OpenSSL 4.1.0 alpha1 adds DTLS 1.3 and faster post-quantum crypto

The OpenSSL project has released the first alpha of OpenSSL 4.1.0, adding DTLS 1.3 (RFC 9147) for UDP-based traffic, faster ML-DSA and ML-KEM post-quantum operations, GREASE (RFC 8701), IKEv2 KDF and Elbrus2000 (e2k) support, along with several breaking…

OpenSSL 4.1.0 alpha1, reported on 2026-09-09 (Help Net Security) and 2026-09-10 (Cyber Security News), is the first alpha of the 4.1.0 line, released months before general availability. It adds DTLS 1.3 per RFC 9147 to secure UDP-based traffic such as VPNs, video calls and IoT, and integrates a DTLS mode into the SSL listener API. Both reports say it speeds up post-quantum cryptography, but they attribute the optimizations differently: Help Net Security says ML-DSA and ML-KEM operations were optimized for ppc64le, s390x and x86_64, with AVX-512 acceleration for SHAKE hashing and AES-CBC decryption, while Cyber Security News says ML-DSA signatures and ML-KEM encapsulation are accelerated via AVX-512 and VAES optimizations on x86_64. The release also adds GREASE (RFC 8701), IKEv2 KDF support and initial Elbrus2000 (e2k) architecture support. Breaking changes include a new Net::Curl::Easy dependency for tsget and replacement of the no-ecdsa/no-ecdh Configure options with no-ec (both reported only by Help Net Security), and removal of Windows-on-Itanium and Windows CE support (reported by both). Both reports stress the alpha is for testing and development only; Cyber Security News explicitly advises not to deploy it to production.

• OpenSSL 4.1.0 alpha1 is the first alpha of the 4.1.0 line, released months before general availability (reported 2026-09-09 and 2026-09-10).
• Adds DTLS 1.3 support per RFC 9147 for securing UDP-based traffic such as VPNs, video calls and IoT.
• Integrates a DTLS mode into the SSL listener API (reported by both sources).
• Post-quantum speedups for ML-DSA and ML-KEM; sources disagree on attribution: Help Net Security says ML-DSA and ML-KEM optimized for ppc64le, s390x and x86_64 plus AVX-512 for SHAKE and AES-CBC, while Cyber Security News says ML-DSA/ML-KEM…
• Adds GREASE support per RFC 8701.
• Adds IKEv2 KDF support (reported by both sources).
• Adds initial Elbrus2000 (e2k) processor architecture support.
• Breaking change: tsget now requires a Net::Curl::Easy dependency (reported only by Help Net Security).