Developers of the OpenBSD project release of the portable edition of the package , which is a fork of OpenSSL focused on providing a higher level of security. The LibreSSL project is aimed at maintaining high-quality support for SSL/TLS protocols while removing unnecessary functionality, adding additional security features, and undertaking significant cleaning and restructuring of the codebase. The release of LibreSSL 3.2.0 is considered experimental, in which features are being developed that will be part of OpenBSD 6.8.
Features of LibreSSL 3.2.0:
- Server-side support enabled by default in addition to the previously offered client-side support. The implementation of TLS 1.3 is based on a new finite state machine and a record-handling subsystem. An OpenSSL-compatible TLS 1.3 API is not yet available, but options related to TLS 1.3 have been added to the openssl command.
- In the record-handling subsystem, the checks for the size of TLS 1.3 fields have been improved and a warning is issued in case the limits are exceeded.
- The TLS server handles only valid hostnames in SNI, compliant with the requirements of RFC 5890 and RFC 6066.
- The implementation of TLS 1.3 has added support for the SSL_MODE_AUTO_RETRY mode for automatic retransmission of connection negotiation messages.
- The TLS 1.3 server and client have added support for sending certificate status verification requests using the extension (a validated response from the certificate authority is passed by the server hosting the site during the TLS connection negotiation).
- SSL_MODE_AUTO_RETRY mode has been enabled by default for input/output, similar to the recent releases of OpenSSL.
- Added regression tests based on .
- In the openssl x509 command, incorrect certificate validity times are marked.
- In TLS 1.3 with RSA only PSS digital signatures are allowed.
Source: opennet.ru
