[issue13636] Python SSL Stack doesn't have a Secure Default set of ciphers

[Antoine Pitrou]

Antoine Pitrou <pitrou at free.fr> added the comment:

> I would suggest to try to keep  ECC/ECDH/ECDHE enabled, conceptually
> we would like to have ECDHE as the first ciphers because it's the most
> modern, performance and secure.

However, this will also divide performance by a large factor (from 2x to
4x apparently).

> Maybe also DH/EDH stuff can be done "in memory"?

Yes, there are also APIs for that, but you still have to provide magic
numbers (or have Python provide them).

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue13636>
_______________________________________