Repository navigation
No way to use TLS-PSK from python ssl #63284
Description
| BPO | 19084 |
|---|---|
| Nosy | @warsaw, @jcea, @pitrou, @giampaolo, @tiran, @chrysn |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = 'https://github.com/tiran'
closed_at = <Date 2017-09-06.14:53:17.746>
created_at = <Date 2013-09-24.15:32:28.932>
labels = ['3.7', 'expert-SSL', 'type-feature', 'library']
title = 'No way to use TLS-PSK from python ssl'
updated_at = <Date 2017-09-06.14:53:17.746>
user = 'https://bugs.python.org/karlp'bugs.python.org fields:
activity = <Date 2017-09-06.14:53:17.746>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2017-09-06.14:53:17.746>
closer = 'christian.heimes'
components = ['Library (Lib)', 'SSL']
creation = <Date 2013-09-24.15:32:28.932>
creator = 'karlp'
dependencies = []
files = ['31859']
hgrepos = []
issue_num = 19084
keywords = []
message_count = 5.0
messages = ['198362', '198364', '198365', '198378', '301475']
nosy_count = 11.0
nosy_names = ['barry', 'jcea', 'janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'chrysn', 'karlp', 'ralight', 'njouanin', 'luizdepra']
pr_nums = []
priority = 'normal'
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue19084'
versions = ['Python 3.7']
Activity
karlp commentedon Sep 24, 2013
OpenSSL supports TLS-PSK which some people (myself obviously) find to be substantially easier to use than setting up certs.
However, there's no way to use PSK via the current SSL api in python. It would be very nice to be able to use PSK from python.
For OpenSSL, even the C API is particularly easy. Attached is the implementation used in Mosquitto, a MQTT message broker that supports both cert based and PSK based TLS.
jcea commentedon Sep 24, 2013
Python 2.7 is open only for bugfixes. No new features.
Do you dare to write a patch for Python 3.4? :-). If you do, remember to sign a Contributor Agreement.
Give it a try! :)
pitrou commentedon Sep 24, 2013
Is it different from TLS SRP, which already has a feature request in bpo-11943?
As Jesus said, feel free to propose a patch, even a proof of concept so that we start discussing the API.
ralight commentedon Sep 25, 2013
This is not TLS-SRP, but TLS-PSK as described by RFC 4279[1]
There is a very small amount of overlap - the "unknown_psk_identity" error defined by PSK is also used in SRP.
[1] http://tools.ietf.org/html/rfc4279
tiran commentedon Sep 6, 2017
This feature request has been idle for almost four years. Although TLS-PSK is nice to have, it is not a priority for protocols such as HTTPS. I neither have time nor motivation to create a patch myself. Therefore I'm closing this issue of lack of activity. Please feel free to re-open it with a patch against 3.7.
pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…
6 remaining items
gpshead commentedon May 30, 2023
I can handle the PR review. I'm not really convinced that this feature is worth having - the original bug filer's excuse was a poor one about not wanting to deal with certificates. letsencrypt has become commonplace not to make that easy.
But so long as
sslexists and is basically a wrapper around things OpenSSL provides, there is no harm in offering the APIs. I'd expect anyone doing a security review of a system design to raise their eyebrows at PSK TLS use...gramsay0 commentedon May 31, 2023
@gpshead thanks for the review!
I will update the PR soon when I get a chance.
Yes, I agree with both sides of that argument.
A more common/standard use of TLS-PSK is resuming TLS sessions that were originally created by asymmetric encryption. Although possibly the TLSv1.3 PSK APIs (that I did not implement) are better suited to that.
Other use cases:
https://docs.bareos.org/include/autogenerated/autosummary/python-bareos/bareos.bsock.html#transport-encryption-tls-psk
michallowasrzechonek-silvair commentedon Oct 20, 2023
There are situations where certificates cannot be used - in IoT it's common that the embedded device has neither RTC (to check validity) nor HTTP (to check revocation lists), and in most cases limited computing power.
tuxmaster5000 commentedon Nov 1, 2023
An other use case will be the backup software bareos/bacula, which makes heavy usage of TLS-PSK.
doronz88 commentedon Nov 26, 2023
I also need this feature for
pymobiledevice3. On very recent updates, Apple started using TLS-PSK to communicate with the device. I believe more and more people will start having problems as a result.gh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module (#…
gpshead commentedon Nov 27, 2023
Thanks for the contribution!
Merge pull request #1 from python/main
pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…
pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…