Is it possible to send a message over https that isn’t encrypted? For example, require that certificate validation and authorization occur, but not encrypt the actual data being sent over the socket?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Is it possible to send a message over https that isn’t encrypted? For example, require that certificate validation and authorization occur, but not encrypt the actual data being sent over the socket?
Yes, TLS and SSL support “no-encryption” modes. Whether the particular client and server in question are configured to enable is a separate issue.
It’s possible, though unlikely, that a server could enable one of these cipher suites by default. What is more likely is that a server would enable weak cipher suites (like the “export”-grade DES-based suites) by default. That’s why you should carefully review the server’s whitelist of cipher suites, and leave only a few trusted, widely-supported algorithms.
You can use the TLS_RSA_WITH_NULL_SHA cipher suite, among others, to protect the authenticity and integrity of traffic, without encryption.
The “RSA” in this case refers to the key exchange algorithm, while “SHA” refers to the message authentication algorithm used to protect the traffic from being altered. “NULL” is the encryption algorithm, or, in this case, the lack of encryption.
It’s important to realize that the traffic, though it’s not encrypted, is bundled up in SSL records. The client and server must be SSL-enabled.
If you are looking for a step-down solution where some data is exchanged over SSL, then SSL is turned off but the application traffic continues, that’s possible too, but keep in mind that it offers absolutely no security for the cleartext traffic; it can be tampered with by an attacker. So, for example, authenticating with SSL, then stepping down to an “in-the-clear” protocol to receive commands that use the authentication negotiated via SSL would unsafe.