After a year and a half of development, the release of OpenSSL 3.1.0 has been made, implementing SSL/TLS protocols and various encryption algorithms. Support for OpenSSL 3.1 will last until March 2025. Support for previous versions OpenSSL 3.0 and 1.1.1 will continue until September 2026 and September 2023, respectively. The project's code is distributed under the Apache 2.0 license.
Main innovations of OpenSSL 3.1.0:
- The FIPS module has implemented support for cryptographic algorithms that comply with the FIPS 140-3 security standard. The certification process for the module to obtain compliance with FIPS 140-3 has begun. Until the certification is completed following the update to OpenSSL 3.1, users can continue using the FIPS module certified for FIPS 140-2. Among the changes in the new version of the module is the inclusion of algorithms Triple DES ECB, Triple DES CBC, and EdDSA, which have not yet been tested for compliance with FIPS requirements. Additionally, the new version includes optimizations to enhance performance and has transitioned to running internal tests on every module load, rather than only after installation.
- The OSSL_LIB_CTX code has been revamped. The new version eliminates unnecessary locks and enables higher performance.
- The performance of the encoder and decoder frameworks has been improved.
- Performance optimizations related to the use of internal structures (hash tables) and caching have been made.
- The speed of RSA key generation in FIPS mode has been increased.
- For various processor architectures, specific assembly optimizations have been made in the implementations of the AES-GCM, ChaCha20, SM3, SM4, and SM4-GCM algorithms. For example, the AES-GCM code has been accelerated using AVX512 vAES and vPCLMULQDQ instructions.
- Support for the KMAC (KECCAK Message Authentication Code) algorithm has been added to KBKDF (Key Based Key Derivation Function).
- Various 'OBJ_*' functions have been adapted for use in multithreaded code.
- The ability to use the RNDR instruction and RNDRRS registers for generating pseudorandom numbers has been added. These are available in processors based on the AArch64 architecture.
- The functions OPENSSL_LH_stats, OPENSSL_LH_node_stats, OPENSSL_LH_node_usage_stats, OPENSSL_LH_stats_bio, OPENSSL_LH_node_stats_bio, and OPENSSL_LH_node_usage_stats_bio have been deprecated. The macro DEFINE_LHASH_OF has been declared obsolete.
Source: opennet.ru
