{"id":123436,"date":"2025-04-08T21:05:14","date_gmt":"2025-04-08T19:05:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-kriptograficheskoj-biblioteki-openssl-3-5-0"},"modified":"2025-04-08T21:05:14","modified_gmt":"2025-04-08T19:05:14","slug":"vypusk-kriptograficheskoj-biblioteki-openssl-3-5-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-kriptograficheskoj-biblioteki-openssl-3-5-0","title":{"rendered":"Release of OpenSSL 3.5.0 cryptographic library","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of OpenSSL 3.5.0 has been announced, implementing SSL\/TLS protocols and various encryption algorithms. OpenSSL 3.5 is classified as a long-term support (LTS) release, with updates provided for 5 years (until April 2030). Support for previous branches OpenSSL 3.3, 3.2, and 3.0 LTS will continue until April 2026, November 2025, and September 2026, respectively. The project's code is distributed under the Apache 2.0 license. <\/p>\n
Key innovations: <\/p>\n
\n
Support for quantum computer-resistant cryptographic algorithms has been added:\n
\n
ML-KEM (CRYSTALS-Kyber) \u2014 a key exchange algorithm that utilizes cryptographic methods based on solving lattice theory problems, with solution times that are similar on both classical and quantum computers.\n
ML-DSA (CRYSTALS-Dilithium) \u2014 a digital signature generation algorithm based on lattice theory.\n
SLH-DSA (Sphincs+) \u2014 a digital signature generation algorithm that applies cryptographic methods based on hash functions. SLH-DSA is slower and produces larger signatures than ML-DSA but is based on entirely different mathematical principles, making it effective in the event of compromises involving lattice-based algorithms. <\/ul>\n
Full support for the QUIC protocol (RFC 9000) has been implemented, which is now available for server applications as well as client applications. QUIC is an extension of the UDP protocol, supporting the multiplexing of multiple connections and providing encryption methods equivalent to TLS. The QUIC protocol is used in HTTP\/3 and was created as an alternative to the TCP+TLS combination, addressing issues with long setup and handshake times in TCP, and eliminating delays caused by packet loss during data transmission.\n
The ability to use third-party stacks implementing the QUIC protocol has been added, including stacks that support 0-RTT (0 Round Trip Time) mode, allowing immediate data transmission after sending the connection setup packet.\n
Support for opaque symmetric key objects (EVP_SKEY), which conceal key implementation details, has been added.\n
A parameter \"no-tls-deprecated-ec\" has been added to disable support for TLS groups deprecated in RFC-8422.\n
A parameter \"enable-fips-jitter\" has been introduced, which enables the use of a jitter-based entropy source in the FIPS provider, implemented using the jitterentropy library. Jitter-based entropy generation is performed by measuring the differences in the execution time of a specific set of instructions on the CPU, influenced by numerous internal factors and unpredictable without physical control over the CPU.\n
Support for centralized key generation has been added to CMP (Certificate Management Protocol) (public and private keys for the client are generated on the server side server<\/a>).\n