OpenSSL 4.1 stable is out today with new AVX-512 optimizations, other performance improvements, and finally retiring Windows on Itanium and Windows CE support.

OpenSSL 4.1 introduces DTLS 1.3 support as the newest version of the Datagram Transport Layer Security protocol. DTLS 1.3 provides for greater security, much faster handshakes, forward secrecy, built-in support for post-quantum cryptography, and an optimized header format.

OpenSSL 4.1 is also introducing support for Generate Random Extensions And Sustain Extensibility "GREASE". GREASE is interesting as it's for sending random, meaningless values in TLS network connections during handshakes for protocol codes that will never be used. The random data with GREASE in turn helps spot failures earlier on and ultimately more robust handling in the TLSS ecosystem by ensuring peers correctly handle unknown values.

Rounding out OpenSSL 4.1 are AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64. Also on the AVX-512 side are AVX-512 and AES optimizations for AES-CBC decryption. This builds on already existing AVX-512 support in the OpenSSL library. Benchmarks of the OpenSSL 4.1 Alpha release with these optimizations on various CPUs can be found via the OpenBenchmarking.org result page.

Downloads and more details on the OpenSSL 4.1 release via GitHub.