wolfSSH now supports X.509 host certificates with TPM-backed keys: Certificate-based host authentication with private keys sealed in hardware
The problem
Read more
Latest Posts
-
-
How To Build wolfSSL + CAAM on i.MX7 with Yocto Linux?
The NXP CAAM (Cryptographic Accelerator and Assurance Module) supports offloading cryptographic operations for acceleration along with heightened security. wolfSSL supports accessing the hardware acceleration in many different operating environments, such as with QNX or NXP’s Yocto Linux builds. For QNX builds wolfSSL has targeted specific i.MX devices, check with our...Read more -
wolfSSL Intel QuickAssist (QAT) Performance Improvements
wolfSSL’s asynchronous crypto offloads public-key, cipher, and hashing work to Intel QuickAssist (QAT) hardware. This update (PR #10772) makes that offload use every QAT device in a multi-adapter system, and hardens it for multi-process and CI use.Read more -
wolfSSL TLS with Hardware-Bound Keys on the RealTek RTL8735B (AmebaPro2)
The RealTek RTL8735B (AmebaPro2) is an Arm Cortex-M33 AIoT SoC with a hardware crypto engine and, importantly, a per-device Hardware Unique Key (HUK) fused into the silicon. The HUK never leaves the chip and cannot be read by software. That makes it an ideal root from which to derive keys...Read more -
Announcing wolfTPM v4.1.0
wolfTPM v4.1.0 delivers the post-quantum upgrade path we promised in v4.0.0, alongside a major round of firmware TPM (fwTPM) hardening. It delivers three headline capabilities:Read more -
Tightening OCSP Responder Authorization for RFC 6960 Compliance
wolfSSL has removed CheckOcspResponderChain(), a non-compliant chain walk that authorized any OCSP responder certificate issued by any ancestor of the target certificate’s issuer as of version 5.9.2. RFC 6960 §4.2.2.2 requires that an OCSP response be signed directly by the CA that issued the certificate in question or a delegated...Read more -
wolfSSL Improves TLS 1.3 Alert Compliance for Missing SNI
wolfSSL now sends the correct alert when a TLS 1.3 server requires the Server Name Indication (SNI) extension and the client fails to include it. Previously, the server sent a generic handshake_failure alert; it now sends the missing_extension alert defined by RFC 8446 for exactly this case. TLS 1.2 and...Read more -
wolfSSL Relaxes Serial Number Validation for Root CA Certificates
wolfSSL has refined its X.509 serial number validation to better handle real-world trust stores. Previously, wolfSSL rejected any certificate with a serial number of 0. While RFC 5280 requires CAs to issue certificates with positive serial numbers, some long-standing self-signed root CA certificates in circulation were created with serial 0,...Read more -
Designing Secure Automotive Platforms (APAC-Friendly Time)
Securing modern vehicles requires more than protecting network traffic. Security must extend from secure boot and software updates to in-vehicle communications, cloud connectivity, and ADAS throughout the vehicle lifecycle.Read more -
Production Rust Cryptography with wolfCrypt: FIPS, Post-Quantum, and High Portability
Choosing a cryptographic library for Rust means balancing more than memory safety. Production deployments require portability, compliance, stable APIs, and a library that can evolve with changing security standards.Read more