Release Announcement for OpenSSL 4.0.0

--000000000000167c5a064f6b7333
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

The final release of OpenSSL 4.0.0 is now live. We would like to thank all
those who contributed to the OpenSSL 4.0.0 release, without whom the
OpenSSL Library would not be possible. OpenSSL 4.0 will be supported until
14th May 2027.

OpenSSL 4.0.0 is a feature release adding significant new functionality
to OpenSSL.

This release incorporates the following potentially significant or
incompatible
changes:

  * Removed extra leading '00:' when printing key data such as an RSA
modulus
    in hexadecimal format where the first (most significant) byte is >=3D
0x80.

  * Standardized the width of hexadecimal dumps to 24 bytes for signatures
    (to stay within the 80 characters limit) and 16 bytes for everything
else.

  * Lower bounds checks are now enforced when using `PKCS5_PBKDF2_HMAC` API
    with FIPS provider.

  * Added AKID verification checks when `X509_V_FLAG_X509_STRICT` is set.

  * Augmented CRL verification process with several additional checks.

  * `libcrypto` no longer cleans up globally allocated data via `atexit()`.

  * `BIO_snprintf()` now uses `snprintf()` provided by libc instead of
internal
    implementation.

  * `OPENSSL_cleanup()` now runs in a global destructor, or not at all
    by default.

  * `ASN1_STRING` has been made opaque.

  * Signatures of numerous API functions, including those that are related
    to X509 processing, are changed to include `const` qualifiers for
argument
    and return types, where suitable.

  * Deprecated `X509_cmp_time()`, `X509_cmp_current_time()`,
    and `X509_cmp_timeframe()` in favor of `X509_check_certificate_times()`=
.

  * Removed support for the SSLv2 Client Hello.

  * Removed support for SSLv3.  SSLv3 has been deprecated since 2015,
    and OpenSSL had it disabled by default since version 1.1.0 (2016).

  * Removed support for engines.  The `no-engine` build option
    and the `OPENSSL_NO_ENGINE` macro are always present.

  * Support of deprecated elliptic curves in TLS according to [RFC 8422] wa=
s
    disabled at compile-time by default. To enable it, use the
    `enable-tls-deprecated-ec` configuration option.

  * Support of explicit EC curves was disabled at compile-time by default.
    To enable it, use the `enable-ec_explicit_curves` configuration option.

  * Removed `c_rehash` script tool.  Use `openssl rehash` instead.

  * Removed the deprecated `msie-hack` option from the `openssl ca` command=
.

  * Removed `BIO_f_reliable()` implementation without replacement.
    It was broken since 3.0 release without any complaints.

  * Removed deprecated support for custom `EVP_CIPHER`, `EVP_MD`,
`EVP_PKEY`,
    and `EVP_PKEY_ASN1` methods.

  * Removed deprecated fixed SSL/TLS version method functions.

  * Removed deprecated functions `ERR_get_state()`, `ERR_remove_state()`
    and `ERR_remove_thread_state()`. The `ERR_STATE` object is now always
    opaque.

  * Dropped `darwin-i386{,-cc}` and `darwin-ppc{,64}{,-cc}` targets
    from Configurations.

This release adds the following new features:

  * Support for Encrypted Client Hello (ECH, [RFC 9849]).
    See `doc/designs/ech-api.md` for details.

  * Support for [RFC 8998], signature algorithm `sm2sig_sm3`, key exchange
    group `curveSM2`, and [tls-hybrid-sm2-mlkem] post-quantum group
    `curveSM2MLKEM768`.

  * cSHAKE function support as per [SP 800-185].

  * "ML-DSA-MU" digest algorithm support.

  * Support for SNMP KDF and SRTP KDF.

  * FIPS self tests can now be deferred and run as needed when installing
    the FIPS module with the `-defer_tests` option of the `openssl
fipsinstall`
    command.

  * Support for using either static or dynamic VC runtime linkage
    on Windows.

  * Support for negotiated FFDHE key exchange in TLS 1.2 in accordance
    with [RFC 7919].

--=20

Matt Caswell, Executive Director, OpenSSL Foundation
<http://openssl.foundation>
We need your support! Help us
<https://openssl.foundation/donate/ways-to-give> protect digital privacy=E2=
=80=A6
everywhere.

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-project" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-project/CAODx15cHQz_xjDbBe16XFjjBrgaEb212tmMya6zrW%3DbhWhXCAg%40=
mail.gmail.com.

--000000000000167c5a064f6b7333
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>The final release of OpenSSL 4.0.0 is now live. We wo=
uld like to thank all those who contributed to the OpenSSL 4.0.0 release, w=
ithout whom the OpenSSL Library would not be possible. OpenSSL 4.0 will be =
supported until 14th May 2027.</div><div><br></div><div>OpenSSL 4.0.0 is a =
feature release adding significant new functionality<br>to OpenSSL.<br><br>=
This release incorporates the following potentially significant or incompat=
ible<br>changes:<br><br>=C2=A0 * Removed extra leading &#39;00:&#39; when p=
rinting key data such as an RSA modulus<br>=C2=A0 =C2=A0 in hexadecimal for=
mat where the first (most significant) byte is &gt;=3D 0x80.<br><br>=C2=A0 =
* Standardized the width of hexadecimal dumps to 24 bytes for signatures<br=
>=C2=A0 =C2=A0 (to stay within the 80 characters limit) and 16 bytes for ev=
erything else.<br><br>=C2=A0 * Lower bounds checks are now enforced when us=
ing `PKCS5_PBKDF2_HMAC` API<br>=C2=A0 =C2=A0 with FIPS provider.<br><br>=C2=
=A0 * Added AKID verification checks when `X509_V_FLAG_X509_STRICT` is set.=
<br><br>=C2=A0 * Augmented CRL verification process with several additional=
 checks.<br><br>=C2=A0 * `libcrypto` no longer cleans up globally allocated=
 data via `atexit()`.<br><br>=C2=A0 * `BIO_snprintf()` now uses `snprintf()=
` provided by libc instead of internal<br>=C2=A0 =C2=A0 implementation.<br>=
<br>=C2=A0 * `OPENSSL_cleanup()` now runs in a global destructor, or not at=
 all<br>=C2=A0 =C2=A0 by default.<br><br>=C2=A0 * `ASN1_STRING` has been ma=
de opaque.<br><br>=C2=A0 * Signatures of numerous API functions, including =
those that are related<br>=C2=A0 =C2=A0 to X509 processing, are changed to =
include `const` qualifiers for argument<br>=C2=A0 =C2=A0 and return types, =
where suitable.<br><br>=C2=A0 * Deprecated `X509_cmp_time()`, `X509_cmp_cur=
rent_time()`,<br>=C2=A0 =C2=A0 and `X509_cmp_timeframe()` in favor of `X509=
_check_certificate_times()`.<br><br>=C2=A0 * Removed support for the SSLv2 =
Client Hello.<br><br>=C2=A0 * Removed support for SSLv3.=C2=A0 SSLv3 has be=
en deprecated since 2015,<br>=C2=A0 =C2=A0 and OpenSSL had it disabled by d=
efault since version 1.1.0 (2016).<br><br>=C2=A0 * Removed support for engi=
nes.=C2=A0 The `no-engine` build option<br>=C2=A0 =C2=A0 and the `OPENSSL_N=
O_ENGINE` macro are always present.<br><br>=C2=A0 * Support of deprecated e=
lliptic curves in TLS according to [RFC 8422] was<br>=C2=A0 =C2=A0 disabled=
 at compile-time by default. To enable it, use the<br>=C2=A0 =C2=A0 `enable=
-tls-deprecated-ec` configuration option.<br><br>=C2=A0 * Support of explic=
it EC curves was disabled at compile-time by default.<br>=C2=A0 =C2=A0 To e=
nable it, use the `enable-ec_explicit_curves` configuration option.<br><br>=
=C2=A0 * Removed `c_rehash` script tool.=C2=A0 Use `openssl rehash` instead=
.<br><br>=C2=A0 * Removed the deprecated `msie-hack` option from the `opens=
sl ca` command.<br><br>=C2=A0 * Removed `BIO_f_reliable()` implementation w=
ithout replacement.<br>=C2=A0 =C2=A0 It was broken since 3.0 release withou=
t any complaints.<br><br>=C2=A0 * Removed deprecated support for custom `EV=
P_CIPHER`, `EVP_MD`, `EVP_PKEY`,<br>=C2=A0 =C2=A0 and `EVP_PKEY_ASN1` metho=
ds.<br><br>=C2=A0 * Removed deprecated fixed SSL/TLS version method functio=
ns.<br><br>=C2=A0 * Removed deprecated functions `ERR_get_state()`, `ERR_re=
move_state()`<br>=C2=A0 =C2=A0 and `ERR_remove_thread_state()`. The `ERR_ST=
ATE` object is now always<br>=C2=A0 =C2=A0 opaque.<br><br>=C2=A0 * Dropped =
`darwin-i386{,-cc}` and `darwin-ppc{,64}{,-cc}` targets<br>=C2=A0 =C2=A0 fr=
om Configurations.<br><br>This release adds the following new features:<br>=
<br>=C2=A0 * Support for Encrypted Client Hello (ECH, [RFC 9849]).<br>=C2=
=A0 =C2=A0 See `doc/designs/ech-api.md` for details.<br><br>=C2=A0 * Suppor=
t for [RFC 8998], signature algorithm `sm2sig_sm3`, key exchange<br>=C2=A0 =
=C2=A0 group `curveSM2`, and [tls-hybrid-sm2-mlkem] post-quantum group<br>=
=C2=A0 =C2=A0 `curveSM2MLKEM768`.<br><br>=C2=A0 * cSHAKE function support a=
s per [SP 800-185].<br><br>=C2=A0 * &quot;ML-DSA-MU&quot; digest algorithm =
support.<br><br>=C2=A0 * Support for SNMP KDF and SRTP KDF.<br><br>=C2=A0 *=
 FIPS self tests can now be deferred and run as needed when installing<br>=
=C2=A0 =C2=A0 the FIPS module with the `-defer_tests` option of the `openss=
l fipsinstall`<br>=C2=A0 =C2=A0 command.<br><br>=C2=A0 * Support for using =
either static or dynamic VC runtime linkage<br>=C2=A0 =C2=A0 on Windows.<br=
><br>=C2=A0 * Support for negotiated FFDHE key exchange in TLS 1.2 in accor=
dance<br>=C2=A0 =C2=A0 with [RFC 7919].</div><div><br></div><span class=3D"=
gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signa=
ture" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><span><p dir=3D"l=
tr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=
=3D"font-size:10pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);backgroun=
d-color:transparent;font-weight:700;vertical-align:baseline">Matt Caswell, =
</span><span style=3D"font-size:10pt;font-family:Roboto,sans-serif;color:rg=
b(0,0,0);background-color:transparent;vertical-align:baseline">Executive Di=
rector</span><span style=3D"font-size:10pt;font-family:Roboto,sans-serif;co=
lor:rgb(0,0,0);background-color:transparent;vertical-align:baseline">, </sp=
an><a href=3D"http://openssl.foundation" target=3D"_blank"><span style=3D"f=
ont-size:10pt;font-family:Roboto,sans-serif;color:rgb(17,85,204);background=
-color:transparent;vertical-align:baseline">OpenSSL Foundation</span></a></=
p></span><span><span style=3D"font-size:10pt;font-family:Roboto,sans-serif;=
color:rgb(34,34,34);background-color:transparent;vertical-align:baseline">W=
e need your support! </span><a href=3D"https://openssl.foundation/donate/wa=
ys-to-give" target=3D"_blank"><span style=3D"font-size:10pt;font-family:Rob=
oto,sans-serif;color:rgb(17,85,204);background-color:transparent;vertical-a=
lign:baseline">Help us</span></a><span style=3D"font-size:10pt;font-family:=
Roboto,sans-serif;color:rgb(34,34,34);background-color:transparent;vertical=
-align:baseline"> protect digital privacy=E2=80=A6 everywhere.</span></span=
><span></span></div></div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;openssl-project&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">openssl-=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/a/openss=
l.org/d/msgid/openssl-project/CAODx15cHQz_xjDbBe16XFjjBrgaEb212tmMya6zrW%3D=
bhWhXCAg%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://g=
roups.google.com/a/openssl.org/d/msgid/openssl-project/CAODx15cHQz_xjDbBe16=
XFjjBrgaEb212tmMya6zrW%3DbhWhXCAg%40mail.gmail.com</a>.<br />

--000000000000167c5a064f6b7333--