I'm working on a project that uses OAuth. In the OAuth RFC it says many times that communication between the authentication server and the client should be with the use of TLS. However, in the project I'm looking at that uses OAuth, they say that the channels they use are only authenticated, not confidential. When looking at the TLS tag here, it says that TLS is both confidential and authenticated. But when looking at wiki, it looks like it can be either or? Can someone maybe clear up whether TLS can provide authenticity without providing confidentiality?
TLS can provide only authenticity without confidentiality.
To do this you need to use the
*_WITH_NULL_* cipher suites. They're disabled by default in most libraries.
However, I strongly recommend against using them.
You've really nothing to lose when using encryption and if you don't there may be privacy concerns.