RECENT BLOG NEWS

So, what’s new at wolfSSL? Take a look below to check out the most recent news, or sign up to receive weekly email notifications containing the latest news from wolfSSL. wolfSSL also has a support-specific blog page dedicated to answering some of the more commonly received support questions.

wolfSSL 5.6.6 Now Available!

Merry Christmas! The Christmas release of wolfSSL is here, version 5.6.6!

Version 5.6.6 brings with it fixes for 4 vulnerabilities, bug fixes, new features, and some enhancements as well! For a description of vulnerabilities fixed, please see our vulnerability page. New features in this release include support for additional hardware devices (STM32WL55), new hardware encryption support for ESP32 devices (ESP32-C3, ESP32-C6, ESP32-S2), improved DTLS 1.3 session resumption support, new implementation of SRTP-KDF and SRTCP-KDF, a cache-attack safe bitslice implementation of AES, and support for memcached.

We also have a nice round of enhancements which range from better testing, disabling TLS 1.1 by default, expanded CMake build support, optimizations and new assembly for our speedy SP math library, and more!

A list of new features and enhancements from our ChangeLog is listed below. For a full list of fixes see our complete ChangeLog on GitHub.

New Feature Additions

  • Build option for disabling CRL date checks (WOLFSSL_NO_CRL_DATE_CHECK) (PR 6927)
  • Support for STM32WL55 and improvements to PKA ECC support (PR 6937)
  • Add option to skip cookie exchange on DTLS 1.3 session resumption (PR 6929)
  • Add implementation of SRTP KDF and SRTCP KDF (–enable-srtp-kdf) (PR 6888)
  • Add wolfSSL_EXTENDED_KEY_USAGE_free() (PR 6916)
  • Add AES bitsliced implementation that is cache attack safe (–enable-aes-bitsliced) (PR 6854)
  • Add memcached support and automated testing (PR 6430, 7022)
  • Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2 (PR 6990)
  • Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010)

Enhancements and Optimizations

  • Better built in testing of “–sys-ca-certs” configure option (PR 6910)
  • Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877)
  • Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled) (PR 6946)
  • Add “–enable-quic” to “–enable-all” configure option (PR 6957)
  • Add support to SP C implementation for RSA exponent up to 64-bits (PR 6959)
  • Add result of “HAVE___UINT128_T” to options.h for CMake builds (PR 6965)
  • Add optimized assembly for AES-GCM on ARM64 using hardware crypto instructions (PR 6967)
  • Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952)
  • Add wolfCrypt test and unit test to ctest (PR 6977)
  • Move OpenSSL compatibility crypto APIs into ssl_crypto.c file (PR 6935)
  • Validate time generated from XGMTIME() (PR 6958)
  • Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868)
  • Add GitHub Actions testing with nginx 1.24.0 (PR 6982)
  • Allow encoding of CA:FALSE BasicConstraint during cert generation (PR 6953)
  • Add CMake option to enable DTLS-SRTP (PR 6991)
  • Add CMake options for enabling QUIC and cURL (PR 7049)
  • Improve RSA blinding to make code more constant time (PR 6955)
  • Refactor AES-NI implementation macros to allow dynamic fallback to C (PR 6981)
  • Default to native Windows threading API on MinGW (PR 7015)
  • Return better error codes from OCSP response check (PR 7028)
  • Updated Espressif ESP32 TLS client and server examples (PR 6844)
  • Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips (PR 7035, 7037)
  • Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963)
  • Improve Arduino IDE 1.5 project file to match recursive style (PR 7007)
  • Simplify and improve apple-universal build script (PR 7025)

Visit our download page or wolfSSL GitHub repository to download the release bundle. If you have questions about any of the above, feel free to email us at facts@wolfSSL.com or support@wolfSSL.com, or call us at +1 425 245 8247 regarding the wolfSSL embedded SSL/TLS library or any other products.

Download wolfSSL Now

Live Webinar: Getting Started with wolfTPM

We are excited to invite you to the 4th episode of our Getting Started series: “Getting Started with wolfTPM”! This informative webinar, led by wolfSSL’s Senior Embedded Software Engineer, David Garske, is scheduled for March 21st at 10 am PT.

Mark your calendar: March 21st | 10am PT

David will delve into how you can start to leverage wolfTPM to elevate the security of your systems. He will guide you through steps for getting started on your platform with wolfTPM.

During the webinar, you will:

  • Gain basic knowledge of TPM 2.0
  • Explore build options for wolfTPM
  • Learn how to use wolfTPM API
  • Engage in a comprehensive API comparison of wolfTPM
  • Delve into real-life wolfTPM use case examples
    And much more!

Don’t miss this opportunity to gain a deeper understanding of TPM technology and discover how wolfTPM can shield your systems against emerging threats. Register now while seats are available.

As always, our webinars will include Q&A sessions throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL gRPC Support

wolfSSL is adding support for the gRPC (https://grpc.io/) project. gRPC is an open source high performance Remote Procedure Call (RPC) framework that can run in any environment. RPC is commonly used to execute procedures or subroutines in other computers on a network. This networking requires security and this is where wolfSSL comes in.

wolfSSL is a lightweight TLS library with a focus on embedded systems. wolfSSL implements protocols up to the latest TLS 1.3 and DTLS 1.3 standards and can run on any architecture or operating system. gRPC uses TLS to provide authentication and confidentiality when executing calls on remote computers.

Work on wolfSSL support in gRPC is currently in progress. If you are interested in using gRPC with wolfSSL or have any questions, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Securing Satellite Communications: Insights from Eric Blankenhorn and wolfSSL at Satellite 2024

wolfSSL returns to Satellite 2024 this year, with Senior Software Engineer Eric Blankenhorn taking the spotlight as a featured speaker for the conference program, “Fortifying the Skies: Space Defenders on the Frontlines of Cybersecurity”. Scheduled for March 21st at 9:30 am ET in room 146C, this program is a pivotal opportunity to delve into the evolving landscape of the space domain and address the critical need for securing satellite networks.

As the space domain continues to evolve and expand, ensuring the security and resilience of satellite networks is crucial. This conference program offers a unique platform to engage with industry leaders, gain invaluable insights, and collectively work towards a more secure future in space.

Eric, alongside other industry experts, will explore various topics including emerging threats in satellites and space, the development of standards and best practice for satellite cybersecurity, the convergence of IT & OT security, and strategies for securing the space supply chain.

Conference Program Details:

Make sure to mark your calendar and seize this opportunity to learn about securing satellite networks from cyber attacks and enhancing their resilience against evolving threats.

The wolfSSL will be available at booth 1445 during Satellite 2024 to address any inquiries. Don’t forget to swing by. Let’s safeguard satellite communication together.

If you have questions about any of the above or would like to schedule a one-on-one meeting with wolfSSL at Satellite 2024, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

How to Build wolfSSL for Android

Here at wolfSSL we provide best in class support by using our past experience to know what you will ask and then having examples, documentation and instructions already prepared before you even open a support ticket with us.

A great example of this is the recent uptick in questions about building our wolfSSL library for Android. If you’re building an Android app and have FIPS 140 needs then you’ve come to the right place!

Want to see an Android NDK Gradle example?

https://github.com/wolfSSL/wolfssl-examples/blob/master/android/README.md#wolfssl-android-studio-ndk-gradle-examples

How about just a standalone toolchain example?

https://github.com/wolfSSL/wolfssl-examples/blob/master/android/README.md#wolfssl-ndk-standalone-toolchain-example

There is also the ability to replace BoringSSL. Have a look at

https://github.com/wolfSSL/wolfssl/tree/master/IDE/Android

Another thing you might be thinking of is wolfSSL JNI and JSSE! You’ll want to have a look at

https://github.com/wolfSSL/wolfssljni?tab=readme-ov-file#building-for-android

Perhaps you’re using OpenSSL on Android and you have FIPS 140 requirements. Have a look at https://github.com/wolfSSL/wolfProvider/tree/master/IDE/Android

When it comes to Android, we’ve got you covered. And if you need further details or clarifications, we are always happy to help you. Please reach out to facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Partner Webinar: wolfSSL and Cesium RTOS Integration

Get Excited! wolfSSL is partnering with Weston Embedded Solutions to host an exclusive webinar, wolfSSL and Cesium RTOS Integration, on March 14th at 10 am PT. We will explore the intricate world of secure communication in an RTOS environment. Led by wolfSSL’s Senior Software Developer, Anthony Hu, and Weston Embedded’s President and co-founder, Janos Magasrevy, along with Senior Software Engineer and co-founder at Weston Embedded, Yanko Sosa.

Weston Embedded Solutions is a leading provider of embedded software and engineering services, specializing in the Micrium µC/OS and Cesium RTOS family of products. This webinar presents a unique opportunity to delve into the fundamentals of Transport Layer Security (TLS) and its pivotal role in securing data transmission. Discover the capabilities of Cs/NET and its seamless integration with wolfSSL’s cutting-edge security solutions.

Save the date: March 14th | 10 am PT

You are expecting to learn:

  • Learn fundamental of wolfSSL TLS
  • Dive into Weston Embedded’s Cs/NET integration with wolfSSL
  • Live Demonstration of Cs/NET’s HTTP Client in Action Using TLS v1.3
    And much more!

Learn from industry experts as they share valuable insights and best practices in secure communication protocols. Seats are limited, so Register Now while they are available.

As always, our webinars will include Q&A sessions throughout. If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL’s Kyber ML-KEM Implementation Now Included Free of Charge for Commercial Customers; Future Proofing is here today

We are now including commercial Kyber/ML-KEM in our wolfSSL/wolfCrypt commercial packages. At this point, you need to ask our support organization for a delivery if you want to start testing it. If you are willing to wait, then you will find it included in the next commercial bundle that we release. In summary, there will be no additional charge if you are a supported customer of wolfSSL/wolfCrypt.

Please note all of the advantages of our Kyber implementation from the previous blog posting here.

This begs the question, what about customers who have let their support plan lapse? Our answer is “What are you waiting for?!?”. Get started by reviewing our support packages. The next step is to get in contact with your wolfSSL business director and get signed up. You can do that by sending a message to facts@wolfssl.com.

To get an idea of the kind of performance you will get, see our benchmarks here:

Start your future proofing today and get started with post-quantum algorithms! Want wolfSSL’s implementation of Dilithium? Interested in LMS and XMSS? Let’s talk! CNSA 2.0 requirements? We can help. Contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now

Support for wolfBoot on Renesas RZ/N2L

We are excited to announce wolfBoot support for the Renesas RZ/N2L evaluation board. The Renesas RZ/N2L uses the high-performance Arm Cortex-R52 core to easily add network functionality onto industrial equipment and machines. The RZ/N2L is supported by an open and flexible ecosystem concept – the Flexible Software Package (FSP), built on FreeRTOS – and is expandable to use other RTOS and middleware.

wolfBoot is a portable secure bootloader solution that offers firmware authentication and firmware update mechanisms. Due to its minimalistic design and tiny HAL API, wolfBoot is completely independent from any OS or bare-metal application.

By adding wolfBoot support for the evaluation board, it demonstrates simple secure firmware boot from external flash memory by wolfBoot. The example uses SPI boot with external flash memory on the evaluation board. On this boot mode, wolfBoot is copied to the internal RAM(B-TCM). wolfBoot copies the application program from external flash memory to RAM(System RAM). As a final step of wolfBoot the entry point of the copied application program is called if the integrity and authenticity of the image are valid. More detailed steps can be found here.

If interested in wolfBoot support on the RZ/N2L, or if you have questions about any of the above, please contact facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

wolfSSL Supports Nucleus RTOS

The Nucleus RTOS uses wolfSSL to provide TLS security. The wolfSSL embedded SSL library is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments – primarily because of its small size, speed, and feature set. wolfSSL supports industry standards up to the current TLS 1.3 and DTLS 1.3 protocol levels, is up to 20 times smaller than OpenSSL, and offers progressive ciphers such as ChaCha20, Curve25519, NTRU, and SHA-3.

Additionally, Nucleus employs wolfSSH to provide a client and server SSH library. The wolfSSH library is a lightweight SSHv2 client and server library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments – primarily because of its small size, speed, and feature set.

Adding FIPS certified cryptography to your Nucleus project is easily accomplished using wolfCrypt FIPS. A version of the wolfCrypt cryptography library has been FIPS 140-2 validated (Certificate #3389), with FIPS 140-3 validation currently in progress!

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Post-Quantum Kyber Benchmarks (ARM Cortex-M4)

Hot on the heels of our MacOS benchmarks, we now have our Kyber Benchmarks for Arm Cortex-M4.

Before getting into the numbers, some information on the conditions under which the benchmarks were taken:

  • The hardware platform was STM NUCLEO-F446ZE
  • The HCLK in the project was set to 168MHz
  • Only 1 core used
  • wolfSSL Math Configuration set to “Single Precision ASM Cortex-M3+ Math”
  • Optimization flag: -Ofast
  • Conventional algorithms are present for comparison purposes

Here are our results:

RSA    	    2048 	public    82 ops took 1.020 sec, avg 12.439 ms, 80.392 ops/sec
RSA    	    2048 	private   4 ops took 1.827 sec, avg 456.750 ms, 2.189 ops/sec
DH     	    2048 	key gen   5 ops took 1.181 sec, avg 236.200 ms, 4.234 ops/sec
DH     	    2048 	agree     6 ops took 1.419 sec, avg 236.500 ms, 4.228 ops/sec
ECC   SECP256R1 	key gen   118 ops took 1.012 sec, avg 8.576 ms, 116.601 ops/sec
ECDHE SECP256R1 	agree     56 ops took 1.016 sec, avg 18.143 ms, 55.118 ops/sec
KYBER512    128 	key gen   232 ops took 1.004 sec, avg 4.328 ms, 231.076 ops/sec
KYBER512    128 	encap     192 ops took 1.008 sec, avg 5.250 ms, 190.476 ops/sec
KYBER512    128 	decap     178 ops took 1.004 sec, avg 5.640 ms, 177.291 ops/sec
KYBER768    192 	key gen   146 ops took 1.008 sec, avg 6.904 ms, 144.841 ops/sec
KYBER768    192 	encap     118 ops took 1.008 sec, avg 8.542 ms, 117.063 ops/sec
KYBER768    192 	decap     110 ops took 1.000 sec, avg 9.091 ms, 110.000 ops/sec
KYBER1024   256 	key gen   92 ops took 1.011 sec, avg 10.989 ms, 90.999 ops/sec
KYBER1024   256 	encap     76 ops took 1.000 sec, avg 13.158 ms, 76.000 ops/sec
KYBER1024   256 	decap     72 ops took 1.000 sec, avg 13.889 ms, 72.000 ops/sec

Our implementation of Kyber’s performance is looking great compared to all the other algorithms. It might appear that ECDHE comes close, but not when you consider the mechanics of a key exchange.

Note that ECDHE is a NIKE (Non-Interactive Key Exchange) while Kyber is a KEM (Key Encapsulation Mechanism) so in the context of TLS 1.3, the numbers as they stand are misleading.

For NIKEs, both the server and the client must do the key generation operation. Then both the server and the client must also do the key agreement step. On the other hand, for KEMs, the client does key generation once, the server does encapsulation once, and the client does decapsulation once. Since NIKEs have double the number of operations to achieve a shared secret, for a fair comparison, we need to double the average time for ECDHE. In this light, the total time for a key exchange looks like this:

Algorithm Total Time for Key Exchange
ECDH SECP256R1 26.719 ms
Kyber512 (NIST Level 1) 15.218 ms
Kyber768 (NIST Level 3) 24.537 ms
Kyber1024 (NIST Level 5) 38.036 ms

Note that Kyber512, from a security perspective, is comparable to ECDH at SECP256R1.

The numbers speak for themselves: Kyber wins. That said, you can look forward to future optimizations and even better performance gains.

As we’ve noted in the past, Kyber has considerably larger artifacts than ECDHE, depending on your method of transmission, this margin can easily be lost if your transmission speeds are slow.

Want to see further optimizations to our Kyber implementation? Interested in wolfSSL’s other post-quantum algorithm implementations? Let us know so we can prioritize the things you are looking for.

If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.

Download wolfSSL Now

Post-Quantum Kyber Benchmarks (MacOS)

You may be aware that wolfSSL has our own implementation of NIST’s ML-KEM, also known as Kyber. ML-KEM is the post-quantum KEM that is slated for standardization by NIST. While the standard is not complete yet, and we have not yet released our implementation into open source, we do have some benchmarking results to share.

Additionally, we should note some things about our implementation that make it unique and useful:

  1. It will be fully integrated with our other products, including wolfSSL, wolfBoot, curl, etc.
  2. It is a consumer of our highly optimized SP Math library, with more ML-KEM optimizations to come!
  3. Because our products are well integrated with many other open source packages, those packages can inherit Kyber/ML-KEM support.
  4. It supports bare metal, as well as all of the other operating systems we support, including FreeRTOS, VxWorks, Integrity, Zephyr, Itron, LynxOS, etc.
  5. It also supports all of the silicon targets we support, including ARM, RISCV, DSPs, FPGAs, intel, etc.

The benchmarks results follow:

Math: 	Multi-Precision: Wolf(SP) no-dyn-stack word-size=64 bits=4096 sp_int.c
	Single Precision: ecc 256 384 521 rsa/dh 2048 3072 4096 asm sp_arm64.c


wolfCrypt Benchmark (block bytes 1048576, min 1.0 sec each)

DH      2048  key gen      3997 ops took 1.000 sec, avg 0.250 ms, 3996.812 ops/sec
DH      2048    agree      4100 ops took 1.001 sec, avg 0.244 ms, 4097.522 ops/sec
KYBER512    128  key gen     96100 ops took 1.001 sec, avg 0.010 ms, 96037.765 ops/sec
KYBER512    128    encap     78000 ops took 1.000 sec, avg 0.013 ms, 77970.220 ops/sec
KYBER512    128    decap     58900 ops took 1.001 sec, avg 0.017 ms, 58867.158 ops/sec
KYBER768    192  key gen     58200 ops took 1.000 sec, avg 0.017 ms, 58192.314 ops/sec
KYBER768    192    encap     48700 ops took 1.001 sec, avg 0.021 ms, 48664.334 ops/sec
KYBER768    192    decap     38100 ops took 1.001 sec, avg 0.026 ms, 38059.656 ops/sec
KYBER1024   256  key gen     37800 ops took 1.003 sec, avg 0.027 ms, 37704.299 ops/sec
KYBER1024   256    encap     32600 ops took 1.001 sec, avg 0.031 ms, 32566.427 ops/sec
KYBER1024   256    decap     26000 ops took 1.001 sec, avg 0.039 ms, 25967.020 ops/sec
ECC   [      SECP256R1]   256  key gen     84100 ops took 1.001 sec, avg 0.012 ms, 84013.469 ops/sec
ECDHE [      SECP256R1]   256    agree     24400 ops took 1.004 sec, avg 0.041 ms, 24300.995 ops/sec

The benchmarks were run on an Apple MacBook Pro 18,3 with an Apple M1 Pro, 3.09 GHz processor. Only 1 core was used. If you want to get the benchmark harness code, then ping us at facts@wolfSSL.com.

This data shows that for Kyber/ML-KEM, algorithm execution performance is rock solid. If you compare Kyber/ML-KEM’s numbers against DH and ECDHE, Kyber holds its own. To understand how to analyze and compare these number, see https://www.wolfssl.com/benchmarks-kyber-level-1-pqm4-integration-stm32-arm-cortex-m4/.

Interested in learning more about our post-quantum efforts? Want to understand how Kyber fits into different protocols and how it might affect your use case? Contact us at wolfSSL by emailing facts@wolfSSL.com or calling us at +1 425 245 8247 to reach out to your regional wolfSSL business director

Download wolfSSL Now

Posts navigation

1 2 3 4 184 185 186

Weekly updates

Archives