Expose set_groups/set_curves functions#14288
Conversation
|
Before we land new CFFI APIs in cryptography, we prefer to have a PoC up for pyOpenSSL, just to make sure the APIs we're adding support a reasonable design in pyOpenSSL. |
|
Sure, the PR for pyOpenSSL is here: pyca/pyopenssl#1477 I still struggle a bit to figure out how to tell the CI for pyOpenSSL/Github/nox to tell that it needs to build cryptography from this PR to make the tests work. Installing manually the cryptography version in the venv make the tests work at least on OpenSSL. |
|
That's fine, the goal is demonstrate that this can work (and that we'll actually getting a pyOpenSSL PR out of it). Unfortunately for a while we had a lot of folks send PRs to add new bindings, but never follow up with the pyOpenSSL PRs. |
src/_cffi_src/openssl/ssl.py
Outdated
|
|
||
| /* both functions are have int return type according to the man page but | ||
| * long in its implementation. Newer versions also have the set1_groups | ||
| * function but the curves variants are availalbe on all forks and OpenSSL |
There was a problem hiding this comment.
| * function but the curves variants are availalbe on all forks and OpenSSL | |
| * function but the curves variants are available on all forks and OpenSSL |
This allows pyOpenSSL to restrict the groups allowed to be used. E.g. for restricting the groups to post-quantum hybrid groups (e.g. X25519MLKEM768) to always ensure that post-quantum cryptography is used. This commit uses the set_curves instead of the set_groups variant since that naming is available on all OpenSSL versions and forks. Signed-off-by: Arne Schwabe <arne@rfc2549.org>
schwabe
force-pushed
the
schwabe/set_groups
branch
from
80a3e9a to
ef0417f
Compare
2 participants
This allows pyOpenSSL to restrict the groups allowed to be used. E.g. for restricting the groups to post-quantum hybrid groups (e.g. X25519MLKEM768) to always ensure that post-quantum cryptography is used.
This commit uses the set_curves instead of the set_groups variant since that naming is available on all OpenSSL versions and forks.