Add fancier ECDHE support #57
Conversation
Conflicts: .gitignore OpenSSL/test/test_ssl.py
It would be great if there were a clean way to enumerate them rather than just listing them like this, but I don't know of one.
…rves Different OpenSSL builds support different curves. Determine the supported curves at startup and expose the list.
|
This depends on pyca/cryptography#738 |
|
The cryptography dependency has been merged. |
|
Looks like Travis CI needs to be asked to try again once cryptography makes a release. |
OpenSSL/SSL.py
Outdated
There was a problem hiding this comment.
dict comprehension are Python 2.7+. Try dict((key, value) for (key, value) in sequence) instead.
|
I updated the branch. |
|
@amluto, we're considering not adding any more NID bindings to cryptography and instead asking users to use |
|
I didn't know about OBJ_sn2nid and OBJ_nid2sn. Let me adjust the branch to use strings instead of numbers -- I like that better. |
Using NIDs is awkward and requires updating pyOpenSSL every time a new curve is added. This approach avoids needing to update pyOpenSSL each time a new curve is added, and it results in more readable code and a more readable dict ELLIPTIC_CURVE_DESCRIPTIONS.
that we access them by name.
|
I updated the pull request. I renamed the function, since it no longer uses a "curve name" (which, in OpenSSL parlance, is a number, not really a name). |
|
This is only still failing because cryptography hasn't made a release yet, right? |
|
This works for me (PyPy 2.2.1, cryptography 3.0-dev1, OpenSSL 1.0.1e). Other than adjusting install_requires=["cryptography>=0.3", "six>=1.5.2"], |
|
I think that version of cryptography has to be actually released before we can merge this :) Specifically we can't merge things with red buildbots ;) |
|
I've just merged the updated Travis configuration that will test this against cryptography master, so I will now re-run the build. |
|
awesome! I'd love to retire a bunch of hacks and take this into production .. |
|
Likewise, although in Twisted trunk you should actually already get ECDHE (with nistp256 only though) even without this branch. |
|
Seems like crypography 0.2.2 is still missing |
|
Yes. I can't figure out how to convince Travis to build against cryptography master. I've asked in their IRC channel. It may be necessary for @amluto to merge master back into his branch. |
|
Yeah. Heard back from the Travis CI people. @amluto: could you please merge pyca/pyopenssl master back into your branch? That way we can at least see if it works on the buildbots with cryptography master :) |
|
@lvh I have merged master and @amluto 's ecdeh branch into https://github.com/oberstet/pyopenssl/tree/ecdhe Will that work for Travis testing? |
|
Only if you submit it as a PR. |
|
done: #71 |
|
So, recap from the #71 experiment: everything works with everything as trunk; we need cryptography 0.3 to be released and to depend on it in master, and then have master merged into this branch. |
|
We've done a release now. |
|
Awesome. If @amluto is busy with other stuff: why can't we just merge master onto amluto's branch plus the updated require on another branch (as I did 10 days ago for prelimiary testing) ourselves? In the end, this is Git .. version history is preserved. Why would @amluto be required to perform these mechanical acts? |
|
There's no reason. Since @hynek thought the branch that needed the new cryptography should add the requirement, I'll make a new PR. |
|
Closing in favor of #82. |
|
See #89, and feel free to close it if you merge into here. |
6 participants
This is based on #9, but it adds more curve definitions and ELLIPTIC_CURVE_DESCRIPTIONS. The latter lists curves that are actually supported on the system's OpenSSL.