Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs

Documentation

Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768. The same release added ssl.get_sigalgs(), SSLSocket.client_sigalg() and SSLSocket.server_sigalg() for signature algorithms.

The reference documentation for both sets of methods is thinner than it could be.

Five of them need a specific OpenSSL version and raise NotImplementedError when linked against an older one, but the reference docs don't say so:

• SSLSocket.group() needs OpenSSL 3.2 or later
• SSLContext.get_groups() needs OpenSSL 3.5 or later
• ssl.get_sigalgs() needs OpenSSL 3.4 or later
• SSLSocket.client_sigalg() needs OpenSSL 3.5 or later
• SSLSocket.server_sigalg() needs OpenSSL 3.5 or later

Each requirement is already stated in the What's New in 3.15 entries and enforced in Modules/_ssl.c, so this is only about the reference pages.

There are a few other gaps around the group API. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.

Linked PRs

• gh-154518

Inizia dalle pagine di riferimento SSL per set_groups(), get_groups(), group(), le API degli algoritmi di firma, set_ecdh_curve() e la sezione TLS 1.3, quindi confronta i dettagli esistenti con Modules/_ssl.c e le voci di What's New in 3.15. Il lavoro sarà completo quando i requisiti documentati di OpenSSL, il comportamento di NotImplementedError, il supporto ai gruppi post-quantistici, gli esempi e i riferimenti incrociati copriranno le lacune descritte nell'issue.