OpenSSL 4.1 Arrives With DTLS 1.3, GREASE and More AVX-512 Tuning

The OpenSSL project has shipped its stable 4.1 release. The headline additions are support for the recent DTLS 1.3 protocol, the GREASE mechanism, and another round of optimizations built on the AVX-512 instruction set.

DTLS 1.3

OpenSSL 4.1 adds DTLS 1.3, the newest version of the Datagram Transport Layer Security protocol. It offers greater security, much faster handshakes, forward secrecy, built-in support for post-quantum cryptography, and an optimized header format.

GREASE

The second notable feature is support for GREASE — Generate Random Extensions And Sustain Extensibility. The idea is a clever one: during a TLS handshake, random and meaningless values are injected for protocol codes that will never actually be used. That deliberate noise helps surface failures earlier and ultimately makes the whole TLS ecosystem more robust by forcing peers to handle unknown values correctly.

AVX-512 optimizations

Rounding things out are performance changes. On x86_64 there are now AVX-512-optimized SHAKE x4 operations used by ML-DSA, along with AVX-512 and AES instructions to speed up AES-CBC decryption. These build on the library's existing AVX-512 support; benchmarks of the 4.1 alpha across various CPUs are available on OpenBenchmarking.org.

Finally, the release drops support for Windows on Itanium and Windows CE for good. Downloads and further details on OpenSSL 4.1 can be found via the project's GitHub.

Source: Phoronix