OpenSSL 4.1.0 adds Elbrus support and DTLS 1.3

OpenSSL has released version 4.1.0, introducing initial support for Russia’s Elbrus e2k processor architecture alongside a DTLS 1.3 implementation. The OpenSSL Project describes the Elbrus integration as a baseline, structural port rather than a performance-optimised upgrade, noting that no throughput benchmarks or full feature parity across all primitives have yet been published.

The release also implements DTLS 1.3 to secure UDP datagram transmissions, reducing handshake churn and supporting hybrid post-quantum key exchange mechanisms, with the SSL Listener API updated to handle datagrams. Applications relying on legacy DTLSv1_listen functions will need migration to the newer interface.

The update incorporates GREASE as defined in RFC 8701 to test middlebox behaviour, and expands cryptographic acceleration and maintenance. Notably, post-quantum variants ML-KEM and ML-DSA receive performance tuning for some architectures, while x86_64 gains AVX-512 acceleration for SHAKE and ML-DSA, and AES-CBC decryption benefits from combined AVX-512 and VAES. The release also adds Key Derivation Function capabilities for IPsec IKEv2 and deprecates Windows CE and Itanium configurations.

Four DTLS 1.3-related issues are acknowledged at launch, including possible loss of retransmission messages after key renegotiation and rare premature server disconnections; administrators should weigh these caveats before moving UDP pipelines to production. OpenSSL 4.1.0 maintenance is planned through 23 November 2027, with OpenSSL 3.5 LTS remaining supported until April 2030, according to the project roadmap.