The OpenBSD project developers have released a portable edition of the LibreSSL 3.6.0 package, which develops a fork of OpenSSL aimed at providing a higher level of security. The LibreSSL project focuses on quality support for SSL/TLS protocols by removing unnecessary functionality, adding additional security measures, and conducting significant cleaning and restructuring of the codebase. The release of LibreSSL 3.6.0 is considered experimental, featuring capabilities that will be included in OpenBSD 7.2.
Features of LibreSSL 3.6.0:
- The EVP API for the HKDF (HMAC Key Derivation Function) key generation function has been ported from OpenSSL.
- An API has been added for setting and getting security levels — SSL_{,CTX}_{get,set}_security_level().
- Experimental support for the QUIC protocol API has been added, originally implemented in BoringSSL.
- Initial support for verifying TS ESSCertIDv2 has been added.
- The Baillie-PSW primality test has replaced the Miller-Rabin test.
- Significant internal rework has been completed. Resource-intensive checks from RFC 3779 have been removed during certificate verification. The decoder and time parser for ASN.1 have been redesigned. The implementation of ASN1_STRING_to_UTF8() has been rewritten.
- The openssl utility has been added with the -"s" option to show only the ciphers supported by the specified protocol.
Source: opennet.ru
