RECENT BLOG NEWS
FIPS 140-3 Announcement to the world
wolfSSL Inc. is very pleased to announce our wolf pack has successfully hunted down and captured the ever elusive FIPS 140-3 certificate! The world’s first automated submission (SP800-140Br1) FIPS 140-3 validated certificate #4718 posted to the NIST website on July 11th 2024, valid through July 10th, 2029!
“wolfSSL remains focused on enhancing our technologies and expanding capabilities. We are dedicated to continuous innovation in security. The advancements in our FIPS 140-3 module highlight our commitment to delivering state-of-the-art cryptographic solutions that meet the rigorous demands of today’s cybersecurity landscape.” Stated wolfSSL CTO, Todd Ouska.
We are thrilled to work with ÆGISOLVE, INC. on this journey. The wolfSSL team is grateful for the ÆGISOLVE staff’s hard-work and dedication in realizing the very first SP800-140Br1 140-3 certificate in the world! A note from the ÆGISOLVE team:
“‘AEGISOLVE is pleased to announce the world’s first SP800-140Br1 compliant FIPS 140-3 Validation Certificate for wolfSSL’s wolfCrypt module’ reported Travis Spann, Founder and President of AEGISOLVE (NVLAP Lab Code: 200802-0).
‘As a first of its kind, this is a tremendous achievement and a huge step forward for the next generation of FIPS 140-3 Validated Cryptographic Modules. Congratulations, wolfSSL!
Highlights
- Boot Times
- wolfCrypt FIPS 140-2, power-on times could be slower due to mandatory self-tests
- wolfCrypt FIPS 140-3 requires self-tests only at the first algorithm use or during a slower event cycle
- faster boot times
- optimal power and resource consumption with careful planning!
- Design
- The wolfCrypt FIPS 140-3 validated module is the only commercial FIPS solution tailored for embedded
- Emphasis on a minimal footprint, low resource use, reduced power consumption, and high performance for standard and real time systems
- Design leads to superior scalability across devices, from mobile to server
- 10 times more connections per device at 15-20% better performance than competing solutions.
- The wolfCrypt FIPS 140-3 validated module is the only commercial FIPS solution tailored for embedded
- OpenSSL Replacement
- Embeddability
- Embedded Systems (Medical, networking, sensors, security systems, etc.)
- Extended Battery life and high performance
- Hardware Encryption Support
- Assembly Acceleration
Changes from the historic wolfCrypt FIPS 140-2 cert #3389 to the active wolfCrypt FIPS 140-3 cert #4718:
- CAST (conditional algo self tests)
- KDF-TLS, TLS v1.2 KDF and TLSv1.3 KDF
- SSH KDF
- AES-OFB mode
- RSA 3072, 4096 and PSS
- New Degraded mode of operation in the event of a CAST failure other algorithm services will remain available.
For more about what FIPS is please checkout these blogs:
- What is FIPS (long version)
- What is FIPS (short version)
- Webinar: Everything You Need To Know About FIPS 140-3
For information on transitioning from 140-2 to 140-3 please checkout our blog: What is the difference between FIPS 140-2 and FIPS 140-3?
Algo cert Link
Security Policy Link
Ref: Section 2.5 Algorithms
Ref: Section 2.2 Table 6 “Tested Operational Environments – Software, Firmware, Hybrid”
Cert #4718 Link
For questions, comments or feedback please contact the wolfSSL team anytime at fips@wolfssl.com.
Download wolfSSL Now
SM Ciphers on an HSM??
In recent years, China’s cryptographic standards have gained significant traction on the global stage, with algorithms like SM2, SM3, and SM4 setting the standard for secure communications within Chinese regulatory frameworks. Companies operating in or doing business with China must support these ciphers to meet compliance requirements and to ensure secure interoperability. However, until now, no commercially available HSM solutions offered support for the full suite of SM ciphers, meaning industries that rely on HSM offload for security—such as automotive, industrial, or aerospace—face significant integration challenges.
Enter wolfHSM, our generic Hardware Security Module (HSM) firmware framework, targeting automotive HSM platforms and beyond. wolfHSM provides a unified API for secure cryptography, object storage, and key management on devices with HSM coprocessors. wolfHSM enables applications to easily leverage a platform’s hardware-based root of trust and provides a streamlined abstraction for offloading all cryptography to the HSM coprocessor through the wolfCrypt API.
Built to support any algorithm provided by wolfCrypt, wolfHSM enables users to integrate a wide variety of cryptography, from established algorithms to the latest bleeding edge draft standards. This flexibility is a key differentiating factor of wolfHSM, setting it apart in a market where adaptability and cryptographic choice are becoming increasingly crucial. With existing HSM solutions, you are locked into a small set of supported algorithms with no opportunity to modify or update HSM capabilities. With wolfHSM, you can deploy any algorithm supported by wolfCrypt, and are able to seamlessly switch between algorithms as needed, ensuring that you’re always using the best tools for your security needs. Given this flexibility, new algorithms like the SM ciphers can be deployed on your HSM just as easily as standard algorithms like AES or SHA256.
Whether you’re specifically looking to integrate SM ciphers into your HSM-based application, or just need a solution that allows you keep your options open, wolfHSM has what you need. wolfHSM’s “out of the box” crypto-agility means that as new requirements arise, wolfHSM can quickly and easily adapt – securely and without overhauling your existing infrastructure.
wolfHSM supports standard automotive HSM platforms like the Infineon AURIX TC3xx, ST SPC58N, Renesas RH850, etc. but can be easily ported to run on any device.
Are SM ciphers on an HSM something you are interested in? Do you want to use SM ciphers on AURIX TC3xx HSM? Let us know! Reach out to us at facts@wolfSSL.com and we can discuss.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
PKCS7 parsing in wolfCLU
Parsing and viewing PKCS7 bundles just got easier with the addition of the `pkcs7` command in wolfCLU. This neat command takes multiple arguments allowing for printing out the certificates contained in a PKCS7 bundle and parsing both PEM and DER formats. Creation of PKCS7 bundles is supported using wolfSSL API’s but not yet supported in wolfCLU. Let us know at facts@wolfssl.com if this is a capability desired in wolfCLU.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
Enhancing Realm Database Security with wolfSSL
Are you looking to add FIPS 140-3 certified cryptography to your Realm database? wolfSSL has you covered!
We’ve successfully integrated wolfSSL into Realm, providing you with robust TLS and cryptographic functionality. A version tested on Linux is available, and we can also help you enable support for platforms like Android and iOS upon request.
Getting Started with Realm and wolfSSL
To start using wolfSSL with Realm, follow these steps:
Configure wolfSSL:
./configure --enable-static --enable-opensslall --enable-enckeys --enable-certgen --enable-context-extra-user-data sudo make install
Optionally, specify the installation directory with --prefix=/path/to/install
.
Download and patch Realm Core:
git clone https://github.com/realm/realm-core.git cd realm-core git checkout a5e87a39 git submodule update --init --recursive
Applying the Patch to support wolfSSL:
git apply ../realm-v13.26.0.patch
You can obtain the patch from wolfSSL/osp/realm
directory
Build Realm Core with wolfSSL:
mkdir build cmake -B build -DREALM_ENABLE_ENCRYPTION=1 -DREALM_USE_WOLFSSL=1 -DREALM_WOLFSSL_ROOT_DIR=/usr/local/lib cmake --build build ./build/test/realm-tests
If you’d like to secure your Realm app with wolfSSL or need support for other platforms, reach out to us at facts@wolfSSL.com or call us at +1 425 245 8247.
Stay secure with wolfSSL and Realm!
Download wolfSSL Now
Want to Comply with CNSA 2.0? Move to DTLS 1.3!
For anyone using DTLS 1.2, now might be a good time to start moving to DTLS 1.3. Why is now a good time?
- It is likely that you own both the server and the client so you have full control over the migration process.
- New post-quantum authentication (ML-DSA) and key exchange (ML-KEM) algorithms will soon be coming to both TLS and DTLS but only to version 1.3 of the protocols.
- The NSA (National Security Agency) has given the guidance in CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) with timelines stating these algorithms should have already been an option and tested since the beginning of 2024 in cloud services.
- Moreover, the CNSA 2.0 guidance requires that these algorithms be the default and preferred algorithms by 2025 in cloud services.
Are you selling software that uses DTLS 1.2 to the American government agencies? If so, now is the time to move to DTLS 1.3.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
Live Webinar: What’s new in wolfBoot
Learn how wolfBoot 2.3.0 revolutionizes secure boot for embedded systems with groundbreaking features designed for quantum resistance and hybrid authentication. Join us for our upcoming webinar, What’s new in wolfBoot, on November 21st at 10 AM PT, presented by wolfSSL Software Engineer Daniele Lacamera. Gain insights into the integration of ML-DSA signature algorithms, the impact of post-quantum cryptography, and performance optimizations that elevate boot security and efficiency.
Register Today: What’s new in wolfBoot
Date: November 21st | 10 AM PT
Explore advancements that are redefining secure boot, including hybrid authentication that combines post-quantum and classic cryptographic techniques to protect against quantum threats. Discover how these innovations ensure future-proof security and compliance with the highest standards, such as CNSA 2.0.
This webinar will cover:
- Introduction of ML-DSA and its role in FIPS-204 compliance
- Implementation of hybrid authentication combining ECC/RSA and PQC
- ARM assembly optimizations for faster boot times on Cortex-M devices
- Enhanced keystore and keyvault management capabilities
- Expanded and improved hardware support, from Infineon AURIX to Nordic nRF5340
And much more…
Secure your spot now to stay ahead in embedded system security and learn from industry experts. Register Now!
As always, our webinars include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
wolfCLU Release 0.1.6
wolfCLU release 0.1.6 is available! wolfSSL’s command line utility (wolfCLU) is a drop in replacement for the OpenSSL command line utility. It’s a handy swiss army knife of common operations used, often great for system admins or test developers. Doing things such as creating and signing certificates, generating new keys, parsing X509 certificates into human readable form, and much more. This release has seen some fixes to wolfCLU along with exciting new features. One of the new features being the addition of support for post quantum Dilithium signature generation and verification. For a full list of changes check out the ChangeLog.md.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
Join Our Live Webinar: Post-Quantum Algorithms in curl
Join us for an exclusive webinar on the cutting-edge integration of post-quantum algorithms in curl! As quantum computing advances, the need for quantum-safe cryptography is becoming critical. wolfSSL Senior Software Developer Anthony Hu will introduce essential concepts and demonstrate how to future-proof your applications against quantum threats using curl.
Register Now: Post-Quantum Algorithms in curl
Date: November 20th | 10 AM PT
Gain insights into post-quantum algorithms in curl with a hands-on demo and an in-depth exploration of key topics, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204). From understanding the motivation behind CNSA 2.0 to building quantum-safe connections, this session covers the technical and practical aspects of achieving quantum resistance.
This webinar will cover:
- Why CNSA 2.0 is essential for future security
- How to build and implement post-quantum algorithms in curl
- Explanation of quantum-safe connections and supported post-quantum algorithms
And much more…
Register today for exclusive access to this in-depth webinar on post-quantum algorithms in curl! Enhance your understanding and stay ahead in the evolving landscape of quantum-safe cybersecurity.
As always, our webinars include Q&A throughout. If you have questions about any of the above, please contact us at facts@wolfssl.com or +1 425 245 8247.
Download wolfSSL Now
wolfCrypt JNI/JCE 1.7.0 Now Available
wolfCrypt JNI/JCE 1.7.0 is now available for download! This release contains a number of bug fixes, changes and new features to help better support usage from applications and 3rd party frameworks that consume wolfJCE internally.
wolfCrypt JNI/JCE allows for easy use of the native wolfCrypt cryptography library from Java. The thin JNI wrapper can be used for direct JNI calls into native wolfCrypt, or the JCE provider (wolfJCE) can be registered as a Java Security provider for seamless integration underneath the Java Cryptography API. wolfCrypt JNI/JCE can also support running on top of wolfCrypt FIPS 140-2 and 140-3 validated modules.
Changes in this release are summarized below, but please see ChangeLog.md for a full list. Watch for individual future blogs on some of these topics as well for a more in depth description.
New JCE Functionality:
- Addition of a new WolfSSLKeyStore (WKS) KeyStore implementation to help conform to FIPS 140-2 / 140-3 compliant KeyStore use
JNI and JCE Changes:
- Build compatibility has been fixed with older Java versions that do not support BigInteger.longValueExact()
- Detection of native RSA minimum key size (RSA_MIN_SIZE), and exposure of this minimum to Java via Rsa.RSA_MIN_SIZE
- Fixes to pointer use when calling the native X509CheckPrivateKey() API
Example Changes:
- Addition of a new Android Studio example IDE project, located under the “IDE/Android” directory. This can be useful as an example to see how CMakeLists.txt should be structured to build native wolfSSL and wolfCrypt JNI/JCE.
Testing Changes:
- Facebook Infer is now run on all GitHub pull requests using GitHub Actions
- Android Gradle builds are now tested on all GitHub pull requests using GitHub Actions
wolfCrypt JNI/JCE 1.7.0 can be downloaded from the wolfSSL download page, and an updated version of the wolfCrypt JNI/JCE User Manual can be found here. For any questions, or to get help using wolfSSL products in your projects, contact us at support@wolfssl.com.
If you have any questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now
Announcing wolfHSM Integration with wolfBoot
We’re excited to announce that wolfBoot now supports integration with wolfHSM, bringing enhanced security features to our best-in-class secure bootloader solution on supported platforms. This enhancement positions wolfBoot as an even stronger tool for automotive and industrial applications with the highest security requirements.
What are wolfBoot and wolfHSM?
wolfBoot is our open-source, portable, OS-agnostic secure bootloader solution for 32-bit microcontrollers and beyond. It ensures that only authenticated firmware can run on your embedded device, providing a root of trust for your application..
wolfHSM is our generic Hardware Security Module (HSM) firmware framework, providing a unified API for secure cryptography, object storage, and key management on HSM coprocessors. wolfHSM enables applications to easily leverage a platform’s hardware-based root of trust and provides a streamlined abstraction for offloading all cryptography to the HSM coprocessor through the wolfCrypt API.
wolfHSM Integration with wolfBoot
By integrating wolfHSM with wolfBoot, we’ve enhanced the security capabilities of our already secure bootloader with the following features:
- Secure Key Storage: Cryptographic keys are now stored securely on the wolfHSM server, never accessible to wolfBoot or user applications.
- Remote Cryptographic Operations: All cryptographic operations are offloaded as remote procedure calls to the wolfHSM server. Hardware acceleration for cryptographic algorithms is included when supported by the platform.
- Flexible Key Management: Keys can be updated or rotated on the wolfHSM server without requiring a wolfBoot update.
Supported Platforms
Currently, wolfBoot supports using wolfHSM on the following platforms:
- wolfBoot simulator (using wolfHSM POSIX TCP transport)
- Infineon AURIX TC3xx (shared memory transport)
More platforms are in development. Don’t see your platform here? Reach out to us at facts@wolfSSL.com and we can discuss adding support!
Getting Started
To get started with wolfBoot + wolfHSM:
- Check out the wolfHSM integration documentation for an overview of the configuration options and HAL requirements.
- Consult your platform-specific wolfHSM documentation for instructions on configuring the wolfHSM server.
- To test wolfHSM + wolfBoot using the simulator, simply follow the instructions here to build wolfBoot with wolfHSM support and run it against our example wolfHSM server.
Give it a try and let us know what you think!
If you have any questions about wolfBoot or wolfHSM, please reach out via email at facts@wolfSSL.com or call us at +1 425 245 8247 and we will be happy to assist you!
Download wolfSSL Now
wolfSSL JNI/JSSE 1.14.0 Now Available
wolfSSL JNI/JSSE 1.14.0 is now available for download! This release contains a number of bug fixes, changes and new features to help better support usage from applications and 3rd party frameworks that consume wolfJSSE internally.
wolfSSL JNI/JSSE allows for easy use of the native wolfSSL SSL/TLS library from Java. The thin JNI wrapper can be used for direct JNI calls into native wolfSSL, or the JSSE provider (wolfJSSE) can be registered as a Java Security provider for seamless integration underneath the Java Security API. wolfSSL JNI/JSSE provides TLS 1.3 support and can also support running on top of wolfCrypt FIPS 140-2 and 140-3 validated modules.
Changes in this release are summarized below, but please see ChangeLog.md for a full list. Watch for individual future blogs on some of these topics as well for a more in depth description.
New JNI and JSSE Functionality:
- Addition of a new WKS KeyStore type to better facilitate FIPS compliance where needed
- Performance and scalability improvement with the use of native poll() set as default over select()
- Support for using RSA-PSS based certificates in TLS connections
- Addition of LDAPS endpoint identification verification to X509ExtendedTrustManager
- Two new JNI wrapped methods for native “wolfSSL_SessionIsSetup()” and “wolfSSL_SESSION_dup()”
JSSE System/Security Property Support:
- wolfjsse.debugFormat=JSON – a new System property to support outputting debug logs in JSON format, which can be more friendly for some log collection mechanisms
- wolfjsse.clientSessionCache.disabled – a new Security property to disable the Java client-side session cache, which will prevent session resumption from occurring
JSSE Changes:
- Native memory leak fixes, related to calls to wolfSSL_get_peer_certificate()
- Optimizations to allow for easier and more efficient garbage collection
- SSLEngine fixes for session storage, unwrap() FINISHED state transitions, HandshakeStatus when receiving TLS 1.3 session tickets after the handshake, correctly closing inbound on ALPN protocol name errors, and closure when fatal alerts are received
- SSLSocket fixes for end of stream handling in InputStream read() calls
- Fixes to throw expected or correct exceptions for several cases
- SSLSession getPeerCertificates() returns correct X509Certificate array
- Fixes around SSLSocket closure in a few different use cases
- Client-side session resumption is now keyed on the cipher suite and protocol in addition to host and port
- Build compatibility has been fixed with the older Android API 24, removing method calls not available in that SDK version
- A potential deadlock on close() between SSLSocket and the associated InputStream read() or OutputStream write() calls has been fixed
Exchange Changes:
- The Host String has been added into the HTTP GET request in the example ClientJSSE when used with the “-g” command line option
- JNI-only threaded client/server example applications have been added which can be helpful for seeing or debugging session resumption at the JNI-only level
- A basic RMI example client and server have been added, which can useful for reference and testing wolfJSSE over RMI
Testing Changes:
- Facebook Infer is now run on all GitHub pull requests using GitHub Actions
- TLS 1.0 and 1.1 JUnit tests are now run even if those protocols are disabled in the system “java.security” file, as long as native wolfSSL support has been compiled in
- Android Gradle builds are now tested on all GitHub pull requests using GitHub Actions
wolfSSL JNI/JSSE 1.14.0 can be downloaded from the wolfSSL download page, and an updated version of the wolfSSL JNI/JSSE User Manual can be found here. For any questions, or to get help using wolfSSL products in your projects, contact us at support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now
Weekly updates
Archives
- November 2024 (26)
- October 2024 (18)
- September 2024 (21)
- August 2024 (24)
- July 2024 (27)
- June 2024 (22)
- May 2024 (28)
- April 2024 (29)
- March 2024 (21)
- February 2024 (18)
- January 2024 (21)
- December 2023 (20)
- November 2023 (20)
- October 2023 (23)
- September 2023 (17)
- August 2023 (25)
- July 2023 (39)
- June 2023 (13)
- May 2023 (11)
- April 2023 (6)
- March 2023 (23)
- February 2023 (7)
- January 2023 (7)
- December 2022 (15)
- November 2022 (11)
- October 2022 (8)
- September 2022 (7)
- August 2022 (12)
- July 2022 (7)
- June 2022 (14)
- May 2022 (10)
- April 2022 (11)
- March 2022 (12)
- February 2022 (22)
- January 2022 (12)
- December 2021 (13)
- November 2021 (27)
- October 2021 (11)
- September 2021 (14)
- August 2021 (10)
- July 2021 (16)
- June 2021 (13)
- May 2021 (9)
- April 2021 (13)
- March 2021 (24)
- February 2021 (22)
- January 2021 (18)
- December 2020 (19)
- November 2020 (11)
- October 2020 (3)
- September 2020 (20)
- August 2020 (11)
- July 2020 (7)
- June 2020 (14)
- May 2020 (13)
- April 2020 (14)
- March 2020 (4)
- February 2020 (21)
- January 2020 (18)
- December 2019 (7)
- November 2019 (16)
- October 2019 (14)
- September 2019 (18)
- August 2019 (16)
- July 2019 (8)
- June 2019 (9)
- May 2019 (28)
- April 2019 (27)
- March 2019 (15)
- February 2019 (10)
- January 2019 (16)
- December 2018 (24)
- November 2018 (9)
- October 2018 (15)
- September 2018 (15)
- August 2018 (5)
- July 2018 (15)
- June 2018 (29)
- May 2018 (12)
- April 2018 (6)
- March 2018 (18)
- February 2018 (6)
- January 2018 (11)
- December 2017 (5)
- November 2017 (12)
- October 2017 (5)
- September 2017 (7)
- August 2017 (6)
- July 2017 (11)
- June 2017 (7)
- May 2017 (9)
- April 2017 (5)
- March 2017 (6)
- January 2017 (8)
- December 2016 (2)
- November 2016 (1)
- October 2016 (15)
- September 2016 (6)
- August 2016 (5)
- July 2016 (4)
- June 2016 (9)
- May 2016 (4)
- April 2016 (4)
- March 2016 (4)
- February 2016 (9)
- January 2016 (6)
- December 2015 (4)
- November 2015 (6)
- October 2015 (5)
- September 2015 (5)
- August 2015 (8)
- July 2015 (7)
- June 2015 (9)
- May 2015 (1)
- April 2015 (4)
- March 2015 (12)
- January 2015 (4)
- December 2014 (6)
- November 2014 (3)
- October 2014 (1)
- September 2014 (11)
- August 2014 (5)
- July 2014 (9)
- June 2014 (10)
- May 2014 (5)
- April 2014 (9)
- February 2014 (3)
- January 2014 (5)
- December 2013 (7)
- November 2013 (4)
- October 2013 (7)
- September 2013 (3)
- August 2013 (9)
- July 2013 (7)
- June 2013 (4)
- May 2013 (7)
- April 2013 (4)
- March 2013 (2)
- February 2013 (3)
- January 2013 (8)
- December 2012 (12)
- November 2012 (5)
- October 2012 (7)
- September 2012 (3)
- August 2012 (6)
- July 2012 (4)
- June 2012 (3)
- May 2012 (4)
- April 2012 (6)
- March 2012 (2)
- February 2012 (5)
- January 2012 (7)
- December 2011 (5)
- November 2011 (7)
- October 2011 (5)
- September 2011 (6)
- August 2011 (5)
- July 2011 (2)
- June 2011 (7)
- May 2011 (11)
- April 2011 (4)
- March 2011 (12)
- February 2011 (7)
- January 2011 (11)
- December 2010 (17)
- November 2010 (12)
- October 2010 (11)
- September 2010 (9)
- August 2010 (20)
- July 2010 (12)
- June 2010 (7)
- May 2010 (1)
- January 2010 (2)
- November 2009 (2)
- October 2009 (1)
- September 2009 (1)
- May 2009 (1)
- February 2009 (1)
- January 2009 (1)
- December 2008 (1)