GeezerVison is showing github.com — Add support in SSL module for getting/setting groups used for key agreement · Issue #136306 · python/cpython
Add support in SSL module for getting/setting groups used for key agreement #136306DescriptionAdd support for getting/setting groups used for key agreement
Proposal:
This feature proposal is an expansion of the feature proposed in issue #109945. It began as a discussion on the PR where I provided some suggestions on generalizing that feature to include supporting more than just EC curves, and I provided some rough example code. Since then, I've put together a more complete version of this which I'll be submitting shortly as a PR attached to this issue.
The basic idea is to add three new methods related to getting & setting groups used for key agreement:
SSLContext.get_groups() -> List[str]:
"""Get a list of groups implemented for key agreement, taking into account
the SSLContext's current TLS `minimum_version` and `maximum_version` values."""
SSLContext.set_groups(groups: str) -> None:
"""Set the groups allowed for key agreement for sockets created with this context."""
SSLSocket.group() -> str:
"""Return the group used for key agreement, after the TLS handshake completes."""These methods are designed to directly mimic the existing methods for getting and setting ciphers suites. Prior to TLS 1.3, all of this could be done with just setting ciphers, but that's no longer the case.
This proposal provides a superset of the functionality requested in #109945, allowing not only multiple EC curves to be specified but also allowing other mechanisms like fixed field DHE and post-quantum algorithms added in OpenSSL 3.5. In fact, once the set_groups() method is available the existing set_ecdh_curve() method could be deprecated, as the methods it calls are available all the way to OpenSSL 1.1.1, which is now the minimum supported OpenSSL version for Python.
The group() and get_groups() methods require later versions of OpenSSL (3.2 and 3.5, respectively), but the code can check for this and raise a NotImplemented exception if the version of OpenSSL that Python is built against is too old to support them.
Links to previous discussion of this feature:
Previous discussion occurred in PR #119244, and it was suggested that it might be best to create a new issue and PR, since the previous request might not be monitored any more.
Linked PRs
Activitypicnixz commented on Aug 4, 2025 I'm re-opening the issue because this broke the AMD64 CentOS9 FIPS Only Blake2 Builtin Hash 3.x which was working until now. I don't think the issue is with the PR itself, but rather that something is not supported due to the OpenSSL build configuration (outside Python's control). picnixz commented on Aug 4, 2025 So the error is:
ERROR: test_set_groups (test.test_ssl.ContextTests.test_set_groups)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/buildbot/buildarea/3.x.cstratak-CentOS9-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/test/test_ssl.py", line 967, in test_set_groups
self.assertIsNone(ctx.set_groups('P-256:X25519'))
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
ssl.SSLError: unrecognized group (_ssl.c:3665)
The OpenSSL version of this buildbot is configured as:
fips.linux_crypto_fips_enabled: 1
fips.openssl_fips_mode: 1
ssl.OPENSSL_VERSION: OpenSSL 3.5.1 1 Jul 2025
ssl.OPENSSL_VERSION_INFO: (3, 5, 0, 1, 0)
ssl.SSLContext.maximum_version: 772
ssl.SSLContext.minimum_version: 771
ssl.SSLContext.options: 2186412112
ssl.SSLContext.protocol: 16
ssl.SSLContext.verify_mode: 2
that is, for the options:
<Options.OP_NO_COMPRESSION|OP_ENABLE_MIDDLEBOX_COMPAT|OP_CIPHER_SERVER_PREFERENCE|OP_NO_SSLv3|OP_ALL: 2186412112>
Interestingly, the other FIPS buildbot that is working has another version:
ssl.OPENSSL_VERSION: OpenSSL 1.1.1k FIPS 25 Mar 2021
ssl.OPENSSL_VERSION_INFO: (1, 1, 1, 11, 15)
ssl.OP_ALL: 0x80000054
ssl.OP_NO_TLSv1_1: 0x10000000
ssl.SSLContext.maximum_version: 772
ssl.SSLContext.minimum_version: 771
ssl.SSLContext.options: 2186412116
ssl.SSLContext.protocol: 16
ssl.SSLContext.verify_mode: 2
For the options, that is
<Options.OP_LEGACY_SERVER_CONNECT|OP_NO_COMPRESSION|OP_ENABLE_MIDDLEBOX_COMPAT|OP_CIPHER_SERVER_PREFERENCE|OP_NO_SSLv3|OP_ALL: 2186412116>
ronf commented on Aug 4, 2025 ContributorAuthor More actions Since this is a FIPS build, X25519 will not be available. However, P-256 should be available. To avoid getting an error here, we might need to add a '?' in front of X25519 in the test (e.g. 'P-256:?X25519'). Alternately, we could odd in a #if check for whether this is a FIPS compile if that's available, and request only 'P-256' in that case. picnixz commented on Aug 4, 2025 Wait X25519 is not allowed? I thought that a recent draft allowed its usage. Anyway, to know whether the FIPS module is enabled, there is _hashlib.get_fips_mode(). So yes, let's skip the test if this is in FIPS mode.
Or .. maybe it's a stupid idea but how about "P-256:P-256"? would it work actually? ronf commented on Aug 4, 2025 ContributorAuthor More actions FIPS recently allowed x25519mlkem768, but they haven't gone back and allowed plain X25519. Even if they did at some point in the future I'm not sure OpenSSL 1.1.1 would pick up those changes.
My recommendation would be to add the '?' flag in front of x25519, which says to just ignore X25519 on OpenSSL versions/configurations that don't support it. The other option would be something like "P-256:P-384". While I expect 'P-256:P-256' would probably also work, I don't think we need to resort to that. picnixz commented on Aug 4, 2025 Ok, let's just do the ? trick. Could you open a PR for that and add a comment indicating why we need it? ronf commented on Aug 5, 2025 ContributorAuthor More actions Sure - I'll try to get to that in the next day or two. In the meantime, only FIPS builds should be affected, and it should really only affect the unit tests. The resulting binary should still be completely usable. picnixz commented on Aug 5, 2025 Yes that I agree. I have a few hours so I'll do it myself picnixz commented on Aug 5, 2025 Ah actually, ignoring unknow groups is not possible before OpenSSL 3.3:
Support for ignoring unknown groups in SSL_CTX_set1_groups_list() and SSL_set1_groups_list() was added in OpenSSL 3.3.
added a commit that references this issue on Aug 5, 2025gh-136306: fix `test_ssl.ContextTests.test_set_groups` on FIPS builds (… picnixz commented on Aug 5, 2025
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|