[EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option

Yury Mazin ymazin at opentext.com
Tue Sep 8 18:17:33 UTC 2020


Thank you.


From: openssl-users <openssl-users-bounces at openssl.org> on behalf of Viktor Dukhovni <openssl-users at dukhovni.org>
Sent: Tuesday, September 8, 2020 10:56 AM
To: openssl-users at openssl.org <openssl-users at openssl.org>
Subject: Re: [EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option

On Tue, Sep 08, 2020 at 05:39:51PM +0000, Yury Mazin via openssl-users wrote:

> I have a question based on the response provided to me:
> My question is why following openssl commands (version 1.1.1f)  return
> those TLSv1.3 ciphers as offering no authentication and no encryption?

It does not.  You still have not understood that "-ciphers" constrains
**ONLY** the TLS 1.2 (and earlier) cipher lists.  When you say:

    ciphers ... NULL

you asking for all the ciphers (TLS 1.2 and 1.3) where the TLS 1.2 ciphers
are NULL.  To also constrain the TLS 1.3 ciphers you MUST use the

    -ciphersuites ...

option to list the desired TLS 1.3 ciphersuites, otherwise they remain

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20200908/7679bc54/attachment.html>

More information about the openssl-users mailing list