openssl_encrypt 1.4.8

A feature and security release. Format version 14 becomes the default write format, PQC files become interoperable with the 1.5.x line, new password tooling lands, and a batch of security review findings is fixed and documented as advisories. Every file written by earlier releases remains decryptable.

What changed

• Format version 14 is the default write format. New encryptions derive their key with the independent XOR robust combiner, which stays as strong as the strongest configured KDF component instead of inheriting the weakest link of a sequential cascade. The KDF seed uses length prefixed TLV fields, so password, salt and hardware pepper enter the derivation with unambiguous
  boundaries. PQC files additionally bind the KEM symmetric key to the full transcript (algorithm, AEAD choice and a digest of the KEM encapsulation ciphertext). Sequential XOR stays available as an opt in, pinned at format version 13.
• Cross line PQC compatibility. PQC KEM keys for format version 12 and newer files now derive identically to the 1.5.x line (HKDF SHA256 with algorithm domain separation), so PQC files interoperate across both maintenance lines. Files written by releases up to 1.4.7 remain fully decryptable through an authenticated legacy retry that recommends re encryption.
• Password tooling. The new read only check-password subcommand reports pattern aware strength, entropy, weakness warnings and policy pass or fail, with --json for scripting. Password strength feedback now detects predictable structure (dictionary words, keyboard walks, sequences, repeats, dates) instead of trusting raw character space entropy; the optional
  --strict-strength flag turns the estimate into a hard gate.
• Security review follow ups, recorded as ADVISORY 2026-03 and ADVISORY 2026-04 in SECURITY.md:
  • Package plugins are covered by a signed per package manifest over every importable module, closing the gap where a signed __init__.py could import unverified sibling modules. The plugin loader now verifies, pins and executes the exact same bytes.
  • The HSM diagnostic commands hsm fido2-test and hsm onlykey-test no longer print the derived hardware pepper; per round KDF debug lines no longer leak a derived key intermediate; new files can no longer be written in the cost bypassing v8/v10 sequential XOR format.
  • Memory hygiene hardening: pepper material is zeroized after use, the v14 KDF seed is built in a single exact size allocation, and several ineffective secure wipe call sites now wipe the real secret.
• Reliability fixes. Embedded password encrypted PQC private keys at format versions 11 to 13 decrypt again; keystore dual encryption works for files at format version 11 and newer; RandomX combined with wide key ciphers (AES SIV, Threefish) no longer crashes key derivation; the streaming plus sequential XOR combination, which silently wrote undecryptable files, is now
  refused with a clear error.

Notes

• The on disk format gains version 14 as the new default. Files written by 1.4.8 with recipient (asymmetric) encryption cannot be opened by older releases; everything else that older releases could write, they can still read, and 1.4.8 reads all of it.
• SECURITY.md carries the full advisory texts, including affected versions and mitigations. The pepper output advisory is published as GHSA-p9g8-wvh4-2jmx.
• See CHANGELOG.md for the complete list of changes.