René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Add ssl.HAS_PSK_TLS13 to detect libssl external TLS 1.3 PSK support","articleBody":"### Proposal:\n\nDue to [security concerns](https://www.rfc-editor.org/rfc/rfc9258.html#section-1), neither AWS-LC [nor BoringSSL](https://issues.chromium.org/issues/369963041) support \"External PSK\" (as defined [here](https://www.rfc-editor.org/rfc/rfc9258.html#section-3)) in TLS 1.3.\n\nThis issue proposes the addition of a boolean property `ssl.HAS_PSK_TLS13` to indicate whether the crypto library CPython is built against supports External PSK, allowing python's test suite and consuming modules to branch accordingly.\n\nThis feature has precedent in the `ssl.HAS_PSK` and `ssl.HAS_PHA` flags indicating support (or lack thereof) for other TLS features that are not universally implemented across TLS libraries.\n\n#### [One Hard Thing](https://martinfowler.com/bliki/TwoHardThings.html): Naming Concerns\n\nI'm not sure that `HAS_PSK_TLS13` is the best name. While AWS-LC doesn't support \"External PSKs\" in TLS 1.3 (i.e. \"PSK\" is only used for session resumption), it [does](https://github.com/aws/aws-lc/blob/8233b4bbaf7b186639a76084f37d49b2c0bebf3c/ssl/handshake_server.cc#L1421-L1446) for earlier TLS versions. However, the \"external\" terminology established in RFC 9258 pertains specifically to TLS 1.3. So do we include `EXTERNAL` instead of `TLS13` in the `ssl` module property name? My thought is \"no\" because it's somewhat imprecise.\n\nA further complication is that AWS-LC does notionally support PSK in TLS 1.3, but [only for session resumption](https://github.com/aws/aws-lc/blob/main/ssl/tls13_enc.cc#L374) (this is fine security-wise, as sessions can't span protocol versions). This makes the current suggestion of `HAS_PSK_TLS13` somewhat disingenuous, as the [PreSharedKeyExtension](https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.11) is indeed used.\n\nSomething like `ssl.HAS_TLS13_EXTERNAL_PSK` \"feels\" like an abomination, but is probably the most accurate. Anyway, I don't see a clear choice and am very open to suggestions.\n\n### Has this already been discussed elsewhere?\n\nThis is a minor feature, which does not need previous discussion elsewhere\n\n### Links to previous discussion of this feature:\n\nRelated changes to increase libcrypto/libssl compatibility (specifically with AWS-LC) have been discussed with the community [here](https://discuss.python.org/t/support-building-ssl-and-hashlib-modules-against-aws-lc/44505/2).\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-133624\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/WillChilds-Klein","@type":"Person","name":"WillChilds-Klein"},"datePublished":"2025-05-07T22:22:18.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/133623/cpython/issues/133623"}