1

I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3.

In section 4.2.3 (Signature Algorithms) it says

Clients which desire the server to authenticate itself via a certificate MUST send "signature_algorithms".

Is it possible to establish a TLS1.3-session without any certificates/authentication? If yes, how can I instruct an openssl client (via commandline) to do so?

3

Is it possible to establish a TLS1.3-session without any certificates/authentication?

It is possible to do the authentication without certificates but it is not possible to do no authentication at all. By using PSK the server authentication is not done with a certificate but with a pre-shared key, i.e. a common secret known between client and server.

If yes, how can I instruct an openssl client (via commandline) to do so?

With openssl1.1.1 you can start a server the following way:

# use a 48 byte PSK
$ PSK=63ef2024b1de6417f856fab7005d38f6df70b6c5e97c220060e2ea122c4fdd054555827ab229457c366b2dd4817ff38b 
$ openssl s_server -psk $PSK -cipher TLS13-AES-256-GCM-SHA384 -nocert -accept 2020

If you then start the client with the same PSK you get a successful TLS 1.3 handshake with no certificates involved:

$ openssl s_client -psk $PSK -connect localhost:2020 
CONNECTED(00000003)
---
no peer certificate available
---
No client certificate CA names sent
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 195 bytes and written 475 bytes
Verification: OK
---
Reused, TLSv1.3, Cipher is TLS13-AES-256-GCM-SHA384
...
0

This requirement says that the client must specify which signature algorithms it supports, so that the server can perform the handshake properly. It does not require the client to send a client certificate - this is a different part of the protocol.

A server certificate is absolutely required as part of the TLS protocol, at least for TLS 1.3. Older protocols had anonymous cipher suites which did not use a long-term key (i.e. the key in the certificate) for authenticity, which resulted in those suites having no resistance to man-in-the-middle attacks. Those old suites are no longer available due to their insecurity.

  • 1
    "A server certificate is absolutely required as part of the TLS protocol, at least for TLS 1.3" - I don't think this is true. TLS 1.3 can still use PSK authentication which does not require any certificate. And similar older TLS version could use PSK authentication and PSK is also resistent against MITM. What is no longer available in TLS 1.3 is anonymous authentication which is probably the one you've meant when talking about no resistance against MITM. – Steffen Ullrich Jun 8 '18 at 13:01
  • @SteffenUllrich Ah yes, you are correct. I had forgotten about PSK auth in TLS. Yes, I was talking about anonymous suites (I mentioned it in the answer). My main point here was that I think OP was misunderstanding the statement as "clients must perform client authentication" rather than "clients must tell the server what types of signature algorithms it supports". – Polynomial Jun 8 '18 at 17:16
  • So you cannot capture (e.g. with wireshark) the server cert in TLS1.3 anymore? With 1.1 and 1.2, I remember we can see the server cert in the pcap. – 匿名柴棍 Jan 17 at 21:51
  • @匿名柴棍 You are correct. The server certificate is encrypted to prevent surveillance of the hostname. You can still sniff the Server Name Indication (SNI) record to get the hostname, unless the client and server support the new ESNI feature, which encrypts that record too. – Polynomial Jan 19 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.