wolfSSL/wolfProvider

Description

wolfProvider is a library that can be used as a Provider in OpenSSL.

Supported OpenSSL Versions

wolfProvider supports all release versions of OpenSSL 3.x

Replace Default Mode

wolfProvider can be configured to replace OpenSSL's default provider, making wolfSSL's cryptographic implementations the default for all OpenSSL operations. This ensures applications use wolfSSL crypto without code changes. See the Integration Guide for details.

Documentation

Information on how to configure, build, and test wolfProvider can be found here:

• wolfProvider FIPS Integration Guide - FIPS baseline and production builds
• wolfProvider Integration Guide - General integration and replace-default mode

Features

Digests

• MD5
• SHA-1
• SHA-2: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256
• SHA-3: SHA3-224, SHA3-256, SHA3-384, SHA3-512
• SHAKE-256

Symmetric Ciphers

• AES (128, 192, 256-bit keys)
  • ECB, CBC, CTR, CFB, CTS
  • GCM, CCM (AEAD)
  • Key Wrap
• 3DES-CBC

MACs

• HMAC
• CMAC
• GMAC

KDFs

• HKDF
• PBKDF2
• PKCS12 KDF
• TLS 1.3 KDF
• TLS1 PRF
• KBKDF
• KRB5 KDF
• SSHKDF

Random

• CTR-DRBG
• Hash-DRBG

RSA

• Signing, Verification (PKCS#1 v1.5, PSS)
• Encryption, Decryption
• Key generation

DH

• Key exchange
• Key generation

Parameter generation refuses a requested generator other than 2: wolfSSL derives the generator from the prime it generates, so openssl dhparam -3 and -5 fail. A request for 2, which openssl dhparam sends by default, is accepted, but the generator is still the one wolfSSL derives. Key generation from a named group or existing parameters accepts a generator only when the parameters already have it. A non-zero priv_len is refused because wolfSSL takes the private key length from the group.

ECC

• ECDSA (signing, verification)
• ECDH (key exchange)
• Key generation
• Curves: P-192, P-224, P-256, P-384, P-521

Curve25519/448

• X25519, X448 (key exchange)
• Ed25519, Ed448 (signatures)

Post-Quantum (NIST FIPS 203 / 204)

PQC is opt-in and requires wolfSSL master/v5.9.2-stable+ and OpenSSL 3.6+.

• With the script: ./scripts/build-wolfprovider.sh --enable-pqc (or --enable-mlkem / --enable-mldsa / --enable-slhdsa for one only). --enable-slhdsa enables all 12 parameter sets by default. For SHAKE-only: WOLFSSL_SLHDSA_CONFIG=yes ./scripts/build-wolfprovider.sh --enable-slhdsa.
• Building wolfProvider directly: ./configure --enable-pqc (or --enable-mlkem / --enable-mldsa / --enable-slhdsa); build wolfSSL with the matching options. Use wolfSSL's --enable-slhdsa=yes,sha2 for all 12 parameter sets or plain --enable-slhdsa for SHAKE-only. Link an OpenSSL 3.6+.

Without an enable flag no PQC code is compiled, regardless of what wolfSSL enables.

• ML-KEM (FIPS 203): ML-KEM-512, ML-KEM-768, ML-KEM-1024 (key encapsulation)
• ML-DSA (FIPS 204): ML-DSA-44, ML-DSA-65, ML-DSA-87 (signatures, pure mode with empty context per FIPS 204 sec 5.2)
• SLH-DSA (FIPS 205): all 12 parameter sets, SLH-DSA-SHA2-{128,192,256}{s,f} and SLH-DSA-SHAKE-{128,192,256}{s,f} (signatures, pure mode)

wolfProvider additionally supports streamed SLH-DSA sign and verify by buffering the message because wolfSSL has no streaming SLH-DSA API. This extension accepts messages up to 64 MiB; use the one-shot API for larger messages.

LMS (RFC 8554 / NIST SP 800-208)

LMS verification is independently opt-in and requires wolfSSL 5.9.2-stable or newer and OpenSSL 3.6 or newer:

./scripts/build-wolfprovider.sh --enable-lms

wolfProvider follows OpenSSL's LMS provider contract: it imports and exports raw XDR public keys and supports one-shot verification through EVP_PKEY_verify_message_init() followed by EVP_PKEY_verify(). The OpenSSL wire format omits the single-level HSS header; wolfProvider adds that wrapper only at the wolfCrypt boundary. LMS signing, key generation, private-key import, and streaming operations are not exposed because OpenSSL's LMS provider is verification-only for SP 800-208 software modules.

Because wolfProvider only verifies, wolfSSL must be built without LMS key generation or signing. Configure wolfSSL with --enable-lms=verify-only,sha256-192,shake256 (which defines WOLFSSL_LMS_VERIFY_ONLY) so the private-key operations are absent rather than built but unused. The bundled build-wolfprovider.sh --enable-lms flow already builds wolfSSL this way.

The PQC KAT workflow runs OpenSSL's 320 LMS verification vectors, including valid and corrupted messages, signatures, and key encodings. Focused unit tests cover public-key import/export, XDR decoding, selection handling, and the unsupported stateful operations.

Support

• GitHub Issues
• wolfSSL Support