Version 2.3.0 of the wolfSSL embedded SSL/TLS library has been released and is now available for download. This release contains bug fixes and new features. Changes include the following (with details and comments for each listed below):
– AES-GCM crypto and cipher suites
– “make test” cipher suite checks
– Subject AltName processing
– Command line support for client/server examples
– Sniffer SessionTicket support
– SHA-384 cipher suites
– Verify cipher suite validity when user overrides
– CRL directory monitoring
– DTLS Cookie support, reliability coming soon
AES-GCM
The addition of AES-GCM (Galois/Counter Mode) cryptography and cipher suites brings the wolfSSL embedded SSL library one step away from being NSA Suite B compliant. The one missing element is ECC – which wolfSSL will be getting in September 2012.
wolfSSL 2.3.0 offers four different implementations of AES-GCM balancing speed versus memory consumption. If available, wolfSSL will use 64-bit or 32-bit math. For embedded applications, there is a speedy 8-bit version that uses RAM-based lookup tables (8KB per session) which is speed comparable to the 64-bit version and a slower 8-bit version that doesn`t take up any additional RAM. To enable AES with GCM in wolfSSL, configure the build with the option “–enable-aesgcm”. The configure option may be modified with the options “=word32”, “=table”, or “=small”, i.e. “–enable-aesgcm=table”.
“make test” Cipher Suite Checks
With the last few releases of wolfSSL, we’ve been working on enhancing wolfSSL’s default test cases which are executed when “make test” is issued from the wolfSSL root directory. With this release, we have added test cases for wolfSSL’s ciphers suites. The cipher suite checks iterate through wolfSSL’s SSL 3.0, TLS 1.0, 1.1, and 1.2 cipher suites (as defined in the /tests/test.conf file), verifying that each suite works correctly. When running “make test” you will now see output similar to the following for each cipher suite tested:
# server SSLv3 RC4-SHA
# client SSLv3 RC4-SHA
trying server command line[1]: SuiteTest -v 0 -l RC4-SHA
trying client command line[1]: SuiteTest -v 0 -l RC4-SHA
Client message: hello cyassl!
Server response: I hear you fa shizzle!
Subject AltName Processing
An X.509 certificate may contain a Subject Alternative Name, or “subjectAltName” extension which allows identities to be bound to the subject of the certificate. These names might be included in addition to the existing name in the Subject field of an X.509 certificate, or they may included in place of the standard Subject field of the certificate. Subject Alternative Names may take a variety of formats including an email address, DNS name, IP address, or a URI. This extension is defined in Section 4.2.1.6 of RFC 5280 (http://tools.ietf.org/html/rfc5280).
With this release, wolfSSL now processes Subject Alternative Names in certificates. wolfSSL has a new API function, wolfSSL_X509_get_next_altname() which allows retrieval of the subjectAltNames that have been processed.
Command Line Support for client/server Examples
The wolfSSL example client and server can now be run from the command line with a number of different options. These options allow users to select the Host, Port, SSL version, cipher list, certificate file, key file, CA file, toggle DTLS and pre shared keys, and more. To see the available options, run either ./examples/client/client or ./examples/server/server with the “-?” option:
./examples/client/client -?
The available options will be listed, similar to:
client 2.3.0 NOTE: All files relative to wolfSSL home dir
-? Help, print this usage
-h
-p
-v
-l
-c
-k
-A
-b
-s Use pre Shared keys
-d Disable peer checks
-g Send server HTTP GET
-u Use UDP DTLS
-m Match domain name in cert
Sniffer SessionTicket Support
wolfSSL’s Sniffer (or Inspection) functionality has been made more robust by the addition of support for TLS Session Tickets. The SessionTicket TLS extension is defined in RFC 5077 (http://tools.ietf.org/html/rfc5077). This extension enables a TLS server to resume sessions without storing per-client session information on the server side. The server encapsulates the current session state for a specific client into a ticket and forwards it to the client. That client is then able to resume a session if needed by using the previously-obtained ticket from the server.
SHA-384 Cipher Suites
With the addition of GCM support to wolfSSL, we have also added a number of SHA-384 cipher suites. New SHA-384 suites include:
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
Verify Cipher Suite Validity when User Overrides
wolfSSL 2.3.0 now checks to make sure that certificates and keys loaded into wolfSSL are valid for specified cipher suites chosen by the user. This added check enhances wolfSSL’s robustness and will prevent errors some users see when hand-picking cipher suites to use while not having all the correct functionality built into wolfSSL.
CRL Directory Monitoring
As you may know, we added initial support for CRL (Certificate Revocation List) with the release of wolfSSL 2.2.0 in May of this year. With this 2.3.0 release, we have added the ability to have wolfSSL actively monitor a specific CRL directory. Example usage can be seen in the wolfSSL example server (./examples/server/server.c) inside of the HAVE_CRL defines:
wolfSSL_EnableCRL(ssl, 0);
wolfSSL_LoadCRL(ssl, crlPemDir, SSL_FILETYPE_PEM, CYASSL_CRL_MONITOR |
CYASSL_CRL_START_MON);
wolfSSL_SetCRL_Cb(ssl, CRL_CallBack);
DTLS Cookie Support
wolfSSL has had DTLS support for quite some time, but we’re currently working on making it more functional and robust. With this release, wolfSSL’s DTLS implementation now supports cookies. Cookies are used in DTLS to prevent denial of service attacks. As stated in section 4.2.1 of RFC 4347 (http://tools.ietf.org/html/rfc4347):
“Datagram security protocols are extremely susceptible to a variety of denial of service (DoS) attacks. Two attacks are of particular concern:
• An attacker can consume excessive resources on the server by transmitting a series of handshake initiation requests, causing the server to allocate state and potentially to perform expensive cryptographic operations.
• An attacker can use the server as an amplifier by sending connection initiation messages with a forged source of the victim. The server then sends its next message (in DTLS, a Certificate message, which can be quite large) to the victim machine, thus flooding it.
In order to counter both of these attacks, DTLS borrows the stateless cookie technique used by Photuris (http://tools.ietf.org/html/rfc4347#ref-PHOTURIS) and IKE (http://tools.ietf.org/html/rfc4347#ref-IKE). When the client sends its ClientHello message to the server, the server MAY respond with a HelloVerifyRequest message. This message contains a stateless cookie generated using the technique of Photuris. The client MUST retransmit the ClientHello with the cookie added. The server then verifies the cookie and proceeds with the handshake only if it is valid. This mechanism forces the attacker/client to be able to receive the cookie, which makes DoS attacks with spoofed IP addresses difficult. “
We’re currently working on adding reliability to our DTLS implementation. This should be rolling out in the near future, so keep an eye on our blog for more news!
To download the open source, GPLv2-licensed version of wolfSSL 2.3.0, please visit our Download Page. If you have any questions or comments or would like more information on commercial versions of wolfSSL, please contact us at info@yassl.com.
For build instructions, a full feature list, API reference, and more, please see the wolfSSL Manual.