OpenSSL 4.1.0 Released with DTLS 1.3 Support, but Four Bugs Plague Implementation
The latest OpenSSL 4.1.0 release introduces support for DTLS 1.3, yet it ships with four known bugs in its DTLS implementation that could impact connection data interpretation and handshake stability.
The OpenSSL project has announced the release of version 4.1.0, a significant update that brings support for the Datagram Transport Layer Security (DTLS) 1.3 protocol, as defined in RFC 9147. DTLS is crucial for securing datagram-based transports like UDP. However, this new release is not without its issues, as it includes four known bugs specifically within its DTLS code.
Developers integrating DTLS 1.3 or utilizing the newly added DTLS support in OpenSSL's SSL listener API are strongly advised to exercise caution. Two of the identified bugs can lead to incorrect interpretation of a connection's state. One issue causes a permanent receive failure on a DTLS listener to be reported as SSL_ERROR_WANT_READ, a code that typically signals the application to wait for more data. This can be exacerbated by polling and subsequent accept calls, potentially causing the application to wait indefinitely on a dead connection. Another bug involves retryable write failures on non-blocking connections, which may surface as SSL_ERROR_SYSCALL. Applications that treat this error code as fatal could inadvertently close connections that are still functional.
Further complicating matters, the release also contains bugs affecting DTLS 1.3 handshakes and session ticket handling. A DTLS 1.3 server might abort a handshake with an unexpected_message alert if a client acknowledges parts of the server's initial message flight before responding, a scenario that can occur due to packet loss. This could disrupt the establishment of secure connections.
The fourth reported bug relates to the KeyUpdate message, which peers use to refresh encryption keys mid-session. When OpenSSL receives a KeyUpdate message, it clears all other pending post-handshake records from its retransmission buffer. If a NewSessionTicket, essential for clients to resume sessions later, was lost during its initial transmission, OpenSSL will not retransmit it, potentially preventing session resumption.
The OpenSSL project has indicated that a fix is in progress for the NewSessionTicket bug, but no fix status has been provided for the other three DTLS-related issues. This means organizations running DTLS 1.3 servers must plan their deployments with these four bugs in mind, as they could lead to connection instability and data integrity problems.
Beyond the DTLS issues, OpenSSL 4.1.0 also addresses build flag inconsistencies. The no-ecdsa and no-ecdh options have been removed from the Configure script because they did not effectively disable the intended cryptographic implementations. Users seeking to disable elliptic curve support entirely are now directed to use the no-ec flag.
Additionally, the release includes changes that may impact existing setups. The build targets for Windows-on-Itanium and Windows CE have been dropped. Furthermore, the tsget time-stamping utility now requires the Perl module Net::Curl::Easy, replacing the previously used WWW::Curl::Easy. Users relying on tsget will need to install the new module before upgrading to OpenSSL 4.1.0.
On a more positive note, the release brings performance enhancements, particularly in post-quantum cryptography. Optimized NTT operations for ML-KEM and ML-DSA have been implemented for ppc64le architectures, with further x86_64 optimizations for ML-DSA, including AVX-512 SHAKE x4 code. AES-CBC decryption on x86_64 also benefits from AVX-512 and VAES optimizations. The update also incorporates RFC 8701 GREASE (Generate Randomly Extended And Supported Extensions) to help identify servers that mishandle unrecognized values during handshakes, adds an IKEv2 key derivation function, and introduces initial support for the Elbrus2000 architecture.