OpenSSL 3.5 has officially launched, marking a significant update for this open-source library that enables secure communications over networks for various applications and websites. This new version comes just over six months after the previous OpenSSL 3.4 release.<\/p>\n
One of the notable features in OpenSSL 3.5 is support for server-side QUIC (RFC 9000) along with support for third-party QUIC stacks, which includes 0-RTT support. Additionally, it introduces post-quantum cryptography (PQC) algorithms such as ML-KEM, ML-DSA, and SLH-DSA, which are essential as we move towards a more quantum-resilient digital future.<\/p>\n
The update also adds support for central key generation in CMP, opaque symmetric key objects (EVP_SKEY), and multiple TLS keyshares. It further improves the configurability of TLS key establishment groups and offers API support for pipelining within provided cipher algorithms.<\/p>\n
In terms of security enhancements, the default TLS-supported groups list now prioritizes hybrid PQC KEM groups. Further changes include adjustments to default TLS keyshares to offer X25519MLKEM768 and X25519, and a modification of the default encryption cipher for various applications from However, developers have noted a known issue in OpenSSL 3.5 regarding SSL handshakes. When invoking SSL_accept on specific objects, it does not advance the SSL handshake as expected. A solution suggested is to utilize SSL_do_handshake instead. This issue is slated for resolution in the upcoming OpenSSL 3.5.1.<\/p>\n For further details, you can refer to the release notes<\/a>. OpenSSL 3.5 is available for download from the official website<\/a>. It is highly recommended that all users, websites, and operating systems upgrade to this release promptly to ensure enhanced security and performance.<\/p>\n","protected":false},"excerpt":{"rendered":" OpenSSL 3.5 has officially launched, marking a significant update for this open-source library that enables secure communications over networks for various applications and websites.…<\/p>\n","protected":false},"author":0,"featured_media":2439,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45,4,936,937],"tags":[],"class_list":["post-2438","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apps","category-news","category-openssl","category-openssl-3-5"],"yoast_head":"\ndes-ede3-cbc<\/code> to aes-256-cbc<\/code>. Moreover, there is a new configuration option to disable deprecated TLS groups as specified in RFC8422, along with an option to enable the FIPS JITTER seed source.<\/p>\n