wolfCOSE 2.0.0 adds post-quantum signatures, attestation

wolfSSL has updated its lightweight COSE library for embedded systems, releasing wolfCOSE 2.0.0 with new cryptographic capabilities while preserving its small memory footprint. The update targets developers working with constrained hardware, such as IoT devices and secure elements, where resource efficiency is critical for security operations.

What changed in wolfCOSE 2.0.0

The release introduces support for HSS/LMS stateful hash-based signatures, the second post-quantum cryptographic family standardized by NIST alongside ML-DSA. These signatures are now available for COSE_Sign1, multi-signer COSE_Sign, and delegated signing workflows, allowing devices to use quantum-resistant authentication without requiring full algorithm upgrades. The implementation follows RFC 8778, which defines how these signatures integrate with COSE structures.

Attestation capabilities have also been expanded through RFC 9783 PSA/EAT token support. Devices can now issue and verify attestation tokens in both COSE_Sign1 and COSE_Mac0 formats, with configurable profiles for current and legacy use cases. A key management feature allows hardware security modules (HSMs), secure elements, or remote key management services to handle private keys while wolfCOSE constructs the message payloads, keeping sensitive material isolated from the application layer.

Other additions include full RFC 9338 countersignature support across all six tagged COSE message types, enabling independent verification of endorsements without modifying original messages. The library has also adopted RFC 9864's fully specified signature algorithms, replacing polymorphic identifiers with explicit bindings between algorithms and their intended curves. Default configurations now use ESP256, ESP384, ESP512, Ed25519, and Ed448, while deprecated identifiers require explicit compilation flags.

Integration and compliance improvements

The update includes expanded COSE_Key and CBOR APIs, offering more precise control over encoded sizes, public key handling, and metadata inspection before key import. These changes aim to reduce memory usage and improve error handling in embedded contexts. For STM32 developers, wolfSSL has released an I-CUBE-wolfCOSE pack that integrates directly with STM32CubeMX and STM32CubeIDE, including on-device testing capabilities.

Compliance testing has been strengthened with MISRA C:2012 and C:2023 checks, along with expanded continuous integration coverage. The library now undergoes validation with cppcheck, Clang analyzer, GCC -fanalyzer, Coverity, CodeQL, and Semgrep, alongside interoperability testing against other COSE implementations like t_cose, go-cose, and Rust coset. The cryptographic backend remains FIPS 140-3 validated through wolfCrypt Certificate #4718, which is wolfCOSE's sole dependency.

Practical implications for embedded developers

The release maintains wolfCOSE's zero-allocation design, which is critical for devices with limited memory. New features like delegated signing and attestation token issuance allow developers to offload cryptographic operations to dedicated hardware while keeping message construction in the application layer. This separation is particularly relevant for devices that must comply with PSA Certified or other hardware security standards.

Experimental support for COSE-HPKE (Hybrid Public Key Encryption) has been added for COSE_Encrypt0 and multi-recipient COSE_Encrypt, though it remains behind compilation gates to prevent accidental use in production. The library continues to be dual-licensed under GPLv3 and commercial terms, with commercial licensing required for closed-source deployments.