OpenSSL 4.1.0 Released With DTLS 1.3 and Post-Quantum Security Improvements

OpenSSL has released version 4.1.0, bringing DTLS 1.3 support, faster cryptographic operations, and new tools for developers building secure network services.

Published on October 23, the update is a feature release, not a standalone security patch. It also includes compatibility changes and four known issues that teams should review before deployment.

The official release notes identify DTLS 1.3 as a key addition. The release follows the earlier OpenSSL 4.1.0 Alpha1 preview, which introduced the protocol alongside GREASE support and cryptographic performance improvements.

Datagram Transport Layer Security protects applications that use transports such as UDP. Unlike TCP, UDP does not guarantee that packets arrive or arrive in order.

DTLS adds encryption and authentication while preserving that behavior, making it useful for applications where delays matter, including gaming and some streaming services.

OpenSSL 4.1.0 Released With DTLS 1.3

Defined in RFC 9147, DTLS 1.3 builds on TLS 1.3 and helps prevent eavesdropping, data tampering, and forged messages. It provides similar security guarantees, but applications must account for differences in message ordering and replay protection. DTLS also handles lost handshake messages without turning application traffic into a reliable, ordered stream.

OpenSSL 4.1.0 adds DTLS support to its SSL listener API. Other additions include GREASE, the IKEv2 key derivation function, and initial support for the Elbrus2000 processor architecture. GREASE stands for Generate Random Extensions And Sustain Extensibility.

The release improves ML-DSA and ML-KEM number theoretic transform operations on ppc64le systems. On x86_64, it adds optimized ML-DSA operations, AVX-512 SHAKE processing for ML-DSA, and AVX-512 and VAES improvements for AES-CBC decryption. The release notes provide no benchmark figures.

Developers using the tsget utility must install Net::Curl::Easy before upgrading because it replaces the abandoned WWW::Curl::Easy dependency. OpenSSL also removes Windows-on-Itanium and Windows CE build targets while adding targets that address gaps in MSVC 2013’s C99 support.

The no-ecdsa and no-ecdh configuration options have been removed because they didn’t actually turn off those implementations. Teams seeking to turn off elliptic curve support must use no-ec instead.

Four documented problems affect DTLS behavior. Receiving a DTLS 1.3 KeyUpdate can remove other pending post-handshake records from the retransmission buffer. If the original packets are lost, records such as session tickets will not be resent. A fix is planned for a future release.

Listener error handling also has limitations. A permanent receive failure may appear as SSL_ERROR_WANT_READ, leaving applications waiting.

A retryable write failure may instead appear as SSL_ERROR_SYSCALL, potentially causing applications to close usable connections. Early client acknowledgments can also trigger handshake failures after packet loss.

Teams should test these paths before rollout. Earlier OpenSSL DTLS memory-leak coverage provides useful security context. However, those patched flaws are separate from the known issues documented for this release.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post OpenSSL 4.1.0 Released With DTLS 1.3 and Post-Quantum Security Improvements appeared first on Cyber Security News.