{"slug": "openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations", "title": "OpenSSL 4.1 Released with DTLS 1.3 Support, Crypto Optimizations", "summary": "The OpenSSL Project released OpenSSL 4.1, adding support for DTLS 1.3 as defined in RFC 9147 and implementing GREASE per RFC 8701. The release adds optimized Number Theoretic Transform operations for ML-DSA and ML-KEM on PPC64LE systems and faster ML-DSA operations on x86-64, plus AVX-512-optimized SHAKE x4 for ML-DSA and AVX-512 and VAES optimizations for AES-CBC decryption. OpenSSL 4.1 drops Windows CE and Windows on Itanium build targets, removes the no-ecdsa and no-ecdh options in favor of no-ec, and documents four known DTLS-related issues, with fixes planned for future releases.", "body_md": "The OpenSSL Project announced OpenSSL 4.1, a feature update to the open-source cryptographic library used to secure network communications.\n\nThe biggest addition is support for DTLS 1.3, defined in RFC 9147. Datagram Transport Layer Security provides TLS-like security for datagram-based communications, especially UDP, where packets may arrive out of order or be lost. Version 1.3 modernizes the protocol with security improvements based on TLS 1.3.\n\nAlongside this, OpenSSL 4.1 implements GREASE, specified in RFC 8701. This mechanism helps prevent protocol implementations from becoming dependent on a fixed set of recognized values, making it easier to introduce new extensions without compatibility problems.\n\nAnother notable improvement is cryptographic performance, particularly for post-quantum algorithms. OpenSSL 4.1 introduces optimized Number Theoretic Transform operations for ML-DSA and ML-KEM on PPC64LE systems, along with faster ML-DSA operations on x86-64 processors.\n\nThe release also adds AVX-512-optimized SHAKE x4 operations for ML-DSA and AVX-512 and VAES optimizations for AES-CBC decryption on x86-64. These changes improve performance on supported processors.\n\nOn the API side, DTLS support has been added to the SSL listener API, while support for the IKEv2 Key Derivation Function expands the library’s cryptographic capabilities. Initial support for the Elbrus2000 processor architecture is also included.\n\nThere are several compatibility changes worth mentioning. OpenSSL 4.1 drops build targets for Windows CE and Windows on Itanium. The no-ecdsa and no-ecdh configuration options have been removed because they did not disable the corresponding implementations. Developers should now use no-ec to disable elliptic curve support.\n\nAdditionally, the `tsget` utility has switched from the abandoned `WWW::Curl::Easy` Perl module to `Net::Curl::Easy`. Anyone relying on this utility should install the new dependency before upgrading.\n\nHowever, the OpenSSL team has documented four known issues in version 4.1, all related to DTLS functionality. These include problems with retransmitting certain records after DTLS 1.3 KeyUpdate messages, incorrect error reporting on DTLS listener connections, and handshake failures under specific packet-loss conditions. Fixes are planned for future releases.\n\nFor more information, refer to the [release notes](https://github.com/openssl/openssl/releases/tag/openssl-4.1.0).", "url": "https://wpnews.pro/news/openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations", "canonical_source": "https://linuxiac.com/openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations/", "published_at": "2026-10-23 12:58:20+00:00", "updated_at": "2026-10-23 13:12:52.504293+00:00", "lang": "en", "topics": ["artificial-intelligence"], "entities": ["OpenSSL Project", "OpenSSL 4.1", "DTLS 1.3", "ML-DSA", "ML-KEM", "RFC 9147", "RFC 8701", "Elbrus2000"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations", "markdown": "https://wpnews.pro/news/openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations.md", "text": "https://wpnews.pro/news/openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations.txt", "jsonld": "https://wpnews.pro/news/openssl-4-1-released-with-dtls-1-3-support-crypto-optimizations.jsonld"}}