The release of the OpenSSL 4.1.0 library has been published, offering an implementation of TLS protocols and various encryption algorithms. OpenSSL 4.1 is classified as a regular support release, with updates issued for 13 months. Support for the LTS branch OpenSSL 3.5 will continue until April 2030. The project's code is distributed under the Apache 2.0 license.
Key innovations:
- Initial support for the Elbrus2000 (e2k) architecture has been added.
- Support for the DTLS 1.3 protocol (RFC 9147), an adaptation of TLS 1.3 for UDP and SCTP, has been introduced.
- In the API SSL the Listener now supports DTLS.
- Support for the GREASE mechanism (RFC 8701, Generate Random Extensions And Sustain Extensibility) has been added, which inserts dummy values into various fields of the TLS and DTLS protocols during connection negotiation to verify the correctness of their processing on servers and firewalls (server should ignore unknown values and continue the connection negotiation based on known ones).
- Support for the Key Derivation Function (KDF) of IKEv2 (Internet Key Exchange) has been added.
- Support for new build targets VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 for building with MSVC 2013 has been implemented. The targets VC-WIN64I (Windows on Itanium systems) and VC-CE (Windows CE) have been removed.
- Implementations of ML-DSA and ML-KEM optimized for the ppc64le architecture have been added, as well as an ML-DSA variant optimized for x86_64.
- An AES-CBC decryption code variant optimized using x86_64 AVX-512 and VAES extensions has been added.
Additionally, it is worth mentioning the release of the portable version of the LibreSSL 4.4.0 package, which develops the OpenSSL fork. The release of LibreSSL 4.4.0 is considered experimental, focusing on features that will be included in OpenBSD 8.1.
The changes in the new version of LibreSSL primarily relate to bug fixes, optimizations, and addressing compatibility issues with OpenSSL. Support for Windows has been significantly improved, and build support for
macOS 27.0 has been added. Assembly optimizations for MIPS32 and MIPS64 have been included. SHA-3 performance has been enhanced.
Source: opennet.ru
