Category: wolfSSL/ wolfCrypt

wolfSSL is excited to announce additional support for wolfCrypt API’s in our CSharp (C#) wrapper. Our CSharp wrapper now includes wolfCrypt support for ECC (ECDSA/ECDHE), ECIES, RSA, ED25519/Curve25519, AES-GCM, and HASH cryptographic algorithms. The supported HASH algorithms are MD2, MD4, MD5, SHA, SHA-224, SHA-256, SHA-384, SHA-512, SHA-MD5, SHA3-224, SHA3-256, SHA3-384, SHA3-512, BLAKE2B, and BLAKE2S.

In addition to the CSharp wrapper, we supply a comprehensive test suite, `wolfCrypt-Test.cs` to test all of the supported cryptographic algorithms. The PR for these changes can be found here: PR# 3166.

To start using the wolfCrypt CSharp wrapper, please refer to the README.md, which contains useful information on how to get started. Another useful resource is the `wolfCrypt-Test.cs` suite, which shows common use cases and can help in validating your application setup.

If you have any questions about our wolfCrypt CSharp wrapper or need assistance, feel free to email us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL’s trusted partner, Analog Devices, Inc. (ADI), recently announced that integrating the MAXQ1065 with wolfSSL can significantly enhance security for IoT and embedded systems. Explore the ADI Engineer Zone blog post, Securing IoT and Embedded Systems: Integrate MAXQ1065 with wolfSSL, to discover wolfSSL’s competitive advantages and how this integration improves IoT security solutions and embedded system security applications.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

rustls-wolfcrypt-provider integrates the wolfCrypt cryptographic library as a backend for Rustls, allowing developers to use wolfCrypt’s secure cryptographic functions with Rustls’ modern TLS stack. Currently in alpha, this library offers flexibility for those needing an alternative crypto provider, especially for projects requiring FIPS 140-3 readiness.

Other reasons to consider wolfCrypt as your Rustls provider include the following:

1. Hardware encryption support, wolfCrypt supports hardware encryption and assembly optimizations for systems big and small. See our list of supported hardware encryption schemes.
2. Support: we will support Rustls when used in conjunction with wolfCrypt.
3. Consulting: If you need help making all of this work in your environment, we’ll help!

Supported Cipher Suites

TLS 1.3:

• TLS13_CHACHA20_POLY1305_SHA256
• TLS13_AES_128_GCM_SHA256
• TLS13_AES_256_GCM_SHA384

TLS 1.2:

• TLS12_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
• TLS12_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS12_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS12_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS12_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS12_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

With rustls-wolfcrypt-provider, developers can combine the cryptographic strengths of wolfCrypt with the modern TLS capabilities of Rustls, supporting Rustls version 0.23.9. This integration is ideal for projects that require both strong security and the flexibility of wolfCrypt’s cryptography.

Are you interested in Rust solutions with wolfSSL integration?

If you have questions about any of the above or need assistance, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfSSL helps make the internet secure. Part of this task is continually updating our default settings to keep up with adversarial advancements. A recent article detailed the use of default RSA key sizes by an IoT manufacturer, which resulted in a 512 bit key being used for authentication. “The factoring required $70 in cloud computing costs and less than 24 hours.”

Since wolfSSL also had the default minimum set to 512 bits, we decided to update the default minimum to 2048 bits. The decision to use 2048 bit for the minimum was based on NIST recommendations and security industry best practices. This affects key generation using wc_MakeRsaKey. Testing infrastructure was also updated to be sure the smaller key sizes are still being covered by CI tests. The default RSA key size minimum can be overridden in the configuration using the RSA_MIN_SIZE macro.

For more information about using RSA in wolfSSL or have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

wolfSSL’s trusted partner, ExpressVPN, recently announced impressive cryptographic benchmark results comparing unaccelerated and hardware-accelerated performance with wolfSSL. Check out ExpressVPN’s benchmarks and download Lightway Core, ExpressVPN’s modern VPN protocol, on GitHub.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Are you prepared for the upcoming security enhancements in Azure, which will remove support for TLS 1.0 and TLS 1.1? By the end of October, Azure will no longer accept connections using TLS 1.0 and TLS 1.1 (Azure announcement). This is great news! The older TLS protocols are less secure compared to the newer TLS 1.2 and TLS 1.3 standards. wolfSSL supports both TLS 1.2 and TLS 1.3, and can assist in upgrading your product’s security to prepare for the deprecation of TLS 1.0 and TLS 1.1 in Azure.

For more information and upgrade assistance contact facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Do you have an idea for a project but want a quick prototype without the hassle of a custom board? We’re happy to announce that our latest wolfSSL v5.7.2 library is now available in the Arduino Registry for rapid prototypes.

Just type “wolfSSL” in the Library Manager of the Arduino IDE. If nothing happens right away, check to see if the IDE is downloading updates as indicated in the lower-right corner of the app and wait for the process to complete.

There are TLS Client and Server apps, as well as a bare-bones Hello World that just prints the wolfSSL version. See the bottom of the list in Files – Examples – “Examples from Custom Libraries” in the IDE.

Just edit the SSID and Password:

All of the source code is available at: https://github.com/wolfSSL/Arduino-wolfSSL. We also have a more detailed Getting Started with wolfSSL on Arduino guide.

Want to check performance? Check out our recent blog: How do you benchmark cryptography?

When you are ready to move on to the next step, wolfSSL will be there for you! Need to have your project NIST Certified? Recently we announced that wolfSSL is the First in the World to offer FIPS 140–3 Automated Submission with our NIST Certificate #471.

See our prior blogs on:

• What is the difference between FIPS 140-2 and FIPS 140-3?
• FIPS vs FedRAMP Compliance and Requirements

The What is FIPS (Quick Overview) blog also applies to RISC-V with regards to how your RISC-V Operating Environment (“OE”) can be certified:

1. You send us your hardware and toolchain.
2. We run the initial tests which ensure the cryptography module behaves according to specification given your specific hardware and operating system.
3. The CMVP certified lab runs and verifies the tests and their documentation.
4. The test results are submitted to CMVP for review.
5. Your specific operating environment is added to our certificate.
6. You are FIPS 140 compliant in 60-90 days.

For more details, see our blog What is FIPS (In-Depth Overview).

Have specific requests or technical questions? We’d love to hear from you! Please reach out to us at support@wolfSSL.com or open an issue on GitHub. For general inquiries, please contact us at facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now

Are you interested in FIPS 140-3 RISC-V Certification? Check out our RISC-V Announcement:

wolfSSL Embraces RISC-V; FIPS 140-3 Certifications Now Available

Here are some places where wolfSSL can be found:

1. Hex Five And wolfSSL Announce The First Secure IoT Stack For RISC-VHex Five Security, Inc., in collaboration with wolfSSL, has developed the first secure IoT stack for RISC-V, which is a significant advancement for secure embedded systems. This stack integrates Hex Five’s MultiZone™ Security, a trusted execution environment (TEE) that allows for hardware-enforced separation of software components into multiple isolated zones, with wolfSSL’s TLS 1.3 cryptographic library. This combination ensures that any security vulnerabilities in one part of the system are contained, preventing them from compromising the entire IoT device.

   “wolfSSL, a leading provider of TLS cryptography and Hex Five Security, provider of MultiZone™ Security, the first Trusted Execution Environment for RISC-V announce general availability of the industry-first secure IoT stack for RISC-V – a TLS 1.3 reference implementation of freeRTOS with hardware-enforced separation between OS, TCP/IP stack and root of trust”

   This secure IoT stack is particularly valuable for RISC-V developers as it addresses the security challenges inherent in monolithic system designs by enabling fine-grained separation and protection of system functions. The stack is open source and available for developers on GitHub, promoting wider adoption and innovation within the RISC-V community?.

2. wolfSSL and Synopsys are working together to bring the wolfSSL portfolio of products to the Synopsys ARC® architecture.The Synopsys ARC Access Program is a collaborative initiative that supports a diverse ecosystem of hardware and software vendors in developing optimized solutions for Synopsys DesignWare® ARC® processors. The program provides members with access to essential development tools, such as ARC MetaWare, as well as opportunities for joint marketing and technical collaboration. This ecosystem is designed to accelerate the development and deployment of ARC-based embedded systems across various industries.

   As part of this program, wolfSSL offers its lightweight and embedded security solutions, which are highly optimized for speed, size, and portability, to enhance the security of ARC-based systems. This collaboration helps developers integrate advanced cryptographic features into their designs, ensuring secure communication and data protection in embedded applications.

3. Microchip Microsemi PolarFire SoCThe Microchip Microsemi Accelerate Ecosystem Partner Program is a collaborative initiative that connects Microsemi with industry leaders in silicon, IP, systems, software, and design services to deliver integrated and pre-validated solutions. This program helps partners accelerate time to market and revenue generation through technology collaboration, joint marketing efforts, and sales acceleration. Notably, wolfSSL, a leading provider of SSL/TLS libraries, is part of this ecosystem, offering secure communication solutions that integrate with Microsemi’s products, enhancing security and performance for end customers?.
4. Lightway, ExpressVPN’s new protocol for a superior VPN experienceWe at wolfSSL are proud to be partners with the awesome team over at ExpressVPN.

   Also read what you need to know about the OpenSSL bug:

   “Our Lightway VPN protocol uses wolfSSL for all of its cryptographic needs and does not use OpenSSL at all. That means that all Lightway clients and servers are totally unaffected by the OpenSSL bug. If you connect to ExpressVPN using Lightway (which is the default in our apps), you’ll be protected by wolfSSL”

5. Espressif Managed ComponentsAnother company leveraging wolfSSL for RISC-V is Espressif, specifically in their ESP32-C3 and ESP32-C6 devices. wolfSSL has integrated RISC-V hardware acceleration into these devices, enhancing cryptographic performance. This integration allows Espressif’s RISC-V-based chips to benefit from the high-performance, lightweight SSL/TLS libraries that wolfSSL is known for, providing secure communication capabilities optimized for embedded systems.

   There are more details on Getting Started with Managed Components in our prior blog.

   See also:

   • Espressif RISC-V Hardware Accelerated Cryptographic Functions Up to 1000% Faster
   • Post Quantum Key Share on the Espressif ESP32
   • wolfSSH – Now Available as an Espressif Managed Component
   • wolfMQTT – Now Available as an Espressif Managed Component
   • Secure Your Apple HomeKit Espressif ESP32 Devices with wolfSSL

Having any questions or problems with wolfSSL? We want to help!

1. Check out the documentation
2. Reach out to us on our product forums
3. Open a GitHub issue
4. View the wiki
5. Send us an email at support@wolfSSL.com

Are you interested in RISC-V or FIPS Certification? We want to hear about your project!

If you have questions about any of the above, please contact us at facts@wolfSSL.com, +1 425 245 8247, or open an issue on GitHub.

Download wolfSSL Now