{"id":101224,"date":"2021-09-08T16:23:07","date_gmt":"2021-09-08T14:23:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-kriptograficheskoj-biblioteki-openssl-3-0-0"},"modified":"2021-09-08T16:23:07","modified_gmt":"2021-09-08T14:23:07","slug":"vypusk-kriptograficheskoj-biblioteki-openssl-3-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-kriptograficheskoj-biblioteki-openssl-3-0-0","title":{"rendered":"Release of the cryptographic library OpenSSL 3.0.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After three years of development and 19 test releases, OpenSSL 3.0.0 has been released, featuring implementations of the SSL\/TLS protocols and various encryption algorithms. This new branch includes changes that break backward compatibility at the API and ABI levels, but these changes will not affect the operation of most applications, which can be ported from OpenSSL 1.1.1 with a simple rebuild. Support for the previous branch, OpenSSL 1.1.1, will be maintained until September 2023. <\/p>\n
The significant version number change reflects a shift to traditional 'Major.Minor.Patch' numbering. The first digit (Major) will now change only when there is a breaking change in API\/ABI compatibility, while the second digit (Minor) will change with the addition of functionality without altering API\/ABI. Bug-fix updates will be indicated by a change in the third digit (Patch). The number 3.0.0, immediately following 1.1.1, has been chosen to avoid overlaps with the ongoing development of the FIPS module for OpenSSL, which used 2.x numbering. <\/p>\n
The second significant change for the project was the transition from a dual license (OpenSSL and SSLeay) to the Apache 2.0 license. The previously used proprietary OpenSSL license was based on the outdated Apache 1.0 license text and required explicit mention of OpenSSL in promotional materials when using OpenSSL libraries, as well as the addition of a special notice when delivering OpenSSL as part of a product. Such requirements made the old license incompatible with the GPL, creating difficulties when using OpenSSL in GPL-licensed projects. To navigate this GPL incompatibility, GPL projects were forced to adopt specific licensing agreements that supplemented the main GPL text with a clause explicitly allowing linking the application with the OpenSSL library and stating that the GPL requirements do not apply to linking with OpenSSL. <\/p>\n
Compared to the OpenSSL 1.1.1 branch, OpenSSL 3.0.0 has over 7500 changes prepared by 350 developers. Key innovations in OpenSSL 3.0.0: <\/p>\n
\n
A new FIPS module has been proposed, which includes the implementation of cryptographic algorithms that comply with the FIPS 140-2 security standard (the certification process for the module is expected to start this month, with the FIPS 140-2 certificate anticipated next year). The new module is significantly easier to use, and its integration with various applications will be no more complicated than changing a configuration file. By default, the FIPS module is disabled and requires the enable-fips option to be activated.\n
The concept of plug-in providers has been implemented in libcrypto, replacing the engine concept (the ENGINE API is now deprecated). With providers, you can add your own implementations of algorithms for operations such as encryption, decryption, key generation, MAC computation, and digital signature creation and verification. Both new implementations can be added, as well as alternative implementations of existing supported algorithms (by default, the built-in OpenSSL provider is used for each algorithm).\n