No way to use TLS-PSK from python ssl #63284

karlp · 2013-09-24T15:32:29Z

BPO	19084
Nosy	@warsaw, @jcea, @pitrou, @giampaolo, @tiran, @chrysn
Files	5bcfpEKD.txt: implementation of TLS-PSK from Mosquitto

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2017-09-06.14:53:17.746>
created_at = <Date 2013-09-24.15:32:28.932>
labels = ['3.7', 'expert-SSL', 'type-feature', 'library']
title = 'No way to use TLS-PSK from python ssl'
updated_at = <Date 2017-09-06.14:53:17.746>
user = 'https://bugs.python.org/karlp'

bugs.python.org fields:

activity = <Date 2017-09-06.14:53:17.746>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2017-09-06.14:53:17.746>
closer = 'christian.heimes'
components = ['Library (Lib)', 'SSL']
creation = <Date 2013-09-24.15:32:28.932>
creator = 'karlp'
dependencies = []
files = ['31859']
hgrepos = []
issue_num = 19084
keywords = []
message_count = 5.0
messages = ['198362', '198364', '198365', '198378', '301475']
nosy_count = 11.0
nosy_names = ['barry', 'jcea', 'janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'chrysn', 'karlp', 'ralight', 'njouanin', 'luizdepra']
pr_nums = []
priority = 'normal'
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue19084'
versions = ['Python 3.7']

Linked PRs

gh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module #103181

karlp · 2013-09-24T15:32:28Z

OpenSSL supports TLS-PSK which some people (myself obviously) find to be substantially easier to use than setting up certs.

However, there's no way to use PSK via the current SSL api in python. It would be very nice to be able to use PSK from python.

For OpenSSL, even the C API is particularly easy. Attached is the implementation used in Mosquitto, a MQTT message broker that supports both cert based and PSK based TLS.

jcea · 2013-09-24T15:42:50Z

Python 2.7 is open only for bugfixes. No new features.

Do you dare to write a patch for Python 3.4? :-). If you do, remember to sign a Contributor Agreement.

Give it a try! :)

pitrou · 2013-09-24T17:57:54Z

Is it different from TLS SRP, which already has a feature request in bpo-11943?
As Jesus said, feel free to propose a patch, even a proof of concept so that we start discussing the API.

ralight · 2013-09-25T09:28:45Z

This is not TLS-SRP, but TLS-PSK as described by RFC 4279[1]

There is a very small amount of overlap - the "unknown_psk_identity" error defined by PSK is also used in SRP.

[1] http://tools.ietf.org/html/rfc4279

Sep 6, 2017 · 2017-09-06T14:53:02Z

This feature request has been idle for almost four years. Although TLS-PSK is nice to have, it is not a priority for protocols such as HTTPS. I neither have time nor motivation to create a patch myself. Therefore I'm closing this issue of lack of activity. Please feel free to re-open it with a patch against 3.7.

ddurham2 reacted with thumbs down emoji

…odule

arhadthedev · 2023-04-02T04:17:40Z

This feature request has been idle for almost four years

A PR is proposed so reopening.

…odule

grantramsay · 2023-05-14T04:38:26Z

Hey, is anyone available to review the proposed PR?

gpshead · 2023-05-30T19:23:01Z

I can handle the PR review. I'm not really convinced that this feature is worth having - the original bug filer's excuse was a poor one about not wanting to deal with certificates. letsencrypt has become commonplace not to make that easy.

But so long as ssl exists and is basically a wrapper around things OpenSSL provides, there is no harm in offering the APIs. I'd expect anyone doing a security review of a system design to raise their eyebrows at PSK TLS use...

gramsay0 · 2023-05-31T04:30:47Z

@gpshead thanks for the review!
I will update the PR soon when I get a chance.

Yes, I agree with both sides of that argument.

A more common/standard use of TLS-PSK is resuming TLS sessions that were originally created by asymmetric encryption. Although possibly the TLSv1.3 PSK APIs (that I did not implement) are better suited to that.

Other use cases:

Small embedded systems without enough resources for asymmetric encryption
Ephemeral PSKs from a secure source - this is my use case, where a hypervisor is passing PSKs to VMs
Some other projects seem to find a use for it:
https://docs.bareos.org/include/autogenerated/autosummary/python-bareos/bareos.bsock.html#transport-encryption-tls-psk

michallowasrzechonek-silvair · 2023-10-20T08:34:34Z

I can handle the PR review. I'm not really convinced that this feature is worth having - the original bug filer's excuse was a poor one about not wanting to deal with certificates. letsencrypt has become commonplace not to make that easy.

There are situations where certificates cannot be used - in IoT it's common that the embedded device has neither RTC (to check validity) nor HTTP (to check revocation lists), and in most cases limited computing power.

tuxmaster5000 · 2023-11-01T07:24:44Z

An other use case will be the backup software bareos/bacula, which makes heavy usage of TLS-PSK.

doronz88 · 2023-11-26T15:42:30Z

I also need this feature for pymobiledevice3. On very recent updates, Apple started using TLS-PSK to communicate with the device. I believe more and more people will start having problems as a result.

…103181) Add support for TLS-PSK (pre-shared key) to the ssl module. --------- Co-authored-by: Oleg Iarygin <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]>

gpshead · 2023-11-27T04:08:58Z

Thanks for the contribution!

pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module …

…odule (python#103181) Add support for TLS-PSK (pre-shared key) to the ssl module. --------- Co-authored-by: Oleg Iarygin <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]>

karlp mannequin added type-bug An unexpected behavior, bug, or error stdlib Python modules in the Lib dir labels Sep 24, 2013

pitrou added type-feature A feature request or enhancement and removed type-bug An unexpected behavior, bug, or error labels Sep 24, 2013

3.7 (EOL) end of life topic-SSL labels Sep 8, 2016

Sep 15, 2016

completed Sep 6, 2017

ezio-melotti transferred this issue from another repository Apr 10, 2022

This was referenced Aug 29, 2022

Provide a SSLContext() API drbild/sslpsk#19

Open

General Usage maovidal/paho_sslpsk2_demo#2

Open

grantramsay added a commit to grantramsay/cpython that referenced this issue Apr 2, 2023

pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…

d33eccc

…odule

grantramsay mentioned this issue Apr 2, 2023

gh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module #103181

Merged

arhadthedev reopened this Apr 2, 2023

grantramsay added a commit to grantramsay/cpython that referenced this issue Apr 2, 2023

pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…

7fab649

…odule

grantramsay added a commit to grantramsay/cpython that referenced this issue Apr 3, 2023

pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…

79f9d24

…odule

grantramsay added a commit to grantramsay/cpython that referenced this issue Apr 3, 2023

pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl m…

9d0f6dc

…odule

arhadthedev added 3.13 bugs and security fixes and removed 3.7 (EOL) end of life labels May 14, 2023

gpshead self-assigned this May 30, 2023

gpshead unassigned tiran Nov 27, 2023

gpshead closed this as completed Nov 27, 2023

samkhaningur added a commit to samkhaningur/cpython that referenced this issue Nov 27, 2023

Merge pull request #1 from python/main

77ab200

pythongh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module …

salrashid123 mentioned this issue Apr 26, 2024

crypto/tls: add PSK support golang/go#6379

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

No way to use TLS-PSK from python ssl #63284

No way to use TLS-PSK from python ssl #63284

karlp mannequin commented Sep 24, 2013 •

edited by bedevere-bot

Loading

karlp mannequin commented Sep 24, 2013

jcea commented Sep 24, 2013

pitrou commented Sep 24, 2013

ralight mannequin commented Sep 25, 2013

Sep 6, 2017

arhadthedev commented Apr 2, 2023

grantramsay commented May 14, 2023

gpshead commented May 30, 2023

gramsay0 commented May 31, 2023 •

edited

Loading

michallowasrzechonek-silvair commented Oct 20, 2023

tuxmaster5000 commented Nov 1, 2023

doronz88 commented Nov 26, 2023

gpshead commented Nov 27, 2023

No way to use TLS-PSK from python ssl #63284

No way to use TLS-PSK from python ssl #63284

Comments

karlp mannequin commented Sep 24, 2013 • edited by bedevere-bot Loading

Linked PRs

karlp mannequin commented Sep 24, 2013

jcea commented Sep 24, 2013

pitrou commented Sep 24, 2013

ralight mannequin commented Sep 25, 2013

Sep 6, 2017

arhadthedev commented Apr 2, 2023

grantramsay commented May 14, 2023

gpshead commented May 30, 2023

gramsay0 commented May 31, 2023 • edited Loading

michallowasrzechonek-silvair commented Oct 20, 2023

tuxmaster5000 commented Nov 1, 2023

doronz88 commented Nov 26, 2023

gpshead commented Nov 27, 2023

karlp mannequin commented Sep 24, 2013 •

edited by bedevere-bot

Loading

gramsay0 commented May 31, 2023 •

edited

Loading