Ability to "pin" TLS version and/or ciphers

[rugk]

It would be nice if you could not only pin the cert hash (#9), but also the ciphers and the TLS version to use. This would effectively make any downgrade attacks impossible and ensure that always the best encryption is used.

E.g. you can also do this in the PHP-SDK.

[lgrahl]

I'm in two minds about this. Certainly, a developer should have this option, and in fact he has because no one is required to use this project as is. Then again, good TLS settings security change over time and there are plenty of misleading optimal settings out there. I'm quite sure that the developers of aiohttp take this as seriously as we do and they can use their knowledge to provide us sane and safe TLS settings.

I guess it would be okay to add an optional keyword argument connector to the class Connection which contains a aiohttp.BaseConnector instance. But I wouldn't want to go any further. At least not without some very convincing arguments.

Nevertheless, if somebody wants to do it, the following should work (TLS settings from this page). I have not tested this and I'm definitely not recommending it!

import ssl
import aiohttp

from threema import gateway


class Connection(gateway.Connection):
    def __init__(self, *args, fingerprint=None, verify_fingerprint=False, **kwargs):
        super().__init__(*args, fingerprint=fingerprint,
                         verify_fingerprint=verify_fingerprint, **kwargs)

        # Create your own SSL context here...
        ssl_context = ssl.create_default_context()

        # Override session
        if fingerprint is None and verify_fingerprint:
            fingerprint = self.fingerprint
        connector = aiohttp.TCPConnector(fingerprint=fingerprint, ssl_context=ssl_context)
        self._session = aiohttp.ClientSession(connector=connector)

[rugk]

Yes I would also only make it optional (that's why I said "ability" 😃), so that the user can choose for him/herself the best ciphers and therefore he should know that this might need to be updated at some time.