RECENT BLOG NEWS

wolfSSL FIPS Ready

Along with the recent release of wolfSSL v4.1.0, wolfSSL has updated its support for the wolfCrypt FIPS Ready version of the wolfSSL library. wolfCrypt FIPS Ready is our FIPS enabled cryptography layer included in the wolfSSL source tree that can be enabled and built. To elaborate on what FIPS Ready really means: you do not get a FIPS certificate and you are not FIPS approved. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and Power On Self Test (POST).

FIPS Ready with curl

(modified from Daniel Stenberg) 

The integration of wolfSSL and curl means that the curl library can also be built using the wolfCrypt FIPS ready library. The following outlines the steps for building curl with FIPS Ready:

1. Download wolfSSL fips ready

2. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip wolfssl-4.1.0-gplv3-fips-ready.zip
$ cd wolfssl-4.1.0-gplv3-fips-ready

3. Build the fips-ready wolfSSL and install it somewhere suitable:

$ ./configure --prefix=$HOME/wolfssl-fips --enable-harden --enable-all
$ make -sj
$ make install

4. Download curl, the normal curl package.

5. Unzip the source code somewhere suitable:

$ cd $HOME/src
$ unzip curl-7.66.0.zip
$ cd curl-7.66.0

6. Build curl with the just recently built and installed FIPS ready wolfSSL version:

$ LD_LIBRARY_PATH=$HOME/wolfssl-fips/lib ./configure --with-wolfssl=$HOME/wolfssl-fips --without-ssl
$ make -sj

7. Now, verify that your new build matches your expectations by:

$ ./src/curl -V

It should show that it uses wolfSSL and that all the protocols and features you want are enabled and present. If not, iterate until it does!

wolfSSL FIPS ready is open source and dual-licensed. More information about building FIPS ready can be found in the FIPS Ready user guide.
More information about wolfSSL and curl can be found on the curl product page.
Details on wolfSSL support for curl is also located on the support page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The wolfSSL embedded SSL/TLS library provides support for various open source projects, including Nginx. For those who are unfamiliar, Nginx is a high-performance, high-concurrency web server. Like wolfSSL, it is also compact, fast, and highly scalable. Additionally, wolfSSL also provides support for TLS 1.3 and features such as OCSP, so Nginx servers can be configured with the latest and most secure protocols.

Nginx and wolfSSL make a likely pairing because they are both lean, compact, fast, and scale well under high volumes of connections. wolfSSL + Nginx is available in a public GitHub repository.  The configure option --enable-nginx will compile the wolfSSL libraries with Nginx support.

wolfSSL also provides FIPS and FIPS ready versions of the wolfCrypt library, meaning Nginx can be built FIPS compliant. More information on wolfCrypt FIPS can be found on the wolfCrypt FIPS FAQ page.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

The wolfMQTT client library has a Microsoft Azure IoT Hub example that demonstrates securely connecting over TLS provided by the wolfSSL embedded SSL/TLS library.

We setup a wolfMQTT IoT Hub on the Azure server for testing. We added a device called `demoDevice`, which you can connect and publish to. The example demonstrates the creation of a SasToken, which is used as the password for the MQTT connect packet. It also shows the topic names for publishing events and listening to `devicebound` messages.

Everyone deserves to have their IoT data secure, and wolfSSL provides the best libraries to accomplish that! Secure-IoT-Love from the wolfSSL team!

You can download the latest release here: https://www.wolfssl.com/download/

Or clone directly from our GitHub repository: https://github.com/wolfSSL/wolfMQTT

Don’t forget to add a star while you’re there!

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Is your team looking for a 32-bit MCU that boasts advanced security, performance, and connectivity for your next project in industrial / building automation, automotive or IoT?

Would you like peace of mind knowing that your product solution incorporates the best tested TLS / Cryptography libraries with blazing fast speeds on bare-metal and Amazon FreeRTOS environments?

If so, then check out the embedded-C wolfSSL TLS and wolfCrypt cryptography libraries on the Renesas RA Family of 32-bit MCUs with Arm Cortex-M Core.

wolfSSL is delighted to partner with Renesas to offer examples and solutions for Renesas RA devices.  Quickly get started with a Renesas EK-RA6M3G kit and the wolfSSL example projects.

The team at wolfSSL is excited to help you hit the ground running on your next project. We can also provide additional support through your product development and release cycle. Please feel free to ask us any questions.

More to come…
Progress is being made to support the Renesas RA cryptography accelerators within the wolfCrypt library. The hardware acceleration support will include ECC, RSA, AES, TRNG, and SHA-256 operations with the possibility of more in the future. We will announce support for hardware cryptography and benchmark results soon.

Why wolfSSL?
wolfSSL is a team that has passion and dedication to creating the best supported and best tested secure communication software products with outstanding performance on a host of operating environments.

We want you to focus your product development efforts on your core-features that your customers crave.

wolfSSL ensures peace of mind for your product development team; that their cutting-edge, disruptive innovations won’t be disrupted by malicious hackers.

Allow us to help guide and expedite the necessary process of securing your device and communications.

[wolfSSL General Questions]
Email: facts@wolfssl.com
Phone:  +1 425 245 8247.

[wolfSSL Technical Support]
Email: support@wolfssl.com

[wolfSSL Open Source and Commercial Licensing Questions]
Email: licensing@wolfssl.com

There are many reasons why a user might want to switch from OpenSSL to wolfSSL. In order to facilitate this transition, wolfSSL has an accessible compatibility layer.

Why Migrate?
Why might one want to make this migration and turn on this compatibility in the first place? To start, wolfSSL has numerous benefits over its counterpart, OpenSSL. Some of these include hardware acceleration implementations, progressive adoptions of TLS 1.3 as well as a reduced footprint size. In addition to this, there is the potential to use wolfSSL FIPS. wolfSSL maintains current FIPS support and is used in numerous applications and provides FIPS Ready builds to help get projects ready for FIPS verification. All of this is supported by a team of trained wolfSSL engineers.

What is the wolfSSL OpenSSL compatibility layer?
The wolfSSL OpenSSL compatibility layer is a means to switch applications designed for OpenSSL to wolfSSL. In addition to this, it is constantly expanded with more than 500 commonly used OpenSSL functions. wolfSSL also provides Crypto API support to enable easier migration of projects.

To learn more about migrating from OpenSSL to wolfSSL, visit:
https://www.youtube.com/watch?v=ooom_obeHE8

To read about the OpenSSL compatibility layer, visit:
https://www.wolfssl.com/openssl-compatibility-layer-expansion-3/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL now supports OpenVPN through the OpenSSL compatibility layer. This support has resulted in an expansion of wolfSSL’s OpenSSL compatibility layer, adding the following API:

• EC_builtin_curve
• EC_get_builtin_curves
• EC_GROUP_order_bits
• DES_check_key_parity
• EVP_CIPHER_CTX_cipher
• EVP_PKEY_get0_EC_KEY
• HMAC_CTX_new
• HMAC_CTX_free
• HMAC_CTX_reset
• HMAC_size
• RSA_meth_new
• RSA_meth_free
• RSA_meth_set_pub_enc
• RSA_meth_set_pub_dec
• RSA_meth_set_priv_enc
• RSA_meth_set_priv_dec
• RSA_meth_set_init
• RSA_meth_set_finish
• RSA_meth_set0_app_data
• RSA_get_method
• RSA_set_method
• RSA_get0_key
• RSA_set0_key
• RSA_flags
• RSA_set_flags
• RSA_bits
• SSL_CTX_set_ciphersuites
• PEM_read_bio_X509_CRL
• PEM_X509_INFO_read_bio
• X509_NAME_get_index_by_OBJ
• BIO_set_ssl
• ASN1_BIT_STRING_new
• ASN1_BIT_STRING_free
• ASN1_BIT_STRING_get_bit
• ASN1_BIT_STRING_set_bit
• sk_ASN1_OBJECT_num
• sk_ASN1_OBJECT_value
• sk_ASN1_OBJECT_free
• sk_ASN1_OBJECT_pop_free
• sk_X509_OBJECT_num
• sk_X509_OBJECT_value
• sk_X509_OBJECT_delete
• sk_X509_NAME_find
• sk_GENERAL_NAME_free
• sk_ACCESS_DESCRIPTION_free
• EVP_MD_CTX_reset
• EVP_MD_name
• EVP_CIPHER_name
• EVP_CIPHER_mode
• EVP_MD_name
• X509_STORE_get0_objects
• X509_OBJECT_free
• X509_OBJECT_get_type
• EVP_CIPHER_nid
• OpenSSL_version

wolfSSL strives to the best-tested SSL/TLS and cryptography implementation available today.  We are happy to bring wolfSSL support to OpenVPN and excited to help users and customers get going quickly.  The wolfSSL lightweight SSL/TLS library supports TLS 1.3, FIPS 140-2, DO-178, and more!

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

With wolfSSL’s updated support for OpenSSH v8.1 comes new OpenSSL compatibility layer functionality!

The list of API added to the compatibility layer is:

• EVP_CIPHER_CTX_ctrl is expanded to include the following commands:
  • EVP_CTRL_AEAD_SET_IV_FIXED
  • EVP_CTRL_GCM_SET_IV_FIXED
  • EVP_CTRL_GCM_IV_GEN
• BN_clear
• BN_clear_bit
• OpenSSL_version_num
• ERR_GET_LIB
• SSL_CTX_set1_groups_list
• SSL_set1_groups_list

• DSA_SIG support was added:
  • DSA_SIG_new
  • DSA_SIG_free
  • DSA_do_sign
  • DSA_do_verify

• ECDSA_size
• ECDSA_sign
• EC_GROUP_method_of
• EC_METHOD_get_field_type
• EC_POINT_set_affine_coordinates_GFp
• ECPoint_i2d
• ECPoint_d2i
• EC_POINT_point2oct
• EC_POINT_oct2point
• EC_POINT_point2bn

• Added reference counter to RSA structure
  • RSA_up_ref
• RSAPublicKey_dup
• RSA_get_ex_data
• RSA_set_ex_data
• RSA_get_ex_new_index

Changes made and bug fixed:

• EC_POINT_get_affine_coordinates_GFp now checks if internal coordinates are in Jacobian format and converts to affine coordinates when needed
• Singleton allocated by BN_value_one is now freed in wolfSSL_Cleanup
• Entire EVP_CIPHER_CTX and DH structures are now correctly zeroed at initialization
• Improved initialization vector handling in EVP_CipherInit

In addition to the above, there was also some refactorization done on existing OpenSSL compatibility layer code. Functions have been streamlined to allow for easier maintenance and tests added to ensure the correct functionality of the compatibility layer.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Do you need SSH support for an embedded device running VxWorks and you have a FIPS 140-2 requirement? wolfSSL has what you need: wolfSSH, an embedded SSH library running on top of our wolfCrypt FIPS library with support for VxWorks. Email us today at fips@wolfssl.com and we will help you integrate wolfSSH into your VxWorks application and walk you through the FIPS process.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

#wolfssh #fips #vxworks

The performance of public key algorithms regularly comes up with customers – they are after all the most costly operations.
wolfSSL has you covered with the Single Precision (SP) big number maths library that brings you the best implementations.
But how does it compare to OpenSSL?

Intel x86 64-bit assembly optimised implementations are as fast or faster than OpenSSL for RSA 2048-bit, EC P-256 and X25519.
One major drawback with OpenSSL is the lack of choice if not using assembly code. The C code is significantly slower, especially the elliptic curve operations which can be 15-40 times slower!
wolfSSL has the option to compile in optimised C code. This code is significantly faster and can be configured to meet your resource profile. Lots of memory, the default build is optimised for maximum speed and handily beats OpenSSL C code. Not so much memory, try the small build, it has similar performance to OpensSSL but half the size!

If you don’t have space for specialised code then good news is coming! Later this year a new implementation of MP, our big number math API, will be released that will be faster than the OpenSSL C code and it’s still smaller.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

We can give you the performance you need and we want to help you!

Team wolfSSL

wolfSSL is looking for a high-energy, motivated individual to drive sales and impact revenue growth in the Midwest region. The primary goal of the Midwest Sales Director is to expand our customer base and grow current customers into larger accounts. This position is remote, preferably close to a major hub such as Chicago, Detroit, Dallas or Austin. You will travel at least once a month to customer meetings, industry meet-ups and relevant conferences (more if you like or if needed for prospective client opportunities).

Responsibilities

• Must be a winner with a great attitude
• Develop and implement sales strategies
• Directly coordinate cross-selling and joint marketing initiatives to maximize exposure and profitability

Qualifications

• Self-motivated, driven and persistent work-ethic
• Excellent written and verbal communication skills
• 5+ years’ software sales experience
• Ability to exercise decisive, agile thinking in a fast-paced industry

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.