Repository navigation
Deprecation warning with Cryptography v50.0.0 #826
Description
Greetings,
I noticed the deprecation warning below with cryptography v50.0.0 -> https://cryptography.io/en/latest/changelog/#v50-0-0
[WARNING] py.warnings - /src/.venv/lib/python3.14/site-packages/asyncssh/crypto/dh.py:30: CryptographyDeprecationWarning: Diffie-Hellman over finite fields (FFDH) is deprecated and support will be removed in a future release. Use a more modern key exchange algorithm.
Thanks,
Activity
sarthak-shubham commentedon Sep 27, 2026
Hi, I'd like to work on this. I'll take a look at how the deprecated FFDH call in dh.py is being used and put together a fix , likely either suppressing the warning for this specific legacy path with an explanatory comment or checking if a safer default makes sense. Will open a PR once I have something working , happy to adjust the approach if you have a preference.
ronf commentedon Sep 27, 2026
Sorry - I missed responding to this when the original issue was posted.
I'd like to keep all the old algorithms available here for as long as OpenSSL continues to support them. I did something like this before for older symmetric ciphers -- see the references to cryptography.hazmat.decrepit.ciphers.algorithms in crypto/cipher.py and the later use of _algs and _decrepit_algs, where the code will fall back from _algs to _decrepit_algs when necessary. The code there also catches and hides warnings for anything which has a deprecation but hasn't actually moved to _decrepit yet. I think a similar approach should work for FFDH, as long as the symbols and their APIs remain the same, but just move to a different module.
I wouldn't worry about defaults here. All these older algorithms should either be disabled by default or enabled but very late in the preferential ordering, so more modern algorithms will always be preferred as long as both sides support them.