OpenSSL 4.1 Adds AVX-512 Optimizations for Post-Quantum Crypto & DTLS 1.3 Support

OpenSSL 4.1 Release Overview

OpenSSL 4.1.0 was released on October 23, introducing several major features and performance improvements while dropping support for legacy platforms.

DTLS 1.3 Support

OpenSSL 4.1 adds support for DTLS 1.3, the latest version of the Datagram Transport Layer Security protocol. DTLS provides TLS-like encryption and authentication for unreliable transports such as UDP, commonly used in real-time communication, IoT, and VPNs. DTLS 1.3 brings higher security, faster handshakes, forward secrecy, built-in post-quantum cryptography support, and optimized header formats.

GREASE Implementation

The release introduces support for GREASE (Generate Random Extensions And Sustain Extensibility). During TLS handshakes, GREASE sends random, meaningless values to reserved protocol code points, helping detect implementation faults early and ensuring peers correctly handle unknown values for a more robust TLS ecosystem.

AVX-512 Optimizations for Post-Quantum and Symmetric Cryptography

OpenSSL 4.1 extends its existing AVX-512 support with two key optimizations:

AVX-512 optimized SHAKE x4 operations for ML-DSA (Module-Lattice-Based Digital Signature Algorithm) on x86_64, accelerating post-quantum signature generation.

AVX-512 and AES instruction optimizations for AES-CBC decryption, building on the library's prior AVX-512 work.

Benchmark Results

OpenBenchmarking.org provides benchmark results for the OpenSSL 4.1 Alpha across various CPUs, demonstrating the impact of these optimizations.

Deprecated Platform Support

This release ends support for the Itanium architecture on Windows and for Windows CE.

Source: https://openbenchmarking.org/test/pts/openssl#results