OpenSSL 4.1.0
OpenSSL 4.1.0, a feature release adding significant new functionality, has been released with support for DTLS 1.3 and other security enhancements.
OpenSSL 4.1.0 introduces several significant changes, including optimized ML-DSA and ML-KEM NTT operations on ppc64le and x86_64 architectures, along with AVX-512 optimizations for SHAKE x4 operations and AES-CBC decryption. The tsget utility has been updated to use Net::Curl::Easy instead of the abandoned WWW::Curl::Easy.
The release drops Windows-on-Itanium and Windows CE targets from Configurations, as well as the no-ecdsa and no-ecdh options from Configure. Users now need to use no-ec to disable elliptic curve support.
New Features
Key additions include support for DTLS 1.3 (RFC 9147), RFC 8701 GREASE, DTLS support in the SSL listener API, IKEV2 KDF support, and initial support for the Elbrus2000 (e2k) architecture.
Known Issues
Several issues remain in version 4.1.0, including problems with DTLS 1.3 KeyUpdate handling, permanent receive failures on DTLS listeners, retryable write failures on nonblocking connections, and DTLS 1.3 servers potentially aborting handshakes unexpectedly.
A fix for the DTLS 1.3 KeyUpdate issue is in progress and planned for a future release.
Related
