Add TLS 1.3 cipher suites
MODIFY
urllib3/contrib/_securetransport/bindings.py
urllib3/contrib/_securetransport/bindings.py
@@ -588,3 +588,6 @@ class SecurityConst(object):
TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003C
TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035
TLS_RSA_WITH_AES_128_CBC_SHA = 0x002F
+ TLS_AES_128_GCM_SHA256 = 0x1301
+ TLS_AES_256_GCM_SHA384 = 0x1302
+ TLS_CHACHA20_POLY1305_SHA256 = 0x1303

MODIFY
urllib3/contrib/securetransport.py
urllib3/contrib/securetransport.py
@@ -91,6 +91,9 @@ SSL_WRITE_BLOCKSIZE = 16384
# individual cipher suites. We need to do this becuase this is how
# SecureTransport wants them.
CIPHER_SUITES = [
+ SecurityConst.TLS_AES_256_GCM_SHA384,
+ SecurityConst.TLS_CHACHA20_POLY1305_SHA256,
+ SecurityConst.TLS_AES_128_GCM_SHA256,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,

MODIFY
urllib3/util/ssl_.py
urllib3/util/ssl_.py
@@ -61,13 +61,17 @@ except ImportError:
# - https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
#
# The general intent is:
-# - Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE),
+# - Prefer TLS 1.3 cipher suites
+# - prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE),
# - prefer ECDHE over DHE for better performance,
# - prefer any AES-GCM and ChaCha20 over any AES-CBC for better performance and
# security,
# - prefer AES-GCM over ChaCha20 because hardware-accelerated AES is common,
# - disable NULL authentication, MD5 MACs and DSS for security reasons.
DEFAULT_CIPHERS = ':'.join([
+ 'TLS13-AES-256-GCM-SHA384',
+ 'TLS13-CHACHA20-POLY1305-SHA256',
+ 'TLS13-AES-128-GCM-SHA256',
'ECDH+AESGCM',
'ECDH+CHACHA20',
'DH+AESGCM',

Add TLS 1.3 cipher suites

Signed-off-by: Christian Heimes <christian@python.org>