Crypto Abstraction Layer for wolfCrypt v2.0.0 and v2.0.1

microej_official · October 28, 2026, 7:34am

Hello everyone,

The Crypto Abstraction Layer for WolfCrypt versions v2.0.0 and v2.0.1 have been released on GitHub.
This abstraction layer holds the native code required by the Crypto Foundation Library.
It replaces the support of the Security Foundation Library provided by the 1.x versions.

Version 2.0.0 brings the following changes:

The abstraction layer implements the LLCRYPTO API of the Crypto Foundation Library instead of the LLSEC API of the Security Foundation Library. To migrate, rename every LLSEC_ file, symbol and configuration macro to LLCRYPTO_.
AES secret keys held in a PKCS#11 token can be addressed by their label.
The natives report memory allocation failures to the Crypto Foundation Library, which can then run a garbage collection and retry the operation.
Secret key material and shared secrets are wiped before their memory is released.
wolfSSL 5.8.4 or higher is required.

Version 2.0.1 fixes the following issues:

Certificate parsing and validation retry after a garbage collection when native memory is low.
On a key held in a PKCS#11 token, the operations that the token cannot run (multi-part AES/CBC or AES/CTR, AES/CBC input that is not a whole number of blocks, AES/CCM) are refused with an exception instead of producing a wrong result.
A VEE Port without an external key store links with the Crypto Foundation Library 2.1.0.

See the CHANGELOG for more information:

github.com/MicroEJ/AbstractionLayer-Security-WolfCrypt

CHANGELOG.md

2.0.1

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [2.0.1] - 2026-10-27

### Fixed

- Fix the certificate parsing and validation failing instead of retrying after a garbage collection when native memory is low.
- Refuse a multi-part AES/CBC or AES/CTR operation on a key held in a PKCS#11 token instead of producing wrong output.
- Refuse an AES/CBC input that is not a whole number of blocks on a key held in a PKCS#11 token instead of truncating it.
- Report an AES/CCM cipher initialized with a key held in a PKCS#11 token as `InvalidAlgorithmParameterException` instead of a native exception at the first operation.
- Add the thirteen external key store natives of the LLCRYPTO 2.1.0 header that the stub file lacked, so a VEE Port without a key store links with the Crypto library 2.1.0.

## [2.0.0] - 2026-09-16

### Added

This file has been truncated. show original

Happy coding,
The MicroEJ Team.