diff --git a/cores/esp8266/StackThunk.cpp b/cores/esp8266/StackThunk.cpp
index 9d7cc24f56..89294d3902 100644
--- a/cores/esp8266/StackThunk.cpp
+++ b/cores/esp8266/StackThunk.cpp
@@ -36,8 +36,8 @@ uint32_t *stack_thunk_top = NULL;
 uint32_t *stack_thunk_save = NULL;  /* Saved A1 while in BearSSL */
 uint32_t stack_thunk_refcnt = 0;
 
-/* Largest stack usage seen in the wild at scripts.google.com at 5828 */
-#define _stackSize (5900/4)
+/* Largest stack usage seen in the wild at  6120 */
+#define _stackSize (6200/4)
 #define _stackPaint 0xdeadbeef
 
 /* Add a reference, and allocate the stack if necessary */
diff --git a/tools/sdk/include/bearssl/bearssl_ec.h b/tools/sdk/include/bearssl/bearssl_ec.h
index f954309eb6..acd3a2bf5a 100644
--- a/tools/sdk/include/bearssl/bearssl_ec.h
+++ b/tools/sdk/include/bearssl/bearssl_ec.h
@@ -108,7 +108,7 @@ extern "C" {
  *
  *   - The multipliers (integers) MUST be lower than the subgroup order.
  *     If this property is not met, then the result is indeterminate,
- *     but an error value is not ncessearily returned.
+ *     but an error value is not necessarily returned.
  * 
  *
  * ## ECDSA
diff --git a/tools/sdk/include/bearssl/bearssl_git.h b/tools/sdk/include/bearssl/bearssl_git.h
index e494ac6832..432d98a410 100644
--- a/tools/sdk/include/bearssl/bearssl_git.h
+++ b/tools/sdk/include/bearssl/bearssl_git.h
@@ -1,2 +1,2 @@
 // Do not edit -- Automatically generated by tools/sdk/ssl/bearssl/Makefile
-#define BEARSSL_GIT 89454af
+#define BEARSSL_GIT 0645c68
diff --git a/tools/sdk/include/bearssl/bearssl_ssl.h b/tools/sdk/include/bearssl/bearssl_ssl.h
index fe3f6be2fe..d760dff2d7 100644
--- a/tools/sdk/include/bearssl/bearssl_ssl.h
+++ b/tools/sdk/include/bearssl/bearssl_ssl.h
@@ -2114,7 +2114,7 @@ void br_ssl_engine_sendapp_ack(br_ssl_engine_context *cc, size_t len);
 /**
  * \brief Get buffer for received application data.
  *
- * If the engine has received application data from the peer, hen this
+ * If the engine has received application data from the peer, then this
  * call returns a pointer to the buffer from where such data shall be
  * read, and its length is written in `*len`. Otherwise, `*len` is set
  * to 0 and `NULL` is returned.
diff --git a/tools/sdk/lib/libbearssl.a b/tools/sdk/lib/libbearssl.a
index 773eeaf804..9bcd86fe15 100644
Binary files a/tools/sdk/lib/libbearssl.a and b/tools/sdk/lib/libbearssl.a differ
diff --git a/tools/sdk/ssl/bearssl b/tools/sdk/ssl/bearssl
index 89454af34e..0645c68c36 160000
--- a/tools/sdk/ssl/bearssl
+++ b/tools/sdk/ssl/bearssl
@@ -1 +1 @@
-Subproject commit 89454af34e3e61ddfc9837f3da5a0bc8ed44c3aa
+Subproject commit 0645c68c3653233c4d0e59252cd591a664f808fd