On Wed, Jul 27, 2011 at 02:53:09AM -0700, navin gopalakrishnan wrote:
> a) testing NULL Encryption:
>
> While building openssl i modified the macro SSL_DEFAULT_CIPHER_LIST to
> #define SSL_DEFAULT_CIPHER_LIST "eNULL"
That was unwise, don't do that.
> My understanding is the above modification? would provide only data
> authentication with NO encryption.
Or possibly neither:
$ openssl ciphers -v eNULL
ECDHE-RSA-NULL-SHA SSLv3 Kx=ECDH Au=RSA Enc=None Mac=SHA1
ECDHE-ECDSA-NULL-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=None Mac=SHA1
AECDH-NULL-SHA SSLv3 Kx=ECDH Au=None Enc=None Mac=SHA1
ECDH-RSA-NULL-SHA SSLv3 Kx=ECDH/RSA Au=ECDH Enc=None Mac=SHA1
ECDH-ECDSA-NULL-SHA SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=None Mac=SHA1
NULL-SHA SSLv3 Kx=RSA Au=RSA Enc=None Mac=SHA1
NULL-MD5 SSLv3 Kx=RSA Au=RSA Enc=None Mac=MD5
as you can see above, the AECDH-NULL-SHA cipher provides neither
authentication nor encryption, just message integrity over an anonymous
channel.
> Is there a way to check this by running any test programs.
You should not change the DEFAULT cipher list. Rather, applications can
be configured with appropriate ciphers at run-time. The ciphers(1)
utility, by default lists the DEFAULT ciphers.
$ openssl ciphers
$ openssl ciphers -v
> b) build openssl with no compression/decompression support in openssl.?
You could read the "INSTALL" document that is included with the source
code.
> While building openssl passed "no-zlib" option in the configure script and
> build went fine.
This is documented to do what you requested.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
