OpenSSL 4.1.0-beta2 Release
The OpenSSL Project is pleased to announce the release of OpenSSL 4.1.0-beta2.
OpenSSL 4.1.0 is a feature release adding significant new functionality
to OpenSSL.
This release incorporates the following potentially significant or incompatible
changes:
-
Added
VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide
internal functions for bridging the gaps in C99 standard support
that are present in MSVC 2013.
-
Added optimized ML-DSA and ML-KEM NTT operations on
ppc64le;
optimized ML-DSA operations on x86_64;
AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64;
AVX-512 and VAES optimizations for AES-CBC decryption on x86_64.
-
Changed
tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN
distribution) instead of the abandoned WWW::Curl::Easy. Users who rely
on tsget should install Net::Curl::Easy before upgrading.
-
Dropped Windows-on-Itanium (
VC-WIN64I) and Windows CE (VC-CE) targets
from Configurations.
-
Dropped
no-ecdsa and no-ecdh options from Configure, as these options
did not really disable the implementations. Use no-ec to disable
the elliptic curve support.
This release adds the following new features:
-
Support for DTLS 1.3 (RFC 9147).
Refer to the ossl-guide-dtlsv13(7) manual page for details.
-
Support for RFC 8701 GREASE (Generate Random Extensions And Sustain
Extensibility).
-
DTLS support in the SSL listener API.
-
Support for IKEV2 KDF.
-
Initial support for the Elbrus2000 (
e2k) architecture.
Known issues in 4.1.0
- #32878
When a DTLS 1.3 KeyUpdate is received, all other outstanding
post-handshake records are dropped from the retransmission buffer.
This means post-handshake records still awaiting an ACK (such as a
NewSessionTicket) will no longer be retransmitted if the original
transmission is lost. A fix is in progress and planned for a future
release. - #33172 and #33173
These potential security issues in the DTLS-1.3 code were reported
today. We did not want to release 4.1.0 with known security issues in
the new implementation. For that reason, we have released 4.1.0-beta2 instead.
You can download the release from our download page or from the GitHub release page.
