Subject: Re: [TLS] Registering SHA256 null encryption ciphersuites

From: "Lewis, Nick" <[email-masked]>
Date: Thu, 7 Jun 2012 09:08:19 +0100

>I could easily be missing something, but what would the intended use of this ciphersuite (or

>any "*_anon_WITH_NULL_*" ciphersuite) be?  Since it has no encryption, it doesn't offer any

>protection against passive eavesdroppers.  But since it has no authentication, it doesn't offer

>any protection against active attackers.  What sort of attack is it meant to protect against?

>(There is currently one "*_anon_WITH_NULL_*" ciphersuite registered with IANA,

>TLS_ECDH_anon_WITH_NULL_SHA, and my puzzlement extends to that ciphersuite, as well.)

>--Patrick

I guess anon_with_null could be used when only data integrity is required or for long lived sessions in which the environment is known to be free from middlemen or impersonators at the time of the diffie-hellman exchange but tampering could occur thereafter. Would you suggest that TLS_ECDH_anon_WITH_NULL_SHA256 be omitted? What about SHA384 variants? In practice our requirements are limited to the authenticated SHA256 variants. Is it best to proceed exclusively with these?

--Nick

Nick Lewis
[email-masked]<mailto:[email-masked]>
+44 1684 277137<tel:+441684277137>
www.g4stechnology.com<http://www.g4stechnology.com/>
New Challenge House, International Drive, Tewkesbury, Gloucestershire, GL20 8UQ, UK

P Please consider the environment before printing this email

________________________________
The details of this company are as follows:
G4S Technology Limited, Registered Office: Challenge House, International Drive, Tewkesbury, Gloucestershire GL20 8UQ, Registered in England No. 2382338.

This communication may contain information which is confidential, personal and/or privileged.

It is for the exclusive use of the intended recipient(s).
If you are not the intended recipient(s), please note that any distribution, forwarding, copying or use of this communication or the information in it is strictly prohibited.

Any personal views expressed in this e-mail are those of the individual sender and the company does not endorse or accept responsibility for them.

Prior to taking any action based upon this e-mail message, you should seek appropriate confirmation of its authenticity.

This e-mail has been scanned for all viruses by MessageLabs.