Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs

Documentation

Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768. The same release added ssl.get_sigalgs(), SSLSocket.client_sigalg() and SSLSocket.server_sigalg() for signature algorithms.

The reference documentation for both sets of methods is thinner than it could be.

Five of them need a specific OpenSSL version and raise NotImplementedError when linked against an older one, but the reference docs don't say so:

• SSLSocket.group() needs OpenSSL 3.2 or later
• SSLContext.get_groups() needs OpenSSL 3.5 or later
• ssl.get_sigalgs() needs OpenSSL 3.4 or later
• SSLSocket.client_sigalg() needs OpenSSL 3.5 or later
• SSLSocket.server_sigalg() needs OpenSSL 3.5 or later

Each requirement is already stated in the What's New in 3.15 entries and enforced in Modules/_ssl.c, so this is only about the reference pages.

There are a few other gaps around the group API. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.

Linked PRs

• gh-154518

まず、set_groups()、get_groups()、group()、署名アルゴリズム API、set_ecdh_curve()、および TLS 1.3 セクションの SSL リファレンスページから始め、次に、それらに現在記載されている詳細を Modules/_ssl.c および What's New in 3.15 の項目と比較します。OpenSSL の要件、NotImplementedError の動作、ポスト量子グループのサポート、例、相互参照について、issue で説明されている不足箇所が網羅されれば完了です。