OpenSSL 4.1 Alpha 1: DTLS 1.3, GREASE and New AVX-512 Optimizations

The OpenSSL project has published the first alpha version of the upcoming 4.1 release. Intended for testing, it brings several notable additions to the cryptographic library.

DTLS 1.3 and GREASE

OpenSSL 4.1 Alpha 1 adds support for DTLS 1.3 — the newest version of the Datagram Transport Layer Security protocol. Compared to its predecessors, it offers a higher level of security, a markedly faster handshake, forward secrecy, built-in support for post-quantum cryptography and an optimized header format.

The second important addition is the GREASE (Generate Random Extensions And Sustain Extensibility) mechanism. At first glance its idea seems paradoxical: during the TLS handshake, random, deliberately meaningless values are sent for protocol codes that will never actually be used. The point is a stress test: if one of the parties to a connection mishandles values unknown to it, the failure will surface sooner. In this way GREASE helps keep the TLS ecosystem more resilient to future extensions.

Speedups and Post-Quantum Cryptography

Work on AVX-512-based optimizations continues. The new version introduces AVX-512-accelerated SHAKE x4 operations for the ML-DSA algorithm on the x86_64 architecture, as well as AVX-512 and AES optimizations for decryption in AES-CBC mode. All of this complements the AVX-512 support already present in OpenSSL. Phoronix promises to begin benchmarking OpenSSL 4.1 soon.

What Was Removed and What Was Added

OpenSSL 4.1 permanently discontinues support for Windows on the Itanium architecture, as well as the Windows CE build target. At the same time, initial support appears for a new processor architecture — the Russian «Elbrus» (E2K, Elbrus 2000).

You can download the alpha version and learn the details on the project's GitHub.

Source: Phoronix