OpenSSL 4.1.0 is a feature release that adds significant new functionality to the open-source cryptography library. Among its headline additions is support for DTLS 1.3 (RFC 9147), with details available in the ossl-guide-dtlsv13(7) manual page. The release also brings support for RFC 8701 GREASE, DTLS support in the SSL listener API, the IKEv2 KDF, and initial support for the Elbrus2000 (e2k) architecture.
Performance receives attention as well. The release adds optimized ML-DSA and ML-KEM NTT operations on ppc64le, optimized ML-DSA operations on x86_64, AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64, and AVX-512 and VAES optimizations for AES-CBC decryption on x86_64. Build support gains VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 targets, which provide internal functions to bridge C99 gaps in MSVC 2013.
Several changes may affect existing users. The Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets have been dropped. The no-ecdsa and no-ecdh options were removed from Configure because they did not truly disable their implementations; administrators should use no-ec to disable elliptic curve support. The tsget utility now relies on Net::Curl::Easy instead of the abandoned WWW::Curl::Easy, so users should install Net::Curl::Easy before upgrading.
The release notes list several known issues. Issue #32878 can cause post-handshake records to drop from the retransmission buffer after a DTLS 1.3 Key Update, with a fix planned for a future release. Issues #33277 and #33278 involve DTLS listener error reporting, and issue #33242 may cause DTLS 1.3 servers to abort handshakes with an unexpected_message alert.
Source: Hacker News · Summarized by HeadlinesBriefing