[Python-ideas] Unified TLS API for Python

[Cory Benfield]

> On 2 Feb 2017, at 11:17, Paul Moore <p.f.moore at gmail.com> wrote:
> 
> One thing that wasn't clear to me was the backward compatibility
> implications. Will the existing ssl module and its API be retained, or
> will it be modified/deprecated? Will Windows/OSX distributions of
> Python ultimately stop shipping with OpenSSL included? From an end
> user POV, I won't care (high level modules like asyncio, urllib[1],
> http.client etc will be updated to transparently use the new
> infrastructure) so I accept that this is something of an "internal"
> and/or library author concern.

These are all good questions.

For the existing ssl module and its API, deprecating it is hard work: it’s used extremely widely, and I don’t think we’d ever remove it. I suspect we’d warn against using it in favour of programming to the new tls API, but we’d keep it in place partly because it is so heavily used today, and partly because it’ll form the basis of the OpenSSL implementation of the abstract API here.

As to stopping shipping with OpenSSL, that’s unlikely. OpenSSL doesn’t just back the ssl module, it backs hashlib as well (via libcrypto). While it’s potentially possible to replace most of hashlib with constructs from platform-native implementations (CommonCrypto and CryptoNG), that’s a lot of work and hard to do, as the cryptography.io <http://cryptography.io/> folks would tell you. So I suspect we’ll end up shipping with both, but the importance of OpenSSL for TLS would drop dramatically (and it would even potentially be possible to link only against libcrypto instead of libssl).

> [1] urllib wasn't actually a module noted as needing change. Was that
> an omission, or is it simply because it defers the TLS stuff to the
> lower levels like http.client?

That was an omission: I forgot to check whether it needed updating. It does. I’ve amended the PEP accordingly.

Cory
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-ideas/attachments/20170202/d29ea636/attachment-0001.html>