🎯Basically, OpenSSL 4.0.0 cuts old features and adds new security measures.
What Happened
OpenSSL has released version 4.0.0, marking a significant update that removes several long-deprecated features. This version eliminates support for SSLv3, SSLv2 client hello, and the engine API, which were previously phased out due to security concerns. The removal of these protocols is a crucial step in enhancing security standards in cryptographic communications.
What's at Risk
Applications built against older versions of OpenSSL may face compatibility issues due to the removal of these deprecated features. Developers will need to update their code to ensure continued functionality and security. The changes could potentially lead to vulnerabilities if not addressed promptly.
New Features
The update introduces support for Encrypted Client Hello (ECH), which encrypts the client hello message, preventing passive observers from reading sensitive information like server names. Additionally, OpenSSL 4.0.0 includes post-quantum cryptography features, such as the hybrid key exchange group curveSM2MLKEM768 and the ML-DSA-MU digest algorithm, enhancing security against future quantum threats.
API Changes
Significant API-level changes have been made that will require integrators to revise their applications. Functions related to X.509 processing have been updated, and some deprecated functions have been removed entirely. For instance, the libcrypto library no longer cleans up globally allocated data, which could affect how applications manage memory.
Build and Tooling Adjustments
The release also includes changes in build and tooling, such as the removal of support for deprecated elliptic curves in TLS and dropping certain build targets. These adjustments aim to streamline the development process and improve security practices.
What You Should Do
Developers using OpenSSL should: By taking these steps, developers can maintain robust security practices and adapt to the evolving landscape of cybersecurity.
Containment
- 1.Review the changes in version 4.0.0 and update their applications accordingly.
- 2.Test applications to ensure compatibility with the new version.
Remediation
🔒 Pro insight: The removal of SSLv3 and SSLv2 client hello is pivotal for modernizing cryptographic standards, but developers must act quickly to mitigate compatibility risks.
