<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have a question based on the response provided to me:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My question is why following openssl commands (version 1.1.1f) return those TLSv1.3 ciphers as offering no authentication and no encryption?
<div><br>
</div>
<div> </div>
<div><br>
</div>
<div>C:\OpenText\iHub20.4-29324643-250C200831\ihub\modules\BIRTiHub\iHub\bin>openssl ciphers -v -s NULL</div>
<div><br>
</div>
<div>TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD</div>
<div><br>
</div>
<div>TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD</div>
<div><br>
</div>
<div>TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD</div>
<div><br>
</div>
<div> </div>
<div><br>
</div>
<div>C:\OpenText\iHub20.4-29324643-250C200831\ihub\modules\BIRTiHub\iHub\bin>openssl ciphers -v -s eNULL</div>
<div><br>
</div>
<div>TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD</div>
<div><br>
</div>
<div>TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD</div>
<div><br>
</div>
<div>TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD</div>
<div><br>
</div>
<div> </div>
<div><br>
</div>
<div>C:\OpenText\iHub20.4-29324643-250C200831\ihub\modules\BIRTiHub\iHub\bin>openssl ciphers -v -s aNULL</div>
<div><br>
</div>
<div>TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD</div>
<div><br>
</div>
<div>TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD</div>
<div><br>
</div>
TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Yury Mazin <ymazin@opentext.com><br>
<b>Sent:</b> Friday, September 4, 2020 12:43 PM<br>
<b>To:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: [EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Viktor,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thank you for clarifying it.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Yury<br>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>Sent:</b> Friday, September 4, 2020 12:10 PM<br>
<b>To:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: [EXTERNAL] - Re: Question about TLS 1.3 and openssl -cipher aNULL option</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">On Fri, Sep 04, 2020 at 07:00:01PM +0000, Yury Mazin via openssl-users wrote:<br>
<br>
> Thank you Benjamin,<br>
> <br>
> According to OpenSSL , aNULL stands for no-authentication.<br>
<br>
Specifically, SSL 3.0 through TLS 1.2 ciphers in which the server and<br>
client exchange no certificates, and the TLS handshake consists largely<br>
of an unsigned anonymous ephemeral DH or ECDH key exchang.<br>
<br>
TLS 1.3 dropped support for anonymous DH and ECDH. Server certificates<br>
are *required. And the all-in-one ciphersuites of TLS <= 1.2, are<br>
replaced with separately negotiated components. As a result of which,<br>
in OpenSSL 1.1.1 and later, they are controlled via a different set of<br>
APIs and command-line options.<br>
<br>
Specifically, in your case, the "-ciphers aNULL" option only applies<br>
to TLS <= 1.2<br>
<br>
> Does it mean that all 3 default protocols of TLS 1.3 offer no<br>
> authentication<br>
<br>
No. None of them "support no authentication" (which is not even strictly<br>
true, it is the protocol that does not support "no authentication",<br>
the TLS 1.3 ciphers are simply silent re certificate algorithm selection),<br>
but the "-cipher aNULL" is simply not used when TLS 1.3 is negotiated,<br>
so your question is makes incorrect assumptions to reach its tentative<br>
conclusions.<br>
<br>
-- <br>
Viktor.<br>
</div>
</span></font></div>
</div>
</body>
</html>