Hi Frederik,

This is indeed expected behavior, as we do not generate an ephemeral key until you call wolfSSL_UseKeyShare.

May I ask what project you are using our post-quantum support for?  Are you working on a personal or commercial project?  Feel free to contact us at support [AT] wolfssl [DOT] com if these details are sensitive.

Thanks,
Kareem

Hi m_u_h,

You can call wolfCrypt_GetStatus_fips to get the current FIPS POST status, if it returns 0, POST was successful, non-zero means there was an error.
Yes, you can call wolfCrypt_IntegrityTest_fips to manually trigger a POST.

Thanks,
Kareem

Yes, please try updating to 5.5.3.
wpa_supplicant requires multiple build flags which you can find in configure.ac: https://github.com/wolfSSL/wolfssl/blob … e.ac#L1669
You will need to define all of them.  The main flag is WOLFSSL_WPAS.

Hi Danny,

-188 is ASN_NO_SIGNER_E, this means we were not able to find a CA signer for your peer's certificate.
Are you registering CA certificates before connecting?  You can register CA certs using a _verify API such as wolfSSL_CTX_load_verify_buffer.  Are you confident your CA certificates include your peer's certificate?

Thanks,
Kareem

Hi swaroopk,

Did you install your distro's wolfSSL, or did you build it yourself?  If you built it yourself, please attach your build settings (user_settings.h or ./configure line).
It looks like you're missing SHA support (ie. --disable-sha or NO_SHA), please confirm SHA is enabled.  Please also confirm you're using the latest wolfSSL release, 5.5.3.

Is your FIPS hash unstable?  Is it changing after you change it in fips_test.c and rebuild?
If so, make sure you are linking wolfCrypt FIPS in the right order, see our linker script here for an example: https://github.com/wolfSSL/wolfssl/blob … er_fips.ld  Specifically, wolfcrypt_first.o needs to come first, then the FIPS objects, and lastly wolfcrypt_last.o.

Hi karikjame2021,

This is most likely caused by an outdated FIPS hash, you will need to update your FIPS hash and rebuild.  The easiest way to do this is to run the script "fips-hash.sh" in the root of your wolfSSL directory.
You will need to register our FIPS seed callback in your application with the following code:

#ifdef WC_RNG_SEED_CB
 wc_SetSeed_Cb(wc_GenerateSeed);
#endif

Thanks,
Kareem

Hello,

Your ECC key is using a Koblitz curve which we do not enable support for by default.
Please add --enable-ecccustcurves=all to your configure line, rebuild wolfSSL and let me know if you still see any issues.

Thanks,
Kareem

Hi Jun Li,

We do have different behavior than OpenSSL by default with cert chains, to use OpenSSL's behavior you can build wolfSSL with WOLFSSL_ALT_CERT_CHAINS.  Let me know if you still have any issues with alt cert chains defined.

Thanks,
Kareem

Happy to help.

For wolfSSL_EC_KEY_dup, you'll need OpenSSL all enabled as well, so you'll need to add --enable-opensslall to your ./configure line.
wolfSSL_EC_POINT_is_on_curve requires USE_ECC_B_PARAM.  Add CFLAGS='-DUSE_ECC_B_PARAM' to your configure line.

We don't currently support EC_GROUP_get0_generator or PEM_write_PrivateKey.  You will need to replace these functions, or send a request to support AT wolfssl DOT com if you'd like to see these added to our compatibility layer.
I also wanted to note we provide wolfEngine, for full OpenSSL compatibility: https://github.com/wolfSSL/wolfEngine  But we do recommend using our OpenSSL compatibility layer when possible.

Hello,

Which version of wolfSSL are you using?  If you aren't using our latest release (5.4.0), try upgrading and let me know if it helps.
How are you building wolfSSL?  Can you share your build settings (user_settings.h or ./configure line)?
Your includes look correct, make sure you have <wolfssl/options.h> included before all other wolfssl headers in all files using these headers.

Thanks,
Kareem

You can disable wolfSSL's certificate validity check using wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
This significantly hurts security, and we strongly recommend against it.  Instead, you should register your CA certificates by calling wolfSSL_CTX_load_verify_locations(ctx, NULL, "/path/to/CAcerts/"); before connecting.

Thanks,
Kareem