OpenSSL 3.5 adds support for server-side QUIC ( RFC 9000 ), support for third-party QUIC stacks, PQC algorithm support, various default changes, and other enhancements.
The OpenSSL 3.5.0 release announcement on GitHub sums up the new release with:
This release incorporates the following potentially significant or incompatible changes:
- Default encryption cipher for the req, cms, and smime applications changed from des-ede3-cbc to aes-256-cbc.
- The default TLS supported groups list has been changed to include and prefer hybrid PQC KEM groups. Some practically unused groups were removed from the default list.
- The default TLS keyshares have been changed to offer X25519MLKEM768 and and X25519.
All BIO_meth_get_*() functions were deprecated.
This release adds the following new features:
- Support for server side QUIC (RFC 9000)
- Support for 3rd party QUIC stacks including 0-RTT support
- Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
- A new configuration option no-tls-deprecated-ec to disable support for TLS groups deprecated in RFC8422
- A new configuration option enable-fips-jitter to make the FIPS provider to use the JITTER seed source
- Support for central key generation in CMP
- Support added for opaque symmetric key objects (EVP_SKEY)
- Support for multiple TLS keyshares and improved TLS key establishment group configurability
- API support for pipelining in provided cipher algorithms
OpenSSL 3.5 is also the project's newest Long Term Support (LTS) release.
OpenSSL 3.5 LTS is available for download from OpenSSL-Library.org .