Allow to trigger a TLS 1.3 KeyUpdate

[adiroiban]

If you have a long-lived connection that does a lot of data transfer it might help to refresh the session key.

For example during the download or upload of a 4GB file.

This is for the following low-level API https://docs.openssl.org/master/man3/SSL_key_update/

#include <openssl/ssl.h>

int SSL_key_update(SSL *s, int updatetype);
int SSL_get_key_update_type(const SSL *s);

We already have Context.set_timeout which restrict the time after which connections can reuse an already negotiated session ... but if you have a single long lasting session , I am not sure that pyOpenSSL triggers any key updates.

This is only for TLS 1.3

The API is also available for QUIC.. but I don't know if pyOpenSSL supports it.

---

I am opening this issue here to see if it make sense to expose this API.

[reaperhulk]

While nominally this is something an application can trigger, I don't see a good resaon to do so. The underlying library has thresholds for re-keying that will occur automatically and securely long before any key exhaustion concerns occur, and exposing these knobs to the application layer adds complexity for no significant security benefit.

[adiroiban]

Thanks for the feedback.

The underlying library has thresholds for re-keying

I was under the impression that automatic re-key is not yet implemented in OpenSSL

There is this upstream issue: openssl/openssl#23566

[reaperhulk]

Sigh, it appears you're correct. Poking the libraries now, because this absolutely seems like a thing they should be handling.