# OpenSSL 4.1 adds DTLS 1.3, post-quantum crypto optimizations

> **Key takeaway:** OpenSSL 4.1 introduces DTLS 1.3 support for UDP-based secure communications and significantly improves post-quantum cryptographic performance on x86-64 and PPC64LE.

**Published:** 2026-10-23T12:58:20+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/openssl-41-adds-dtls-13-post-quantum-crypto-optimizations.html 

## Summary
The OpenSSL Project released version 4.1 of its widely used cryptographic library. The update adds DTLS 1.3 (RFC 9147) for securing datagram protocols like UDP, implements GREASE (RFC 8701) for smoother protocol extension deployment, and delivers substantial performance gains for post-quantum algorithms ML-DSA and ML-KEM through architecture-specific optimizations. The release also drops legacy Windows CE and Itanium build targets and removes misleading no-ecdsa and no-ecdh configuration options.

## What's new in OpenSSL 4.1
- **DTLS 1.3**: New support for Datagram TLS (RFC 9147) brings TLS 1.3-level security to UDP and other datagram transports
- **GREASE**: Implements RFC 8701 mechanism to prevent ossification of protocol extension points
- **Post-quantum optimizations**: NTT operations accelerated for ML-DSA and ML-KEM on PPC64LE; ML-DSA operations faster on x86-64
- **SIMD crypto**: AVX-512-optimized SHAKE x4 for ML-DSA; AVX-512 and VAES for AES-CBC decryption on x86-64
- **API additions**: DTLS support in SSL listener API; IKEv2 KDF support added
- **Platform support**: Initial Elbrus2000 architecture support added; Windows CE and Itanium build targets removed
- **Breaking changes**: no-ecdsa and no-ecdh config options removed (use no-ec instead); tsget utility now requires Net::Curl::Easy instead of WWW::Curl::Easy
- **Known issues**: Four DTLS-related bugs documented, including KeyUpdate retransmission problems and handshake failures under packet loss

## Why it matters
DTLS 1.3 support enables modern encrypted communications for real-time applications using UDP, including VoIP, gaming, and IoT. The post-quantum optimizations prepare OpenSSL for NIST-standardized algorithms on production hardware, though the documented DTLS bugs may delay adoption for latency-sensitive use cases.