OpenSSL 4.1.0 adds DTLS 1.3 and ships four known DTLS bugs
Original title: OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken
Two bugs can misreport connection state, one can abort handshakes after packet loss, and KeyUpdate can drop a lost NewSessionTicket.
The OpenSSL project released 4.1.0 with DTLS 1.3 support, defined in RFC 9147, and four known bugs in the DTLS code. A permanent receive failure can appear as SSL_ERROR_WANT_READ, and a retryable write failure on a nonblocking accepted connection can appear as SSL_ERROR_SYSCALL. A server may abort a handshake with unexpected_message, and a KeyUpdate drops other outstanding post-handshake records so a lost NewSessionTicket is not resent. A fix is in progress only for the ticket bug. Configure no-ecdsa and no-ecdh were removed because they did not disable the named code; users should use no-ec.
Unconfirmed: A fix is in progress only for the KeyUpdate ticket bug; the other three have no stated fix status.
- DTLS 1.3 support and the new SSL listener DTLS path carry the four bugs.
- OpenSSL lists no fix status for three of the bugs.
- Windows-on-Itanium and Windows CE build targets were dropped.
- tsget now requires Perl module Net::Curl::Easy instead of WWW::Curl::Easy.
- ML-KEM, ML-DSA, and AES-CBC decryption received architecture-specific optimizations.
Impact: DTLS apps may misread state, abort handshakes, or lose tickets
| Product | Affected |
|---|---|
| OpenSSL | 4.1.0 |
- 1.Plan around all four DTLS 1.3 bugs if running a DTLS 1.3 server.
- 2.Do not treat SSL_ERROR_WANT_READ or SSL_ERROR_SYSCALL at face value on DTLS listeners.
- 3.Use no-ec instead of the removed no-ecdsa and no-ecdh Configure options.
- Vendors
- OpenSSL
- Organizations
- OpenSSL project
From the original article
2 min read at helpnetsecurity.com
The OpenSSL project released version 4. 1. 0, adding support for DTLS 1.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.