OpenSSL 4.1 brings DTLS 1.3 support, IKEV2 KDF, GREASE, and post-quantum optimizations

The OpenSSL Foundation has released version 4.1, marking a significant milestone for the widely-used cryptography library with substantial new features and architectural improvements. This feature release introduces support for DTLS 1.3 (RFC 9147), RFC 8701 GREASE extensions, and initial compatibility with the Elbrus2000 (e2k) processor architecture, expanding the cryptographic toolkit available to developers and security professionals worldwide.

The update brings notable performance enhancements through hardware-specific optimizations, including AVX-512-accelerated SHAKE and AES-CBC operations on x86_64 systems, along with improved ML-DSA and ML-KEM NTT operations for both PPC64LE and x86_64 platforms. These improvements position OpenSSL to better handle emerging post-quantum cryptography standards while maintaining efficiency on modern hardware. The release also drops legacy support for Windows-on-Itanium and Windows CE targets, reflecting the platform's evolution toward contemporary computing environments, though users relying on the tsget utility should note the migration from WWW::Curl::Easy to Net::Curl::Easy before upgrading.

Industry observers suggest this release represents OpenSSL's ongoing commitment to adapting to evolving cryptographic requirements and hardware capabilities. The addition of DTLS support in the SSL listener API and IKEV2 KDF support further strengthens the library's applicability for secure communications infrastructure. Security teams planning upgrades will want to review the configuration changes carefully, particularly the consolidation of elliptic curve options and the removal of ineffective no-ecdsa and no-ecdh flags in favor of the unified no-ec option.