1

Using ANON ciphers (No certificates required/used) while establishing connection and later using the username/password for authentication considered secure communication?

Are there any flaws in it, like 'Man In The Middle' (MITM) attacks possible?

5
  • How do you perform key exchange between client/server with this protocol? May 16, 2017 at 16:35
  • @user52472 I don't perform any key exchange. May 16, 2017 at 16:40
  • 2
    How do the client/server get the keys to encrypt/decrypt data? May 16, 2017 at 16:44
  • @user52472 Is it mandatory to provide keys while using ANON ciphers? May 16, 2017 at 16:56
  • Ok, nevermind. I misunderstood your original question. I will add my answer below. Why are you considering anonymous ciphers instead of standard SSL? May 16, 2017 at 17:00

1 Answer 1

1

A large portion of the value of SSL/TLS is the validation of the authenticity of the application you are communicating with. Yes, a MITM attack is possible in the scenario you describe. See this other SE answer for more information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .