Is it possible to send messages over TLS with out encryption?
If so which cipher suite is needed for this?

  • $\begingroup$ Do you mean cipher suite NONE? $\endgroup$
    – Uwe Plonus
    Jul 1 '13 at 10:03
  • $\begingroup$ Are you wanting authentication but not confidentiality? Or neither? $\endgroup$
    – mikeazo
    Jul 1 '13 at 14:05
  • $\begingroup$ Why do you want to do this? Just to save the CPU time for the encryption? $\endgroup$ Jul 1 '13 at 18:35
  • $\begingroup$ want to check whther that suite is supported by the server or not.. $\endgroup$
    – Kalai
    Jul 3 '13 at 7:10
  • $\begingroup$ @Kalai: If you're looking to test your setup's ssl security, you can use the Qualys SSL Labs test. $\endgroup$
    – Reid
    Jul 24 '13 at 17:13

Yes, there are a number of TLS cipher suites that don't include any encryption. These cipher suites are not normally used by OpenSSL, but they can be explicitly requested e.g. using the -cipher option to the OpenSSL tools.

Specifically, the suites offering no encryption and/or authetication are found under the NULL and aNULL cipher classes. The openssl ciphers manual page describes them as:

"eNULL, NULL: the "NULL" ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are disabled unless explicitly included.

aNULL: the cipher suites offering no authentication. This is currently the anonymous DH algorithms. These cipher suites are vulnerable to a "man in the middle" attack and so their use is normally discouraged."

To get a list of the cipher suites included in the NULL class, run openssl ciphers -v NULL. For me, the returned list looks like this:

ECDHE-RSA-NULL-SHA      SSLv3 Kx=ECDH     Au=RSA  Enc=None      Mac=SHA1
AECDH-NULL-SHA          SSLv3 Kx=ECDH     Au=None Enc=None      Mac=SHA1
ECDH-RSA-NULL-SHA       SSLv3 Kx=ECDH/RSA Au=ECDH Enc=None      Mac=SHA1
NULL-SHA256             TLSv1.2 Kx=RSA      Au=RSA  Enc=None      Mac=SHA256
NULL-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=SHA1
NULL-MD5                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=MD5 

To see if a specific server lets you connect to it using one of these suites, run:

openssl s_client -connect host:port -cipher NULL

Of course, for most services, this should cause the cipher suite negotiation to fail, like this:

$ openssl s_client -connect www.google.com:443 -cipher NULL
3073382600:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert
handshake failure:s23_clnt.c:724:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 7 bytes and written 139 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.