Security built for your device.
NoxTLS™ is an open-source TLS 1.2 and 1.3 and crypto library for embedded devices. Its platform layer, memory hooks and hardware offload are designed for the porting work most libraries leave to you.
Need it on your platform blazing fast? Get porting support
TLS 1.2–1.3
Full protocol support
Configurable
Footprint tailored to your product
GPL 2.0
Open source, commercial licence available
SECURE BY DEFAULT
Phone to device. Nothing readable in between.
Your app opens a TLS 1.3 session with the device, checks its certificate and agrees fresh keys. From then on every command and reading is encrypted, and anyone listening on the air sees only noise.
An animation: a phone app and a NoxTLS device complete a TLS 1.3 handshake (ClientHello with a key share, ServerHello with the device certificate, then Finished). The app then sends an encrypted unlock command, the device decrypts it and unlocks, while an eavesdropper sees only ciphertext.
CONFIGURE YOUR FOOTPRINT
Choose the parts. Shape the footprint.
Keep the cryptography your device needs. See how the component mix changes the space it takes.
Crypto components
Relative build footprint
A focused starting configuration
Illustrative relative footprint. Actual flash and RAM depend on selected features, buffers, certificates and target platform. Toggle any component to try it yourself.
THE WORK BETWEEN DOWNLOAD AND DEVICE
Downloading a TLS library takes a minute. Making it work shouldn’t take months.
Porting to your RTOS. Wiring in the chip’s crypto accelerator. Fitting the handshake into the RAM you have left. Tracing why one server rejects you and another doesn’t. That’s where weeks go on most embedded projects.
NoxTLS is designed around those jobs, with cleaner APIs, a clear architecture and logs that tell you what happened.
Get help with your platform
Written by firmware security engineers, for firmware engineers.
Platform abstraction
One thin layer for entropy, time, sockets and memory. Port to a new RTOS or bare metal without touching the TLS code.
Hardware crypto offload
Route AES, SHA and ECC to the accelerator on your chip.
Swappable crypto backends
Use the built-in algorithms, a secure element, or your own implementation behind the same API.
Memory you control
Configure allocation and buffer sizes for your application. Measure flash and RAM usage with your chosen features and target platform.
Certificates and configuration
Load, parse and verify X.509 chains. Pick cipher suites and protocol versions in one config.
Debugging and observability
Readable handshake traces and error codes that point to the cause, so a failed connection takes minutes to explain.
Protocols & cryptography.
Choose the features your build needs. Available algorithms and protocol options depend on the selected configuration.
- Protocols
- TLS 1.2 and 1.3, and DTLS 1.2 and 1.3, with client and server APIs. TLS 1.0 and 1.1 are available as opt-in legacy options.
- Symmetric encryption
- AES-128/192/256 with GCM, CCM, ECB, CBC, CTR, CFB, OFB and XTS modes. ChaCha20-Poly1305, ARIA and Camellia are also available.
- Key exchange & signatures
- ECDH and ECDSA on P-256, P-384 and P-521. X25519 and X448. RSA with PKCS#1 and PSS. Ed25519, Ed448 and finite-field Diffie–Hellman.
- Hashes & key derivation
- SHA-2, SHA-3/SHAKE and BLAKE2. HMAC, HKDF and opt-in PBKDF2. AES-CMAC, Poly1305 and a deterministic random bit generator (DRBG).
- Certificates & authentication
- X.509 parsing and chain verification, client certificates and pre-shared keys. SPAKE2+ with optional Matter PASE helpers, plus opt-in EC-JPAKE for Thread commissioning.
- Post-quantum crypto Experimental
- ML-KEM-512/768/1024, ML-DSA-44/65/87 and SLH-DSA. Optional TLS 1.3 post-quantum and X25519 + ML-KEM hybrid integration.
From git clone to first handshake.
1
Build on your desktop
Clone the repo and run the examples against a test server.
2
Fill in the platform layer
Entropy, time, network and memory. Ready for Zephyr, with templates for other common RTOSes.
NoxOS
3
Map crypto to your hardware
Enable the accelerators your chip has, keep software fallbacks for the rest.
4
Tune and ship
Trim cipher suites and buffers to your footprint target.
Plays well with the rest of the family.
Free to use. Backed by the people who wrote it.
Community
Free under GPL 2.0
- Full source on GitHub
- Documentation and examples
- GitHub issues
Commercial
Contact us
- Ship closed-source firmware without GPL obligations
- Priority support with response times
- Long-term maintenance and security fixes
Integration services
Project-based
- Porting to your chip and RTOS
- Hardware offload drivers
- Security design review
Questions engineers ask
Can I use NoxTLS in a commercial product?
Yes. Under GPL 2.0, firmware that includes NoxTLS must be released as source. If you can’t release yours, a commercial licence removes that requirement. Contact us for terms.
Can you port it to our platform for us?
Yes. Our engineering team does porting, offload drivers and security reviews as fixed-scope projects.
Your board, speaking TLS 1.3.
Start with the docs, or tell us your chip and RTOS and an engineer will scope the port.
