OpenSSL 4.1.0

Code

Issues1k (1k)

Pull requests583 (583)

Discussions

Actions

Projects

Wiki

Security and quality

Insights

More items

Releases

openssl-4.1.0

OpenSSL 4.1.0

Latest

Latest

Compare

Choose a tag to compare

Sorry, something went wrong.

Filter

Loading

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

openssl-4.1.0

2f4e3a5

OpenSSL 4.1.0 is a feature release adding significant new functionality

to OpenSSL.

This release incorporates the following potentially significant or incompatible

changes:

Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide

internal functions for bridging the gaps in C99 standard support

that are present in MSVC 2013.

Added optimized ML-DSA and ML-KEM NTT operations on ppc64le;

optimized ML-DSA operations on x86_64;

AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64;

AVX-512 and VAES optimizations for AES-CBC decryption on x86_64.

Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN

distribution) instead of the abandoned WWW::Curl::Easy. Users who rely

on tsget should install Net::Curl::Easy before upgrading.

Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets

from Configurations.

Dropped no-ecdsa and no-ecdh options from Configure, as these options

did not really disable the implementations. Use no-ec to disable

the elliptic curve support.

This release adds the following new features:

Support for DTLS 1.3 (RFC 9147).

Refer to the ossl-guide-dtlsv13(7) manual page for details.

Support for RFC 8701 GREASE (Generate Random Extensions And Sustain

Extensibility).

Initial support for the Elbrus2000 (e2k) architecture.

#32878

When a DTLS 1.3 KeyUpdate is received, all other outstanding

post-handshake records are dropped from the retransmission buffer.

This means post-handshake records still awaiting an ACK (such as a

NewSessionTicket) will no longer be retransmitted if the original

transmission is lost. A fix is in progress and planned for a future

release.

#33277

A permanent receive failure on a DTLS listener can be reported as

SSL_ERROR_WANT_READ on an accepted connection. Polling and subsequent

accept calls may also fail to report the error, causing applications

to continue waiting after a permanent failure.

#33278

A retryable write failure on a nonblocking connection accepted from a

DTLS listener can be reported as SSL_ERROR_SYSCALL instead of

SSL_ERROR_WANT_WRITE. Applications treating this result as fatal may

close a connection that is still usable.

#33242

DTLS 1.3 servers may abort handshakes with an unexpected_message alert

when a client acknowledges part or all of the server's first flight

before sending its response. This can occur after packet loss or while

the client is preparing its authentication response.

Loading

Uh oh!

There was an error while loading. Please reload this page.