HomeKit update to 0.12.2 in 0.87 causes UnsupportedAlgorithm error

[alistairg]

Home Assistant release with the issue:
0.87.0

Last working Home Assistant release (if known):
0.86.4

Operating environment (Hass.io/Docker/Windows/etc.):
Hassio installed on Custom Debian (via install scripts). Host OS is fully up-to-date.

Component/platform:
homeassistant
homeassistant_controller

Description of problem:

Platform no longer starts - cryptography in latest 0.12.2 underlying library not supported by host OS.

Problem-relevant configuration.yaml entries and (fill out even if it seems unimportant):

Traceback (if applicable):

Traceback (most recent call last):
  File "/usr/local/lib/python3.6/concurrent/futures/thread.py", line 56, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/homekit_controller/__init__.py", line 362, in discovery_dispatch
    device = HKDevice(hass, host, port, model, hkid, config_num, config)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/homekit_controller/__init__.py", line 98, in __init__
    self.accessory_setup()
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/homekit_controller/__init__.py", line 112, in accessory_setup
    data = self.pairing.list_accessories_and_characteristics()
  File "/config/deps/lib/python3.6/site-packages/homekit/controller.py", line 272, in list_accessories_and_characteristics
    self.session = Session(self.pairing_data)
  File "/config/deps/lib/python3.6/site-packages/homekit/controller.py", line 604, in __init__
    c2a_key, a2c_key = get_session_keys(conn, pairing_data)
  File "/config/deps/lib/python3.6/site-packages/homekit/protocol/__init__.py", line 247, in get_session_keys
    ios_key = x25519.X25519PrivateKey.generate()
  File "/usr/local/lib/python3.6/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 39, in generate
    _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM
cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL.

Additional information:

[awarecan]

Duplicate of #20361

[awarecan]

Also refer home-assistant/supervisor#914

[Jc2k]

This is slightly different to the asuswrt thing which I think has a workaround, more relevent ticket is probably home-assistant/supervisor#903.

Especially these comments:

• Openssl-version dont have X25519 supervisor#903 (comment)
• Openssl-version dont have X25519 supervisor#903 (comment)

[Jc2k]

(The best workaround I have right now is to not use HASS.io and use Docker or venv to install HA).

[Gunth]

I use the docker container (homeassistant/raspberrypi3-homeassistant) but i also have the same issue ..

[Jc2k]

Good news, hopefully this means it is fixed very soon: home-assistant/docker-base#7

[Gunth]

this will be a fix for hassio but the docker container, homeassistant/raspberrypi3-homeassistant, currently on version 3.8.1 will not be updated ?

[Jc2k]

Looking at the hassio-homeassistant repo I think raspberrypi3-homeassistant is the hassio container for pi 3, so it too should get updated.

[Gunth]

version 0.88.0b2 seems to solve the issue for me..

[Jc2k]

That’s good to hear. They have merged Alpine 3.9 changes into the HASS.io containers now, but it wasn’t clear when that would go live. I was avoiding mentioning it but the latest prerelease amd64 HASS.io image seems to not have this issue too, although I only did limited tests.

[pvizeli]

Should be fixed with new base images on alpine 3.9/ssl started with 0.88.0b0