pyOpenSSL

Feature Request: Support for TLS 1.2

Bug #1020632 reported by Thom Nichols on 2012-07-03

This bug affects 9 people

Affects		Status	Importance	Assigned to	Milestone
	pyOpenSSL	Fix Committed	Medium	Jean-Paul Calderone

Bug Description

When building against OpenSSL 1.0.1, it should be possible to take advantage of TLS 1.2 support. I believe this would require the addition of a OpenSSL.SSL.TLSv1_2_METHOD to signal the use of a TLS 1.2 handshake.

Also there is no TLS 1.1 method but it's unclear if that's covered by the OpenSSL.SSL.TLSv1_METHOD. There should be an explicit method for TLS v1.1 as well. Thanks!

Related branches

lp://staging/~exarkun/pyopenssl/tlsv1_1or2

Merged into lp://staging/~exarkun/pyopenssl/trunk at revision 171

Jean-Paul Calderone: Pending requested 2013-10-04

Revision history for this message

Fedor Brunner (fedor-brunner) wrote on 2013-09-05:

patch for TLS v1.1 and TLS v1.2 support Edit (5.7 KiB, text/plain)

This patch will add support for TLS v1.1 and TLS v1.2 . These protocols protect against SSL/TLS new attacks
https://en.wikipedia.org/wiki/Transport_Layer_Security#RC4_attacks
https://en.wikipedia.org/wiki/Transport_Layer_Security#CRIME_and_BREACH_attacks

Revision history for this message

Jean-Paul Calderone (exarkun) wrote on 2013-10-01:

This patch looks reasonable. However, please contribute future patches against *trunk* so that they don't need to be ported to trunk.

Jean-Paul Calderone (exarkun) on 2013-10-04

Changed in pyopenssl:
assignee:	nobody → Jean-Paul Calderone (exarkun)
importance:	Undecided → Medium
status:	New → In Progress

Revision history for this message

Andy Lutomirski (luto-mit) wrote on 2013-10-04:

After staring at the utter crap OpenSSL docs for a while, it turns out that, almost regardless of what you're trying to interoperate with, the correct method to use is SSL.SSLv23_METHOD. TLSv1_2_METHOD means TLS 1.2 *only*. Similarly, TLSv1_METHOD means TLS 1.0 *only* (in particular, TLSv1_METHOD disallows TLSv1.2).

If you use SSL.SSLv23_METHOD and set SSL.OP_NO_SSLv2 (and optionally SSL.OP_NO_SSLv3) then you get reasonable results, including the availability of GCM ciphers.

Jean-Paul Calderone (exarkun) on 2013-10-06