Java ssl encryption without CA authentication

Question

I have written android client using apache Mina. Now I am trying to add TLS support to this client. But at client side I don't want to do server authentication. I am using it only for purpose of encryption. How should I achieve this?

I have tried like this.

SSLContext sc = null;
SslFilter sslFilter;
private void startTLS() {
    try {
        sc = SSLContext.getInstance("TLSv1");
        sc.init(null, null, null);
        sslFilter = new SslFilter(sc);
        sslFilter.setUseClientMode(true);
        session.getFilterChain().addFirst("mySSL", sslFilter);
    } catch(Exception e) {
        e.printStackTrace();
    }    
}

But when I hit this method connection is getting closed. Can anybody has idea about this?

Also sslFilter.getEnabledProtocols() & sslFilter.getEnabledCipherSuites() giving null value.

Server is in twisted. For more clarity you can take a look at following link where server mechanism is mentioned. https://twistedmatrix.com/documents/13.1.0/core/howto/ssl.html

Also in Mina API, there is one method sslFilter.setNeedClientAuth(boolean) but I am not sure about its application.(I think it is useful at server side).

New code :

@Override
public void messageReceived(IoSession session, Object msg) {

    jsonParser(msg) //communication is in json
    if (condition) {
        startTLS();
    }

}


SslFilter sslFilter;
public void startTLS(JSONObject msg) throws GeneralSecurityException{

    TrustManager[] trustAllCerts = new TrustManager[] { 
          new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return null;
                    }

                public void checkClientTrusted(X509Certificate[] certs, String authType) {  }

                public void checkServerTrusted(X509Certificate[] certs, String authType) {  }

        }};     

    try {               

        SSLContext sslContext = SSLContext.getInstance("TLSv1");
        sslContext.init(null, trustAllCerts, null);

        IoFilterChain chain = session.getFilterChain();
        sslFilter = new SslFilter(sslContext);
        sslFilter.setUseClientMode(true);               
        chain.addFirst("sslFilter", sslFilter);

    } catch(Exception e){
        e.printStackTrace();
    }
}

Trace back: Negotiation message is : SESSION_UNSECURED Track trace is as follows:

02-05 12:50:20.365: W/System.err(994): Unexpected character (S) at position 0.
02-05 12:50:20.374: W/System.err(994):     at org.json.simple.parser.Yylex.yylex(Yylex.java:610)
02-05 12:50:20.394: W/System.err(994):     at org.json.simple.parser.JSONParser.nextToken(JSONParser.java:269)
02-05 12:50:20.394: W/System.err(994):     at org.json.simple.parser.JSONParser.parse(JSONParser.java:118)
02-05 12:50:20.404: W/System.err(994):     at org.json.simple.parser.JSONParser.parse(JSONParser.java:81)
02-05 12:50:20.444: W/System.err(994):     at org.json.simple.parser.JSONParser.parse(JSONParser.java:75)
02-05 12:50:20.444: W/System.err(994):     at network.com.parse(com.java:146)
02-05 12:50:20.444: W/System.err(994):     at network.com.messageReceived(com.java:106)
02-05 12:50:20.474: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:690)
02-05 12:50:20.474: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:417)
02-05 12:50:20.474: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:47)
02-05 12:50:20.474: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:765)
02-05 12:50:20.487: W/System.err(994):     at org.apache.mina.filter.codec.ProtocolCodecFilter.messageReceived(ProtocolCodecFilter.java:214)
02-05 12:50:20.494: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:417)
02-05 12:50:20.494: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:47)
02-05 12:50:20.514: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:765)
02-05 12:50:20.514: W/System.err(994):     at org.apache.mina.filter.ssl.SslHandler.flushScheduledEvents(SslHandler.java:322)
02-05 12:50:20.524: W/System.err(994):     at org.apache.mina.filter.ssl.SslFilter.messageReceived(SslFilter.java:497)
02-05 12:50:20.524: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:417)
02-05 12:50:20.524: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1200(DefaultIoFilterChain.java:47)
02-05 12:50:20.524: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:765)
02-05 12:50:20.556: W/System.err(994):     at org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:109)
02-05 12:50:20.564: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:417)
02-05 12:50:20.564: W/System.err(994):     at org.apache.mina.core.filterchain.DefaultIoFilterChain.fireMessageReceived(DefaultIoFilterChain.java:410)
02-05 12:50:20.574: W/System.err(994):     at org.apache.mina.core.polling.AbstractPollingIoProcessor.read(AbstractPollingIoProcessor.java:710)
02-05 12:50:20.574: W/System.err(994):     at org.apache.mina.core.polling.AbstractPollingIoProcessor.process(AbstractPollingIoProcessor.java:664)
02-05 12:50:20.604: W/System.err(994):     at org.apache.mina.core.polling.AbstractPollingIoProcessor.process(AbstractPollingIoProcessor.java:653)
02-05 12:50:20.604: W/System.err(994):     at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$600(AbstractPollingIoProcessor.java:67)
02-05 12:50:20.604: W/System.err(994):     at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:1124)
02-05 12:50:20.614: W/System.err(994):     at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
02-05 12:50:20.614: W/System.err(994):     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1080)
02-05 12:50:20.614: W/System.err(994):     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:573)
02-05 12:50:20.625: W/System.err(994):     at java.lang.Thread.run(Thread.java:841)

'Not working' isn't an acceptable problem description. However SSL isn't secure without authentication of at least one of the peers. See RFC 2246. There's not much point in encryption if you don't know who you're talking to, in a secure way. — user207421, Feb 05 '14 at 22:25
When I see a question saying "it's not working" without explaining *in which way* it doesn't work, I'll vote to close as "lacks sufficient information to diagnose the problem" 9 times out of 9. "It's not working" doesn't give anyone a starting point for examining the problem. Explain what results you're getting and how they differ from the intended results, and include any error messages you received. (It's *sooooo* tempting to post as an answer, "Tell it to go check out job ads at dice.com".) — Adi Inbar, Feb 06 '14 at 05:40
The fellow is asking for either: (1) no server authentication (i.e., a custom `X509TrustManager`), or (2) how to use `aNULL` in the cipher suites. Someone could have asked the question rather than downvoting him and closing the question. (And if you don't know what I'm talking about, then you probably should not have gotten involved in the first place). [Could we please be a bit nicer to new users?](http://meta.stackexchange.com/questions/9953/could-we-please-be-a-bit-nicer-to-new-users). — jww, Feb 06 '14 at 07:11
@EJP,Adi 'not working' in the sense, connection is getting closed. — userx, Feb 06 '14 at 07:22
If you want to add an `aNULL` cipher suite, see [How to override the cipherlist sent to the server by Android when using HttpsURLConnection?](http://stackoverflow.com/questions/16299531/how-to-override-the-cipherlist-sent-to-the-server-by-android-when-using-httpsurl). You'll have to pick your cipher suites in advance, and ensure they include the `aNULL`'s. — jww, Feb 06 '14 at 07:25
If you want to forgoe server authentication (i.e., the customary X509 checks), then add a custom `X509TrustManager`, override `checkServerTrusted`, and always accept what you get during an invocation. See the Android example at OWASP's [Certificate and Public Key Pinning](https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#Android), and **don't** do the stuff shown in `checkServerTrusted`. — jww, Feb 06 '14 at 07:27
'In the sense that the connection is getting closed' in conjunction with what exceptions? Stack traces? Error messages? Surely it is obvious to you that you're still not provide any useful information here? — user207421, Feb 06 '14 at 07:55
@EJP connection is getting closed by server. I have not getting any logs at client side (as there is not any exception at client, though not sure @ this). Also I am new to Mina. If you have any idea how to get detailed logs about handshaking, pls let me know. I have tried to give some things which I know in re-edited question. — userx, Feb 06 '14 at 08:06
@noloader idea is that any client can connect server. Then at time of handshaking they will decide cypher for encryption & further communication will be encrypted. Though in first comment of EJP, he mentioned that it will not be secured. Its true. But you can look it as requirement. — userx, Feb 06 '14 at 08:09
@user2732017 - use the custom `X509TrustManager`. While EJP is correct, not performing the customary X509 checks is equivalent to opportunistic encryption and self-signed certificates. Opportunistic encryption stops all passive attackers, so there is a benefit to it if that's what the requirements dictate. And CAs don't warrant what users expect with respect to identity and authentication, so its only a marginal benefit to use a CA (there's other, more powerful strategies available). — jww, Feb 06 '14 at 08:18
@noloader please refere re-edited post. Though it is not working, ur awesome man, in less time you has given tons of information. — userx, Feb 06 '14 at 08:51
*How do you know* the connection is getting closed by the server? What's your evidence? — user207421, Feb 06 '14 at 08:52
@EJP it was happening with previous code.(api method sessionClosed() is there.) Actually with new code, I am able to connect using plain java. But shit is, now trying luck with android. Here getting parsing error at client side. — userx, Feb 06 '14 at 09:33
Session closure isn't the same thing as connection. Your question and your responses to comments don't make any sense. — user207421, Feb 06 '14 at 22:44

Java ssl encryption without CA authentication

0 Answers0