WolfSSL

Last updated
wolfSSL
Developer(s) Todd Ouska
Initial releaseFebruary 19, 2006 (2006-02-19) [1]
Stable release
5.7.2 [2]   OOjs UI icon edit-ltr-progressive.svg / 8 July 2024
Repository github.com/wolfssl/wolfssl
Written in C
Operating system Multi-platform
Type Cryptography library
License GPL-2.0-or-later or proprietary [3]
Website www.wolfssl.com

wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers. It is an open source implementation of TLS (SSL 3.0, TLS 1.0, 1.1, 1.2, 1.3, and DTLS 1.0, 1.2, and 1.3) written in the C programming language. It includes SSL/TLS client libraries and an SSL/TLS server implementation as well as support for multiple APIs, including those defined by SSL and TLS. wolfSSL also includes an OpenSSL compatibility interface with the most commonly used OpenSSL functions. [4] [5]

Contents

A predecessor of wolfSSL, yaSSL is a C++ based SSL library for embedded environments and real time operating systems with constrained resources.

Platforms

wolfSSL is currently available for Microsoft Windows, Linux, macOS, Solaris, ESP32, ESP8266, Threadx, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, Yocto Project, OpenEmbedded, WinCE, Haiku, OpenWrt, iPhone, Android, Wii, and GameCube through DevKitPro support, QNX, MontaVista, Tron variants, NonStop OS, OpenCL, Micrium's MicroC/OS-II, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, TI-RTOS, HP-UX, uTasker, uT-kernel, embOS, INtime, mbed, RIOT, CMSIS-RTOS, FROSTED, Green Hills INTEGRITY, Keil RTX, TOPPERS, PetaLinux, Apache Mynewt, and PikeOS. [6]

History

The genesis of yaSSL, or yet another SSL, dates to 2004. OpenSSL was available at the time, and was dual licensed under the OpenSSL License and the SSLeay license. [7] yaSSL, alternatively, was developed and dual-licensed under both a commercial license and the GPL. [8] yaSSL offered a more modern API, commercial style developer support and was complete with an OpenSSL compatibility layer. [4] The first major user of wolfSSL/CyaSSL/yaSSL was MySQL. [9] Through bundling with MySQL, yaSSL has achieved extremely high distribution volumes in the millions.

In February 2019, Daniel Stenberg, the creator of cURL, was hired by the wolfSSL project to work on cURL. [10]

Protocols

The wolfSSL lightweight SSL library implements the following protocols: [11]

Protocol Notes:

Algorithms

wolfSSL uses the following cryptography libraries:

wolfCrypt

By default, wolfSSL uses the cryptographic services provided by wolfCrypt. [13] wolfCrypt Provides RSA, ECC, DSS, Diffie–Hellman, EDH, NTRU, DES, Triple DES, AES (CBC, CTR, CCM, GCM), Camellia, IDEA, ARC4, HC-128, ChaCha20, MD2, MD4, MD5, SHA-1, SHA-2, SHA-3, BLAKE2, RIPEMD-160, Poly1305, Random Number Generation, Large Integer support, and base 16/64 encoding/decoding.

wolfCrypt also includes support for the recent X25519 and Ed25519 algorithms.

wolfCrypt acts as a back-end crypto implementation for several popular software packages and libraries, including MIT Kerberos [14] (where it can be enabled using a build option).

NTRU

CyaSSL+ includes NTRU [15] public key encryption. The addition of NTRU in CyaSSL+ was a result of the partnership between yaSSL and Security Innovation. [15] NTRU works well in mobile and embedded environments due to the reduced bit size needed to provide the same security as other public key systems. In addition, it's not known to be vulnerable to quantum attacks. Several cipher suites utilizing NTRU are available with CyaSSL+ including AES-256, RC4, and HC-128.

Hardware Integration

Secure Element Support

wolfSSL supports the following Secure Elements:

Technology Support

wolfSSL supports the following hardware technologies:

Hardware Encryption Support

The following tables list wolfSSL's support for using various devices' hardware encryption with various algorithms.

AES cipher modes
DeviceAES-GCMAES-CCMAES-CBCAES-ECBAES-CTR
Intel AES-NI

(Xeon and Core processor families)

AllAllAllAllAll
Freescale

Cryptographic Accelerator and Assurance Module (CAAM)

AllAllAllAll
Freescale Coldfire SEC

(NXP MCF547X and MCF548X)

All
Freescale Kinetis MMCAU

K50, K60, K70, and K80 (ARM Cortex-M4 core)

AllAllAllAll
STMicroelectronics STM32

F1, F2, F4, L1, W Series (ARM Cortex - M3/M4)

AllAll
Cavium NITROX

(III/V PX processors)

All
Microchip PIC32 MX/MZ

(Embedded Connectivity)

AllAllAll
Texas Instruments TM4C1294

(ARM Cortex-M4F)

AllAllAllAllAll
Nordic NRF51 Archived 2018-06-19 at the Wayback Machine

(Series SoC family, 32-bit ARM Cortex M0 processor core)

128-bit
ARMv8 AllAllAll
Intel QuickAssist Technology AllAll
Freescale NXP LTC AllAllAllAllAll
Xilinx Zynq UltraScale+ 256-bit
Renesas RX65N (R5F565NEHDFB) AllAll
Renesas RX72N (RTK5RX72N0C00000BJ) AllAll
Renesas RX MPU (R5F571MLDDFC) AllAll
Renesas Synergy DK-S7G2 128-bit

- "All" denotes 128, 192, and 256-bit supported block sizes

DES/3DES cipher modes
DeviceDES-CBCDES-ECB3DES-CBC
Freescale Coldfire SEC

(NXP MCF547X and MCF548X)

64 bit192 bit
Freescale Kinetis MMCAU

K50, K60, K70, and K80 (ARM Cortex-M4 core)

64 bit192 bit
STMicroelectronics STM32

F1, F2, F4, L1, W Series (ARM Cortex - M3/M4)

64 bit64 bit (encrypt)192 bit
Cavium NITROX

(III/V PX processors)

192 bit
Microchip PIC32 MX/MZ

(Embedded Connectivity)

64 bit192 bit
Texas Instruments TM4C1294

(ARM Cortex-M4F)

64 bit192 bit
Stream ciphers
DeviceRC4ChaCha20
AVX1/AVX2

(Intel and AMD x86)

Supported
Cavium NITROX

(III/V PX processors)

2048 bit max.
Hashing algorithm support
DeviceMD5SHA1SHA2SHA-256SHA-384SHA-512
AVX1/AVX2

(Intel and AMD x86)

SupportedSupportedSupported
Freescale Kinetis MMCAU

K50, K60, K70, and K80 (ARM Cortex-M4 core)

SupportedSupportedSupported
STMicroelectronics STM32

F1, F2, F4, L1, W Series (ARM Cortex - M3/M4)

SupportedSupported
Microchip PIC32 MX/MZ

(Embedded Connectivity)

SupportedSupportedSupported
ARMv8 Supported
Intel QuickAssist Technology SupportedSupportedSupported
Freescale NXP LTC SupportedSupported
Xilinx Zynq UltraScale+ Supported
Renesas Synergy DK-S7G2 SupportedSupported
Renesas RX65N (R5F565NEHDFB) SupportedSupported
Renesas RX72N (RTK5RX72N0C00000BJ) SupportedSupportedSupported
Renesas RX MPU (R5F571MLDDFC) SupportedSupportedSupported
Key operations: generation and exchange, elliptic curve cryptography
DeviceRSAECCECC-DHEX25519Ed25519
Cavium NITROX

(III/V PX processors)

512–4096 bitNIST Prime

192, 224, 256, 384, 521

Microchip/Atmel

ATECC508A (compatible with any MPU or MCU including: Atmel SMART and AVR MCUs)

256 bit

(NIST-P256)

Intel QuickAssist Technology 512–4096 bit128, 256 bit
Freescale NXP LTC 512 - 4096 bit128, 256 bit128, 256 bit256 bit256 bit
Xilinx Zynq UltraScale+ 2048–4096 bit
MAC algorithms
DeviceHMAC-MD5HMAC-SHA1HMAC-SHA2HMAC-SHA256SHA-3Poly1305
AVX1/AVX2

(Intel and AMD x86)

Supported
Cavium NITROX

(III/V PX processors)

SupportedSupportedSupportedSupported
Microchip PIC32 MX/MZ

(Embedded Connectivity)

SupportedSupportedSupported
Intel QuickAssist Technology SupportedSupported
Renesas RX65N (R5F565NEHDFB) SupportedSupported
Renesas RX72N (RTK5RX72N0C00000BJ)
Renesas RX MPU (R5F571MLDDFC) SupportedSupported
Renesas Synergy DK-S7G2 Supported
Random number generation
DeviceRNG
STMicroelectronics STM32

F1, F2, F4, L1, W Series (ARM Cortex - M3/M4)

Supported
Cavium NITROX

(III/V PX processors)

Supported
Nordic NRF51 Archived 2018-06-19 at the Wayback Machine

(Series SoC family, 32-bit ARM Cortex M0 processor core)

Supported

Certifications

wolfSSL supports the following certifications:

Licensing

wolfSSL is dual licensed:

See also

Related Research Articles

Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securing HTTPS remains the most well known.

The Embedded Configurable Operating System (eCos) is a free and open-source real-time operating system intended for embedded systems and applications which need only one process with multiple threads. It is designed to be customizable to precise application requirements of run-time performance and hardware needs. It is implemented in the programming languages C and C++ and has compatibility layers and application programming interfaces for Portable Operating System Interface (POSIX) and The Real-time Operating system Nucleus (TRON) variant μITRON. eCos is supported by popular SSL/TLS libraries such as wolfSSL, thus meeting all standards for embedded security.

<span class="mw-page-title-main">OpenSSL</span> Open-source implementation of the SSL and TLS protocols

OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites.

OpenVPN is a virtual private network (VPN) system that implements techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications.

Nucleus RTOS is a real-time operating system (RTOS) produced by the Embedded Software Division of Mentor Graphics, a Siemens Business, supporting 32- and 64-bit embedded system platforms. The operating system (OS) is designed for real-time embedded systems for medical, industrial, consumer, aerospace, and Internet of things (IoT) uses. Nucleus was released first in 1993. The latest version is 3.x, and includes features such as power management, process model, 64-bit support, safety certification, and support for heterogeneous computing multi-core system on a chip (SOCs) processors.

<span class="mw-page-title-main">GnuTLS</span> Free software library implementing TLS

GnuTLS is a free software implementation of the TLS, SSL and DTLS protocols. It offers an application programming interface (API) for applications to enable secure communication over the network transport layer, as well as interfaces to access X.509, PKCS #12, OpenPGP and other structures.

strongSwan is a multiplatform IPsec implementation. The focus of the project is on authentication mechanisms using X.509 public key certificates and optional storage of private keys and certificates on smartcards through a PKCS#11 interface and on TPM 2.0.

<span class="mw-page-title-main">Network Security Services</span> Collection of cryptographic computer libraries

Network Security Services (NSS) is a collection of cryptographic computer libraries designed to support cross-platform development of security-enabled client and server applications with optional support for hardware TLS/SSL acceleration on the server side and hardware smart cards on the client side. NSS provides a complete open-source implementation of cryptographic libraries supporting Transport Layer Security (TLS) / Secure Sockets Layer (SSL) and S/MIME. NSS releases prior to version 3.14 are tri-licensed under the Mozilla Public License 1.1, the GNU General Public License, and the GNU Lesser General Public License. Since release 3.14, NSS releases are licensed under GPL-compatible Mozilla Public License 2.0.

cryptlib is an open-source cross-platform software security toolkit library. It is distributed under the Sleepycat License, a free software license compatible with the GNU General Public License. Alternatively, cryptlib is available under a proprietary license for those preferring to use it under proprietary terms.

In cryptography, Curve25519 is an elliptic curve used in elliptic-curve cryptography (ECC) offering 128 bits of security and designed for use with the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme. It is one of the fastest curves in ECC, and is not covered by any known patents. The reference implementation is public domain software.

There are various implementations of the Advanced Encryption Standard, also known as Rijndael.

A cipher suite is a set of algorithms that help secure a network connection. Suites typically use Transport Layer Security (TLS) or its deprecated predecessor Secure Socket Layer (SSL). The set of algorithms that cipher suites usually contain include: a key exchange algorithm, a bulk encryption algorithm, and a message authentication code (MAC) algorithm.

Mbed TLS is an implementation of the TLS and SSL protocols and the respective cryptographic algorithms and support code required. It is distributed under the Apache License version 2.0. Stated on the website is that Mbed TLS aims to be "easy to understand, use, integrate and expand".

The Transport Layer Security (TLS) protocol provides the ability to secure communications across or inside networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free software and open source.

OpenConnect is a free and open-source cross-platform multi-protocol virtual private network (VPN) client software which implement secure point-to-point connections.

MatrixSSL is an open-source TLS/SSL implementation designed for custom applications in embedded hardware environments.

<span class="mw-page-title-main">LibreSSL</span> Open-source implementation of TLS protocols; forked from OpenSSL in 2014

LibreSSL is an open-source implementation of the Transport Layer Security (TLS) protocol. The implementation is named after Secure Sockets Layer (SSL), the deprecated predecessor of TLS, for which support was removed in release 2.3.0. The OpenBSD project forked LibreSSL from OpenSSL 1.0.1g in April 2014 as a response to the Heartbleed security vulnerability, with the goals of modernizing the codebase, improving security, and applying development best practices.

The tables below compare cryptography libraries that deal with cryptography algorithms and have application programming interface (API) function calls to each of the supported features.

Probabilistic Signature Scheme (PSS) is a cryptographic signature scheme designed by Mihir Bellare and Phillip Rogaway.

wolfSSH is a small, portable, embedded SSH library targeted for use by embedded systems developers. It is an open-source implementation of SSH written in the C language. It includes SSH client libraries and an SSH server implementation. It allows for password and public key authentication.

References

  1. "wolfSSL ChangeLog".
  2. "Release 5.7.2". 8 July 2024. Retrieved 16 July 2024.
  3. "LICENSING". GitHub .
  4. 1 2 wolfSSL – Embedded Communications Products
  5. "What You Need to Know About the TLS 1.3 Protocol and wolfSSL's SSL/TLS Libraries". www.allaboutcircuits.com. Retrieved 2018-12-28.
  6. "wolfSSL Embedded SSL/TLS Library | wolfSSL Products" . Retrieved 2019-01-31.
  7. OpenSSL: Source, License
  8. wolfSSL – License
  9. "MySQL, Building MySQL with Support for Secure Connections". Archived from the original on 2017-07-06. Retrieved 2016-06-12.
  10. Daniel Stenberg, founder and Chief Architect of cURL, joins wolfSSL
  11. wolfSSL – Docs | CyaSSL Manual – Chapter 4 (Features)
  12. "wolfSSL 3.6.6 is Now Available".
  13. wolfSSL – Docs | wolfSSL Manual – Chapter 10 (wolfCrypt Usage Reference)
  14. Kerberos: The Network Authentication Protocol
  15. 1 2 NTRU CryptoLabs Archived 2013-02-02 at archive.today
  16. wolfSSL – wolfSSL with Intel® SGX
  17. WOLFCRYPT FIPS 140-2 and FIPS 140-3
  18. wolfSSL Support for DO-178C DAL A