SSLContext.set_ecdh_curve() not accepting x25519

[sruester]

BPO	32882
Nosy	@tiran, @sruester
PRs	bpo-32882: Added support for X25519 in SSLContext.set_ecdh_curve() #5770 gh-77063: Added support for X25519 in SSLContext.set_ecdh_curve() #5771
Superseder	bpo-32858: Improve OpenSSL ECDH support

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = None
created_at = <Date 2018-02-20.09:49:54.078>
labels = ['expert-SSL', 'type-bug', '3.8', '3.9', '3.10', '3.11', '3.7']
title = 'SSLContext.set_ecdh_curve() not accepting x25519'
updated_at = <Date 2021-04-21.09:29:10.670>
user = 'https://github.com/sruester'

bugs.python.org fields:

activity = <Date 2021-04-21.09:29:10.670>
actor = 'sruester'
assignee = 'christian.heimes'
closed = False
closed_date = None
closer = None
components = ['SSL']
creation = <Date 2018-02-20.09:49:54.078>
creator = 'sruester'
dependencies = []
files = []
hgrepos = []
issue_num = 32882
keywords = ['patch']
message_count = 3.0
messages = ['312405', '312408', '391504']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'sruester']
pr_nums = ['5770', '5771']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = '32858'
type = 'behavior'
url = 'https://bugs.python.org/issue32882'
versions = ['Python 2.7', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

[sruester]

Using SSLContext.set_ecdh_curve() it is neither possible to choose X25519, nor to choose a list of curves to be used for key agreement.

[tiran]

This bug was originally the more generic issue bpo-32858.

SSLContext.set_ecdh_curve() uses EC_KEY_new_by_curve_name() and SSL_CTX_set_tmp_ecdh() to configure the ECDH curve parameters. The current approach has multiple downsides. It doesn't work with X25519 and can only set one curve. OpenSSL 1.0.2+ has SSL_CTX_set1_curves_list(), which supports a list of curve names.

Proposal:

SSLContext.set_ecdh_curve() is changed from taking one curve name to an *arg of curve names. With OpenSSL 1.0.2+, 1..n curves are supported. For OpenSSL < 1.0.2 on 2.7-3.6, one curve is supported. Perhaps it makes sense to map an empty *arg to auto-configuration?

I like to cover the issue in PEP-543, too.

Cory,
what do you think about another enum of IANA groups of EC groups, https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 ?

[sruester]

PEP-543 was withdrawn in the meantime. Any suggestion how to proceed with this?

[OrionCodeDev]

Any updates?

[sla-te]

+