wolfSSL Releases wolfCOSE Library for Embedded Security

wolfSSL has introduced wolfCOSE, a new embedded library designed to provide structured cryptographic messaging for resource-constrained hardware [2]. Built on the wolfCrypt engine, the library implements both the CBOR serialization format and COSE standards, offering a footprint as small as 7.5 KB [2].

Key takeaways

• The library supports 40 cryptographic algorithms, including post-quantum ML-DSA signing at all three NIST security levels [2].
• It utilizes a zero dynamic memory allocation model, ensuring deterministic memory usage for bare-metal and safety-critical systems [2].
• The code is designed for compliance with MISRA C 2012 and 2023 standards to meet requirements in automotive, medical, and industrial sectors [2].
• Users can leverage a path to FIPS 140-3 certification through the existing wolfCrypt Certificate #4718 [2].

Technical Architecture and Standards Coverage

wolfCOSE is designed to address the challenges of implementing secure messaging in environments where traditional protocols like TLS are too resource-intensive [2]. By implementing all six message types defined in RFC 9052—including Sign1, Sign, Encrypt0, Encrypt, Mac0, and Mac—the library supports complex scenarios such as multi-signer firmware distribution [2]. Because the library avoids dynamic memory allocation, all operations rely on caller-provided buffers, which is a common requirement for devices governed by standards like IEC 61508 or ISO 26262 [2].

The library’s algorithm suite is extensive, covering ECDSA, EdDSA, RSA-PSS, and various AES-based encryption and MAC methods [2]. A notable feature is the integration of ML-DSA (formerly CRYSTALS-Dilithium), which allows developers to implement post-quantum signing on devices with long operational lifespans [2]. To utilize these post-quantum features, users must employ wolfSSL version 5.8.0 or newer, which includes the necessary context-aware APIs [2].

Quality Assurance and Future Development

Although wolfSSL currently classifies wolfCOSE as a project in progress rather than an officially supported product, the library has undergone rigorous testing [2]. The development process includes continuous integration across multiple compilers and platforms, with code coverage reaching 99.3% for core components [2]. Static analysis is performed using tools such as Coverity Scan, Clang analyzer, and cppcheck to enforce strict adherence to MISRA C guidelines [2].

Why it matters

As IoT devices increasingly require secure, verifiable firmware updates and remote attestation, COSE has emerged as a standard for constrained environments [2]. By providing a production-grade C implementation that avoids heap allocation, wolfSSL aims to fill a gap for developers working in regulated industries like automotive and healthcare [2]. While the library is currently available under a GPLv3 license, wolfSSL intends to transition it to full supported status as market demand for embedded post-quantum security grows [2].