cpython

mirror of https://github.com/python/cpython.git synced 2026-05-14 22:40:42 +00:00

History

Christian Heimes e983252b51 bpo-43998: Default to TLS 1.2 and increase cipher suite security (GH-25778) The ssl module now has more secure default settings. Ciphers without forward secrecy or SHA-1 MAC are disabled by default. Security level 2 prohibits weak RSA, DH, and ECC keys with less than 112 bits of security. :class:`~ssl.SSLContext` defaults to minimum protocol version TLS 1.2. Settings are based on Hynek Schlawack's research. ``` $ openssl version OpenSSL 1.1.1k FIPS 25 Mar 2021 $ openssl ciphers -v '@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM' TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD TLS_AES_128_CCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESCCM(128) Mac=AEAD ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 ``` Signed-off-by: Christian Heimes <christian@python.org>		2021-05-01 20:53:10 +02:00
..
NEWS.d	bpo-43998: Default to TLS 1.2 and increase cipher suite security (GH-25778)	2021-05-01 20:53:10 +02:00
ACKS	bpo-42800: add audit hooks for f_code and tb_frame (GH-24182)	2021-04-30 00:15:55 +01:00
coverity_model.c	bpo-35808: Retire pgen and use pgen2 to generate the parser (GH-11814)	2019-03-01 15:34:44 -08:00
gdbinit	gdbinit: Use proper define syntax (GH-19557)	2020-04-23 05:49:26 -07:00
HISTORY	Fix typos mostly in comments, docs and test names (GH-15209)	2019-08-30 16:21:19 -04:00
indent.pro	Merged revisions 86134,86315-86316,86390,86424-86425,86428,86550,86561-86562,86564-86565,86705,86708,86713 via svnmerge from	2010-11-26 09:05:43 +00:00
Porting	bpo-30737: Update DevGuide links to new URL (GH-3228)	2017-08-30 09:37:43 -07:00
python-config.in	bpo-38468 : Refactor python-config (#16749 )	2019-10-15 11:18:47 -03:00
python-config.sh.in	bpo-37925: Mention --embed in python-config usage (GH-15458)	2019-08-26 23:45:36 +02:00
python-embed.pc.in	bpo-36721: Add --embed option to python-config (GH-13500)	2019-05-23 03:30:23 +02:00
python-wing3.wpr	Mark files as executable that are meant as scripts. (GH-15354)	2019-09-09 07:16:33 -07:00
python-wing4.wpr	Mark files as executable that are meant as scripts. (GH-15354)	2019-09-09 07:16:33 -07:00
python-wing5.wpr	Mark files as executable that are meant as scripts. (GH-15354)	2019-09-09 07:16:33 -07:00
python.man	bpo-43862: Enhance -W cmdline option documentation (GH-25439)	2021-04-16 19:12:14 +02:00
python.pc.in	bpo-36721: Add --embed option to python-config (GH-13500)	2019-05-23 03:30:23 +02:00
README	bpo-32159: Revert Misc/svnmap.txt (#4639 )	2017-11-29 18:58:33 +01:00
README.AIX	bpo-42087: Remove support for AIX 5.3 and below (GH-22830)	2020-11-16 16:16:10 +01:00
README.coverity
README.valgrind	bpo-18859: Document --with-valgrind option in README.valgrind (#10591 )	2018-11-20 12:10:49 +01:00
requirements-test.txt	Update tzdata to 2020.3 (GH-22856)	2020-10-21 06:40:43 -07:00
SpecialBuilds.txt	bpo-43774: Remove unused PYMALLOC_DEBUG macro (GH-25711)	2021-04-29 10:47:47 +02:00
stable_abi.txt	bpo-43916: Export the _PyStructSequence_InitType to fix build errors in the curses module (GH-25768)	2021-05-01 02:21:19 +01:00
svnmap.txt	bpo-32159: Revert Misc/svnmap.txt (#4639 )	2017-11-29 18:58:33 +01:00
valgrind-python.supp	bpo-35561: Supress valgrind false alarm on epoll_ctl(event) (GH-18060)	2020-01-19 23:38:37 +01:00
vgrindefs

README

Python Misc subdirectory
========================

This directory contains files that wouldn't fit in elsewhere.  Some
documents are only of historic importance.

Files found here
----------------

ACKS                    Acknowledgements
gdbinit                 Handy stuff to put in your .gdbinit file, if you use gdb
HISTORY                 News from previous releases -- oldest last
indent.pro              GNU indent profile approximating my C style
NEWS                    News for this release (for some meaning of "this")
Porting                 Mini-FAQ on porting to new platforms
python-config.in        Python script template for python-config
python.man              UNIX man page for the python interpreter
python.pc.in            Package configuration info template for pkg-config
python-wing*.wpr        Wing IDE project file
README                  The file you're reading now
README.AIX              Information about using Python on AIX
README.coverity         Information about running Coverity's Prevent on Python
README.valgrind         Information for Valgrind users, see valgrind-python.supp
SpecialBuilds.txt       Describes extra symbols you can set for debug builds
svnmap.txt              Map of old SVN revs and branches to hg changeset ids,
                        help history-digging
valgrind-python.supp    Valgrind suppression file, see README.valgrind
vgrindefs               Python configuration for vgrind (a generic pretty printer)