Documentation
Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768.
The reference documentation for these methods is thinner than it could be. SSLSocket.group() doesn't mention that it needs OpenSSL 3.2 or later and raises NotImplementedError otherwise, and get_groups() has the same omission for OpenSSL 3.5. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.
Linked PRs
Documentation
Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768.
The reference documentation for these methods is thinner than it could be. SSLSocket.group() doesn't mention that it needs OpenSSL 3.2 or later and raises NotImplementedError otherwise, and get_groups() has the same omission for OpenSSL 3.5. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.
Linked PRs