wolfssl

wolfSSL Embedded SSL/TLS Library

The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments - primarily because of its small size, speed, and feature set. It is commonly used in standard operating environments as well because of its royalty-free pricing and excellent cross platform support. wolfSSL supports industry standards up to the current TLS 1.3 and DTLS 1.3, is up to 20 times smaller than OpenSSL, and offers progressive ciphers such as ChaCha20, Curve25519, BLAKE2b/BLAKE2s and Post-Quantum TLS 1.3 groups. User benchmarking and feedback reports dramatically better performance when using wolfSSL over OpenSSL.

wolfSSL is powered by the wolfCrypt cryptography library. Two versions of wolfCrypt have been FIPS 140-2 validated (Certificate #2425 and certificate #3389). FIPS 140-3 validated (Certificate #4718). For additional information, visit the wolfCrypt FIPS FAQ or contact [email protected].

wolfCrypt also includes support for deriving device-unique keys from hardware entropy (--enable-puf[=small|balanced|strong|strongest], selecting the BCH error-correction strength). Each raw SRAM readout is health tested before use, so a degenerate readout - all zero, all ones, a repeating block, or an implausible bit bias - cannot silently produce a device-independent key. An example exists at SRAM PUF.

Why Choose wolfSSL?

There are many reasons to choose wolfSSL as your embedded, desktop, mobile, or enterprise SSL/TLS solution. Some of the top reasons include size (typical footprint sizes range from 20-100 kB), support for the newest standards (SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3, DTLS 1.0, DTLS 1.2, and DTLS 1.3), current and progressive cipher support (including stream ciphers), multi-platform, royalty free, and an OpenSSL compatibility API to ease porting into existing applications which have previously used the OpenSSL package. For a complete feature list, see Chapter 4 of the wolfSSL manual.

SBOM / CRA Compliance

wolfSSL provides a Software Bill of Materials (SBOM) for EU Cyber Resilience Act (CRA) compliance via two entry points:

• python3 scripts/gen-sbom … for embedded / RTOS / IDE-based builds (Keil, IAR, STM32CubeIDE, ESP-IDF, Zephyr, plain CMake, custom Makefile) configured through a hand-edited user_settings.h. No autotools required.
• make sbom for Linux server / Debian / RPM / Yocto / FIPS-Ready builds that already use ./configure && make.

Both produce SPDX 2.3 + CycloneDX 1.6 JSON intended to satisfy the NTIA minimum elements. The make sbom path additionally runs SPDX-spec validation via pyspdxtools and gates the build on it; the standalone path validates only on demand (see doc/SBOM.md § 1.3). Neither path runs an NTIA-minimum-elements checker by default. See doc/SBOM.md for per-toolchain recipes and the full flag reference.

OmniBOR / Bomsh

wolfSSL supports generating an OmniBOR artifact dependency graph via make bomsh, providing cryptographic traceability from the installed library back to every source file that produced it. See doc/SBOM.md for details.

Security advisories (CSAF / VEX)

wolfSSL can generate machine-readable security advisories via make advisory (requires python3), emitting one CSAF 2.0 document and one CycloneDX 1.6 VEX document per CVE into advisories/out/ (*.csaf.json and *.cdx.json) from the git-tracked records under advisories/. See section 21 of INSTALL for details.

Notes, Please Read

Note 1

wolfSSL as of 3.6.6 no longer enables SSLv3 by default. By default, wolfSSL disables static key cipher suites that use PSK, RSA, or ECDH without ephemeral key exchange. Instead, wolfSSL enables cipher suites that provide perfect forward secrecy (PFS) using ephemeral Diffie-Hellman (DH) or Elliptic Curve (ECC) key exchange, both of which are enabled by default.

If you need to support legacy systems that require static key cipher suites, you can enable them using one or more of these defines:

• WOLFSSL_STATIC_DH
• WOLFSSL_STATIC_RSA
• WOLFSSL_STATIC_PSK

Important: Static key cipher suites reduce security by eliminating perfect forward secrecy. These cipher suites reuse the same long-term private key for all session key exchanges. In contrast, PFS-enabled cipher suites (the wolfSSL default) generate a new ephemeral key for each session, ensuring that compromising a long-term key cannot decrypt past sessions.

When compiling ssl.c, wolfSSL will now issue a compiler error if no cipher suites are available. You can remove this error by defining WOLFSSL_ALLOW_NO_SUITES in the event that you desire that, i.e., you’re not using TLS cipher suites.

AES CryptoCB Key Import Support

wolfSSL supports hardware-accelerated AES operations via CryptoCB.

When WOLF_CRYPTO_CB_AES_SETKEY is defined, wolfSSL invokes a CryptoCB callback during AES key setup. The callback behavior determines the mode:

If callback returns 0 (success) and leaves aes->rounds at 0:

• Key is imported to Secure Element/HSM
• Key is NOT copied to wolfSSL RAM (true key isolation)
• GCM tables are NOT generated (full hardware offload)
• All subsequent AES operations route through CryptoCB; in default builds a mode the callback declines returns MISSING_KEY, as does streaming AES-GCM

A callback that sets aes->rounds must also build a software key schedule, since wolfSSL then treats the key as a software key as well. It does so by calling wc_AesSetKey() on the same object with aes->devId set to a devId no device is registered under, then restoring it. INVALID_DEVID only works without WOLF_CRYPTO_CB_FIND, whose find callback can map it back to the device. This request carries no key direction, so only a WOLF_CRYPTO_CB_SETKEY callback, which is given one, can build it.

If callback returns CRYPTOCB_UNAVAILABLE:

• SE doesn’t support key import
• Normal software AES path is used
• Key is copied to devKey for CryptoCB encrypt/decrypt acceleration
• The callback must first release any key it holds for this object and set aes->devCtx to NULL, since wolfSSL does not clear it

This feature enables TLS 1.3 traffic key protection on embedded platforms where symmetric keys must never exist in main RAM.

Enable with: CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"

Note 2

wolfSSL takes a different approach to certificate verification than OpenSSL does. The default policy for the client is to verify the server, this means that if you don’t load CAs to verify the server you’ll get a connect error, no signer error to confirm failure (-188).

If you want to mimic OpenSSL behavior of having SSL_connect succeed even if verifying the server fails and reducing security you can do this by calling:

wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);

before calling wolfSSL_new();. Though it’s not recommended.

Note 3

The enum values SHA, SHA256, SHA384, SHA512 are no longer available when wolfSSL is built with --enable-opensslextra (OPENSSL_EXTRA) or with the macro NO_OLD_SHA_NAMES. These names get mapped to the OpenSSL API for a single call hash function. Instead the name WC_SHA, WC_SHA256, WC_SHA384 and WC_SHA512 should be used for the enum name.

wolfSSL Release 5.9.4 (Sep 25, 2026)

Release 5.9.4 has been developed according to wolfSSL’s development and QA process (see link below) and successfully passed the quality criteria. https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance

NOTE:

• liboqs is no longer used for any algorithm: Falcon now has a native wolfCrypt implementation, and the liboqs dependency and its configure and CMake options have been removed (see PQC below).
• Certificates carrying trailing bytes after the DER structure are now rejected unless WOLFSSL_NO_ASN_STRICT is defined; only the certificate itself is copied into WOLFSSL_X509.
• ABI: struct OcspRequest (exported as OCSP_REQUEST) loses its trailing ssl pointer; consumers that embed the struct must be rebuilt.
• Under FIPS: HMAC-MD5 is rejected, AES-GCM encryption with an IV shorter than 12 bytes returns FIPS_BAD_VALUE_E (override with WC_FIPS_AESGCM_ALLOW_SHORT_NONCES), the CMAC minimum tag is 64 bits, and RSA-PSS salts longer than the hash are refused (FIPS 186-5). --enable-wolfclu no longer enables MD5, Ed25519 or ASN relaxation on FIPS builds.

PR stands for Pull Request, and PR references a GitHub pull request number where the code change was added.

Vulnerabilities

• [High] CVE-2026-93302 MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the certificates being loaded to either of those APIs to take advantage of the issue. When OPENSSL_COMPATIBLE_DEFAULTS is also defined this widens the affected API to include all CA certificate loading. Both macros are defined when using autoconf builds such as (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, all, distro). When the certificate is listed as a trusted peer certificate the issue previously allowed for a malicious (D)TLS server to bypass authentication once knowing which CA’s the client would accept. This also affects mutual authentication cases where the client knows which CA’s the server has loaded. If building with any of these configurations and using (D)TLS where the loaded CA’s could be known and authentication of the peer is desired, users should either: update to the latest wolfSSL version, apply the fix patch, or use the configure flag --disable-openssl-compatible-defaults and not load CA’s with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert() to mitigate the issue. The affected certificate verification path with (D)TLS is in wolfSSL versions 5.3.0 to 5.9.2. Found via the Anthropic OSS program. Fixed in commit https://github.com/wolfSSL/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1

• [High] CVE-2026-89102 In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVE_CERTIFICATE_STATUS_REQUEST_V2 feature and calls wolfSSL_UseOCSPStaplingV2(ssl, WOLFSSL_CSR2_OCSP_MULTI, options), the client accepts any certificate in the peer’s chain as a certificate authority without verifying that the certificate is actually authorized to act as one. This means that an attacker who possesses any certificate that chains to a CA trusted by the client (along with its private key) can forge certificates for arbitrary identities that will be accepted as valid by the client. The end entity certificate of the server is stored in the persistent trust store, affecting subsequent connections that reuse the context even when OCSP multi usage is not employed. Found by internal wolfSSL testing. Fixed in PR 11027

• [High] CVE-2026-89136 When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds. This affects versions 5.6.0 to 5.9.2. Thanks to Christos Papakonstantinou (Cantina Security) for the report. Fixed in PR 11009

• [Medium] CVE-2026-93304 A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known (deterministic) key and checks the server’s Finished against that same key. An out-of-order ChangeCipherSpec can therefore be used by an attacker to complete the handshake in place of the server and send data the client accepts as authentic. The client’s own traffic still uses correctly derived keys, so the attacker cannot read it, and the genuine server never completes the handshake. DTLS 1.2 clients are exposed because a datagram read can deliver the out-of-order records on its own. TLS 1.2 clients are exposed when the application supplies received bytes with wolfSSL_inject() or enables read ahead. For certificate suites, the attacker must be in a man-in-the-middle position. For PSK (Pre Shared Key) connections, any fake server can succeed without knowing the PSK. The affected versions of wolfSSL are from 4.7.0 to 5.9.2. Found via the Anthropic OSS program. Fixed in PR 11458

• [Medium] CVE-2026-89133 wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for hostnames they shouldn’t be allowed to cover, due to a chain-walking state-machine bug that resets the validation state when encountering an intermediate without NameConstraints, thereby bypassing cryptographic delegation controls. This defect exists in the default build configuration that makes use of certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for reporting the issue. Fixed in PR 10687

• [Medium] CVE-2026-89134 A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of “no dNSName SAN”, so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2. Thanks to Jorge Milla (Pig-Tail) for the report. Fixed in PR 10837

• [Medium] CVE-2026-89135 A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function. Thanks to Christos Papakonstantinou (Cantina Security) for the report. Fixed in PR 11009

• [Low] CVE-2026-15442 In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues trying to send data during the shutdown it would lead to a state where a potential heap-use-after free happened. This affects versions 4.4.0 through 5.9.2 of wolfSSL. Thanks to the Fuzz0x team for the report. Fixed in PR 10863

• [Low] CVE-2026-94417 When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy for a missing responder collapses the OCSP result onto success before the code decides whether the CRL fallback is still needed, so “no responder exists” becomes indistinguishable from “the responder answered good”. Affected builds define both HAVE_OCSP and HAVE_CRL: --enable-ocsp --enable-crl directly, and implicitly --enable-all, --enable-distro, --enable-curl, --enable-nginx, --enable-haproxy, --enable-stunnel, --enable-lighty, --enable-wpas, --enable-strongswan, --enable-mosquitto, --enable-jni, --enable-openvpn and --enable-krb. An application is affected only if it calls both wolfSSL_CTX_EnableOCSP() (or wolfSSL_EnableOCSP() / wolfSSL_CertManagerEnableOCSP()) and wolfSSL_CTX_EnableCRL() (or the equivalents) with a CRL loaded; an application that uses OCSP stapling alone through wolfSSL_CTX_EnableOCSPStapling() is not affected, because that sets up a separate OCSP instance. The defect sits in ProcessPeerCerts() and is reachable over TLS 1.0 through TLS 1.3 and DTLS, both on a client verifying a server certificate and on a server verifying a client certificate under mutual or post-handshake authentication. When the skipped check falls on a chain certificate rather than the leaf, the unchecked intermediate is promoted into the certificate manager and stays a trusted signer for every later connection on that context, so an affected long-running process needs its WOLFSSL_CTX torn down and not only its library replaced. All wolfSSL versions from 5.9.2 and earlier are affected; on versions 5.9.1 and 5.9.2 the WOLFSSL_OCSP_CHECKALL configuration fails closed with OCSP_NEED_URL, which leaves wolfSSL_CTX_EnableOCSP() without CHECKALL as the exposed configuration on 5.9.2. Found via the Anthropic OSS program. Fixed in PR 11500

• [Low] CVE-2026-94418 Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative() reaches its validity-date, name-constraint and critical-extension checks only after ConfirmSignature() has passed, so splitting the signature check out inverts the precedence that makes “override date errors” a sound policy, and ASN_SIG_CONFIRM_E is never surfaced anywhere. The attacker needs no key material from the real PKI and no CA compromise: a self-made certificate carrying the expected subject name, the trusted CA’s subject as its issuer, arbitrary bytes where the signature goes, a validity window in the past and the attacker’s own key pair is sufficient. Affected builds define WOLFSSL_SMALL_CERT_VERIFY, which is off by default, is not set implicitly by any platform or preset header, and is not reachable from any CMake option; the autotools routes are --enable-lowresource, --enable-leantls, --enable-tinytls13=cert and --enable-tinytls13=mutualauth, and examples/configs/user_settings_embedded.h reaches it through WC_CFG_SMALL_CERT_VERIFY, which ships as 0, while neither --enable-all nor --enable-distro enables it at all. The application must additionally install a verify callback through wolfSSL_CTX_set_verify() or wolfSSL_set_verify() with WOLFSSL_VERIFY_PEER that returns 1 for ASN_BEFORE_DATE_E or ASN_AFTER_DATE_E; wolfSSL ships this exact shape as myVerify() in wolfssl/test.h under VERIFY_OVERRIDE_DATE_ERR, which examples/client -D selects. An application with no callback, or whose callback returns preverify for date errors, still fails the handshake, and wolfSSL_CertManagerVerifyBuffer() and wc_CheckCertSignature() report ASN_SIG_CONFIRM_E correctly in the same binary. TLS 1.2 and TLS 1.3 are affected in both directions, and DTLS reaches the same function; where the forged certificate is a chain certificate the callback’s consent causes it to be cached in the WOLFSSL_CTX certificate manager, so an exposed deployment must restart the context or the process rather than merely reconnect. Releases v3.15.5 through v5.9.2 are affected. Found via the Anthropic OSS program. Fixed in PR 11500

• [Low] CVE-2026-94419 Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the process-global SessionCache, and ClientSessionToSession() validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the server and sent in clear, AddSessionToCache() matches any other server’s session on the same ID and overwrites the client-side entry with that server’s master secret, cipher suite and version, while the handle continues to resolve; nothing on the write path compares the peer, the application’s server ID or the WOLFSSL_CTX. Resuming through the handle then produces an abbreviated handshake in which no Certificate message is sent, so neither chain verification nor wolfSSL_check_domain_name() runs, and the attacker is accepted as the original server for the whole of that connection. Affected builds are those leaving NO_SESSION_CACHE_REF, NO_SESSION_CACHE, NO_CLIENT_CACHE and TITAN_SESSION_CACHE all undefined, which includes a plain ./configure, --enable-opensslextra and --enable-opensslall; fifteen integration options define NO_SESSION_CACHE_REF and are therefore not affected, among them --enable-all, --enable-distro, --enable-curl, --enable-nginx, --enable-haproxy, --enable-stunnel, --enable-wpas and the rest of the OPENSSL_COMPATIBLE_DEFAULTS family, and --enable-leanpsk, --enable-leantls, --enable-lowresource and --enable-tinytls13 disable the cache outright. The application must use the legacy reference flow, wolfSSL_get_session() or SSL_get_session() followed by wolfSSL_set_session(); wolfSSL_get1_session() returns the session object itself and is not affected, nor are wolfSSL_SetServerID() lookups. Only TLS 1.2 and below and DTLS 1.2 and below are reachable, since TLS 1.3 and ticket resumption with an empty ServerHello session ID both use a client-chosen cache key. The poisoned entry lives in the process-global cache, so it crosses WOLFSSL_CTX boundaries and persists until the entry is evicted or the session times out, 500 seconds by default. Releases v5.3.0 through v5.9.2 are affected; the fix adds a per-write generation counter to the cache and raises WOLFSSL_CACHE_VERSION from 2 to 3, so a cache persisted by an older build is rejected by a fixed one. Found via the Anthropic OSS program. Fixed in PR 11500

New Features

• Added make sbom (SPDX 2.3 + CycloneDX 1.6) and make bomsh (OmniBOR build provenance) targets for EU Cyber Resilience Act compliance. by @MarkAtwood (PR 10343)
• Added Argon2 (RFC 9106) password hashing with all three variants; Argon2d, Argon2i and Argon2id. --enable-argon2. Only version 0x13 is implemented. Provides the one-shot wc_Argon2()/wc_Argon2_ex() and a reusable context API (wc_Argon2Init/wc_Argon2SetParams/wc_Argon2DeriveTag/wc_Argon2Free, plus wc_Argon2New/wc_Argon2Delete unless WC_NO_CONSTRUCTORS) that allocates the memory block array once for applications deriving many tags. --enable-argon2-threads fills the segments of a slice in parallel, which does not change the derived tag: the one-shot functions use a thread per lane, and the context API takes a count from wc_Argon2SetThreads(). by @SparkiDev (PR 11165)
• Replaced the liboqs-based Falcon wrapper with a native wolfCrypt implementation (levels 1 and 5) with crypto callbacks, ARM DSP and AArch64 NEON acceleration, and removed the liboqs dependency. Falcon’s vector backends can now run inside the Linux kernel. by @danielinux (PR 10827, PR 10996)
• Added FrodoKEM with fast, small and small-stack C code and assembly for x86_64, AArch64, AArch32 and Thumb2, plus ASN.1 keys and X.509 certificates. by @SparkiDev (PR 10870)
• Added SLH-DSA (FIPS 205) authentication for the TLS 1.3 and DTLS 1.3 handshake (draft-reddy-tls-slhdsa), all twelve parameter sets. by @Frauschi (PR 10901)
• Added a Xilinx Versal Gen2 ASU port: TRNG, hashes, HMAC, AES ciphers, CMAC, GMAC, RSA (raw, PSS, OAEP), ECC, ECDH, ECIES, EdDSA and X25519/X448 offload, with Vitis 2026.1 support and a port README. by @night1rider (PR 10765, PR 10994, PR 11034, PR 11052, PR 11053, PR 11248, PR 11252)
• Added AES-GCM-SIV (RFC 8452) in C with assembly for Intel x64, ARM64, ARM32 and Thumb2. by @SparkiDev (PR 10807)
• Added KMAC and cSHAKE (SP 800-185), and switched the SHA-3 assembly on AMD CPUs to the faster BMI variant. by @SparkiDev (PR 10888)
• Added AES Key Wrap with Padding (RFC 5649) with crypto callback support. by @night1rider (PR 10718)
• Added a Time-Stamp Protocol (RFC 3161) implementation in wolfCrypt with an OpenSSL compatibility layer, tests, certificates and examples. wc_TspResponse_Verify() now requires a trusted TSA certificate, and the request/TstInfo message imprint setters cross-check the digest length against the hash algorithm. by @SparkiDev (PR 10778, PR 10868) and @yosuke-wolfssl (PR 11152, PR 11153)
• Added --enable-tinytls13, a TLS 1.3-only footprint profile (PSK + ECDHE floor with optional minimal X.509), and an in-memory smoke test in examples/tls13/tls13_memio.c. by @aidangarske (PR 10751)
• Added TLS receive read-ahead (--enable-readahead, WOLFSSL_TLS_READ_AHEAD) to cut the number of recv() calls per record. by @Frauschi (PR 10944)
• Added wolfSSL_CTX_require_psk() / wolfSSL_require_psk() to require that an external PSK is negotiated for a (D)TLS 1.3 handshake to succeed. by @Frauschi (PR 10745)
• Added wolfSSL_CTX_RequireExtendedMasterSecret() / wolfSSL_RequireExtendedMasterSecret() and wolfSSL_CTX_EnableExtendedMasterSecret() / wolfSSL_EnableExtendedMasterSecret() to enforce the Extended Master Secret requirement at runtime; wolfSSL_CTX_DisableExtendedMasterSecret() now also disables server-side EMS, not just the client side. by @kareem-wolfssl (PR 10978)
• Added a WOLFSSL_VERBOSE_LOGGING tier (WOLFSSL_MSG_VERBOSE(), WOLFSSL_ENTER_VERBOSE(), WOLFSSL_LEAVE_VERBOSE()) and moved the highest-volume traces onto it, cutting DEBUG_WOLFSSL unit test output by about 62%; WOLFSSL_DEBUG_OPENSSL is honored as an alias. by @dgarske (PR 11387)
• Added a DTLS 1.3 scheduled work API so a reader can send the work it schedules. by @Frauschi (PR 11018)
• Added a CRL unknown extension callback API mirroring the X.509 one, so unrecognized CRL extensions can be handled instead of failing with ASN_CRIT_EXT_E. by @anhu (PR 10961)
• Added public alt-name list APIs (wc_SetDNSEntry() and friends) so applications can build and attach SAN entries to a Cert without internal functions. by @Frauschi (PR 10768)
• Added wc_SignCRL_ex2() for signing CRLs with post-quantum and EdDSA keys. by @Frauschi (PR 10943)
• Added PKCS#7/CMS encode of degenerate certs-only SignedData, SignedData with absent eContent (signed-attributes-only), and a multi-certificate decode fix, for EST/SCEP enrollment. by @Frauschi (PR 10760, PR 10804)
• Added AES-GCM as an ECIES DEM alongside AES-CBC/CTR+HMAC, ECIES crypto callbacks and devId threading; fixed-nonce GCM is opt-in via WOLFSSL_ECIES_STATIC_GCM_NONCE. by @night1rider (PR 10883)
• Added WC_RNG_SEED_DEVICE to seed the DRBG from a nominated device such as /dev/hwrng before the default sources. by @dgarske (PR 11216)
• Added wc_ConstantCompare() as a public wrapper (guarded by WOLFSSL_NO_CONST_CMP). by @philljj (PR 10867)
• Added wc_ecc_key_new_ex(). by @holtrop-wolfssl (PR 11160)
• Added configurable SRAM PUF error correction (WC_PUF_BCH_T) and footprint (WC_PUF_NUM_CODEWORDS); the default build is byte-for-byte compatible with prior releases. by @dgarske (PR 11057)
• Added zero-copy encryption of AEAD application data in BuildMessage, roughly 1% to 3% faster on the send path; disable with WOLFSSL_BUILD_MSG_NO_ZERO_COPY. by @julek-wolfssl (PR 10899)
• Added WOLFSSL_WIDE_BYTE support for CHAR_BIT != 8 targets, validated on the TI C2000 C28x (LAUNCHXL-F28P55X), plus WOLFSSL_MLDSA_VERIFY_SMALLEST_MEM. by @dgarske (PR 10724)

Crypto Callback Additions

• Added WOLF_CRYPTO_CB_ONLY_SLHDSA, a crypto-callback-only mode for SLH-DSA that saves about 16 KB when the algorithm is offloaded. by @padelsbach (PR 11055)
• Extended TLS 1.3 asynchronous crypto callback support (WOLF_CRYPTO_CB returning WC_PENDING_E, driven by wolfSSL_AsyncPoll()) to the HKDF key schedule, transcript HMAC, AES-GCM record encrypt/decrypt, RNG, ECC/X25519 key shares and ECDSA/Ed25519 sign and verify; wc_HKDF_Extract_ex() and wc_HKDF_Expand_ex() now propagate WC_PENDING_E. by @dgarske (PR 11231)
• Added WOLF_CRYPTO_CB_ASYNC_POLL, a poll-to-complete model for crypto callback devices servicing TLS record ciphers; without it a pending bulk cipher now errors with ASYNC_OP_E instead of corrupting the record. by @julek-wolfssl (PR 10990)
• Added WC_ALGO_TYPE_KEYSTORE, a crypto callback algorithm type for lifetime operations on keys held in a hardware key store, with the public API in wolfssl/wolfcrypt/wc_keystore.h behind --enable-cryptocbutils=keystore. Seven operations - plaintext and wrapped import/export, derive, delete and get-info - address keys by an opaque device-defined reference, so a device can create, wrap, derive and destroy keys that never appear in memory. wc_KeyStore_Derive() takes a keySz argument to request the derived key size. by @Frauschi (PR 11336, PR 11425)
• Added crypto callbacks for HKDF extract/expand, AES CFB/OFB, SHAKE128/256, ECC public key derivation and validation (WC_PK_TYPE_EC_MAKE_PUB, WC_PK_TYPE_EC_CHECK_PUB_KEY), Ed448 sign/verify, CMAC free, and RSA-PSS verify with digest. by @twcook86 (PR 10598), @night1rider (PR 10748, PR 10750, PR 10886) and @rizlik (PR 10663)
• Added crypto-callback-only modes for Ed25519, Curve25519 (including make_pub and generic, saving about 6 KB) and Curve448 (with new wc_curve448_init_ex/new/delete and wc_curve448_generic), and --enable-cryptocb=only to turn on every WOLF_CRYPTO_CB_ONLY_* flag. by @padelsbach (PR 10830, PR 10832, PR 10955), @night1rider (PR 11209) and @JacobBarthelmeh (PR 11112)
• Added wc_CryptoCb_IsDeviceRegistered() and rejection of duplicate device registration with ALREADY_E. by @AlexLanzano (PR 10604)
• Added CryptoCb_Free for Falcon with tests and CI for the free hook on other algorithms. by @padelsbach (PR 11204)

Behavioral Changes

• ForceZero() no longer issues CPU fences. The wipe is kept alive by a compiler barrier (WC_BARRIER_DATA()) that takes the buffer address, so it is not optimized away for buffers that never leave the inlined code. A caller that needs the zeroed memory to be visible to another core must order it itself with a lock or an atomic release. by @julek-wolfssl (PR 11429)
• --disable-tlsv12 now defines WOLFSSL_NO_TLS12 and compiles the TLS 1.2 implementation out. Previously it only changed the configure summary and a peer could still negotiate TLS 1.2. by @Frauschi (PR 11324)
• PERSIST_SESSION_CACHE now saves and restores the entire session cache rather than the first session of each row. The on-disk layout changed, so WOLFSSL_CACHE_VERSION was bumped from v2 to v3; caches saved with v2 (file and memory) are no longer restorable. by @philljj (PR 11070)
• wc_PufReadSram() now health tests the raw SRAM readout and rejects a degenerate one (all-zero or all-one 128-bit blocks, a block repeating the previous one, or a Hamming weight outside WC_PUF_HW_MIN_PCT…WC_PUF_HW_MAX_PCT, 35% to 65% by default) with PUF_READ_E; wc_PufEnroll() and wc_PufReconstruct() refuse to run on a rejected readout. Qualify a candidate region with the new wc_PufCheckSram() and widen the band if the silicon warrants it. The helper-data format and derived key are unchanged, so helper data enrolled by 5.9.2 stays valid. by @dgarske (PR 11143)
• wolfSSL_shutdown() on a connection already closed or reset with no close_notify sent now returns WOLFSSL_FATAL_ERROR with SOCKET_PEER_CLOSED_E instead of 0 (WOLFSSL_SHUTDOWN_NOT_DONE), so a loop waiting on 0 terminates. Under OPENSSL_EXTRA this reports as WOLFSSL_ERROR_SYSCALL and adds an entry to the error queue; call wolfSSL_ERR_clear_error() if a non-empty queue after shutdown matters. by @SparkiDev (PR 11022)
• wolfSSL_X509_STORE_up_ref() only takes a reference on a store allocated with wolfSSL_X509_STORE_new(); a store owned by another object (such as the one wolfSSL_CTX_get_cert_store() returns when none was set) returns 1 without touching the count, matching wolfSSL_X509_STORE_free(). A NULL store still returns 0. by @SparkiDev (PR 11022)
• wolfSSL_OCSP_parse_url() (OCSP_parse_url) was rewritten to follow OpenSSL. An omitted scheme means http, the scheme is matched case sensitively, IPv6 literals keep their brackets, userinfo up to the first @ of the authority is discarded, the port is reported as written, the query stays with the path and the fragment is dropped. A CR or LF anywhere in the URL and an empty host are still refused. Applications that log, pin or allow-list a responder must use the host this function returns rather than the URL it was given. by @SparkiDev (PR 11022)
• wolfSSL_set0_verify_cert_store() and wolfSSL_set1_verify_cert_store() now treat a NULL store as a request to clear the store set on the SSL object and revert to the context’s store, returning 1. by @SparkiDev (PR 11022)
• wolfSSL_read_ex() and wolfSSL_write_ex() return BAD_FUNC_ARG for a NULL object in every build instead of 0, which is also the value for “no application data was transferred”. Callers treating any non-1 result as failure are unaffected. by @SparkiDev (PR 11022, PR 10926)
• wolfSSL_CTX_set_client_cert_cb() and client_cert_cb are now declared only under WOLFSSL_CERT_SETUP_CB with OPENSSL_EXTRA, the one configuration where the setter could compile. by @SparkiDev (PR 11022)
• wolfSSL_write_early_data() now fails with WOLFSSL_FATAL_ERROR and TOO_MUCH_EARLY_DATA at the AEAD key usage limit instead of sending a KeyUpdate before the handshake completes (RFC 9846 Section 5.5), and the budget stops one record short to leave room for EndOfEarlyData. Callers that hit this should abandon early data rather than resume from an offset. Reaching the limit takes roughly 23.7 million early data records. by @SparkiDev (PR 11215)
• LMS/XMSS keys restored with wc_LmsKey_Reload() / wc_XmssKey_Reload() carry no public key. The ExportPubRaw, ExportPub, ExportPub_ex, PublicKeyToDer and Verify functions now return BAD_STATE_E for such a key. by @Frauschi (PR 11426)
• A TLS 1.3 server now answers a ClientHello carrying a non-empty legacy_session_id with a ChangeCipherSpec record (RFC 8446 Appendix D.4) in every build, not only under WOLFSSL_TLS13_MIDDLEBOX_COMPAT. by @Frauschi (PR 11306)
• The default ticket encryption callback rotates two keys and can only honor a hint below half of WOLFSSL_TICKET_KEY_LIFETIME. A larger hint previously left no key available and failed every handshake after the first rotation; the server now continues without issuing a ticket instead. by @mattia-moffa (PR 10822)
• wolfSSL_X509_STORE_CTX_set_verify_cb() is now honored, taking precedence over the store’s callback. Restrictive callbacks installed on a context, and the pathLen / INVALID_CA overrides, now take effect in OPENSSL_EXTRA builds. by @Frauschi (PR 11094)
• wolfSSL_CTX_set_cipher_list() and wolfSSL_set_cipher_list() now return WOLFSSL_FAILURE and leave the configured suites unchanged when the list names only TLS 1.3 suites but the context or object cannot negotiate TLS 1.3 (OPENSSL_EXTRA builds). Previously they returned success without applying the list. by @miyazakh (PR 10963)
• SSL_get_cipher_list() now enumerates the object’s configured cipher list, highest priority first, rather than returning only the negotiated cipher at index 0. by @julek-wolfssl (PR 11003)
• OCSP responder authorization: the OCSP responder certificate’s signature is now verified in the default WOLFSSL_ASN_TEMPLATE build; a responder whose certificate does not verify is rejected. by @holtrop-wolfssl (PR 11195)
• WOLFSSL_SEND_HRR_COOKIE split: WOLFSSL_TLS13_COOKIE now enables only client-side cookie echo; WOLFSSL_SEND_HRR_COOKIE still selects both server and client behavior. by @padelsbach (PR 11101)
• --enable-all-crypto no longer pulls non-FIPS or legacy algorithms into FIPS builds. The new --enable-all-nonfips-crypto and --enable-all-legacy-crypto bundles hold those algorithms and can be enabled or disabled explicitly alongside --enable-all-crypto for subtractive selection. by @douzzer (PR 11383)
• WC_RNG gains a per-instance lock and POSIX-conforming fork handlers so one RNG can be shared between threads and across fork(); on by default where the build supports it, opt out with --disable-rng-autolock and --disable-rng-autofork. TLS performance is unchanged since each WOLFSSL owns its RNG. by @kaleb-himes (PR 11210)

Post-Quantum Cryptography (PQC)

• Added support for post-quantum-only TLS 1.3 builds (ML-KEM key exchange with ML-DSA or SLH-DSA authentication, no RSA/ECC/DH), and fixed the TLS 1.3 certificate chain send resuming after WANT_WRITE. by @Frauschi (PR 11096)
• Added ML-DSA (FIPS 204) signing and verification for PKCS#7/CMS SignedData (RFC 9882). by @Frauschi (PR 10759)
• Added ML-DSA to the OpenSSL compatibility layer. PEM/DER private and public key read, X509_sign, X509_REQ_sign, X509_set_pubkey, and fixed verifyX509orX509REQ() and the ML-DSA OID handling. by @kojo1 (PR 10962) and @stenslae (PR 10785)
• Added ML-KEM assembly for AVX512F/AVX512VBMI and ML-DSA assembly for AVX512F/BW/VBMI with AVX2 improvements. by @SparkiDev (PR 10981, PR 11032)
• Added --enable-all-quantum-crypto to enable every quantum-resistant asymmetric algorithm. by @douzzer (PR 10920)
• Enforced FIPS 205 pre-hash rules for SLH-DSA (SHA-256 and SHAKE128 only at the lowest security level) and fixed a PKCS#7 test callback typedef. by @kaleb-himes (PR 11265)
• Validate ML-DSA s1/s2 coefficient bounds in wc_dilithium_check_key() and added further ML-DSA checks. by @MarkAtwood (PR 10254) and @padelsbach (PR 11056)
• Made the ML-DSA low-bits check constant time in the C and x64 assembly implementations. by @SparkiDev (PR 11371)
• Fixed unaligned reads and casts in ML-KEM and ML-DSA, and a misspelled __aarch64__ guard. by @SparkiDev (PR 10707), @kojiws (PR 10816, PR 10839) and @Frauschi (PR 10958)
• Fixed ML-DSA level auto-detection in WOLFSSL_MLDSA_NO_ASN1 builds. by @stenslae (PR 10852)
• Route wc_MlDsaKey_SignCtx() through the crypto callback before the private key check so device-resident ML-DSA keys can sign. by @aidangarske (PR 10979)
• Fixed signed-shift undefined behavior in the SLH-DSA base_2b accumulator and the ML-DSA gamma1_19 encoder and slow-multiply reductions. Thanks to Dominik Blain of Qreative Lab for the reports. by @MarkAtwood (PR 10917, PR 10918, PR 10919)
• Fixed multiple issues in XMSS and added LMS bounds checks. Thanks to 007bsd for the report. by @kareem-wolfssl (PR 11189)
• Fixed LMS/XMSS Reload skipping the software reload when a read callback is set on a device id. by @Frauschi (PR 11059)
• Runtime-dispatch the ML-KEM SHA-3 crypto extension on ARM64 to fix SIGILL on CPUs without FEAT_SHA3. by @dgarske (PR 11123)
• Added missing ForceZero of ML-KEM/ML-DSA private key data. Identified by Uday Devaraj, SYNE Lab, Syracuse University. by @Frauschi (PR 10683, PR 10697)
• wc_SlhDsaKey_Export* now return MISSING_KEY when no key is present. by @holtrop-wolfssl (PR 11268)
• Added Windows project support for FIPS v7 with the post-quantum algorithm files in the module hash range. by @kaleb-himes (PR 11338)

TLS/DTLS

• Added verify-only secondary DTLS cookie secrets for application-driven rotation of the DTLS 1.2 HelloVerifyRequest and DTLS 1.3 HelloRetryRequest cookie secrets. by @julek-wolfssl (PR 10634)
• RFC 9846 (TLS 1.3 update) conformance: added the general_error(117) alert, capped sender key updates at 2^48-1, accept empty CertificateRequest extensions, updated cert_with_extern_psk to RFC 9973, parse the sniffer keylog line by line (RFC 9850), and honor SSLKEYLOGFILE. Early-data AEAD limits, user_canceled handling and decode_error alerts are covered under Behavioral Changes and Bug Fixes. by @Frauschi (PR 10941) and @SparkiDev (PR 11215)
• Enforce Extended Key Usage on chain-supplied intermediate CAs: ProcessPeerCerts() now applies the serverAuth/clientAuth purpose check to every CA the peer transmits and fails the handshake with EXTKEYUSE_AUTH_E when the CA does not carry the purpose in use. An absent extension and anyExtendedKeyUsage leave all purposes valid (RFC 5280 4.2.1.12), self-signed certificates are exempt, and IGNORE_KEY_EXTENSIONS opts out. Adds WOLFSSL_X509_V_ERR_INVALID_PURPOSE. by @embhorn (PR 11145)
• Fixed TLS 1.3 early data: fatal bad_record_mac when an accepted 0-RTT record fails to decrypt, reject 0-RTT for tickets minted before the server context existed, and added a WOLFSSL_TLS13_MIDDLEBOX_COMPAT build option. by @julek-wolfssl (PR 11097) and @Frauschi (PR 11379)
• Enforce the RFC 5746 renegotiation_info check in the TLS 1.2 client by default, with a new wolfSSL_CTX_set_scr_check_enabled(). Thanks to Lucca Hirschi and the puffin team at Inria for the report. by @embhorn (PR 10984)
• Enforce the RFC 8446 SHA-1 certificate rule against the peer’s signature_algorithms_cert on TLS 1.3 chains. Thanks to Xiangdong Li (Beijing University of Posts and Telecommunications) for the report. by @embhorn (PR 11185)
• Stopped offering SHA-1 signature schemes for TLS 1.2 by default, enforced attribute certificate validity, zeroized the secure renegotiation key copy, and send unexpected_message on EndOfEarlyData in DTLS 1.3. by @Frauschi (PR 10968)
• Do not export keying material until the handshake is complete, check ticket expiration before using a ticket for resumption, and stop advertising NULL cipher suites by default (WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT restores them). Thanks to Ben Smyth for the report. by @kareem-wolfssl (PR 10594)
• Enabled the TLS_FALLBACK_SCSV check unconditionally. by @yosuke-wolfssl (PR 10661)
• Mask the top bit of a peer’s X25519 public value per RFC 7748 instead of rejecting it, in wolfCrypt and in the TLS 1.2 and 1.3 key exchange paths; WOLFSSL_X25519_NO_MASK_PEER restores rejection. by @SparkiDev (PR 10713) and @miyazakh (PR 11283)
• Reject a HelloRetryRequest lacking supported_versions before a downgrade-capable client falls back to TLS 1.2, send missing_extension for it, and avoid duplicate protocol_version alerts. by @embhorn (PR 10892) and @kareem-wolfssl (PR 10811, PR 10764)
• Send illegal_parameter for a bad ServerHello supported_versions, decrypt_error for a TLS 1.3 PSK binder failure, protocol_version when no version can be negotiated, record_overflow in every build, and unexpected_message for a duplicate TLS 1.3 handshake message. by @gasbytes (PR 11106), @Frauschi (PR 11105, PR 11094), @embhorn (PR 10795) and @julek-wolfssl (PR 10930)
• Send unsupported_extension for quic_transport_parameters on a non-QUIC connection (RFC 9001) and reject trusted_ca_keys outside the ClientHello in TLS 1.3. by @gasbytes (PR 11304)
• Forbid supported_versions from being sent for TLS versions below 1.3, forbid sending more than one certificate with Raw Public Keys, confirm the QUIC max_early_data_size is 0xffffffff, and distinguish QUIC alerts from TLS alerts in the alert history. by @kareem-wolfssl (PR 11174)
• Only process ChangeCipherSpec after the ClientKeyExchange has been sent, fixed the verification logic for Raw Public Keys, clear legacy_session_id when using TLS 1.3, and forbid Certificate messages for PSK handshakes. Thanks to Anthropic for the reports. by @kareem-wolfssl (PR 11458)
• wolfSSL_SetVersion() is now reflected in the advertised versions and downgrade handling. by @padelsbach (PR 11456)
• Reject a TLS 1.3 ClientHello with no mutually supported group with a handshake_failure alert instead of picking a server-only group and hanging until timeout (RFC 8446 4.2.1). by @julek-wolfssl (PR 11253)
• wolfSSL_is_init_finished() no longer reports a TLS 1.3 client handshake complete while its Finished message is still buffered after WANT_WRITE. by @gasbytes (PR 11139)
• Send close_notify after user_canceled even under quiet shutdown, as the RFC 9846 pairing requires. by @night1rider (PR 11264)
• Enforce the RFC 8446 certificate_authorities lower bound on send and receive. by @night1rider (PR 11118)
• Reject a zero-length TLS 1.3 session ticket. by @philljj (PR 11114)
• Harden TLS 1.3 NewSessionTicket handling per RFC 9846: validate the extensions framing in every build (decode_error on malformed framing), and optionally only issue tickets to clients that advertised psk_key_exchange_modes (WOLFSSL_TLS13_TICKET_CHECK_PSK_MODES). by @julek-wolfssl (PR 11178)
• The default session ticket encryption callback now uses AES-256-GCM when available; unknown FFDHE-range codepoints in supported_groups are retained per RFC 7919, with enforcement gated on WOLFSSL_QT. by @mattia-moffa (PR 11161)
• Reassemble fragmented TLS 1.3 post-handshake messages after the handshake arrays are freed. by @julek-wolfssl (PR 10691)
• Check the context’s extensions before rejecting a TLS 1.3 Certificate message extension, so OCSP stapling requested on the CTX is accepted. by @aidangarske (PR 10936)
• Fixed TLS 1.3 post-handshake authentication with OCSP stapling and repeated PHA over write_dup. by @kojo1 (PR 10421)
• Do not select RSA-PSS in TLS 1.2 when the RSA key is too small for the signature. by @kojo1 (PR 10866)
• Reject status_request_v2 ocsp-multi staples bundling multiple SingleResponses. by @gasbytes (PR 10747)
• Reworked ECH public-extension handling into a public extension manager, fixed the ECH AAD offset with read-ahead, and use the DTLS-aware header size for the inner ClientHello. by @sebastian-carpenter (PR 10568), @gasbytes (PR 11310) and @aidangarske (PR 10878)
• Free and reset all five QUIC encryption levels in wolfSSL_quic_clear(), declare the QUIC record length from the bytes remaining, and fixed a QUIC buffer underflow. by @gasbytes (PR 11196), @yosuke-wolfssl (PR 11045) and @loganaden (PR 10838)
• Forbid a post-handshake CertificateRequest over QUIC and zero a MAX3266X result buffer before use. by @mattia-moffa (PR 11299)
• Aligned wolfSSL_set1_groups_list() with OpenSSL: case-insensitive names and MLKEMxxx aliases. by @Frauschi (PR 10686)
• Fixed wolfSSL_inject() appending data at the wrong offset. by @yosuke-wolfssl (PR 11044)
• Clear SSL-owned credentials when switching context with wolfSSL_set_SSL_CTX(), fixing a stale chain and a double free. by @yosuke-wolfssl (PR 11330)
• Set sess_free_cb to NULL after calling it. Thanks to Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Yu, Xiaotian Zhou, Ali Ranjbar, Ananna Rahman, Syed Rafiul Hussain for the report. by @philljj (PR 10989)
• Report NID_auth_any for TLS 1.3 ciphers in wolfSSL_CIPHER_get_auth_nid(). by @julek-wolfssl (PR 11255)
• Return an error when Raw Public Key is used with the stubbed DANE compatibility API. Thanks to Peter Samarin for the report. by @embhorn (PR 10486)
• Check the CRL when a peer certificate names no OCSP responder instead of collapsing the no-URL result onto success, report a WOLFSSL_SMALL_CERT_VERIFY signature failure ahead of the later parse errors, and bind a client session cache reference to the entry contents it was issued for. Thanks to Anthropic for the reports. by @Frauschi (PR 11500)
• Rework post-handshake checks for resumed connections. Thanks to Jauhun Lee for the report. by @kareem-wolfssl (PR 11198)
• TLS 1.3-only builds now leave out the TLS 1.2 transcript state (handshake hashes drop from 864 to 352 bytes) and the SHA-512 transcript unless WOLFSSL_TLS13_SHA512 is set; new --enable-tls13-sha512 / CMake WOLFSSL_TLS13_SHA512 options. by @Frauschi (PR 11343)
• DTLS: allow WOLFSSL_DTLS_CID with DTLS 1.2, added receive-side DTLS 1.3 RequestConnectionId/NewConnectionId handling, check a CID record is newest before promoting a pending peer, and return an error on bad CID arguments. by @mattia-moffa (PR 10626) and @rizlik (PR 11364)
• DTLS: preserve the association on invalid record headers during the handshake, take the write lock when setting the pending peer, and clear the dtls_tx_msg cursor when its record is freed. by @yosuke-wolfssl (PR 10826), @Frauschi (PR 11018) and @julek-wolfssl (PR 10982)
• DTLS: only acknowledge DTLS 1.3 handshake records whose messages were processed or buffered (RFC 9147 Section 7), refuse to send a DTLS 1.2 record or accept a renegotiation that would wrap the epoch sequence number and reuse AEAD nonces, and further Connection ID fixes. by @julek-wolfssl (PR 11177)
• DTLS: drop datagrams from an unexpected address once the peer was learned from the first datagram, drop datagrams that do not parse as a handshake message until the server has verified the peer, and prime the replay window when the handshake turns stateful so every earlier record number counts as seen. Found via the Anthropic OSS program. by @gasbytes (PR 11521)
• DTLS 1.3: send the correct second ClientHello when the server sends no HelloRetryRequest, check handshake message lengths, bound the ACK list, verify the echoed legacy_session_id, and improved epoch management. Reported by Jorge Milla (Pig-Tail). by @rizlik (PR 10730, PR 10769, PR 11016), @kareem-wolfssl (PR 10833) and @aidangarske (PR 10922)
• DTLS 1.3: use the correct Connection ID transmit output size. Thanks to Abdullah Al Ishtiaq, Kai Tu, Matthew Carter, Xiaotian Zhou, Ananna Rahman, Yilu Dong, Tianwei Yu, Ali Ranjbar and Syed Rafiul Hussain (SyNSec Lab, The Pennsylvania State University) for the report. by @rizlik (PR 11320)
• Fixed a couple of issues in DTLS ClientHello parsing. Thanks to the Fuzz0x team for the report. by @kareem-wolfssl (PR 11007)
• Corrected the sniffer reassembly logic, fixed the handshake message size in BuildCertificateStatus when renegotiating with OCSP stapling, ensure the MTU is set when using SCTP with DTLS, and improved the SCTP examples. Thanks to 007bsd for the report. by @kareem-wolfssl (PR 11211)
• Added --enable-asynccrypt-sw end-to-end support with --enable-all, fixing five async defects in the record layer, ECCSI and tests. by @Frauschi (PR 11060)
• Added TLS 1.2 RSA PKCS#1 v1.5 negative tests, a TLS 1.3 CertificateVerify signature algorithm test, and more TLS certificate verification mode tests. by @gasbytes (PR 10777) and @SparkiDev (PR 10815, PR 11333)
• Added examples/benchmark/dtls_bench, a DTLS throughput benchmark, and optimized the DTLS send path (cached socket-type probe, sequence number as explicit AEAD nonce). by @julek-wolfssl (PR 10551)

OpenSSL Compatibility Layer

• Added Ed25519 support across the EVP/PEM/X.509 compatibility surface (requires --enable-ed25519 --enable-certgen). by @ordex (PR 10722)
• Added EVP_PKEY_set1_encoded_public_key() / EVP_PKEY_get1_encoded_public_key() and the deprecated tls_encodedpoint names. by @julek-wolfssl (PR 10607)
• Added SSL_CTX_add_client_custom_ext() for TLS 1.2 and below. by @julek-wolfssl (PR 10625)
• Added BIO_get_new_index(), i2d_PUBKEY_bio() and OpenSSL_version(). by @julek-wolfssl (PR 11020)
• Added SSL_get_negotiated_group() and SSL_group_to_name(), accept FFDHE group names in SSL_set1_groups_list(), define WOLFSSL_SIGNER_DER_CERT for OPENSSL_ALL so X509_STORE_get0_objects() returns the added certificates (opt out with WOLFSSL_NO_SIGNER_DER_CERT), and run the X509_VERIFY_PARAM host/IP checks in ProcessPeerCerts() before the application verify callback. by @julek-wolfssl (PR 11108)
• Added wolfSSL_set_tlsext_debug_callback() (SSL_set_tlsext_debug_callback), invoked for every TLS extension received during the handshake. by @julek-wolfssl (PR 11256)
• Added SSL_CIPHER_find(), sk_SSL_CIPHER_delete() and SSL_clear_chain_certs(), and fixed SSL_add0_chain_cert() not counting the chain so TLS 1.3 sent a leaf-only certificate. by @Roy-Carter (PR 10518, PR 10517)
• Added compatibility needed by libodbc: OBJ_find_sigid_algs, BIO method accessors, and related constants and macros. by @kojo1 (PR 10813)
• Added X509_STORE_CTX_set0_crls() for OpenVPN, with caller-owned CRLs checked during verification. by @julek-wolfssl (PR 10896)
• d2i_ECPrivateKey() now derives the public key when it is absent from the DER. by @MarkAtwood (PR 10362)
• X509_verify_cert() no longer mutates the shared store certificate stack, fixing races between concurrent verifications. by @julek-wolfssl (PR 10997)
• Report X509_VERIFY_PARAM hostname/IP mismatches to the verify callback so it can override them, and map them to X509_V_ERR_HOSTNAME_MISMATCH / X509_V_ERR_IP_ADDRESS_MISMATCH under OPENSSL_COMPATIBLE_DEFAULTS. by @gasbytes (PR 11156) and @julek-wolfssl (PR 11260)
• X509_STORE_CTX_init() and a new WOLFSSL object now inherit the full X509_VERIFY_PARAM (hostname, IP and host flags) from the store and CTX. by @gasbytes (PR 11513)
• Clear the trusted stack on X509_STORE_CTX_init() so it does not carry into a later verification. by @gasbytes (PR 11354)
• Fixed X509_NAME_print_ex() flag handling, implemented ASN1_STRFLGS_ESC_2253/ESC_CTRL/ESC_MSB, and write values byte for byte so an embedded NUL no longer leaks heap bytes. by @julek-wolfssl (PR 11395)
• Bounds check the directory path when adding a certificate directory with X509_LOOKUP_add_dir(). by @aidankeefe2022 (PR 11269)
• wolfSSL_EVP_Cipher() no longer swallows the return code of the single-DES CBC branch, which reported success on a failed operation. by @miyazakh (PR 11411)
• Locked globalRNGMutex around every shared globalRNG access, including BN_rand, AddSession, ECDH and X25519. by @yosuke-wolfssl (PR 10824, PR 11048)
• Skip the truncation shift for byte-aligned BN_rand() requests. by @yosuke-wolfssl (PR 11316)
• Fixed buffer overruns in SignCert(), EVP_PKEY_keygen() on a populated key and the WOLFSSL_NO_REALLOC populate paths, plus stale EVP_PKEY key metadata. by @Frauschi (PR 11061)
• Return 0 from the error queue APIs when the queue is not compiled in. by @stenslae (PR 10785)

ASN and Certificate Parsing

• Added WOLFSSL_X509_TINY (minimal-extension X.509 parser with per-feature add-backs) and WOLFSSL_X509_VERIFY_ONLY profiles, cutting roughly 6% to 18% off the certificate parser, with CI coverage. by @aidangarske (PR 10823, PR 10975)
• Added true zero-allocation X.509 certificate verification for strict WOLFSSL_NO_MALLOC builds via the internal WC_ASN_NO_HEAP path. by @aidangarske (PR 10821)
• Fixed a directoryName name constraints bypass by comparing RDN sequences per RFC 5280 7.1 with RFC 4518 string preparation, instead of a byte prefix. by @holtrop-wolfssl (PR 11140)
• Reject certificates with trailing data (opt out with WOLFSSL_NO_ASN_STRICT). Thanks to Lucca Hirschi (Inria, France) and the tlspuffin team for the report. by @kareem-wolfssl (PR 10755)
• Enforce RFC 5280 MUSTs under WOLFSSL_NO_ASN_STRICT: unknown critical extensions, duplicate extensions and dirName constraints on SANs. by @aidangarske (PR 10922)
• Reject certificates with critical policyConstraints / inhibitAnyPolicy, empty certificatePolicies, trailing bytes after the last PolicyInformation, and duplicate netscape certificate type extensions. by @aidangarske (PR 10878), @gasbytes (PR 11221) and @JacobBarthelmeh (PR 11236)
• Enforce MAX_CHAIN_DEPTH when loading chains, sending OCSP status and sending the TLS 1.3 Certificate message, with parser input validation. by @ColtonWilley (PR 10209)
• Fixed X.509 pathLen handling, partial-chain double push, and allow maxPathLen up to WOLFSSL_MAX_PATH_LEN. by @kareem-wolfssl (PR 10737)
• Ensure presented chain certificates are not added to the trust store and fixed a missing certChainCnt increment. by @padelsbach (PR 11305)
• Parse x500UniqueIdentifier (OID 2.5.4.45) in certificate DNs. by @embhorn (PR 10999)
• Added SSH server and missing SSH client extended key usage parsing to the ASN template parser and handle EKU OID collisions. Thanks to Satoru Kanno (GMO Connect Inc / GMO Internet Group Inc.) for the report. by @JacobBarthelmeh (PR 11361)
• Fixed certificate name id lookup when WOLFSSL_CERT_NAME_ALL is defined (the table lacked entries for the extra OIDs) and fixed --disable-rsa builds. by @SparkiDev (PR 11421)
• Track the actual ASN template depth and compare it to the expected depth. by @SparkiDev (PR 11404)
• Improved URI host extraction. Thanks to Satoru Kanno for the report. by @rizlik (PR 11439)
• Encode the basicConstraints critical flag and pathlen into generated CSRs. by @cconlon (PR 11030)
• Encode default certificate validity as UTCTime through 2049. by @aidangarske (PR 11228)
• MakeAnyCert() now strips leading zeros from caller-supplied serials so the DER INTEGER is minimal and the generated certificate parses, bounds serialSz to CTC_SERIAL_SIZE, and rejects a zero serial (RFC 5280 4.1.2.2). by @embhorn (PR 11433)
• Fixed KeyUsage decipherOnly encoding in the template certificate generator and int/word32 type punning in ASN.1 and EVP helpers. by @dgarske (PR 11171)
• Restored the error code from DecodeGeneralName() so hostname matching still runs on a SAN with an embedded NUL. by @embhorn (PR 10793)
• Guard an empty otherName SAN copy against a NULL memcpy. by @night1rider (PR 11117)
• Reject CR/LF in OCSP and CRL URLs from certificates and in OpenSSL-compat OCSP request paths and headers, and bound the port in wolfIO_DecodeUrl(). by @yosuke-wolfssl (PR 10628), @ejohnstown (PR 10966) and @kareem-wolfssl (PR 10675)
• Fixed a use-after-free in GetCRLInfo() under WOLFSSL_SMALL_STACK, a CRL load race in BufferLoadCRL(), an uninitialized EncryptedInfo in PEM CRL chain loading, and deep copy revoked entry extensions in DupCRL_Entry(). by @padelsbach (PR 10693, PR 10716), @yosuke-wolfssl (PR 11046) and @gasbytes (PR 11038)
• Fixed an off-by-one NUL write in GetCertName() in the classic ASN.1 parser. Thanks to Frans van Buul (OpenText Fortify) for the report. by @embhorn (PR 10952)
• Fixed a memcpy length overflow in wolfSSL_d2i_ASN1_INTEGER(). Thanks to SecBuddyF, Tencent KeenLab, for the report. by @padelsbach (PR 10861)
• Fixed an off-by-one in pem_find_pattern() rejecting PEM without a trailing newline. by @gasbytes (PR 11259)
• Check the CALLOC_ASNGETDATA result before use in DecodeCertInternal(). by @danielinux (PR 11378)
• Fixed the ASN guards for RSA key DER export in ECC-free SE050 builds. by @LinuxJedi (PR 11220)
• Added opt-in OCSP hardening: WOLFSSL_OCSP_SCREEN_RESPONDER blocks AIA responder hosts in internal address ranges (SSRF, CWE-918), and WOLFSSL_OCSP_FAIL_IF_NOT_SUPPORTED fails a certificate that advertises no responder; a missing responder now reports the distinct OCSP_NO_URL. by @ejohnstown (PR 10723, PR 10945)
• Added WOLFSSL_ASYNC_CERT_YIELD, an opt-in that returns WC_PENDING_E after each certificate in a peer chain is verified during async TLS chain processing. by @dgarske (PR 10738)
• Added a trusted argument to the Ed25519/Ed448 private key DER decode to skip key checks. by @rizlik (PR 10911)

Hardware and Embedded Ports

• Added an STM32 bare-metal crypto port (HASH, AES, PKA, RNG) needing no HAL, with DHUK (Device Hardware Unique Key) and CCB hardware-protected ECDSA, validated across ~27 STM32 families. by @dgarske (PR 10395, PR 10880)
• Added STM32 CubeMX and RealTek crypto-callback devices for plaintext-key AES, hardware AES-GCM and ECDSA. by @dgarske (PR 10970)
• Added STM32V8 (Cortex-M85, Armv8.1-M) hardware crypto family support (WOLFSSL_STM32V8), validated on the NUCLEO-V873XJ. by @dgarske (PR 11296)
• Added STM32CubeMX2 (MX2) support: automatic pickup of the MX2-generated configuration (keyed off WOLFSSL_MX2_CONF_INCLUDE), the pack codegen assets, and HAL2 console support in the STM32Cube example. by @dgarske (PR 11348, PR 11466)
• Fixed the STM32 SAES DHUK wrapped-key unwrap so wc_Stm32_Aes_Wrap() blobs unwrap and are interchangeable with ST’s HAL (this changes every DHUK-derived key), and wc_ecc_import_wrapped_private() now takes the curve id so an imported wrapped scalar is ready to sign. by @dgarske (PR 11462, PR 11497)
• Added a RealTek AmebaPro2 (RTL8735B) HUK crypto-callback port (AES, HMAC-SHA256, ECDSA, TRNG). by @dgarske (PR 10677)
• Added a WISeKey/SealSQ VaultIC secure element port (P-256 sign, verify, keygen, ECDH). by @dgarske (PR 10974)
• Added Vorago VA416x0 hardware TRNG support. by @dgarske (PR 10671)
• Added wolfCrypt support for the TI C2000 C28x DSP family, including the AESA hardware AES accelerator (ECB/CBC/CTR) as a crypto-callback device, an oscillator-jitter entropy source, 16-bit-byte fixes, octet packing helpers and an optional precomputed ML-DSA matrix A. by @dgarske (PR 10724, PR 11202, PR 11344)
• Added UDP support to NetX sockets for DTLS sessions. by @hmohide (PR 10408)
• Fixed the NetX I/O porting layer: NX_NO_PACKET, NX_WINDOW_OVERFLOW and NX_TX_QUEUE_DEPTH now map to WANT_READ/WANT_WRITE so non-blocking operation works, NX_NOT_CONNECTED to a connection close, and the HAVE_NETX socket error aliases were corrected. by @embhorn (PR 11287)
• Zephyr: native k_mutex/k_thread threading without CONFIG_POSIX_THREADS, wolfPSA provider support, and stack tracking in the benchmark. by @Frauschi (PR 10983)
• Zephyr: use UMAAL-free SP math on every M-profile core without the DSP extension, build the .S assembly files on Zephyr, check OSXSAVE/XGETBV before dispatching AVX code, call Zephyr’s clock API instead of remapping the POSIX names, reworked the module’s Kconfig, and added Kconfig symbols for a constant-time AES backend (WOLFSSL_AES_CONSTANT_TIME with touch-lines or bitsliced) and WC_ALLOW_ECC_ZERO_HASH so wolfPSA builds without a settings file. by @Frauschi (PR 11401, PR 11431, PR 11522)
• SE050: dynamic hardware/software offload by key residency, ECDH derive target objects for applet 7.2 middleware, a scratch buffer for raw RSA verify, software ECDH fallback for non-resident keys, C++ header guards, and simulator CI updates. by @rizlik (PR 10862), @LinuxJedi (PR 10971, PR 11194, PR 11206) and @embhorn (PR 11284)
• SE05x: added session lifecycle, policy-aware key insertion and on-chip key generation, binary object management, runtime Platform SCP03 credentials with key rotation, and nonce-bound attestation APIs. by @LinuxJedi (PR 11377)
• Intel QuickAssist: interleave instances across devices, fall back to regular memory when the service is not started, and fixed a Cavium/Nitrox event queue overflow and a TLS 1.3 hybrid PQC key share drop under async crypt. by @dgarske (PR 10772)
• PKCS#11: set label and ID on generated EC public keys, and allow a generated EC key to both derive and sign via WC_ECC_FLAG_DERIVE. by @aidangarske (PR 10954) and @dgarske (PR 11201)
• Fixed Octeon AES-GCM non-12-byte IV and tag verification, and TI AES-CTR streaming, hashCopy and alignment checks. by @dgarske (PR 11148, PR 10986)
• Renesas: RX72N TSIP lock leak, hash return and AES-GCM AAD fixes with command-line build/flash/UART tooling, RA6M4 SCE session-key fixes, and bounded crypto callback context slots. by @miyazakh (PR 10842, PR 10903) and @Frauschi (PR 11093)
• Fixed the STM32 CubeMX AES-GCM AAD over-read from HAL word reads (ST SA0076). by @dgarske (PR 11102)
• NXP: DCP hash channel and lock fixes, hashcrypt AES OFB/CFB streaming state and AES ECB/CBC argument and zero-length validation, CAAM/QNX resource manager input checks, and a missing caamAesCombined declaration. by @danielinux (PR 11282), @night1rider (PR 11262, PR 11261) and @JacobBarthelmeh (PR 11263, PR 11535)
• PSA and KCAPI AES: restart the cipher stream on wc_AesSetIV() so a new IV takes effect. by @danielinux (PR 11158)
• AF-ALG: fixed AES-GCM struct reuse across encrypt and decrypt, redirect AES-ECB, added input checks and a CI workflow; fixed AAD/no-AAD handle interchange and argument validation in AF-ALG and KCAPI. by @JacobBarthelmeh (PR 11162) and @douzzer (PR 10881)
• TROPIC01: keep the caller’s IV in the AES-CBC callback and derive the GHASH subkey from the device key. by @danielinux (PR 11366)
• STSAFE: normalize the digest to the field size in ECDSA verify. by @danielinux (PR 11281)
• IoT-Safe: serialize APDU transactions with a port mutex. by @danielinux (PR 11246)
• MAX32666: streaming SHA and bare-metal TRNG health test on the old SDK. by @mattia-moffa (PR 10733)
• ColdFire: clamp the AES-CBC chunk to the remaining length. by @aidangarske (PR 11223)
• RISC-V port: argument checks and KEYUSAGE_E for AES without a key schedule. by @danielinux (PR 10864)
• ARM CryptoCell: improved (de)initialization and return an error for disabled hash types in RSA hash mode. by @holtrop-wolfssl (PR 11266) and @dgarske (PR 11170)
• Fixed alignment issues in bitsliced AES, scrypt and SHA-256, and staged block data through aligned buffers in STM32 CRYP and Renesas SCE. by @dgarske (PR 11170)
• Fixed FSPSM RSA outLen, devcrypto init tracking and AES tag placement, and CAAM fixes. by @aidankeefe2022 (PR 10786, PR 10808)
• Zero the kop struct in devcrypto X25519 before use. by @holtrop-wolfssl (PR 10817)
• Fixed wc_ecc_sign_hash_hw() overflow under WOLFSSL_XILINX_CRYPT_VERSAL with WOLFSSL_SMALL_STACK. by @miyazakh (PR 11286)
• Return an error from `atmel_get_random_number()

README 内容过长，已截取前 64 KB。完整内容请前往 GitHub 仓库查看。