Bayan watanni takwas na ci gaba, an ƙaddamar da sakin ɗakin karatu na OpenSSL 3.2.0 tare da aiwatar da ka'idojin SSL/TLS da daban-daban algorithms boye-boye. OpenSSL 3.2 za a tallafawa har zuwa Nuwamba 23, 2025. Taimakawa ga rassa na baya na OpenSSL 3.1 da 3.0 LTS zai ci gaba har zuwa Maris 2025 da Satumba 2026, bi da bi. An daina tallafawa reshe 1.1.1 a watan Satumba na wannan shekara. Ana rarraba lambar aikin a ƙarƙashin lasisin Apache 2.0.
Babban sabbin abubuwa na OpenSSL 3.2.0:
- An ƙara tallafin abokin ciniki don yarjejeniyar QUIC (RFC 9000), wanda aka yi amfani da shi azaman jigilar kaya a cikin yarjejeniyar HTTP/3. Aiwatarwa ta haɗa da, a tsakanin wasu abubuwa, ikon watsa rafuka da yawa akan tashar sadarwa guda ɗaya. Abubuwan da aka haɗa don amfani da QUIC akan sabobin za a haɗa shi cikin fitowar OpenSSL 3.3, wadda aka tsara za a buga ba daga baya ba sai 30 ga Afrilu, 2024.
QUIC wani tsawo ne na ka'idar UDP wanda ke goyan bayan haɓakar haɗin kai da yawa kuma yana ba da hanyoyin ɓoyewa daidai da TLS/SSL. An ƙirƙiri ƙa'idar a cikin 2013 ta Google a matsayin madadin haɗin TCP + TLS don Yanar gizo, magance matsaloli tare da saitin haɗin gwiwa mai tsayi da lokutan tattaunawa a cikin TCP da kawar da jinkiri lokacin da fakiti suka ɓace yayin canja wurin bayanai.
- TLS tana aiwatar da tallafi don tsawaita don matsawar takaddun shaida a matakin tattaunawar haɗin gwiwa (RFC 8879), wanda ke ba da izinin saitin haɗin kai da sauri tun lokacin canja wurin bayanan takaddun shaida don kaso na zaki na zirga-zirga yayin matakin tattaunawar haɗin gwiwa. Ana tallafawa matsi ta amfani da ɗakunan karatu na zlib, zstd da Brotli.
- Ƙara goyon baya don ƙayyadaddun sigar sa hannun dijital ECDSA (Deterministic ECDSA, RFC 6979) wanda, maimakon jeri bazuwar lokacin samar da sa hannu, ana amfani da hash HMAC-SHA256 daga maɓalli na sirri da kuma rubutun sa hannu na sa hannu, wanda yana ba ku damar karɓar sa hannu koyaushe a cikin ayyukan sa hannu daban-daban, amma baya ƙyale ɓoyayyun bayanan da za a iya amfani da su don tantance maɓalli na sirri (ana iya ƙididdige maɓalli na sirri idan an ƙirƙiri aƙalla sa hannu biyu don bayanai daban-daban ta amfani da maimaita bazuwar bazuwar. jerin).
- Ƙara tallafi don tsawaita Ed25519 da Ed448 na jama'a maɓalli na sa hannu na dijital: Ed25519ctx, Ed25519ph da Ed448ph (RFC 8032).
- Ƙara goyon baya ga yanayin ɓoye AES-GCM-SIV (RFC 8452), wanda ya haɗu da babban aikin yanayin GCM (Galois/Counter Mode) tare da juriya ga leaks lokacin sake amfani da lambar bazuwar bazuwar.
- An aiwatar da aikin ƙirƙirar maɓalli na Argon2 (RFC 9106), wanda ya lashe gasar ayyukan hashing ɗin kalmar sirri a cikin 2015. Ƙara ikon yin amfani da tafkin zare.
- Ƙara goyon baya don ɓoyayyen ɓoyayyiyar haɗin gwiwa dangane da tsarin HPKE (Hybrid Public Key Encryption, RFC 9180), wanda ya haɗu da sauƙin canja wurin maɓalli a cikin ɓoyayyen maɓalli na jama'a tare da babban aikin ɓoyayyen ɓoye (an rufaffen bayanai tare da maɓalli mai sauri, kuma key da kanta an rufa masa asiri tare da jinkirin asymmetric).
- TLS tana aiwatar da ikon yin amfani da maɓallan jama'a "raw" (RFC 7250).
- Supportara tallafi don hanyar buɗe sauri ta hanyar haɗin TCP (TFO - TCP Fast Buɗe, RFC 7413), wanda ke ba ku damar rage yawan matakan saitin haɗin haɗin ta hanyar haɗa matakan farko da na biyu na tsarin shawarwarin haɗin gwiwa na matakai 3 na al'ada cikin buƙatu ɗaya. kuma yana ba da damar aika bayanai a matakin saitin haɗin farko.
- TLS tana aiwatar da tallafi don tsare-tsaren sa hannu na dijital da za a iya toshewa, yana ba da damar yin amfani da aiwatar da aiwatar da algorithms na ɓangare na uku, alal misali, don amfani da algorithms a cikin TLS waɗanda ke da juriya da ƙarfi akan kwamfutoci masu yawa.
- TLS 1.3 yana ƙara goyan baya ga amintattun layukan elliptic na Brainpool.
- Ƙara goyon baya don umarnin sarrafawa na SM4-XTS.
- A kan dandalin Windows An aiwatar da ikon amfani da shagon takardar shaidar tushen tsarin (an kashe shi ta tsohuwa). Don samun damar takaddun shaida a cikin shagon Windows URI ɗin da aka ba da shawara shine "org.openssl.winstore://".
source: budenet.ru
