wolfSSL 4.1.0 Now Available

    • wolfSSL is excited to announce its summer release of the wolfSSL embedded SSL/TLS library version 4.1.0! As with each release, wolfSSL 4.1.0 comes with many feature additions, bug fixes, and improvements to the wolfSSL library. 

    The list below outlines some of the new features and notable fixes added for version 4.1.0:

    • Fixes and updates for TLS 1.3:
      • Added additional sanity checks and alert messages for TLS 1.3
      • Major version TLS Draft is now ignored and an alert is sent if version negotiation occurs but no versions were matched
      • Added WOLFSSL_PSK_ONE_ID macro for indicating that only one identity in TLS 1.3 PSK is available and will be cached
      • Added XTIME_MS macro to simplify the tls13.c time requirement
      • Improved and refactored code related to parsing and creating TLS 1.3 client hello packets
      • TLS 1.3 version renegotiation now happens before interpreting ClientHello message
    • Fixes and additions for PCKS7:
      • Added a fix for a check on the return value when verifying PKCS7 bundle signatures (users with applications using the function wc_PKCS7_VerifySignedData should update)
      • Added the function wc_PKCS7_GetSignerSID for PKCS7 firmware bundles
      • Added PKCS7 callback functions for unwrapping of CEK and for decryption
    • Increased performance on ARM architecture:
      • Optimizations for Poly1305 and SHA-512/384 on ARM architecture using SIMD NEON extension
      • Optimizations for ChaCha20, Curve25519 and Ed 25519 on ARM architecture for performance increase
    • Added Sniffer updates:
      • Added support for the null cipher and static ECDH key exchange and new SSLWatchCb callback
      • Added cipher suite TLS_RSA_WITH_NULL_MD5 (off by default)
      • Sniffer statistics print out with the macro WOLFSSL_SNIFFER_STATS defined
    • Fixes, updates, and new functions added for OpenSSL Extra
    • Added the build flag –enable-ecccustcurves=all to enable all curve types
    • Added Java Secure Sockets Extension (JSSE) support
    • Added additional TLS alert messages sent with the macro WOLFSSL_EXTRA_ALERTS defined
    • Added CryptoCell-310 support on nRF52840
    • Added SiFive HiFive E31 RISC?V core family port
    • Added Telit IoT AppZone SDK port
    • Added the build flag –enable-blake2s for 32-bit Blake2s support
    • Added support for Ed25519ctx and Ed25519ph sign/verify algorithms as per RFC 8032

    Stay tuned for more information regarding notable features and updates included with the wolfSSL 4.1.0 release. The following lists other various fixes and improvements that have been included with wolfSSL 4.1.0:

    • Compile time fixes for build case with SP math and RSA only
    • Fixes for Coverity static analysis report including explicit initialization of reported stack variables, as well as additional Coverity fixes thanks to Martin
    • Fixes for scan build warnings (i.e possible null dereference in ecc.c)
    • Resetting verify send value with a call to wolfSSL_clear function
    • Fix for extern with sp_ModExp_2048 when building with –cpp option
    • Fix for typo issue with –enable-sp=cortexm
    • Adding #pragma warning disable 4127 for tfm.c when building with Visual Studio
    • Improvements to the maximum ECC signature calculations
    • Improvements to TLS write handling in error cases which helps user application not go through with a wolfSSL_write attempt after a wolfSSL_read failure
    • Fix for read directory functions with Windows (wc_ReadDirFirst and wc_ReadDirNext)
    • Sanity check on index before accessing domain component buffer in call to wolfSSL_X509_NAME_get_entry
    • Sending fatal alert from client side on version error
    • Fix for static RSA cipher suite with PK callback and no loaded private key
    • Fix for potential memory leak in error case with the function wc_DsaKeyToDer, thanks to Chris H. for the report
    • Adjusting STRING_USER macro to remove includes of standard lib <string.h> or <stdio.h>
    • Bug fix for checking wrong allocation assignment in the function wc_PBKDF2 and handling potential leak on allocation failure. This case is only hit when the specific call to malloc fails in the function wc_PBKDF2. Thanks to Robert Altnoeder (Linbit) for the report
    • Improved length checks when parsing ASN.1 certificates
    • Improved checking of return values with TLS extension functions and error codes
    • Removing redundant calls to the generate function when instantiating and reseeding DRBG
    • Improvements for handling error return codes when reading input from transport layer
    • Improvements to efficiency of SNI extension parsing and error checking with ALPN parsing

    This release of wolfSSL also includes a fix for 2 security vulnerabilities. A full detailed list of additions and bug fixes can be found in the wolfSSL README. 

    To download and view the most recent version of wolfSSL, the wolfSSL GitHub repository can be cloned from here: https://github.com/wolfssl/wolfssl.git, and the most recent stable release can be downloaded from the wolfSSL download page here: https://www.wolfssl.com/download/.

    If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.