Developers of the OpenBSD project release of the portable edition of the package , which is a fork of OpenSSL aimed at providing a higher level of security. The LibreSSL project focuses on quality support for SSL/TLS protocols by removing unnecessary functionality, adding extra security features, and performing significant codebase cleaning and restructuring. LibreSSL 3.1.1 is marked as the first stable release of the 3.1 branch, which will be part of the upcoming OpenBSD 6.7 release expected in the coming days.
Features of LibreSSL 3.1.1:
- The implementation of TLS 1.3 has been completed based on a new state machine and record processing subsystem. Currently, only the client part of TLS 1.3 is enabled by default, with plans to enable the server part by default in a future release. The API compatible with OpenSSL TLS 1.3 is not yet available.
- Cipher suite handling has been expanded with automatic enabling of algorithms necessary for TLSv1.3 if they are not explicitly mentioned during the connection negotiation;
- Aliases for cipher names from the TLSv1.3 set defined in RFC 8446 have been provided;
- Methods RSA-PSS and RSA-OAEP have been ported from OpenSSL 1.1.1;
- The implementation of CMS (Cryptographic Message Syntax) has been ported from OpenSSL 1.1.1 and is enabled by default;
- The openssl utility has been updated with the ‘cms’ command, and options ‘req -addext’ and ‘s_server -groups’. Support for TLSv1.3 extension types has been added to the ‘-tlsextdebug’ option;
; - Improved compatibility with OpenSSL 1.1.1;
- Behavior of EVP_chacha20() has been brought closer to OpenSSL;
- Code cleanup has been performed, and improvements have been made to memory handling and protocol parsing functions.
Source: opennet.ru
