<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Viktor,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Yury<br>
</div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>Sent:</b> Tuesday, September 8, 2020 10:56 AM<br>
<b>To:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: [EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On Tue, Sep 08, 2020 at 05:39:51PM +0000, Yury Mazin via openssl-users wrote:<br>
<br>
> I have a question based on the response provided to me:<br>
> <br>
> My question is why following openssl commands (version 1.1.1f) return<br>
> those TLSv1.3 ciphers as offering no authentication and no encryption?<br>
<br>
It does not. You still have not understood that "-ciphers" constrains<br>
**ONLY** the TLS 1.2 (and earlier) cipher lists. When you say:<br>
<br>
ciphers ... NULL<br>
<br>
you asking for all the ciphers (TLS 1.2 and 1.3) where the TLS 1.2 ciphers<br>
are NULL. To also constrain the TLS 1.3 ciphers you MUST use the<br>
<br>
-ciphersuites ...<br>
<br>
option to list the desired TLS 1.3 ciphersuites, otherwise they remain<br>
unconstrained.<br>
<br>
-- <br>
Viktor.<br>
</div>
</span></font></div>
</body>
</html>