7 ms·
OpenSSL 4.0.0
- capitol_ 6mo agoFinally encrypted client hello support \o/
- bombcar 6mo agoIs this something that we can enable "today" or is it going to take 12 years for browsers and servers to support?
- arcfour 6mo agoCloudFlare has supported it since 2023: https://blog.cloudflare.com/announcing-encrypted-client-hello/and https://blog.cloudflare.com/announcing-encrypted-client-hell... Firefox has had it enabled by default since version 119: https://support.mozilla.org/en-US/kb/faq-encrypted-client-hello#w_how-do-i-enable-ech-in-firefox https://support.mozilla.org/en-US/kb/faq-encrypted-client-he... so you can use it today.
- bombcar 6mo agohttps://tls-ech.dev https://tls-ech.dev indicates that Safari doesn't support it, but Chrome does.
- altairprime 6mo agoThat’s likely due to iOS/macOS not supporting it in production-default-enabled yet; there’s an experimental opt-in flag at the OS level, but Safari apparently hasn’t (yet) added a dev feature switch for it. https://developer.apple.com/documentation/security/sec_protocol_options_set_enable_encrypted_client_hello https://developer.apple.com/documentation/security/sec_proto... Presumably anyone besides Safari can opt-in to that testing today, but I wouldn’t ship it worldwide and expect nice outcomes until (I suspect) after this fall’s 27 releases. Maybe someone could PR the WebKit team to add that feature flag in the meantime?
- 1vuio0pswjnm7 6mo ago"... so you can use it today." What if he wanted to use it for requesting blog.cloudflare.com ;; ANSWER SECTION: blog.cloudflare.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.28.7,104.18.29.7 ipv6hint=2606:4700::6812:1c07,2606:4700::6812:1d07 Where are the ECH keys For example, ;; ANSWER SECTION: test.defo.ie. 300 IN HTTPS 1 . ech="AEb+DQBCqQAgACBlm7cfDx/gKuUAwRTe+Y9MExbIyuLpLcgTORIdi69uewAEAAEAAQATcHVibGljLnRlc3QuZGVmby5pZQAA" or ;; ANSWER SECTION: cloudflare-ech.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.18.10.118,104.18.11.118 ech="AEX+DQBBpQAgACB/RU5hAC5mXe3uOZtNY58Bc8UU1cd4QBxQzqirMlWZeQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=" ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76 It's true one can "use it today". One could use it for the past several years as well. The software has been around for a while But ECH has never been consistently enabled for the general public beyond a small number of test sites that are only for testing ECH
- kro 6mo agoNginx mainline 1.29.x supports it. So once you get that and also the openssl version on your system, good to go. Likely too late for ubuntu 26.04, maybe in debian 14 next year, or of course rolling release distros / containers. But, in a personal/single website server, ech does not really add privacy, adversaries can still observe the IP metadata and compare what's hosted there. The real benefits are on huge cloud hosting platforms.
- Bender 6mo agoFWIW Nginx 1.30 [1] just released and supports it so most distributions will have support as soon as those responsible for builds and testing builds push it forward. "Nginx 1.30 incorporates all of the changes from the Nginx 1.29.x mainline branch to provide a lot of new functionality like Multipath TCP (MPTCP)." "Nginx 1.30 also adds HTTP/2 to backend and Encrypted Client Hello (ECH), sticky sessions support for upstreams, and the default proxy HTTP version being set to HTTP/1.1 with Keep-Alive enabled." But, in a personal/single website server, ech does not really add privacy, adversaries can still observe the IP metadata and compare what's hosted there I don't quite follow. I have dozens of throw-away silly hobby domains. I can use any of them as the outer-SNI. How is someone observing the traffic going to know the inner-SNI domain unless someone builds a massive database of all known inner+outer combinations which can be changed on a whim? ECH requires DOH so unless the ISP has tricked the user into using their DOH end-point they can't see the HTTPS resource record. [1] - https://news.ycombinator.com/item?id=47770007 https://news.ycombinator.com/item?id=47770007
- ameliaquining 6mo agoIt's not that adversaries can directly see the domain name; this doesn't have anything to do with domain fronting. The issue is that ECH doesn't hide the server's IP address, so it's mostly useless for privacy if that IP address uniquely identifies that server. The situation where it helps is if the server shares that IP address with lots of other people, i.e., if it's behind a big cloud CDN that supports ECH (AFAIK that's currently just Cloudflare). But if that's the case, it doesn't matter whether Nginx or whatever other web server you run supports ECH, because your users' TLS negotiations aren't with that server, they're with Cloudflare.
- tialaramex 6mo agoTLS (the IETF Working Group not the protocol family named for them) have long experience with the fact that if you specify how B is compatible with A based on how you specified A and ship B what you did won't work because the middleboxes are all cost optimized and don't implement what you specified but instead whatever got the sale for the least investment. So e.g. they'd work for exactly the way you use say TLS 1.0 in the Netscape 4 web browser which was popular when the middlebox was first marketed, or maybe they cope with exactly the features used in Safari but since Safari never sets this bit flag here they reject all connections with that flag. What TLS learned is summarized as "have one joint and keep it well oiled" and they invented a technique to provide that oiling for one working joint in TLS, GREASE, Generate Random Extensions And Sustain Extensibility. The idea of GREASE is, if a popular client (say, the Chrome web browser) just insists on uttering random nonsense extensions then to survive in the world where that happens you must not freak out when there are extensions you do not understand. If your middlebox firmware freaks out when seeing this happen, your customers say "This middlebox I bought last week is broken, I want my money back" so you have to spend a few cents more to never do that. But, since random nonsense is now OK, we can ship a new feature and the middleboxes won't freak out, so long as our feature looks similar enough to GREASE. ECH achieves the same idea, when a participating client connects to a server which does not support ECH as far as it knows, it acts exactly the same as it would for ECH except, since it has neither a "real" name to hide nor a key to encrypt that name it fills the space where those would fit with random gibberish. As a server, you get this ECH extension you don't understand, and it is filled with random gibberish you also don't understand, this seems fine because you didn't understand any of it (or maybe you've switched it off, either way it's not relevant to you). But for a middlebox this ensures they can't tell whether you're doing ECH. So, either they reject every client which could do ECH, which again that's how you get a bunch of angry customers, or, they accept such clients and so ECH works.
- ekr____ 6mo agoEven if the browsers and servers don't support it, you could still enable it because the system is designed to be backward compatible.
- ocdtrekkie 6mo agoJust be aware any reasonable network will block this.
- quantummagic 6mo agoWhy is it "reasonable" to block it?
- vman81 6mo agoWell, I may want to have a say in what websites the employees at work access in their browsers. For example.
- altairprime 6mo agoThat’s not a meaningful issue here. Either snoop competently or snoop wire traffic, pick one. In the snooping-mandatory scenario, either you have a mandatory outbound PAC with SSL-terminating proxy that either refuses CONNECT traffic or only allows that which it can root CA mitm, or you have a self-signed root CA mitm’ing all encrypted connections it recognizes. The former will continue functioning just fine with no issues at providing that; the latter will likely already be having issues with certificate-pinned apps and operating system components, not to mention likely being completely unaware of 80/udp, and should be scheduled for replacement by a solution that’s actually effective during your next capital budgeting interval.
- kccqzy 6mo agoThat’s usually done not on the network side but through the device itself. Think MDM and endpoint management.
- ocdtrekkie 6mo agoA good solution is tackling it on both. At work we have network level firewalls with separate policies for internal and guest networks, and our managed PCs sync a filter policy as well (through primarily for when those devices are not on our network). The network level is more efficient, easier to manage and troubleshoot, and works on appliances, rogue hardware, and other things that happen not to have client management.
- deleted 6mo ago[deleted]
- philipnee 6mo agoAnd QUIC.
- kybishop 6mo agoWasn't QUIC all done in the 3.x versions? Is there something in this release related to QUIC support?
- jlericson 6mo agoCorrect. 3.5 (the current LTS) included QUIC support: https://openssl.foundation/news/the-features-of-3-5-external-quic-library-interface https://openssl.foundation/news/the-features-of-3-5-external...
- yjftsjthsd-h 6mo agoAs a complete non-expert: On the one hand, looks like decent cleanup. (IIRC, engines in particular will not be missed). On the other hand, breaking compatibility is always a tradeoff, and I still remember 3.x being... not universally loved.
- moralestapia 6mo agoThat's why it is version 4.
- deleted 6mo ago[deleted]
- ge96 6mo agoJust in time for the suckerpinch video
- rwmj 6mo agoCompared to OpenSSL 3 this transition has been very smooth. Only dropping of "Engines" was a problem at all, and in Fedora most of those dependencies have been changed.
- jmclnx 6mo agoI wonder how hard it is to move from 3.x to 4.0.0 ? From what I remember hearing, the move from 2 to 3 was hard.
- georgthegreat 6mo agoThat's because there was no version 2...
- some_furry 6mo agoYes there was! But, thousand yard stare it was the version for the FIPS patches to 1.0.2.
- georgthegreat 6mo agohttps://www.haproxy.com/blog/state-of-ssl-stacks https://www.haproxy.com/blog/state-of-ssl-stacks According to this one should not be using v3 at all..
- danudey 6mo agoNice that OpenSSL finally relented and provided an API for developers to use to implement QUIC support - last year, apparently. For those not familiar: until OpenSSL 3.4.1, if you wanted use OpenSSL and wanted to implement HTTP/3, which uses QUIC as the underlying protocol, you had to use their entire QUIC stack; you couldn't have a QUIC implementation and only use OpenSSL for the encryption parts. QUIC, for those not familiar, is basically "what if we re-implemented TCP's functionality on top of UDP, but we could throw out all the old legacy crap". Complicated but interesting, except that if OpenSSL's implementation didn't do what you want or didn't do it well, you either had to put up with it or go use some other SSL library somewhere else. That meant that if you were using e.g. curl built against OpenSSL then curl also inherently had to use OpenSSL's QUIC implementation even if there were better ones available. Daniel Stenberg from Curl wrote a great blog post about how bad and dumb that was if anyone is interested. https://daniel.haxx.se/blog/2026/01/17/more-http-3-focus-one-backend-less/ https://daniel.haxx.se/blog/2026/01/17/more-http-3-focus-one...
- caycep 6mo agoHow is OpenSSl these days? I vaguely remember the big ruckus a while back, was it Heartbleed? where everyone to their horror realized it was maybe 1 or 2 people trying to maintain OpenSSL, and the OpenBSD people then throwing manpower at it to clear up a lot of old outstanding bugs. It seems like it is on firmer/more organized footing these days?
- kccqzy 6mo agoIt’s still terrible. There was a brief period immediately after Heartbleed that it was rapidly improving but the entire OpenSSL 3 was a huge disappointment to anyone who cared about performance and complexity and developer experience (ergonomics). Core operations in OpenSSL 3 are still much much slower than in OpenSSL 1.1.1. The HAProxy people wrote a very good blog post on the state of SSL stacks: https://www.haproxy.com/blog/state-of-ssl-stacks https://www.haproxy.com/blog/state-of-ssl-stacks And the Python cryptography people wrote an even more damning indictment: https://cryptography.io/en/latest/statements/state-of-openssl/ https://cryptography.io/en/latest/statements/state-of-openss... Here are some juicy quotes: > With OpenSSL 3.0, an important goal was apparently to make the library much more dynamic, with a lot of previously constant elements (e.g., algorithm identifiers, etc.) becoming dynamic and having to be looked up in a list instead of being fixed at compile-time. Since the new design allows anyone to update that list at runtime, locks were placed everywhere when accessing the list to ensure consistency. > After everything imaginable was done, the performance of OpenSSL 3.x remains highly inferior to that of OpenSSL 1.1.1. The ratio is hard to predict, as it depends heavily on the workload, but losses from 10% to 99% were reported. > OpenSSL 3 started the process of substantially changing its APIs — it introduced OSSL_PARAM and has been using those for all new API surfaces (including those for post-quantum cryptographic algorithms). In short, OSSL_PARAM works by passing arrays of key-value pairs to functions, instead of normal argument passing. This reduces performance, reduces compile-time verification, increases verbosity, and makes code less readable.
- gavinray 6mo ago> In short, OSSL_PARAM works by passing arrays of key-value pairs to functions, instead of normal argument passing. Ah yes, the ole' " fn(args: Map<String, Any>)" approach. Highly auditable, and Very Safe.
- bensyverson 6mo agoI just updated to 3.5x to get pq support. Anything that might tempt me to upgrade to 4.0?
- altairprime 6mo agoThe top feature, “ Support for Encrypted Client Hello (ECH, RFC 9849)”, is of prime importance to those operating Internet-accessible servers, or clients; hopefully your Postgres server is not one such!
- bensyverson 6mo agoIt's a web server (pg / post-quantum, not pg / Postgres), but that's a great feature!
- altairprime 6mo agogqgq Er. Your first acronym is pg not pq. (I had to font test above to be sure!) But point taken! You might care then, I saw various elliptic changes and I assume it’s got pq advancements somewhere in it.
- pixel_popping 6mo agoMythos is coming for yaaaaa (just kidding).
- theowaway 6mo agooh no not another breaking ABI change
- Neywiny 6mo agoGood to see const more prevalent. Too often I have to add that in to libraries for embedded. Possibly I believe in const by default but it is what it is at this point
- GZGavinZhao 6mo ago*Linux distro package maintainers screams
- cookiengineer 6mo ago> libcrypto no longer cleans up globally allocated data via atexit(). > OPENSSL_cleanup() now runs in a global destructor, or not at all by default. Oh oh. Heartbleed 2.0 incoming. I really do hope that they broke APIs specifically throwing errors or race conditions so that devs are forced to cleanup. Otherwise this is going to be a nightmare to find out in terms of maintenance and audits. I mean it's a new major release so it's a valid design change. But I hope they're thinking of providing and migration/update guide or a checklist to reduce usage errata. (I'm heavily in favor of deprecating the fixed version method names)
- semiquaver 6mo agoMajor version bump? I wonder how much slower it will get now.
- sudo_cowsay 6mo agoActually, it doesn't get that slow. I ran benchmarks and avg. increase was 10%. Compared to other things on the internet, it doesn't cause that much of a slow down.
- lucb1e 6mo agoThat's... actually a lot worse than I'd have expected. When running a new protocol that <=3.x didn't support, sure, but then the test suite couldn't compare so this must be for old protocols that they just made slower?! Sounds like it would be nice to have a separate code path for the 4.x calls so you can import an older, supported version alongside the new one and call into whatever was available there
- ibrahimhossain 6mo agoManual opt out processes are becoming a major friction point. It's interesting how these tools only improve their defaults after a community backlash. Trust is so hard to build but so easy to burn in this space
- snvzz 6mo agoKind reminder we should be using Libressl.