OpenSSL 4.1 Introduces Major Security Upgrades
The highly anticipated OpenSSL 4.1 is now officially available for download. This release serves as a substantial update for the indispensable open-source software library. Essentially, OpenSSL provides the critical cryptographic foundation that ensures secure communications across computer networks. It protects countless applications and websites globally.
Key Features: DTLS 1.3 and GREASE Support
The highlights of OpenSSL 4.1 are truly impressive. Most notably, it introduces full support for the advanced DTLS (Datagram Transport Layer Security) 1.3 protocol. Furthermore, the update incorporates support for the GREASE (Generate Random Extensions And Sustain Extensibility) mechanism. This crucial feature actively prevents frustrating extensibility failures within the broader TLS ecosystem. Additionally, developers integrated the robust IKEV2 KDF cryptographic mechanism. They also established initial support for the unique Elbrus2000 (e2k) hardware architecture.
Performance Optimizations Across Architectures
OpenSSL 4.1 delivers significant performance enhancements. It meticulously optimizes ML-DSA and ML-KEM NTT operations specifically for the PowerPC 64-bit Little Endian (ppc64le) architecture. Similarly, it refines ML-DSA operations on both the 64-bit/amd64 (x86_64) and IBM System z (s390x) architectures. Furthermore, the release boasts AVX-512-optimized SHAKE x4 operations tailored for ML-DSA. It also includes powerful AVX-512 and VAES optimizations designed to accelerate AES-CBC decryption on the x86_64 architecture.
Build Targets and Utility Updates
Beyond cryptographic enhancements, OpenSSL 4.1 introduces new VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets. These additions provide essential internal functions that bridge existing gaps in C99 standard support within MSVC 2013. Moreover, the development team updated the tsget utility. It now utilizes the modern Net::Curl::Easy Perl module from the Net-Curl CPAN distribution. This strategic move abandons the obsolete and unsupported WWW::Curl::Easy module.
Configuration Changes and Removals
Among other noteworthy modifications, OpenSSL 4.1 removes the misleading no-ecdsa and no-ecdh options from the Configure script. Previously, these options did not actually disable the underlying implementations. Consequently, users must now employ the broader no-ec option if they intend to disable elliptic curve support entirely. Finally, the update completely purges the obsolete Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from the Configurations.
Release Notes and Installation Advice
Users should be aware that some known issues persist in this update. Therefore, we highly recommend reviewing the comprehensive release notes available on the project’s GitHub page. This resource provides intricate details regarding all the changes included in OpenSSL 4.1. You can also download the source code directly from that location if you prefer to compile it manually. However, for maximum stability and seamless integration, experts strongly advise installing OpenSSL directly from your specific Linux distribution’s official repositories.
