[Python-ideas] PEP 543-conform TLS library

Mathias Laurin mathias.laurin at gmail.com
Fri Oct 26 11:41:26 EDT 2018

Hello Python ideas,

I have implemented an (I believe) PEP 543-conform TLS library
and released TLS support in the latest version yesterday:


As far as I know, I am the first one to follow PEP 543.  So one
point is that the API works.  However, I have a couple of
questions regarding the PEP:

- I do not know what to do in `TLSWrappedBuffer.do_handshake()`.
  The full TLS handshake requires writing to the server, reading
  back, etc., (ClientHello, ServerHello, KeyExchange, etc.),
  which cannot be accomplished in a single buffer.

  For now, I am doing the handshake in
  `TLSWrappedSocket.do_handshake()`: I set the BIO to using the
  socket directly, then perform the handshake on the socket thus
  entirely bypassing the TLSWrappedBuffer.  Once this is done, I
  swap the BIO to using the buffer and go on encrypting and
  decrypting from the buffer.  That is, the encrypted
  communication is buffered.

- The PEP sometimes mentions an "input buffer" and an "output
  buffer", and some other times just "the buffer".  I believe
  that both implementations are possible.  That is, with two
  different buffers for input and output, or a single one.

  I have implemented it with a single circular buffer (that is a
  stream after all).  What the PEP is expecting is nonetheless
  not clear to me.

So, can anybody clarify these two points from the PEP?

Or should I just address Cory Benfield (who does not seem very
active anymore lately) and Christian Heimes directly?


More information about the Python-ideas mailing list