The (slightly) Less Sorry
State of SSL
Benjamin Peterson
Slide 2
Slide 2 text
Me: CPython, six, etc...
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
Montréal circa April, 2014
Slide 5
Slide 5 text
Montréal circa April, 2014
Slide 6
Slide 6 text
Why so sorry?
Slide 7
Slide 7 text
Background on the ssl module
● added in Python 2.6
● wrapper over OpenSSL
● “transparent” socket API
● used by httplib for HTTPS support
● many improvements in the 3.x series
Slide 8
Slide 8 text
Python 2.7 frozen in 2010.
Slide 9
Slide 9 text
Consequences for Python 2.7.x
● No TLS 1.1 or 1.2
● No good ciphersuites
● No Perfect Forward Security
● No Next Protocol Negotiation (NPN)
● No Server Name Indication (SNI)
● No system certificate access
Slide 10
Slide 10 text
Horrible Defaults
● Bad protocols
● Bad ciphers
● No certificate trust verification
● No hostname validation
PEP 466: Network Security
Enhancements for Python 2.7.x
Slide 14
Slide 14 text
PEP 466
● 3.4 ssl module backported to 2.7
● SSLContext
● TLS 1.2 and good ciphers
● SNI
● other goodies: pbkdf2, constant time
compare, persistent urandom
Slide 15
Slide 15 text
PEP 476: Enabling certificate
verification by default for stdlib
HTTP clients
Slide 16
Slide 16 text
PEP 476
● Python 2.7.9+, 3.4.1+
● for httplib and consumers
● validation and hostname matching
● system cert store used by default
● Network APIs now take a context argument
Slide 17
Slide 17 text
The Goodies
Slide 18
Slide 18 text
SSLContext
● configuration for a TLS connection
● trusted certs
● ciphers
● allowed protocols
● other obscure options
● accepted by many higher level APIs
Slide 19
Slide 19 text
ssl.create_default_context
● creates a SSLContext with sensible defaults
● disables broken protocols and features
● modern ciphers with good ordering
● loads system certs for trust by default
● updated as best practices change (e.g. RC4)
● used by stdlib modules
Slide 20
Slide 20 text
Support for TLS extensions
● Server Name Indication (SNI) - Allows the
server to pick the correct cert.
● Next Protocol Negotiation (NPN)
● Application-Layer Protocol Negotiation
(ALPN)
Slide 21
Slide 21 text
Memory BIO support
● Alternate to traditional socket interface
● Separates network IO from TLS protocol
● Useful for framework
● Used by asyncio
● Just in Python 3.5 not 2.7.x
Slide 22
Slide 22 text
The Slow Creep of Distributors
● Debian: in Jessie
● Ubuntu: Vivid, but not LTS
● OS X: ??
● You’re not using system Python anyway,
right?
Slide 23
Slide 23 text
Hopefully, we’re not at the forefront
of terrible anymore.
Slide 24
Slide 24 text
requests is nice
Slide 25
Slide 25 text
Incomplete Thanks
● Alex Gaynor
● David Reid
● Nick Coghlan
● Donald Stufft
● Hynek Schlawack
● Antoine Pitrou
● GvR