Live Webinar: How to Secure AMD Xilinx Platforms with wolfSSL
Build faster, boot safer, and secure your Xilinx designs against tomorrow’s threats.
Join wolfSSL senior software engineer Jacob Barthelmeh for a live walkthrough of how wolfSSL brings high-assurance cryptography and post-quantum protection to AMD Xilinx platforms. Learn how wolfBoot establishes a secure boot chain, how wolfHSM provides hardware-rooted key management, and how wolfCrypt delivers FIPS 140-3 validated and CNSA 2.0-aligned post-quantum algorithms for long-term security. Whether you’re developing for aerospace, defense, or industrial systems, discover how wolfSSL combines performance, portability, and certification-ready protection for AMD Xilinx devices.
Register Now: How to Secure AMD Xilinx Platforms with wolfSSL
Date: October 29 | 9 AM PT
What this webinar will cover:
- Building wolfSSL for Xilinx Devices — Optimize builds and enable hardware acceleration
- Integration with PetaLinux — Configure, package, and deploy wolfSSL efficiently
- wolfBoot for Secure Boot — Authenticate firmware and enforce a trusted boot chain
- wolfHSM Overview — Implement hardware-backed key storage and crypto offload
- PQC & CNSA 2.0 Readiness — Integrate ML-KEM, ML-DSA, LMS, and XMSS for quantum-safe protection
- FIPS 140-3 Validated wolfCrypt — Meet compliance requirements for regulated environments
Register now to learn how wolfSSL delivers quantum-ready, certifiable security for AMD Xilinx platforms.
As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
wolfSSH 1.4.21 Released
Version 1.4.21 of wolfSSH is now available! This update includes a critical security fix, improved interoperability, and enhancements for embedded and hardware-backed key use cases.
Security Updates
This release addresses two security issues:
- CVE-2025-11625: Fixed a client-side host verification bypass that could expose credentials (PR#840).
- CVE-2025-11624: Fixed an SFTP server stack overflow triggered by malformed input. Thanks to Stanislav Fort of Aisle Research for the report
Feature Additions
- TPM key authentication for hardware-based identity protection.
- ED25519 key generation support added to the API.
- Curve25519 alias compatibility with curve25519-sha256@libssh.org for improved interoperability.
- Keyboard-interactive authentication can now be enabled at build time (–enable-keyboard-interactive).
- AES-CBC is now disabled by default, shifting focus toward stronger default cipher suites.
- Added Microchip ATSAMV71Q21B example with harmony filesystem integration.
This version refines FATFS support, enhances user authentication handling, and improves SFTP and rekeying operations. Post quantum hybrid support was also touched up along with numerous Coverity findings, warning cleanups, and minor API consistency fixes.
Users of the wolfSSH client code or SFTP server should upgrade, particularly those relying on host verification.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
Xilinx Accelerated Crypto with FIPS
It’s already possible to use ARMv8 crypto extensions with FIPS 140-3 using PAA (Processor Algorithm Acceleration) but did you know that we have researched using Xilinx/AMD’s hardened crypto with wolfSSL while being FIPS certified? Many benefits can come from using Xilinx/AMD’s hardened crypto accelerators, for example it free’s up the CPU to be used for other operations and it also comes with additional side channel hardening. Leveraging these benefits in projects where FIPS 140-3 certification is required would be useful. If curious about a hybrid FIPS certification that can make use of the CSU, or newer ASU, while having a FIPS 140-3 certification contact us at facts@wolfssl.com.
Join our upcoming webinar “How to Secure AMD Xilinx Platforms with wolfSSL” on October 29 at 9 AM PT to learn how to leverage AMD/Xilinx’s hardened crypto with FIPS 140-3 certification for enhanced performance and security.
Register now!
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
Updated Xilinx/AMD Versal Benchmarks
There are three build options for crypto operations when using wolfSSL on Xilinx/AMD Ultrascale+ devices. The lightweight wolfSSL library can use a software only implementation, make use of the ARMv8 crypto extensions along with custom ARM assembly, or offload the operation to the CSU. Each has its trade offs. Recently wolfSSL has made improvements to the ARMv8 optimizations for use with AES-GCM operations.
- Offloading to the CSU (labeled here as the hardened option) free’s up the CPU for other operations and it leverages the hardening available which provides enhancements like additional protections against DPA (differential power analysis)
- ARMv8 crypto extensions is very performant for smaller block sizes and can be taken through a FIPS OE with use of PAA (Processor Algorithm Acceleration)
The following tables are raw numbers of the throughput collected. Collecting the performance on even larger block sizes would show that Xilinx/AMD hardened crypto accelerators continue on linearly until reaching their maximum. The hardened numbers were collected previously using FreeRTOS, the software and ARMv8 were collected while running on Petalinux with the latest wolfSSL version 5.8.2. A VMK180 Versal board was used.
| Algorithm | Hardened – MB/s | Block Size |
| AES-256-GCM-enc-no_AAD | 0.19188 | 16 |
| AES-256-GCM-enc-no_AAD | 6.324667 | 528 |
| AES-256-GCM-enc-no_AAD | 12.254902 | 1024 |
| AES-256-GCM-enc-no_AAD | 49.01886 | 4112 |
| AES-256-GCM-enc-no_AAD | 89.60888 | 7696 |
| AES-256-GCM-enc-no_AAD | 181.00591 | 15888 |
| AES-256-GCM-enc-no_AAD | 350.444225 | 32768 |
| AES-256-GCM-enc-no_AAD | 633.100698 | 65535 |
| Algorithm | Software – MB/s | Block Size |
| AES-256-GCM-enc-no_AAD | 15.0984 | 16 |
| AES-256-GCM-enc-no_AAD | 31.0764 | 528 |
| AES-256-GCM-enc-no_AAD | 31.5839 | 1024 |
| AES-256-GCM-enc-no_AAD | 32.0214 | 4112 |
| AES-256-GCM-enc-no_AAD | 32.0883 | 7696 |
| AES-256-GCM-enc-no_AAD | 32.1052 | 15888 |
| AES-256-GCM-enc-no_AAD | 32.1038 | 32768 |
| AES-256-GCM-enc-no_AAD | 32.1293 | 65535 |
| Algorithm | ARMv8 – MB/s | Block Size |
| AES-256-GCM-enc-no_AAD | 120.862503 | 16 |
| AES-256-GCM-enc-no_AAD | 633.607939 | 528 |
| AES-256-GCM-enc-no_AAD | 715.517677 | 1024 |
| AES-256-GCM-enc-no_AAD | 776.28316 | 4112 |
| AES-256-GCM-enc-no_AAD | 783.198307 | 7696 |
| AES-256-GCM-enc-no_AAD | 793.405041 | 15888 |
| AES-256-GCM-enc-no_AAD | 793.122663 | 32768 |
| AES-256-GCM-enc-no_AAD | 797.332681 | 65535 |
For RSA operations the following chart shows performance differences using a 4096 bit key for private key operations. SP stands for Single Precision.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
wolfHSM DMA Feature Addition
wolfHSM provides a client-server model for interacting with HSM’s to do cryptographic operations and currently supports multiple transport mediums: TCP, POSIX shared memory (SHM), and DMA (direct memory access). It gives the option of using wolfCrypt with it’s FIPS 140-3 certification instead of a hardware HSM to take advantage of something like a secure trustzone. This abstraction also makes it easy for developing an application that can make use of any HSM backend without needing to make changes to the application when switching the HSM used.
Recently an additional feature was added for DMA operations with the POSIX shared memory transport. Instead of copying data from the shared memory buffer, wolfHSM can now pass an offset into the SHM buffer by making use of wolfSSL’s static memory feature on the client side and translating the offset into the shared memory region into a pointer on the server side. This reduces redundant memory copies and improves throughput. New `wh_dma.c` and `wh_dma.h` files were introduced to provide offset translation, validation, and hooks for cache handling or memory safety checks. These changes give developers better performance by avoiding unnecessary `memcpy` operations while taking advantage of wolfCrypt FIPS 140-3 certified security.
Along with the feature addition, the POSIX examples were enhanced to take an argument for selecting a transport medium type and the benchmarking tool was also enhanced similarly.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call +1 425 245 8247.
Download wolfSSL Now
Live Webinar: The wolfCrypt Linux Kernel Module: FIPS Full Crypto Stack Replacement
Bring FIPS 140-3 validated cryptography directly into the Linux kernel.
In this webinar, wolfSSL Senior Software Engineer Daniel Pouzner introduces the libwolfssl FIPS-compliant Linux Kernel Module (libwolfssl.ko), a plug-and-play replacement for the kernel crypto stack. Learn how it delivers FIPS-validated algorithms, hardware acceleration, and post-quantum readiness for applications such as LUKS/dm-crypt, VPN, MACsec, and TLS offload.
Register Now: The wolfCrypt Linux Kernel Module: FIPS Full Crypto Stack Replacement
Date: October 22 | 9 AM PT
Discover how wolfSSL extends its proven cryptographic engine to kernel space, integrating with WolfGuard VPN and transforming Linux randomness sources into SP 800-90B compliant DRBGs.
What You’ll Learn:
- Enable FIPS 140-3 validated cryptography directly in the Linux kernel
- Accelerate performance with hardware support and post-quantum algorithms (ML-KEM, ML-DSA)
- Replace the kernel crypto stack for LUKS, VPN, MACsec, and TLS offload
- Integrate FIPS-certified randomness and DRBG sources across the system
Register now to see how wolfSSL enables a fully FIPS-compliant, post-quantum-ready Linux environment.
As always, our webinar will include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
FIPS 140-3 Enabled Linux Authentication & System Services with GnuTLS-wolfSSL
wolfSSL is thrilled to announce that critical enterprise security and system services can now achieve FIPS 140-3 compliance through our GnuTLS-wolfSSL integration. This breakthrough comes from our ongoing work integrating wolfSSL’s FIPS 140-3 certified cryptography (wolfCrypt) into GnuTLS, enabling a true drop-in solution for Linux applications.
For enterprises in government, defense, finance, healthcare, and other regulated industries, this eliminates a major hurdle to deploying essential security infrastructure that must meet federal compliance standards.
What We’ve Built
Unlike traditional approaches requiring extensive rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level with wolfCrypt’s certified cryptographic operations, applications gain FIPS 140-3 compliance without changing a single line of their code. Simply rebuild with our patched GnuTLS library, and your entire security infrastructure achieves FIPS compliance.
We’re continuously validating this integration through CI/CD testing against 17 applications, testing target versions, latest releases, and master branches to ensure rock-solid compatibility. Our fork is now debianized, making deployment as simple as installing a standard Debian package.
Enterprise Applications Now FIPS-Ready
OpenLDAP – The industry-standard directory services platform for authentication and authorization across enterprise networks.
Samba – Provides Windows-compatible file sharing, print services, and Active Directory integration for mixed Linux/Windows environments.
dirmngr – The GnuPG component handling certificate and CRL management for cryptographic operations.
TPM2-tools – Utilities for interacting with Trusted Platform Module 2.0 hardware for secure key storage and attestation.
rsyslog – High-performance system logging with TLS support for secure remote log transmission.
fwupd – The Linux firmware update daemon that securely manages firmware updates across hardware components.
How We Enable FIPS Compliance
These applications rely on GnuTLS for secure authentication, encrypted communications, certificate validation, and cryptographic operations. By integrating wolfSSL’s FIPS 140-3 certified wolfCrypt module into GnuTLS, we deliver a true drop-in solution. Depending on the algorithms your application uses, you may need no code changes at all, just rebuild with our patched library and achieve FIPS compliance across your enterprise security stack.
The debianized package makes deployment straightforward: install our GnuTLS-wolfSSL package on your Debian-based system, and your enterprise services automatically benefit from FIPS-certified cryptography.
Questions?
Take a more in-depth look at our integration on the wolfSSL GitHub, if you need support we are more than happy to help you out, you can email us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
FIPS 140-3 Enabled Linux Network Infrastructure with GnuTLS-wolfSSL
wolfSSL is thrilled to announce that core network infrastructure applications can now achieve FIPS 140-3 compliance through our GnuTLS-wolfSSL integration. This breakthrough comes from our ongoing work integrating wolfSSL’s FIPS 140-3 certified cryptography (wolfCrypt) into GnuTLS, enabling a true drop-in solution for Linux applications.
For developers and system administrators in government, defense, finance, healthcare, and other regulated industries, this eliminates a critical barrier to deploying secure network infrastructure that must meet federal compliance standards.
What We’ve Built
Unlike traditional approaches requiring extensive rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level with wolfCrypt’s certified cryptographic operations, applications can gain FIPS 140-3 compliance without changing a single line of their code. Simply rebuild with our patched GnuTLS library, and your entire networking stack achieves FIPS compliance.
We’re continuously validating this integration through CI/CD testing against 17 applications, testing target versions, latest releases, and master branches to ensure rock-solid compatibility. Our fork is now debianized, making deployment as simple as installing a standard Debian package.
Network Applications Now FIPS-Ready
chrony – The widely-deployed NTP implementation for time synchronization across Linux systems, critical for distributed infrastructure and audit logging.
NetworkManager – The standard Linux network connection manager that handles everything from WiFi to VPN connections in modern distributions.
libnice – Implements ICE protocol for NAT traversal, essential for WebRTC and real-time communication applications.
curl & wget – The ubiquitous data transfer utilities now gain a clear path to FIPS compliance for secure communications.
How We Enable FIPS Compliance
These applications rely on GnuTLS for TLS connections, certificate handling, and cryptographic operations. By integrating wolfSSL’s FIPS 140-3 certified wolfCrypt module into GnuTLS, we deliver a true drop-in solution. Depending on the algorithms your application uses, you may need no code changes at all, just rebuild with our patched library and achieve FIPS compliance across your network infrastructure.
The debianized package makes deployment straightforward: install our GnuTLS-wolfSSL package on your Debian-based system, and your network applications automatically benefit from FIPS-certified cryptography.
Questions?
Take a more in-depth look at our integration on the wolfSSL GitHub, if you need support we are more than happy to help you out, you can email us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
FIPS 140-3 Enabled Linux Desktop & Media Applications with GnuTLS-wolfSSL
wolfSSL is thrilled to announce that desktop, development, and media applications can now achieve FIPS 140-3 compliance through our GnuTLS-wolfSSL integration. This breakthrough comes from our ongoing work integrating wolfSSL’s FIPS 140-3 certified cryptography (wolfCrypt) into GnuTLS, enabling a true drop-in solution for Linux applications.
For developers and organizations in government, defense, finance, healthcare, and other regulated industries, this eliminates barriers to deploying user-facing applications and specialized libraries that must meet federal compliance standards.
What We’ve Built
Unlike traditional approaches requiring extensive rewrites, our solution operates entirely behind the scenes. By patching GnuTLS at the library level with wolfCrypt’s certified cryptographic operations, applications gain FIPS 140-3 compliance without changing a single line of their code. Simply rebuild with our patched GnuTLS library, and your entire application stack achieves FIPS compliance.
We’re continuously validating this integration through CI/CD testing against 17 applications, testing target versions, latest releases, and master branches to ensure rock-solid compatibility. Our fork is now debianized, making deployment as simple as installing a standard Debian package.
Desktop & Media Applications Now FIPS-Ready
glib-networking – The GNOME network stack that provides TLS support for countless GTK-based applications across Linux desktops.
libvnc – Enables VNC client and server functionality for remote desktop access and support tools.
libvte – The terminal emulator widget library used by GNOME Terminal and other popular Linux terminal applications.
libcups – The Common Unix Printing System library that handles secure printing operations across networks.
libcamera – Modern camera support library for Linux systems, handling secure camera data streams.
QPDF – PDF manipulation library for viewing, editing, and transforming PDF documents securely.
libjcat – Archive verification library used by fwupd and other tools for validating signed package integrity.
RTMP – Real-Time Messaging Protocol implementation for secure streaming media applications.
How We Enable FIPS Compliance
These applications rely on GnuTLS for TLS connections, certificate handling, secure communications, and cryptographic operations. By integrating wolfSSL’s FIPS 140-3 certified wolfCrypt module into GnuTLS, we deliver a true drop-in solution. Depending on the algorithms your application uses, you may need no code changes at all, just rebuild with our patched library and achieve FIPS compliance across your desktop and media applications.
The debianized package makes deployment straightforward: install our GnuTLS-wolfSSL package on your Debian-based system, and your applications automatically benefit from FIPS-certified cryptography.
Questions?
Take a more in-depth look at our integration on the wolfSSL GitHub, if you need support we are more than happy to help you out, you can email us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now
New Keystores and Secure Elements Added to wolfSSL (5.8.2)
wolfSSL continues to expand its hardware security ecosystem with significant new additions over the past year. Here are the latest keystores and secure elements now supported by our cryptographic library:
New Secure Element Support
TROPIC01 Secure Element
wolfSSL now includes dedicated crypto callback functions for the TROPIC01 secure element, providing seamless hardware-backed cryptographic operations for enhanced security applications.
Enhanced STM32 Hardware Security
STM32MP135F Platform
Complete hardware acceleration suite featuring:
- STM32CubeIDE integration
- Hardware Abstraction Layer (HAL) support for SHA-2 and SHA-3
- AES hardware acceleration
- Hardware RNG integration
- ECC cryptographic operations
Additional STM32 Variants
- STM32H5 – Advanced performance microcontroller with enhanced security features
- STM32WBA – Wireless connectivity focused platform for IoT security
- STM32G4 – General purpose microcontroller series with crypto acceleration
- STM32U575xx – Ultra-low-power microcontroller boards for battery-powered secure devices
- STM32 Cube Expansion Pack – Enhanced development environment support
Expanded Renesas Security Solutions
Renesas TSIP v1.15
Enhanced support for RX65N and RX72N platforms including:
- RSA Public Encrypt and Private Decrypt operations
- AES-CTR mode hardware acceleration
- Improved cryptographic performance
Renesas SCE Integration
New crypto-only RSA support providing dedicated hardware acceleration without requiring full TLS integration.
Development Board and Platform Support
Raspberry Pi Enhanced Support
- RP2350 – Latest generation with enhanced RNG optimizations
- RP2040 – Improved support with performance-optimized random number generation
RISC-V Platform
- SiFive HiFive Unleashed Board – Complete RISC-V development board support for hardware-accelerated cryptography
Operating System and Bootloader Integration
Zephyr Project RTOS
Full integration with the Zephyr real-time operating system, including:
- TPM usage examples
- Hardware security integration
- Real-time cryptographic operations
U-Boot Bootloader
Secure boot integration supporting:
- TPM-based measured boot
- Hardware security module validation
- Boot integrity verification
Microchip Harmony (MPLABX)
Complete development ecosystem support including:
- SPI HAL integration
- Benchmarking tools
- Development environment optimization
Advanced Infineon Security Features
Infineon TriCore (TC2XX/TC3XX)
Hardware security module support with comprehensive TPM integration using the WOLFTPM_INFINEON_TRICORE macro.
Infineon SLB9672/SLB9673
Advanced TPM modules featuring:
- Secure firmware update capabilities
- Enhanced I2C communication
- Industrial-grade security certification
Infineon Development Tools
- Modus Toolbox – Integrated development environment
- CyHal I2C/SPI – Hardware abstraction layer support
Additional TPM Hardware
Nations NS350
New TPM 2.0 module support expanding our certified hardware ecosystem for secure applications.
Memory Mapped I/O (MMIO) TPMs
Direct memory access support for TPM modules, enabling:
- Faster cryptographic operations
- Reduced system overhead
- Simplified hardware integration
Development Environment Enhancements
Espressif IDE Support
Complete integration with Espressif’s development environment for ESP32 and related platforms.
Windows Visual Studio
New project templates and GitHub Actions testing for Windows development environments.
Advanced Security Features
Pre-provisioned Device Identity Keys
Support for manufacturer-provisioned security credentials, enabling:
- Zero-touch device provisioning
- Factory-sealed security credentials
- Simplified device authentication
Secure Firmware Update
Advanced firmware update capabilities for supported TPM modules with cryptographic verification and rollback protection.
Getting Started
These new hardware security features are available in wolfSSL version 5.7.0 and later, with wolfTPM version 3.0.0 and later. To enable support for your specific platform, consult our documentation or contact our technical support team.
The expanded hardware support demonstrates wolfSSL’s commitment to providing comprehensive security solutions across embedded systems, IoT devices, and enterprise applications.
Questions?
If you have questions about any of the above, please contact us at facts@wolfssl.com, call us at +1 425 245 8247, or visit our FAQ page for more information.
Download wolfSSL Now