{"slug": "openssl-4-1-0", "title": "OpenSSL 4.1.0", "summary": "The OpenSSL project released OpenSSL 4.1.0, a feature release that adds DTLS 1.3 support per RFC 9147, RFC 8701 GREASE support, DTLS support in the SSL listener API, IKEV2 KDF support, and initial support for the Elbrus2000 (e2k) architecture. The release also adds optimized ML-DSA and ML-KEM NTT operations on ppc64le, optimized ML-DSA operations and AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64, and AVX-512 and VAES optimizations for AES-CBC decryption on x86_64. Breaking changes include dropping the Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets, removing the no-ecdsa and no-ecdh Configure options, and switching the tsget utility to Net::Curl::Easy, which users must install before upgrading; the release lists four known DTLS issues, including #32878, where a received DTLS 1.3 KeyUpdate drops other outstanding post-handshake records from the retransmission buffer, with a fix planned for a future release.", "body_md": "## Repository navigation\n\n[openssl-machine](https://github.com/openssl-machine)released this\n\n[438 commits](https://github.com/openssl/openssl/compare/openssl-4.1.0...master)to master since this release\n\nOpenSSL 4.1.0 is a feature release adding significant new functionality\n\nto OpenSSL.\n\nThis release incorporates the following potentially significant or incompatible\n\nchanges:\n\n- \nAdded `VC-WIN32-MSVC2013` and`VC-WIN64A-MSVC2013` build targets to provide\n internal functions for bridging the gaps in C99 standard support\nthat are present in MSVC 2013.\n- \nAdded optimized ML-DSA and ML-KEM NTT operations on `ppc64le` ;\n optimized ML-DSA operations on`x86_64` ;\n AVX-512-optimized SHAKE x4 operations for ML-DSA on`x86_64` ;\n AVX-512 and VAES optimizations for AES-CBC decryption on`x86_64` .\n- \nChanged `tsget` utility to use`Net::Curl::Easy` (from the`Net-Curl` CPAN\n distribution) instead of the abandoned`WWW::Curl::Easy` .  Users who rely\n on`tsget` should install`Net::Curl::Easy` before upgrading.\n- \nDropped Windows-on-Itanium ( `VC-WIN64I` ) and Windows CE (`VC-CE` ) targets\nfrom Configurations.\n- \nDropped `no-ecdsa` and`no-ecdh` options from`Configure` , as these options\n did not really disable the implementations. Use`no-ec` to disable\nthe elliptic curve support.\n\nThis release adds the following new features:\n\n- \nSupport for DTLS 1.3 ( [RFC 9147](https://datatracker.ietf.org/doc/html/rfc9147) ).\n Refer to the`ossl-guide-dtlsv13(7)` manual page for details.\n- \nSupport for [RFC 8701](https://datatracker.ietf.org/doc/html/rfc8701) GREASE (Generate Random Extensions And Sustain\nExtensibility).\n- \nDTLS support in the SSL listener API.\n- \nSupport for IKEV2 KDF.\n- \nInitial support for the Elbrus2000 ( `e2k` ) architecture.\n\nKnown issues in 4.1.0:\n\n- \n[#32878](https://github.com/openssl/openssl/issues/32878)\n When a DTLS 1.3 KeyUpdate is received, all other outstanding\n post-handshake records are dropped from the retransmission buffer.\n This means post-handshake records still awaiting an ACK (such as a\n NewSessionTicket) will no longer be retransmitted if the original\n transmission is lost. A fix is in progress and planned for a future\nrelease.\n- \n[#33277](https://github.com/openssl/openssl/issues/33277)\n A permanent receive failure on a DTLS listener can be reported as\n `SSL_ERROR_WANT_READ` on an accepted connection. Polling and subsequent\n accept calls may also fail to report the error, causing applications\nto continue waiting after a permanent failure.\n- \n[#33278](https://github.com/openssl/openssl/issues/33278)\n A retryable write failure on a nonblocking connection accepted from a\n DTLS listener can be reported as`SSL_ERROR_SYSCALL` instead of\n `SSL_ERROR_WANT_WRITE` . Applications treating this result as fatal may\nclose a connection that is still usable.\n- \n[#33242](https://github.com/openssl/openssl/issues/33242)\n DTLS 1.3 servers may abort handshakes with an`unexpected_message` alert\n when a client acknowledges part or all of the server's first flight\n before sending its response. This can occur after packet loss or while\nthe client is preparing its authentication response.", "url": "https://wpnews.pro/news/openssl-4-1-0", "canonical_source": "https://github.com/openssl/openssl/releases/tag/openssl-4.1.0", "published_at": "2026-10-23 12:42:44+00:00", "updated_at": "2026-10-23 13:10:52.086307+00:00", "lang": "en", "topics": ["artificial-intelligence"], "entities": ["OpenSSL", "OpenSSL 4.1.0", "RFC 9147", "RFC 8701", "Elbrus2000", "Net::Curl::Easy", "WWW::Curl::Easy", "ML-DSA"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openssl-4-1-0", "markdown": "https://wpnews.pro/news/openssl-4-1-0.md", "text": "https://wpnews.pro/news/openssl-4-1-0.txt", "jsonld": "https://wpnews.pro/news/openssl-4-1-0.jsonld"}}