Re: SSL without certificates

From: MS (ms_at_ms.net)
Date: 07/04/03

  • Next message: Chuck: "Freeware Port Monitors" 
    Date: Fri, 04 Jul 2003 12:34:33 -0400

    Splatter wrote:
    > "MS" <ms@ms.net> wrote in message news:3F0428C6.5020609@ms.net...
    >
    >> I want to use SSL for client to server communication. The server is
    >> W2K. I don't care about server authentication, I just want to
    >> encrypt the connection. Do I still have to create and install a
    >> dummy certificate for the server, or is there a way to bypass it?
    >
    >
    > I'm not sure what your specific needs are but I got around this using
    > 2K at home by installing the windows certificate authority, and using
    > it to roll my own CA & website certificate. HTH DP
    >
    >

    In response to my question (the post attached above) I got a lot of
    advice and information from Splatter and others. But I still don't know
    the answer to my original question:

    Does the Microsoft W2K implementation of SSL=TLS allow bypassing the
    handshake step that sends server's certificate to the client? In other
    words, can I set up an SSL-encrypted connections to the W2K server
    without installing a certificate on the server?

    The specification of the TLS standard does allow that: The handshake
    protocol can be set up so that no certificates are used, and the client
    and the server use an "anonymous" key exchange protocol to agree on an
    encryption key. The question is, does Microsoft implementation allow it?
    And if so, how do I configure the server to operate this way?

    As I said in my original post, I want to use SSL to encrypt the
    client-to-server connections. So the advice to use SSH or IPSec doesn't
    help.

    My client is not a browser, so I am not worried about any popup messages
    that specific browsers may display when they cannot authenticate a web
    server.

    mccarthur@btinternet.com wrote that the client needs the server's cert
    because the client uses the public key from the cert to encrypt the data
    sent to the server. That is not correct. The data sent back and forth
    along the SSL connection are encrypted using a symmetric (secret) key,
    not a public key. The secret key is created during the SSL handshake.

    Rainer Gerhards wrote that I can get a free certificate from sources on
    the Internet. That's good information, but I would prefer not to deal
    with the cert at all if I can avoid it.

    ASMdood wrote that encryption without authentication is useless. I
    agree, but in my application this is not an issue.

    As I stated in my original post, I cannot find the answers in Microsoft
    documentation. Anybody out there who is familiar with the Microsoft
    implementation of SSL in W2K and can answer my question?

    MS

  • Next message: Chuck: "Freeware Port Monitors"

    Relevant Pages

    • Re: Antw: Re: LDAP Authentication Problem
      ... TLSv1 und wird auf einen SSL Client Hello Request mit TLSv1 nicht ... antworten anstatt ein SSLv3 Server Hello. ... the LDAP PAM module and the shadow package. ...
      (de.comp.sys.novell)
    • SSL and IPS (was RE: ssh and ids)
      ... How many simultaneous SSL sessions can be tracked?" ... I assume you're talking about a case in which the client constantly ... If you walk the possible session id space and ... The server chooses the session ID, ...
      (Focus-IDS)
    • Re: A cryptography solution for a client/server winforms app
      ... good idea if you want to learn crypto. ... you control both the client and server, you don't even need to use a ... code the client to ignore certificate trust errors. ... encrypt the memory stream. ...
      (microsoft.public.dotnet.security)
    • Re: Using SSL with IIS 5.0 - how does it work.
      ... Description of the Secure Sockets Layer (SSL) Handshake ... username and password when users authenticates to server (e.g. to check ... his/her e-mail) (client sends this data to the server) ... If you want your users to trust your SSL certificate ...
      (microsoft.public.inetserver.iis.security)
    • Re: File ENcryption Problem Detail
      ... > In addition, when u encrypt remotely (client to server), which users ... We can encrypt remotely (client to server, ... >>> it is able to encrypt file locally on the DC, ...
      (microsoft.public.win2000.security)