Category: wolfHSM

Quantum computers are not a far-off dream anymore—they are increasingly becoming a reality, and that brings challenges for the future of secure communications. Traditional public-key cryptosystems like RSA and ECC are vulnerable to quantum attacks, making the transition to post-quantum cryptography (PQC) a vital consideration for businesses planning long-term security solutions, especially those in the Automotive and industrial sectors. With emerging standards from NIST, post-quantum algorithms are paving the way for a new era of cryptographic resilience. However, until now, no commercially available HSM solutions offered support for these post-quantum algorithms, leaving industries like automotive, aerospace, and industrial that rely on HSM security struggling to adopt these critical technologies. Until now.

Enter wolfHSM, our innovative Hardware Security Module (HSM) firmware framework, designed to bring state-of-the-art cryptography to HSM platforms. wolfHSM delivers a unified API for secure cryptographic operations, object storage, and key management on hardware platforms with HSM coprocessors. This allows applications to harness a device’s hardware root of trust while providing a streamlined abstraction for offloading cryptographic operations to the HSM via the wolfCrypt API.

Built on the flexibility of wolfCrypt, wolfHSM enables easy integration of a wide range of cryptographic standards, from trusted legacy algorithms to cutting-edge standards like the latest in post-quantum. This adaptability is what sets wolfHSM apart from the legacy Automotive HSM’s. With traditional HSM solutions, you’re stuck with a fixed set of algorithms, with no option to adapt to evolving security requirements. wolfHSM changes the game—it empowers you to deploy any algorithm supported by wolfCrypt as needed, including post-quantum algorithms. You can easily pivot from RSA or ECC to quantum-resistant alternatives like ML-KEM (Kyber), ML-DSA (Dilithium), Falcon, or LMS/XMSS. This will give you flexibility to meet evolving government regulations like CNSA 2.0, UN R155, and others.

As the cryptographic landscape shifts toward quantum resistance, the inherent flexibility afforded by wolfHSM is an easy way to reduce risk when developing your application. With wolfHSM, your application can evolve with these changes—supporting new standards as they emerge and swapping algorithms without the need for expensive hardware changes. With wolfHSM, adding post-quantum cryptography to your HSM-based applications is as straightforward as using standard algorithms like RSA or AES, giving you future-proof security today.

Whether you need to prepare your infrastructure for quantum-safe cryptography or simply want to keep your cryptographic options open, wolfHSM has you covered. wolfHSM’s intrinsic crypto-agility ensures that new requirements can be met quickly and securely without the need for a complete overhaul of your existing infrastructure. This means peace of mind, knowing that your security is always one step ahead of the next threat.

wolfHSM supports a variety of automotive HSM platforms, including the Infineon AURIX TC3xx, ST SPC58N, and Renesas RH850, but can be ported to run on any device—bringing crypto agility and quantum resilience to your platform of choice.

Interested in taking your HSM application into the quantum age? Want to use post-quantum algorithms like LMS, ML-KEM, ML-DSA, or XMSS on an AURIX TC3xx HSM? Let us know! Reach out to us at facts@wolfSSL.com, and let’s discuss how we can help future-proof your security.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

In recent years, China’s cryptographic standards have gained significant traction on the global stage, with algorithms like SM2, SM3, and SM4 setting the standard for secure communications within Chinese regulatory frameworks. Companies operating in or doing business with China must support these ciphers to meet compliance requirements and to ensure secure interoperability. However, until now, no commercially available HSM solutions offered support for the full suite of SM ciphers, meaning industries that rely on HSM offload for security—such as automotive, industrial, or aerospace—face significant integration challenges.

Enter wolfHSM, our generic Hardware Security Module (HSM) firmware framework, targeting automotive HSM platforms and beyond. wolfHSM provides a unified API for secure cryptography, object storage, and key management on devices with HSM coprocessors. wolfHSM enables applications to easily leverage a platform’s hardware-based root of trust and provides a streamlined abstraction for offloading all cryptography to the HSM coprocessor through the wolfCrypt API.

Built to support any algorithm provided by wolfCrypt, wolfHSM enables users to integrate a wide variety of cryptography, from established algorithms to the latest bleeding edge draft standards. This flexibility is a key differentiating factor of wolfHSM, setting it apart in a market where adaptability and cryptographic choice are becoming increasingly crucial. With existing HSM solutions, you are locked into a small set of supported algorithms with no opportunity to modify or update HSM capabilities. With wolfHSM, you can deploy any algorithm supported by wolfCrypt, and are able to seamlessly switch between algorithms as needed, ensuring that you’re always using the best tools for your security needs. Given this flexibility, new algorithms like the SM ciphers can be deployed on your HSM just as easily as standard algorithms like AES or SHA256.

Whether you’re specifically looking to integrate SM ciphers into your HSM-based application, or just need a solution that allows you keep your options open, wolfHSM has what you need. wolfHSM’s “out of the box” crypto-agility means that as new requirements arise, wolfHSM can quickly and easily adapt – securely and without overhauling your existing infrastructure.

wolfHSM supports standard automotive HSM platforms like the Infineon AURIX TC3xx, ST SPC58N, Renesas RH850, etc. but can be easily ported to run on any device.

Are SM ciphers on an HSM something you are interested in? Do you want to use SM ciphers on AURIX TC3xx HSM? Let us know! Reach out to us at facts@wolfSSL.com and we can discuss.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

The title says it all!! If you have been paying any attention at all to us here at wolfSSL, you will know that we are very proud of our wolfHSM product that already runs on the Aurix Tricore. What we have not been focusing on is the post-quantum algorithms that work with wolfHSM. Let’s use this blog post to fix that oversight.

In this post we will be focusing on ML-KEM, ML-DSA, and especially LMS and XMSS as they are all implemented in wolfCrypt and are therefore available in wolfHSM to protect you from the oncoming quantum threat.

First of all, ML-KEM is a Key Encapsulation Mechanism and generally used for key establishment. In most protocols this means it is used ephemerally, but because of the security properties inherent in the algorithm, it can also be used statically. That means it is fine for wolfHSM to generate an ML-KEM private key and use it multiple times under the protection of the HSM core.

Naturally, as MLDSA is a general purpose post-quantum signature scheme, wolfHSM has an opportunity to help just like in the case of ECDSA or RSA.

Now, where wolfHSM provides a unique offering is LMS and XMSS. These are stateful hash-based signature schemes which are great for firmware and software signing. That said, there is a state associated with the private key and that state MUST be properly managed. A consequence of improper management is that the key pair must be revoked and all signatures encountered after the point of revocation cannot be trusted.

Software libraries that implement signing by stateful hash-based signature schemes, such as wolfSSL, must trust the application developer to properly manage the state. In the case of wolfHSM, the wolfSSL team’s expertise can come into play to ensure proper management of the state. The application developer no longer needs to be an expert in post-quantum algorithms; simply a user of them.

If you’d like to learn how wolfHSM can support your post-quantum migration or have any questions, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now