{"id":168753,"date":"2026-04-14T23:12:07","date_gmt":"2026-04-14T21:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-kriptograficheskoj-biblioteki-openssl-4-0-0"},"modified":"2026-04-14T23:12:07","modified_gmt":"2026-04-14T21:12:07","slug":"vypusk-kriptograficheskoj-biblioteki-openssl-4-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-kriptograficheskoj-biblioteki-openssl-4-0-0","title":{"rendered":"Release of the cryptographic library OpenSSL 4.0.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of OpenSSL 4.0.0 has taken place, offering the implementation of TLS protocols and various encryption algorithms. OpenSSL 4.0 is classified as a release with standard support, with updates released over a 13-month period. Support for previous branches OpenSSL 3.6, 3.5 LTS, 3.4, and 3.0 LTS will continue until November 2026, April 2030, October 2026, and September 2026, respectively. The project code is distributed under the Apache 2.0 license. <\/p>\n
Key innovations: <\/p>\n
\n
Support has been added for the TLS extension ECH (Encrypted ClientHello, RFC 9849), designed to encrypt information about TLS session parameters, such as the requested domain name. Unlike the ESNI (Encrypted Server Name Indication) extension, ECH fully encrypts the entire TLS ClientHello message instead of encrypting at the level of individual fields, which helps block leaks through fields not covered by ESNI, such as the PSK (Pre-Shared Key) field.\n
Support has been added for certain algorithms defined in RFC 8998, which utilize the standard set of cryptographic algorithms SM2 from China: the digital signature generation algorithm sm2sig_sm3, the key exchange group curveSM2, and the post-quantum group curveSM2MLKEM768.\n
A cryptographic hashing function cSHAKE has been added, based on the SHA-3 algorithm and allowing the generation of different hashes from the same input data to protect against attacks that manipulate data reuse.\n
A hybrid algorithm «ML-DSA-MU» has been added, combining the post-quantum digital signature formation algorithm ML-DSA (CRYSTALS-Dilithium) with the classical hash function SHAKE256.\n
Support has been added for SNMP KDF key generation functions based on HMAC-SHA and SRTP KDF based on AES-CM, used in the SNMPv3 and SRTP network protocols to create cryptographic keys.\n
The «openssl fipsinstall» command has been enhanced with the «-defer_tests» option, which allows deferring the execution of tests during the installation of FIPS modules.\n
Support for static or dynamic linking with Visual C++ Runtime has been implemented for the Windows platform.\n
Support for key exchange negotiation based on the FFDHE algorithm has been added to TLS 1.2, corresponding to RFC 7919.\n
Support for SSLv3 and SSLv2 Client Hello has been discontinued.\n
Support for dynamically loaded engines has been removed; instead, the concept of plug-in providers should be used to extend the functionality of OpenSSL.\n
Support for outdated elliptic curves has been disabled in TLS during the compilation stage. The «enable-tls-deprecated-ec» option can be used to revert this change.\n
The c_rehash utility has been removed, and the «openssl rehash» command should now be used instead.\n
The outdated option «msie-hack» has been removed from the «openssl ca» command.\n
Support for custom methods EVP_CIPHER, EVP_MD, EVP_PKEY, and EVP_PKEY_ASN1 has been removed.\n
Outdated SSL\/TLS functions tied to fixed protocol versions have been removed, such as «TLSv1_client_method()».\n
Deprecated functions ERR_get_state(), ERR_remove_state(), and ERR_remove_thread_state() have been removed.\n
Support for target platforms darwin-i386{,-cc} and darwin-ppc{,64}{,-cc} has been discontinued. <\/ul>\n