initial release is to provide the proper cryptographic underpinnings for secure boot and secure firmware update in commercial and military avionics. wolfSSL brings trusted, military-grade security to connected commercial and military aircraft. Avionics developers now have a flexible, compact, economical, high-performance COTS solution for quickly delivering FIPS 140-2 validated crypto algorithms can be used in DO-178 mode for combined FIPS 140-2/DO-178 consumption. The wolfCrypt cryptography library FIPS 140-2 validation certificates can be applied to DO-178 uses. 

Optimization Support

We understand that securely rebooting avionic systems has rigorous performance requirements. As such, we’re here to help with cryptographic performance optimizations through our services organization. 

To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.

wolfSSL DO-178 product page: https://www.wolfssl.com/wolfssl-support-178-dal/.

For more information, please contact facts@wolfssl.com.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247. 

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg) 

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The wolfSSL embedded SSL/TLS library provides support for various open source projects, including Nginx. For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository.  The configure option --enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

For more information on wolfSSL + Nginx, TLS 1.3, OCSP, FIPS, or for any additional questions, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

As many people know, the OpenSSL project is struggling with FIPS, and their new FIPS release is not expected until December 2020. The version of OpenSSL that supports FIPS goes into End Of Life and is no longer supported in December of 2019.

This means that OpenSSL users will not have a supported package for over a year. This is a big issue for companies that rely on security.

To fill this breach, wolfSSL has integrated our FIPS certified crypto module with OpenSSL as an OpenSSL engine. This means that:

1. OpenSSL users can get a supported FIPS solution, with packages available up to the 24×7 level,

2. The new wolfCrypt FIPS solution also supports the TLS 1.3 algorithms, so your package can support TLS 1.3,

3. You can support hardware encryption with your package, as the new wolfCrypt solution has full hardware encryption support.

Additionally, should you be using one of the OpenSSL derivatives like BoringSSL, we can also support you.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We love you.

Team wolfSSL