Scenarion for ENCRYPT_NOT_SUP

Question

According to https://learn.microsoft.com/en-us/openspecs/sql_server_protocols/ms-sstds/75e62f67-f057-4d46-82b3-6920fe0ebada ,
there are 4 options for ENCRYPTION filed. I want to know In what scenario, the ENCRYPTION field for client or server is ENCRYPT_NOT_SUP?

I like to create an environment that both server and client are on ENCRYPT_NOT_SUP, so I can capture the clear-text credential by using Wireshark.

Thanks!

Answer 1

for ssl, there is tsl 1.0, 1.1, 1.2 and 1.3 the handshake decides on the highest version supported by both sides. the client tries for 1.3, but get back no support, then it tries 1.2, to min supported by the client. if no match, the handshake fails. there is no ssl unencrypted support.

if you want unencrypted use http or a ssl proxy which Wireshark supports.

Answer 2

Thanks Bruce for your response.

I am not sure if I understand your answer. ENCRYPT_NOT_SUP is part of TDS protocol, used by all version of TLS, 1.0/1.1/1.2/1.3.

I am not worries the handshake process about how the TLS fail back from 1.3 to 1.0.

My goal is to setup an environment that both Server and Client are communicate on ENCRYPT_NOT_SUP. According to the link i provided in my post, if I can create this environment, I should be able to capture the credential in clear-text.

I want to limit the test environment to using TDS protocol for client to connect to SQL server, I don't want to use HTTP or any proxy for man-in-the-middle.