wolfSSL has detailed several embedded security updates covering deterministic networking, post-quantum cryptography and automotive hardware security. The updates include the wolfIP TCP/IP stack, NIST-validated post-quantum algorithms in wolfCrypt, native Falcon and FrodoKEM implementations, and wolfHSM support for Infineon’s AURIX TC4xx family.

The networking portion centers on wolfIP, a lightweight TCP/IP stack designed for bare-metal and RTOS-based embedded systems. Unlike general-purpose networking stacks that can allocate memory dynamically at runtime, wolfIP uses socket tables and RX/TX packet buffers that are sized during compilation.

This fixed memory model allows developers to determine networking resource requirements before deployment and is intended to support predictable execution in resource-constrained and safety-critical systems.

wolfIP currently provides TCP, UDP, DHCP and DNS functionality and can integrate directly with wolfSSL TLS 1.3. wolfSSL says its endpoint-focused TCP/IP core is approximately four times smaller than lwIP.

wolfIP BSD/POSIX socket integration

wolfSSL is also extending its post-quantum cryptography support through wolfCrypt. Its post-quantum implementations have received validation through the NIST Cryptographic Algorithm Validation Program under certificate #A8437.

The validation covers ML-KEM, ML-DSA and SLH-DSA, along with LMS and XMSS signature verification. Supporting cryptographic functions covered by the certificate include SHA-2, SHA-3, SHAKE, HMAC and SHA-512 Hash DRBG.

The validation also marks a step toward wolfSSL’s planned wolfCrypt FIPS 140-3 v7.0.0 module submission. The planned module is expected to place ML-KEM, ML-DSA, SLH-DSA, LMS verification and XMSS verification within the validated cryptographic boundary.

wolfProvider architecture linking OpenSSL APIs with wolfCrypt

Beyond the validated algorithms, wolfCrypt now includes native implementations of Falcon-512 and Falcon-1024. Previous Falcon support depended on the liboqs library, while the new implementation is integrated directly into wolfCrypt.

The Falcon implementation supports embedded systems, desktop platforms and Linux kernel environments, with optimized paths available for x86-64 and Arm targets. Crypto callbacks can be used to offload operations to supported hardware, while verify-only and reduced-memory configurations are available for systems with tighter resource constraints.

wolfSSL notes that Falcon support remains experimental while NIST continues work on the FN-DSA standard.

FrodoKEM logo

FrodoKEM has also been added directly to wolfCrypt, with support for three parameter sets and both SHAKE- and AES-based matrix generation. Applications can enable individual parameter sets and operations at build time to limit unnecessary code.

The FrodoKEM implementation also includes optimized x86-64 and Arm paths, crypto callback support, and ASN.1 and X.509 integration for handling FrodoKEM keys in certificates and certificate requests.

On the automotive side, wolfHSM now supports Infineon’s AURIX TC4xx family, extending support previously available for AURIX TC3xx devices.

wolfHSM uses a client-server architecture in which applications can send cryptographic operations to an isolated hardware security module core. The platform provides common cryptographic services for secure boot, OTA updates, diagnostics, secure communications and Secure Onboard Communication applications.

wolfSSL logo

The TC4xx implementation retains wolfCrypt-backed cryptographic services and supports integration with AUTOSAR-based software architectures. wolfSSL also lists an available ASIL-D certification package for safety-critical development.

The common architecture across AURIX TC3xx and TC4xx devices is intended to provide automotive applications with a migration path between the two families without redesigning the application-to-HSM interface.

wolfSSL plans to demonstrate its embedded security technologies at embedded world North America, where the company will be located at booth 6027.

Further Information

Additional information is available in wolfSSL’s September 21 press release, “wolfSSL Advances Embedded Security with wolfIP, New Post-Quantum Capabilities and AURIX TC4xx Support.”