OpenSSL 4.1.0 adds DTLS 1.3 and post-quantum speedups
Original title: OpenSSL 4.1.0 Released With DTLS 1.3 and Post-Quantum Security Improvements
The October 23 feature release is not a security patch and documents four DTLS issues still awaiting a fix.
OpenSSL published version 4.1.0 on October 23 as a feature release, not a standalone security patch. It adds DTLS 1.3, defined in RFC 9147, to the SSL listener API, plus GREASE, the IKEv2 key derivation function, and initial Elbrus2000 support. ML-DSA and ML-KEM operations are faster on ppc64le and x86_64, with no benchmark figures given. Four documented DTLS problems remain, including a KeyUpdate bug that can drop pending post-handshake records; a fix is planned for a later release.
Unconfirmed: A fix for the KeyUpdate retransmission issue is planned but not included in 4.1.0.
- tsget users must install Net::Curl::Easy before upgrading.
- Windows-on-Itanium and Windows CE build targets were removed.
- no-ecdsa and no-ecdh options were removed; use no-ec instead.
- A DTLS 1.3 KeyUpdate can stop session tickets from being resent.
- Listener failures may appear as SSL_ERROR_WANT_READ or SSL_ERROR_SYSCALL.
- 1.Review the four documented DTLS issues before deploying OpenSSL 4.1.0.
- 2.Install Net::Curl::Easy before upgrading if you use tsget.
- 3.Disable elliptic curves with no-ec, not the removed no-ecdsa or no-ecdh options.
From the original article
2 min read at cybersecuritynews.com
OpenSSL has released version 4. 1. 0, bringing DTLS 1.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.