OpenSSL 4.1.0 Alpha 1 Introduces DTLS 1.3 Support and Post-Quantum Crypto Optimizations
The first alpha release of OpenSSL 4.1.0 brings support for Datagram Transport Layer Security (DTLS) 1.3 and performance enhancements for post-quantum cryptography algorithms.
The OpenSSL project has released the initial alpha build for OpenSSL 4.1.0, offering developers an early preview of significant updates focused on securing datagram traffic and accelerating post-quantum cryptographic operations. This alpha release provides a glimpse into the features expected in the upcoming stable version, which is still several months away from general availability.
A primary highlight of this release is the introduction of support for DTLS 1.3, as defined in RFC 9147. DTLS is crucial for securing communication channels that rely on the User Datagram Protocol (UDP), such as those used in video conferencing, Virtual Private Networks (VPNs), and Internet of Things (IoT) devices. Unlike protocols built on Transmission Control Protocol (TCP), DTLS is designed to handle the potential for out-of-order or delayed packets inherent in UDP. The 1.3 version brings DTLS security features in line with TLS 1.3, addressing previous gaps in areas like forward secrecy and handshake efficiency.
Further enhancing its future-proofing capabilities, OpenSSL 4.1.0 alpha 1 includes optimizations for post-quantum cryptography (PQC) algorithms. These algorithms are designed to withstand attacks from future quantum computers. The release features accelerated ML-DSA and ML-KEM operations for the ppc64le architecture, along with ML-DSA optimizations for s390x and x86_64 processors. Additionally, it leverages AVX-512 instructions to speed up the SHAKE hashing function, which is integral to ML-DSA. A separate optimization using AVX-512 and VAES enhances AES-CBC decryption performance on x86_64 systems. These improvements aim to reduce the computational overhead of PQC, facilitating smoother adoption for organizations preparing to migrate to quantum-resistant cryptographic standards.
While the release focuses on new features and performance, it also includes several changes that may impact existing configurations. The tsget timestamp utility now requires the Net::Curl::Easy Perl module, replacing the previously used WWW::Curl::Easy, which is no longer maintained. Users of tsget will need to install this new dependency before upgrading. Furthermore, the build system has dropped support for Windows-on-Itanium and Windows CE. The Configure script has also removed the no-ecdsa and no-ecdh options, as they did not effectively disable elliptic curve implementations; users now must use no-ec to disable all elliptic curve support.
Several smaller enhancements are also present in this alpha build. GREASE (Generate Random Extended And Sampled Extensions) support, as per RFC 8701, has been added to prevent TLS clients and servers from failing due to unrecognized extension values. A dedicated DTLS mode for the SSL listener API has been implemented, alongside support for the IKEv2 key derivation function commonly used in VPN negotiations. Initial support for the Elbrus2000 processor architecture, found in some Russian-manufactured systems, has also been included.
As this is an alpha release, the feature set is subject to change before the final version of OpenSSL 4.1.0 is published. The OpenSSL project typically follows a development cycle that includes multiple alpha and beta releases to gather feedback and refine features. Organizations that heavily rely on DTLS for their network communications or are actively testing post-quantum cryptographic deployments are encouraged to begin testing this alpha build to prepare for the upcoming stable release and provide valuable feedback to the OpenSSL development team.