Sending TLS messages with out encryption using openssl code

Question

Is it possible to send messages over TLS with out encryption?
If so which cipher suite is needed for this?

Answer 1

Yes, there are a number of TLS cipher suites that don't include any encryption. These cipher suites are not normally used by OpenSSL, but they can be explicitly requested e.g. using the -cipher option to the OpenSSL tools.

Specifically, the suites offering no encryption and/or authetication are found under the NULL and aNULL cipher classes. The openssl ciphers manual page describes them as:

"eNULL, NULL: the "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are disabled unless explicitly included.

aNULL: the cipher suites offering no authentication. This is currently the anonymous DH algorithms. These cipher suites are vulnerable to a "man in the middle" attack and so their use is normally discouraged."

To get a list of the cipher suites included in the NULL class, run openssl ciphers -v NULL. For me, the returned list looks like this:

ECDHE-RSA-NULL-SHA      SSLv3 Kx=ECDH     Au=RSA  Enc=None      Mac=SHA1
ECDHE-ECDSA-NULL-SHA    SSLv3 Kx=ECDH     Au=ECDSA Enc=None      Mac=SHA1
AECDH-NULL-SHA          SSLv3 Kx=ECDH     Au=None Enc=None      Mac=SHA1
ECDH-RSA-NULL-SHA       SSLv3 Kx=ECDH/RSA Au=ECDH Enc=None      Mac=SHA1
ECDH-ECDSA-NULL-SHA     SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=None      Mac=SHA1
NULL-SHA256             TLSv1.2 Kx=RSA      Au=RSA  Enc=None      Mac=SHA256
NULL-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=SHA1
NULL-MD5                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=MD5 

To see if a specific server lets you connect to it using one of these suites, run:

openssl s_client -connect host:port -cipher NULL

Of course, for most services, this should cause the cipher suite negotiation to fail, like this:

$ openssl s_client -connect www.google.com:443 -cipher NULL
CONNECTED(00000003)
3073382600:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert
handshake failure:s23_clnt.c:724:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 139 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---