Several new versions of cryptographic libraries have been released:
The release of OpenSSL 3.4.0 includes implementations of SSL/TLS protocols and various encryption algorithms. Support for OpenSSL 3.4 will continue until October 2025. Support for previous versions of OpenSSL 3.3, 3.2, 3.1, and 3.0 LTS will last until April 2026, November 2025, March 2025, and September 2026, respectively. The project code is distributed under the Apache 2.0 license. Key innovations include:
- Support for a cipher suite for TLSv1.3, limited to data integrity checking features (RFC 9150) and including algorithms TLS_SHA256_SHA256 and TLS_SHA384_SHA384.
- An optional feature has been added to the pseudo-random number generator to utilize an additional source of entropy based on jitter, implemented using the jitterentropy library. Entropy is generated by measuring the differences in execution time of a certain set of instructions on the CPU, which depend on various internal factors and are unpredictable without physical control over the CPU.
- Initial support for Attribute Certificates (AC), which include information about access rights, authorities, and attributes of the certificate owner certifying the ability to perform certain actions, has been added. For example, an AC certificate can define the right to connect to a specific service.
- Support for X.509v3 extensions related to attribute certificates has been added.
- Support for the FIPS 140-3 Indicator API has been implemented in the FIPS provider, allowing to determine whether a specific operation was performed in an approved service or not.
- Improved handling of Base64 formatted input in the API BIO (Basic Input/Output).
- Support for building the openssl utility in Position Independent Executable (PIE) mode, which allows for Address Space Layout Randomization (ASLR), has been added.
- Support for directly extractable combined digital signature algorithms, such as RSA-SHA2-256, has been added.
- Support for PBMAC 1 (Password-Based Message Authentication Code 1, RFC 9579) has been added to PKCS#12.
- The openssl utility has been enhanced with the '-not_before' and '-not_after' options to explicitly specify the start and end times of the certificate validity.
- The ability to use precomputed values when initializing cryptographic algorithms based on the P-256 elliptic curves has been provided.
- The functions TS_VERIFY_CTX_set_* have been deprecated, replaced by functions TS_VERIFY_CTX_set0_* with improved semantics.
- The functions SSL_SESSION_get_time(), SSL_SESSION_set_time(), and SSL_CTX_flush_sessions() have been deprecated in favor of SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex(), and SSL_CTX_flush_sessions_ex(), which are free from the year 2038 problem.
- The expected support for the QIUC protocol in OpenSSL 3.4 server has been postponed until the next release.
The release of LibreSSL 4.0.0, a project developing a fork of OpenSSL aimed at providing a higher level of security and quality support for SSL/TLS protocols by removing unnecessary functionality, adding additional security features, and undergoing significant codebase cleanup and restructuring. The significant version change is due to the use of decimal numbering (version 4.0 follows 3.9). The most notable changes include:
- Initial support for building with Emscripten, a compiler from C/C++ to WebAssembly, has been added.
- The 'openssl cms' command has been enhanced with the CRLfile option to specify additional Certificate Revocation Lists (CRLs) that will be used for verification.
- Support for the mips32 platform has been discontinued.
- Access to assembly language functions via the public API has been discontinued (these functions are now provided only through C wrapper functions). The assembly implementations of deprecated ciphers for obsolete architectures have been removed.
- Code for caching certificate validity, which became redundant after performance optimization, has been removed.
- The implementation of X.509v3 extensions has been improved, X.509v3 methods have been unified, and the related X.509v3 API has been cleaned up.
- The implementation of the CRYPTO_EX_DATA type has been completely rewritten.
- In libcrypto, the functions atoi() and strtol() have been replaced with strtonum().
- A header file crypto_arch.h has been added, which contains code specific to hardware architectures.
- The implementation of the DES algorithm has been redesigned and optimized.
- The header files pem2.h, ssl2.h, ssl23.h, and ui_compat.h have been removed.
- Support for the Whirlpool hash algorithm has been removed.
- The functions HMAC_Init(), OPENSSL_load_builtin_modules(), X509_REQ_{get,set}_extension_nids(), and X509_check_trust() have been removed.
- Removed types PEM_USER, PEM_CTX, COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, STORE_METHOD, and SSL_AEAD_CTX.
- Added functions SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() to libssl.
The release of the Botan 3.6.0 cryptographic library, used in the NeoPG project, a fork of GnuPG 2, is now available. The library provides a large collection of ready-made primitives used in the TLS protocol, X.509 certificates, AEAD ciphers, TPM modules, PKCS#11, password hashing, and post-quantum cryptography (hash-based signatures and McEliece-based key agreement). The library is written in C++ and is released under the BSD license. In the new version:
- A new library with elliptic curve-based cryptographic algorithms has been integrated, where operations on standard curves are performed 2-3 times faster. A new API for low-level work with elliptic curves has also been proposed.
- Support has been added for recently standardized post-quantum encryption algorithms in NIST: FIPS 203 ML-KEM (Kyber), FIPS 204 ML-DSA (Dilithium), and FIPS 205 SLH-DSA (SPHINCS+).
- Support has been added for TPM2 chips.
- The use of constant-time computation has been expanded to protect against side-channel attacks.
- Additional entropy generation using the jitterentropy library has been added.
- The performance of data processing in hexadecimal format and base64 encoding has been improved.
- Support for AVX2-VAES and GFNI-AVX2 processor extensions has been added.
- Added detection of armv7, aarch64, and ppc64 CPU capabilities on the OpenBSD platform.
- An assembly option has been added to disable all inline assembly insertions.
The release of Rustls 0.23.15, which develops client and server implementations of the TLS1.2 and TLS1.3 protocols for Rust projects, is available. Rustls does not provide its own implementation of cryptographic primitives but uses pluggable providers for cryptographic functions (supporting ECDSA, Ed25519, RSA, ChaCha20-Poly1305, AES128-GCM, and AES256-GCM algorithms). By default, Rustls uses a cryptographic provider based on the aws-lc-rs library, which is developed by Amazon and is based on the C++ code of AWS-LC, a fork of the BoringSSL project (maintained by Google and forked from OpenSSL). The ring library, partially based on BoringSSL and combining code in assembly, C++, and Rust, can also be used as a cryptographic provider.
The new version is notable for significant performance optimizations. It is claimed that when using the cryptoprimitives, the aws-lc-rs Rustls library now outperforms OpenSSL and BoringSSL libraries in tests measuring throughput and connection handshake/resumption speed. 
Source: opennet.ru
