OpenSSL 4.0.0

Post by throw_a_grenade » Wed, Apr 15, 2026, 6:21 AM UTC

ameliaquining wrote: post #45

Bender wrote: post #33

Earlier quoted context omitted.

FWIW Nginx 1.30 [1] just released and supports it so most distributions will have support as soon as those responsible for builds and testing builds push it forward. "Nginx 1.30 incorporates all of the changes from the Nginx 1.29.x mainline branch to provide a lot of new functionality like Multipath TCP (MPTCP)." "Nginx 1.30 also adds HTTP/2 to backend and Encrypted Client Hello (ECH), sticky sessions support for ups…

It's not that adversaries can directly see the domain name; this doesn't have anything to do with domain fronting. The issue is that ECH doesn't hide the server's IP address, so it's mostly useless for privacy if that IP address uniquely identifies that server. The situation where it helps is if the server shares that IP address with lots of other people, i.e., if it's behind a big cloud CDN that supports ECH (AFAIK…

Post by omcnoe » Wed, Apr 15, 2026, 6:30 AM UTC

wahern wrote: post #32

gavinray wrote: post #26

Earlier quoted context omitted.

> In short, OSSL_PARAM works by passing arrays of key-value pairs to functions, instead of normal argument passing. Ah yes, the ole' " fn(args: Map )" approach. Highly auditable, and Very Safe.

I think one of the main motivators was supporting the new module framework that replaced engines. The FIPS module specifically is OpenSSL's gravy train, and at the time the FIPS certification and compliance mandate effectively required the ability to maintain ABI compatibility of a compiled FIPS module across multiple major OpenSSL releases, so end users could easily upgrade OpenSSL for bug fixes and otherwise stay c…

Post by snvzz » Wed, Apr 15, 2026, 9:01 AM UTC

Post by parliament32 » Wed, Apr 15, 2026, 4:43 PM UTC

PunchyHamster wrote: post #50

wahern wrote: post #32

Earlier quoted context omitted.

I think one of the main motivators was supporting the new module framework that replaced engines. The FIPS module specifically is OpenSSL's gravy train, and at the time the FIPS certification and compliance mandate effectively required the ability to maintain ABI compatibility of a compiled FIPS module across multiple major OpenSSL releases, so end users could easily upgrade OpenSSL for bug fixes and otherwise stay c…

Sensible way would be dropping FIPS security threathre entirely and let it rot in the stupid corner companies dug themselves into, but of course the problem is OpenSSL's main income source... I really wish Linux Foundation or some other big OSS founded complete replacement of it, then just write a shim that translates ABI calls from this to openssl 1.1 lookalike

Post by lucb1e » Fri, Apr 17, 2026, 8:29 PM UTC

sudo_cowsay wrote: post #82

semiquaver wrote: post #73

Major version bump? I wonder how much slower it will get now.

Actually, it doesn't get that slow. I ran benchmarks and avg. increase was 10%. Compared to other things on the internet, it doesn't cause that much of a slow down.