[EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option

[Viktor Dukhovni]

On Tue, Sep 08, 2020 at 05:39:51PM +0000, Yury Mazin via openssl-users wrote:

> I have a question based on the response provided to me:
> 
> My question is why following openssl commands (version 1.1.1f)  return
> those TLSv1.3 ciphers as offering no authentication and no encryption?

It does not.  You still have not understood that "-ciphers" constrains
**ONLY** the TLS 1.2 (and earlier) cipher lists.  When you say:

    ciphers ... NULL

you asking for all the ciphers (TLS 1.2 and 1.3) where the TLS 1.2 ciphers
are NULL.  To also constrain the TLS 1.3 ciphers you MUST use the

    -ciphersuites ...

option to list the desired TLS 1.3 ciphersuites, otherwise they remain
unconstrained.

-- 
    Viktor.