1
$\begingroup$

I'm working on a project that uses OAuth. In the OAuth RFC it says many times that communication between the authentication server and the client should be with the use of TLS. However, in the project I'm looking at that uses OAuth, they say that the channels they use are only authenticated, not confidential. When looking at the TLS tag here, it says that TLS is both confidential and authenticated. But when looking at wiki, it looks like it can be either or? Can someone maybe clear up whether TLS can provide authenticity without providing confidentiality?

$\endgroup$
1
$\begingroup$

TLS can provide only authenticity without confidentiality.
To do this you need to use the *_WITH_NULL_* cipher suites. They're disabled by default in most libraries.

However, I strongly recommend against using them.
You've really nothing to lose when using encryption and if you don't there may be privacy concerns.

$\endgroup$
  • 1
    $\begingroup$ “You've really nothing to lose when using encryption” That's not true: you lose caching (except at the endpoints). Caching is only useful for large volumes of data though, not for authentication protocols. $\endgroup$ – Gilles 'SO- stop being evil' Feb 28 '16 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.