OpenSSL Communities

The State of OpenSSL for pyca/cryptography

AK Aditya Koranga Fri 16 Jan 2026 5:46AM Public Seen by 118

Just read this article few minutes ago: https://cryptography.io/en/latest/statements/state-of-openssl/#

The article adresses the reasoning behind the pyca/cryptography maintainers’ decisions to:

  • Stop requiring OpenSSL for new features and may expose some APIs (ML‑KEM, ML‑DSA) only when linked against LibreSSL/BoringSSL/AWS‑LC.​

  • Investigate shipping wheels linked to an OpenSSL fork instead of OpenSSL itself and may eventually drop OpenSSL support entirely.​

  • Track non‑OpenSSL libraries as long‑term alternatives and encourage users who depend on OpenSSL support to push the OpenSSL project to improve on these axes.

Now as OpenSSL community members, what are your thoughts on this. and how can we improve OpenSSL library so that something like that doesn't happen again.

AK

Alicja Kario Fri 16 Jan 2026 10:21AM

I guess the https://openssl-library.org/performance/ should be better known :)

and as others said before, 3.0 was a massive regression compared to 1.1.1, but in some aspects (like private key loading or signing) 3.5 is actually faster than 1.1.1, and current master is faster still

MC

Matěj Cepl Fri 16 Jan 2026 10:39AM

Just after reading the post I have written (as the M2Crypto maintainer) this post to the SUSE internal Slack https://matej.ceplovi.cz/blog/rant-about-the-current-state-of-openssl.html