Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is it possible to send messages over TLS with out encryption?
If so which cipher suite is needed for this?

share|improve this question
    
Do you mean cipher suite NONE? –  Uwe Plonus Jul 1 '13 at 10:03
    
Are you wanting authentication but not confidentiality? Or neither? –  mikeazo Jul 1 '13 at 14:05
    
Why do you want to do this? Just to save the CPU time for the encryption? –  Paŭlo Ebermann Jul 1 '13 at 18:35
    
want to check whther that suite is supported by the server or not.. –  Kalai Jul 3 '13 at 7:10
    
@Kalai: If you're looking to test your setup's ssl security, you can use the Qualys SSL Labs test. –  Reid Jul 24 '13 at 17:13
add comment

1 Answer

up vote 3 down vote accepted

Yes, there are a number of TLS cipher suites that don't include any encryption. These cipher suites are not normally used by OpenSSL, but they can be explicitly requested e.g. using the -cipher option to the OpenSSL tools.

Specifically, the suites offering no encryption and/or authetication are found under the NULL and aNULL cipher classes. The openssl ciphers manual page describes them as:

"eNULL, NULL: the "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are disabled unless explicitly included.

aNULL: the cipher suites offering no authentication. This is currently the anonymous DH algorithms. These cipher suites are vulnerable to a "man in the middle" attack and so their use is normally discouraged."

To get a list of the cipher suites included in the NULL class, run openssl ciphers -v NULL. For me, the returned list looks like this:

ECDHE-RSA-NULL-SHA      SSLv3 Kx=ECDH     Au=RSA  Enc=None      Mac=SHA1
ECDHE-ECDSA-NULL-SHA    SSLv3 Kx=ECDH     Au=ECDSA Enc=None      Mac=SHA1
AECDH-NULL-SHA          SSLv3 Kx=ECDH     Au=None Enc=None      Mac=SHA1
ECDH-RSA-NULL-SHA       SSLv3 Kx=ECDH/RSA Au=ECDH Enc=None      Mac=SHA1
ECDH-ECDSA-NULL-SHA     SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=None      Mac=SHA1
NULL-SHA256             TLSv1.2 Kx=RSA      Au=RSA  Enc=None      Mac=SHA256
NULL-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=SHA1
NULL-MD5                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=MD5 

To see if a specific server lets you connect to it using one of these suites, run:

openssl s_client -connect host:port -cipher NULL

Of course, for most services, this should cause the cipher suite negotiation to fail, like this:

$ openssl s_client -connect www.google.com:443 -cipher NULL
CONNECTED(00000003)
3073382600:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert
handshake failure:s23_clnt.c:724:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 139 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.