The release of the compact cryptographic library wolfSSL 5.1.0 is prepared, optimized for use on embedded devices with limited CPU and memory resources, such as Internet of Things devices, smart home systems, automotive infotainment systems, routers, and mobile phones. The code is written in C and distributed under the GPLv2 license.
The library provides high-performance implementations of modern cryptographic algorithms, including ChaCha20, Curve25519, NTRU, RSA, Blake2b, TLS 1.0-1.3, and DTLS 1.2, which, according to the developers, are 20 times more compact than the implementations from OpenSSL. It offers both its simplified API and a layer for compatibility with the OpenSSL API. OCSP (Online Certificate Status Protocol) and CRL (Certificate Revocation List) support is available for certificate revocation checking.
Key innovations in wolfSSL 5.1.0 include:
- Added support for platforms: NXP SE050 (with Curve25519 support) and Renesas RA6M4. TSIP 1.14 (Trusted Secure IP) support has been added for Renesas RX65N/RX72N.
- The ability to use post-quantum cryptographic algorithms has been added for the Apache HTTP server port. For TLS 1.3, the NIST round 3 FALCON digital signature scheme has been implemented. Tests have been added for cURL compiled with wolfSSL in a mode resilient to quantum computer attacks.
- The compatibility layer with other libraries and applications has been updated to support NGINX 1.21.4 and Apache httpd 2.4.51.
- Support for the flag SSL_OP_NO_TLSv1_2 and the functions SSL_CTX_get_max_early_data, SSL_CTX_set_max_early_data, SSL_set_max_early_data, SSL_get_max_early_data, SSL_CTX_clear_mode, SSL_CONF_cmd_value_type, SSL_read_early_data, and SSL_write_early_data has been added to the code for compatibility with OpenSSL.
- The ability to register a callback function for replacing the built-in AES-CCM algorithm implementation has been added.
- The WOLFSSL_CUSTOM_OID macro has been added for generating custom OIDs for CSR (certificate signing request).
- Support for deterministic ECC signatures has been added, enabled by the FSSL_ECDSA_DETERMINISTIC_K_VARIANT macro.
- New functions wc_GetPubKeyDerFromCert, wc_InitDecodedCert, wc_ParseCert, and wc_FreeDecodedCert have been added.
- Two vulnerabilities with a low severity level have been addressed. The first vulnerability allows for a DoS attack on a client application during a MITM attack on the TLS 1.2 connection. The second vulnerability is related to the potential for gaining control over the client's session resumption while using a wolfSSL-based proxy or connections that do not validate the entire trust chain of the server certificate.
Source: opennet.ru
