[EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option

[Yury Mazin]

Viktor,

Thank you.

Yury

________________________________
From: openssl-users <openssl-users-bounces at openssl.org> on behalf of Viktor Dukhovni <openssl-users at dukhovni.org>
Sent: Tuesday, September 8, 2020 10:56 AM
To: openssl-users at openssl.org <openssl-users at openssl.org>
Subject: Re: [EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option

On Tue, Sep 08, 2020 at 05:39:51PM +0000, Yury Mazin via openssl-users wrote:

> I have a question based on the response provided to me:
>
> My question is why following openssl commands (version 1.1.1f)  return
> those TLSv1.3 ciphers as offering no authentication and no encryption?

It does not.  You still have not understood that "-ciphers" constrains
**ONLY** the TLS 1.2 (and earlier) cipher lists.  When you say:

    ciphers ... NULL

you asking for all the ciphers (TLS 1.2 and 1.3) where the TLS 1.2 ciphers
are NULL.  To also constrain the TLS 1.3 ciphers you MUST use the

    -ciphersuites ...

option to list the desired TLS 1.3 ciphersuites, otherwise they remain
unconstrained.

--
    Viktor.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20200908/7679bc54/attachment.html>