OpenSSL released 4.1.0 with DTLS 1.3 support and four known bugs

OpenSSL released version 4.1.0 of its widely used cryptographic library. Help Net Security reported the release, which adds support for DTLS 1.3 as defined in RFC 9147 while listing four known bugs in the new DTLS code. The bugs affect developers who adopt DTLS 1.3 or enable DTLS support in OpenSSL’s SSL listener API. The release ships the DTLS 1.3 guide as the ossl-guide-dtlsv13(7) manual page.

DTLS works as a variant of TLS built for datagram transports such as UDP. The project defines DTLS 1.3 in RFC 9147. The four known bugs sit in the new DTLS code introduced with version 4.1.0. Developers who adopt DTLS 1.3 or enable DTLS support through the SSL listener API face these issues.

Two of the bugs can cause an application to misread the state of a connection. A permanent receive failure on a DTLS listener can surface as SSL_ERROR_WANT_READ. That error instructs a program to wait for data. Polling or later accept calls could overlook the error, leaving the application waiting on a connection that is dead.

A retryable write failure on a nonblocking accepted connection can surface as SSL_ERROR_SYSCALL. An application that treats that error as fatal may close a working connection. The error can mask a write failure that was actually retryable. Help Net Security says OpenSSL must fix these two bugs first.

A DTLS 1.3 server may abort a handshake by issuing an unexpected_message alert. That can happen when the client acknowledges part or all of the server’s first flight before replying. Packet loss can trigger this situation. The server sends the alert rather than completing the handshake.

The fourth bug involves KeyUpdate, which lets a peer switch to fresh encryption keys mid-session. When OpenSSL receives a KeyUpdate, it clears the retransmission buffer of outstanding post-handshake records. If a NewSessionTicket is lost on its first trip, OpenSSL will not resend it. The client uses the ticket to resume the session later.

The project is working on a fix for the KeyUpdate bug. It lists no fix status for the other three bugs. OpenSSL must fix the two bugs first.

OpenSSL removed the no-ecdsa and no-ecdh options from Configure because the named implementations were not really disabled by these options. A build using either flag still carried the code it was meant to leave out. The project directs users to no-ec, which disables elliptic curve support entirely. OpenSSL also dropped the Windows-on-Itanium and Windows CE build targets.

The tsget time-stamping utility now requires the Perl module Net::Curl::Easy. It replaces the abandoned WWW::Curl::Easy with Net::Curl::Easy. Anyone relying on tsget needs to install the new module before upgrading.

ML-KEM and ML-DSA are the post-quantum key exchange and signature algorithms. They receive optimized NTT operations on ppc64le. ML-DSA also gets further x86_64 work that includes AVX-512 SHAKE x4 code. AES-CBC decryption on x86_64 picks up AVX-512 and VAES optimizations.

The release adds RFC 8701 GREASE. Servers that mishandle unrecognized values get flushed out when GREASE sends random reserved values during handshakes. The release also adds an IKEv2 key derivation function. The release includes initial support for the Elbrus2000 architecture.