wolfSSLs’ Proprietary ACVP client

ANNOUNCEMENT:

wolfSSL is  very proud to let our FIPS community know that wolfCrypt has received its’ first two consolidated ACVP vector certificates!

#A894
#A902

Both of these consolidated certificates were for embedded operating environments (OEs’) and wolfSSL will soon be working on adding a Linux 4.4 on ARM OE, CMSIS-RTOS on EFM32 OE, WINCE on ARM OE and more!

BACKGROUND:

As many in the FIPS world are aware NIST retired CAVP (Cryptogrphic Algorithm Validation Protocol) testing on June 30th of 2020, permanently replacing CAVP with ACVP (Automated Cryptographic Validation Protocol), also referred to as ACVTS (Automated Cryptographic Validation Test System).

In order to prepare for this transition NIST offered a “demo server” that Vendors like wolfSSL and FIPS Labs could utilize in standup of the new protocol. Once the transition was completed NIST also setup “production servers” which only FIPS Labs with a trusted certificate issued by NIST can connect to. Production Vectors passing are now the gateway to Algorithm Certification (IE certs like the ones wolfSSL just received!).

Algorithm Certification is a prerequisite to CMVP FIPS 140-2 (and 140-3) validations. This design keeps in place the need for a FIPS lab to achieve algorithm certification but it now allows for Vendors such as wolfSSL to pre-test in advance of requesting production vectors for certification!

USE-CASES:

The ACVP client wolfSSL has developed can do several things:

  1. Connect to the demo server, request test vectors for 1 (or many) algorithms, process them, and return the responses ultimately receiving either a “pass” or “fail” result.
    1. Support for testing on full Operating System such as Linux/Windows/Unix
    2. Support for testing on embedded Operating Environments (Yes even those that are barely above bare-metal)!
  2. Process JSON files received from a FIPS lab containing production vectors and write out JSON response files for returning to a FIPS lab.
    1. Support for testing on full Operating System such as Linux/Windows/Unix
    2. Support for testing on embedded Operating Environments (even those that are barely above bare-metal)!
  3. The wolfSSL ACVP client also has some local known-answer tests it can run to check algorithms without an RNG component IE most bulk encryption algorithms without an integrity check, and hash algorithms. Bulk encryption algorithms with an integrity check, public key algorithms, and the DRBG can only be sanity-checked against the demo server as the outputs are random and can not be simply diffed with a static known-answer test file.

Users who may want to prepare in advance for the possibility of doing a FIPS validation could use the wolfSSL proprietary ACVP client to test their implementations are ready before pulling the trigger on a FIPS effort with a FIPS lab! If you have any questions or are interested in hearing more about the wolfSSL ACVP client or having wolfSSL validate an Operating Environment so that you can win those deals with customers that need a FIPS validated software module, please contact us at support@wolfssl.com or fips@wolfssl.com anytime!

Sources:

https://csrc.nist.gov/Projects/cryptographic-algorithm-validation-program/cst-lab-transition

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL Has Blazing Fast Throughput for Key Ciphers

We at wolfSSL have recently been benchmarking the performance of our core TLS read and write functions, wolfSSL_read and wolfSSL_write. With assembly optimizations enabled, read and write throughput can reach well over 1 GB/s! The data in the charts below was collected using an Intel Core i5-7300HQ CPU @ 2.50GHz and Ubuntu 18.04.4 LTS. Server and client were both run on this machine, with each given exclusive access to its own CPU core. Benchmarking was done for both TLS version 1.2 and 1.3. We picked a few widely used ciphers and measured throughput on the client side of the TLS connection after the handshake was complete, transmitting 1 MB to the server and receiving 1 MB back. For each cipher, we did this 1000 times and averaged the throughput in each direction (RX and TX). We collected data using our crypto library (wolfCrypt) built with assembly optimizations (configure option –enable-intelasm) and without. If you’re looking for a high throughput TLS implementation, check out wolfSSL!

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

FIPS 140-3 and KDF’s (Key Derivation Functions)

Hi! As our readers know, wolfSSL produces the first embedded TLS library that has begun testing for the new FIPS 140-3 standard, as listed here: https://csrc.nist.gov/projects/cryptographic-module-validation-program/modules-in-process/iut-list

One of the things that is critical to our users is Key Derivation Functions, which are explained here: https://en.wikipedia.org/wiki/Key_derivation_function

Key derivation functions are consumed by TLS 1.2, TLS 1.3, and SSH. We will support KDF’s for all three in our new FIPS 140-3 certificate.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfTPM Support for Parameter Encryption

The TPM feature for parameter encryption and HMAC verification has been added to wolfTPM! The TCG TPM 2.0 specification allows protection of the first parameter of a command or response using parameter encryption. When using an authenticated session it also adds HMAC validation to prove the TPM entity is trusted and integrity of command and response.

Encryption is supported using AES CFB or XOR. The authenticated sessions now support salted unbound sessions with HMAC or Policy type.

The effort was integrated in this GitHub pull request: https://github.com/wolfSSL/wolfTPM/pull/129 and is in the wolfTPM v2.0 release.

Features:

  • Added AES CFB support
  • Added calculation of command hash and HMAC for sessions
  • Added response HMAC validation
  • Fixes and cleanups for KDFa
  • Added KDFa unit test (passes)
  • Inlined the param encryption buffers
  • Added “-aes” and “-xor” options to most examples to enable parameter encryption
  • Refactor of the session authentication
  • Fixes for nonce and auth count
  • Added support for encrypted RSA salt and salted-unbounded session
  • Added innerWrap and outerWrap support for sensitive to private

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Support for Apache httpd 2.4.46

The wolfSSL team is happy to announce support for the latest version of Apache httpd, 2.4.46, with both our standard and FIPS-compliant code. In addition to building wolfSSL with –enable-apachehttpd, users will also need to add –enable-postauth. To support this latest version, we have added new OpenSSL compatibility functions to wolfSSL, updated our Apache httpd documentation, and implemented patch code for httpd to make it play with wolfSSL.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL Support’s Has Speedy Response Times 

wolfSSL provides the most secure embedded SSL/TLS libraries. Our products are run by high-powered, lightweight encryption engines for maximum efficiency and speed. But in the case that a client’s needs are not met, our products are followed by an exceptional support team. 

We have established a channel to hear questions or concerns through support@wolfssl.com. On this platform, we receive over 1400 support inquiries throughout the year that range from simple logistical procedures such as certificate signings to more complex issues users may have such as RSA operations assistance, optimizing performance or build size and more. Upon receiving an inquiry, the appropriate members of the wolfSSL support team are contacted for personal consultation. Instead of forwarding your concerns to a call center where information is ambiguous and answers can be nebulous, we pair you up with individuals who are specialized in your specific area of concern, all of whom have directly contributed to the product itself. Our clients  have their questions answered to the full extent by professionals who understand the product and can explain the process in a concise, cohesive, and intuitive manner.

The speed of wolfSSL support is reflected by the speed of our technologies. On average, our support inquiries are resolved in less than 2 hours. With our premium support package, many wolfSSL support tickets are resolved in under 30 minutes, due to our emphasis on timeliness and getting you connected to the right person. Our fast turnaround times are incredibly beneficial in high-pressure environments and time-sensitive projects.  We offer the type of support that lets you quickly get to a resolution and gets your focus back on your project.

wolfSSL Support is offered at four levels. Depending on the coverage needed, there is a tailored package for you. More details on our packages can be viewed on wolfSSL’s support options page at www.wolfssl.com/products/support-packages/.

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfSSL also supports TLS 1.3! More information can be viewed here: https://www.wolfssl.com/docs/tls13/.

wolfSSL Renesas TSIP Support

The wolfSSL embedded SSL/TLS library supports the Renesas Trusted Secure IP Driver (TSIP) and has been tested on the Renesas RX65N platform.  Using the TSIP driver, wolfSSL can offload supported cryptographic and TLS operations to the underlying Renesas hardware for increased performance.

Supported TSIP Capabilities

wolfSSL has been integrated with the following TSIP capabilities:

  • TSIP driver open/close
  • Random number generation, tested with SP 800-22
  • SHA-1 and SHA-256 hash function support
  • AES-128-CBC and AES-256-CBC support
  • TLS capabilities including:
    • Root CA verification
    • Client and/or Server certificate verification including intermediate certificate verification
    • Support for four TLS cipher suites:
      • TLS_RSA_WITH_AES_128_CBC_SHA
      • TLS_RSA_WITH_AES_128_CBC_SHA256
      • TLS_RSA_WITH_AES_256_CBC_SHA
      • TLS_RSA_WITH_AES_256_CBC_SHA256

FunctionTSIP API
TSIP driver open/closeR_TSIP_Open
R_TSIP_Close
Random Number GenerationR_TSIP_GenerateRandomNumber
SHA-1 and SHA-256R_TSIP_Sha1/256Init
R_TSIP_Sha1/256Update
R_TSIP_Sha1/256Final
AES-128-CBC and AES-256-CBCR_TSIP_Aes128/256CbcEncryptInit
R_TSIP_Aes128/256CbcEncryptUpdate
R_TSIP_Aes128/256CbcEncryptFinal
R_TSIP_Aes128/256CbcDecryptInit
R_TSIP_Aes128/256CbcDecryptUpdate
R_TSIP_Aes128/256CbcDecryptFinal
Root CA VerificationR_TSIP_GenerateTlsRsaPublicKeyIndex
R_TSIP_TlsRootCertificateVerification
Client or Server Certificate VerificationR_TSIP_TlsCertificateVerification
TLS cipher suite support including AES-128-CBC, AES-256-CBCR_TSIP_TlsGeneratePreMasterSecret
R_TSIP_TlsEncryptPreMasterSecret
R_TSIP_TlsGenerateMasterSecret
R_TSIP_TlsGenerateSessionKey
R_TSIP_TlsGenerateVerifyData
R_TSIP_Sha1/256HmacVerifyInit
R_TSIP_Sha1/256HmacVerifyUpdate
R_TSIP_Sha1HmacVerifyFinal

The Renesas TSIP driver is outside the scope of the wolfSSL package download and needs to be obtained externally from Renesas.

Building wolfSSL with RX65N and TSIP Support

Support for Renesas RX65N and TSIP can be enabled at compile-time in wolfSSL by defining one or both of the following defines:

WOLFSSL_RENESAS_TSIP – enables Renesas TSIP support

WOLFSSL_RENESAS_RX65N – enables support for Renesas RX65N

wolfSSL TSIP Benchmarks

The following benchmarks show the performance improvement when using hardware cryptography on the Renesas RX65N through the Renesas TSIP driver.

AlgorithmSoftware CryptoTSIP Accelerated Crypto
RNG231.160 KB/s1.423 MB/s
SHA1.239 MB/s22.254 MB/s
SHA-256515.565 KB/s25.217 MB/s
 

Cipher SuiteSoftware Crypto (sec)TSIP Accelerated Crypto (sec)
TLS_RSA_WITH_AES_128_CBC_SHA0.3810.028
TLS_RSA_WITH_AES_128_CBC_SHA2560.3830.028
TLS_RSA_WITH_AES_256_CBC_SHA0.3820.030
TLS_RSA_WITH_AES_256_CBC_SHA2560.3850.029

Our tests have shown that the implementation of TSIP Accelerated Crypto increased processing speed by an average of 2334%, resulting in 92% faster processing times.

Limitations of TSIP with wolfSSL

The following limitations exist when using wolfSSL with Renesas TSIP:

  • TSIP TLS capabilities are fully available only when using one of the TSIP-supported cipher suites.  These cipher suites include:
    • TLS_RSA_WITH_AES_128_CBC_SHA
    • TLS_RSA_WITH_AES_128_CBC_SHA256
    • TLS_RSA_WITH_AES_256_CBC_SHA
    • TLS_RSA_WITH_AES_256_CBC_SHA256
  • The TSIP TLS capabilities support generation of the normal TLS master secret, but do not support the TLS Extended Master Secret Extension.  TSIP TLS is not available when Extended Master Secret is used.
  • The TSIP TLS certificate verification capability is only available when verifying a certificate signed by “RSA 2048 PSS with SHA-256”.
  • The TSIP TLS capability, common cryptography, is available on client-side only.  Server-side is not currently supported by the TSIP driver.
  • TSIP uses one root CA certificate bundle signature signed by RSA-2048-PSS with SHA-256 available at runtime. When using a different root CA for TSIP TLS capabilities, applications need to call wolfCrypt_Init() to reset the TSIP driver state, then inform TSIP of a new signature and key through the tsip_inform_cert_sign() and tsip_inform_user_keys() APIs.

References

TSIP (Trusted Secure IP) Module Firmware Integration Technology APPLICATION NOTE Rev. 1.06

TSIP Product Page

Support

More information on using wolfSSL in combination with Renesas and wolfSSL’s support for Renesas can be found here: https://www.wolfssl.com/docs/renesas/

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

wolfCrypt FIPS 140-3 Update

HI! We have been industrious in moving forward with our FIPS 140-3 efforts! Here’s where we are at now:

  1. We are in the Implementation Under Test part of the NIST process. You can see from the list: https://csrc.nist.gov/projects/cryptographic-module-validation-program/modules-in-process/iut-list that wolfSSL, Apple, and Intel are leading the FIPS 140-3 charge!
  2. NEW AND COOL: RSA 4096 will be inside of our FIPS 140-3 boundary. More bit strength, more security!
  3. NEW AND COOL: ECDSA with SHA-3 will be inside the FIPS 140-3 boundary! Let’s all welcome SHA-3 to the FIPS universe!
  4. Timelines: We have now iterated with our lab a few times, and are approaching completion of all of our pre-lab work. Once the pre-lab work is completed in the next month or so, the Lab’s work begins in earnest, followed by NIST reviews.

We will not be able to get you a FIPS 140-3 wolfCrypt for Christmas this year, due to a little waiting we are doing on ACVP and IG’s, but we endeavor to lead the market with the freshest FIPS code!

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Your partners in the best and most progressive FIPS solutions,

Team wolfSSL

What is the difference between SSL and TLS?

This week we are tackling a new series of blog posts on the hottest topics! 

This week’s question is: What is the difference between SSL and TLS? 

TLS stands for Transport Layer Security. On the other hand, SSL stands for Secure Sockets Layer. It is important to note that SSL 2.0 and 3.0 have been deprecated by the Internet Engineering Task Force (IETF) in 2011 and 2015.  Both are cryptographic protocols for securing connections between clients and hosts communication over a computer network. The main differences are apparent when it comes to completing the task of encrypting connections. 

Both SSL and TLS refer to the handshake that occurs between a client and a server. The handshake does not encrypt anything itself but rather securely agrees on the shared encryption type to be used. Additionally the handshake takes part in multiple roundtrips as authentication and key exchange occur. On the other hand, TLS 1.3 has reduced the number of cipher suites available in the protocol, and restructured how the cipher suite “string” is represented. 

In conclusion, while these two terms are still used interchangeably, when considering server configuration there are some significant differences in the architecture and fundamentals of the two protocols that do leave your server at risk, if using SSL, to vulnerabilities, outdated cipher suites and browser security warnings. So, note that in your servers, you should only have TLS protocols enabled to have a secure server. 

Are you new to wolfSSL? 

wolfSSL focuses on providing lightweight and embedded security solutions with an emphasis on speed, size, portability, features, and standards compliance, such as FIPS 140-2 and 140-3, RTCA DO-178C level A certification, and support for MISRA-C capabilities. wolfSSL supports industry standards up to the current TLS 1.3 and DTLS 1.2, is up to 20 times smaller than OpenSSL, offers a simple API, an OpenSSL compatibility layer, is backed by the robust wolfCrypt cryptography library, and much more. Our products are open source, giving customers the freedom to look under the hood.

Contact Us 

If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

Additional Resources 

In the meanwhile, check out the wolfSSL embedded SSL/TLS library, star us on Github, and learn more about the latest TLS 1.3 is available in wolfSSL. 

Learn more about TLS and SSL differences here: 

https://www.wolfssl.com/differences-between-ssl-and-tls-protocol-versions-3/

Watch Real-life examples of wolfBoot and wolfTPM! 

Hey wolfSSL friends,
Check out this recording by wolfSSL engineer David Garske who demonstrates multiple live demos of wolfTPM and gives real-life examples of wolfBoot at TPM.dev 2020 Mini Conference Day 1.  Click on the link below to find the slides attached and the video recording!
To learn more about wolfTPM check out our product manual: https://www.wolfssl.com/products/wolftpm/
Contact Us 
If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.
 
Additional Resources 
In the meanwhile, check out the wolfSSL embedded SSL/TLS library, star us on Github, and learn more about the latest TLS 1.3 is available in wolfSSL.

Posts navigation

1 2 3 89 90 91 92 93 94 95 198 199 200