OpenSSL 4.1.0

Secure connections using DTLS 1.3 are now available with this new OpenSSL release.

OpenSSL has released version 4.1.0, introducing significant new features and some compatibility changes. This release adds support for DTLS 1.3 (RFC 9147) and RFC 8701 GREASE, enhancing secure communication protocols. It also includes optimized ML-DSA and ML-KEM operations for ppc64le and x86_64 architectures, along with AVX-512 optimizations for AES-CBC decryption on x86_64. The tsget utility has been updated to use Net::Curl::Easy from the Net-Curl CPAN distribution. Incompatible changes include the dropping of Windows-on-Itanium and Windows CE build targets, and the removal of no-ecdsa and no-ecdh options in favor of a general no-ec option for disabling elliptic curve support. Initial support for the Elbrus2000 (e2k) architecture has also been added. The release notes highlight several known issues, particularly related to DTLS 1.3 KeyUpdate and error reporting on DTLS listeners.

The introduction of DTLS 1.3 support is a key advancement, aligning OpenSSL with the latest security standards for datagram transport layer security. This move is crucial for applications requiring robust security over UDP, such as VoIP, gaming, and IoT devices, ensuring better performance and security. The optimized cryptographic operations for specific architectures also signal a continued push towards hardware-accelerated security, potentially reducing latency and increasing throughput for high-demand applications. Developers relying on OpenSSL should review the updated manual pages and address any compatibility changes, particularly regarding build targets and elliptic curve support.

The known issues in DTLS 1.3, specifically concerning KeyUpdate handling and error reporting on DTLS listeners, indicate that while the protocol is supported, its implementation may require careful testing and workarounds in production environments. These issues could lead to unexpected connection terminations or incorrect error states, impacting application stability. Developers will need to monitor for fixes in subsequent releases and potentially implement their own error-handling logic to mitigate these problems, especially in mission-critical applications relying on continuous DTLS connectivity.