Hi,

No, unless you change the user-mode to be Anonymous (is this an option for you?). Basically there is almost no point in other modes without sending a proper Nonce.

Note that there are multiple different Nonces involved. This one comes from the CreateSession, which has different rules than OpenSecureChannel (for that null/0-length is expected for NONE, we have seen this mistake in the past). Thus, the server should be fixed (or check if there are updates for it). For the CreateSession https://reference.opcfoundation.org/Core/Part4/v104/docs/5.6.2, in the Response parameters: “
serverNonce
ByteString
A random number that should never be used in any other request.
This number shall have a minimum length of 32 bytes.
The Client shall use this value to prove possession of its Application Instance Certificate in the ActivateSession request.
This value may also be used to prove possession of the userIdentityToken it specified in the ActivateSession request.”

SDK will skip (automatically) the security-check if the combination is exactly NONE+Anonymous, but it cannot be skipped for anything else. This is our SDK-specific relaxation of the general rules, which can be done here since the Nonce is not used for anything (basically the point of this is to allow connecting to “tiny” servers that cannot do crypto at all). For any other combination it validates that the Nonce length is at least 32 bytes.

If a server supports anything but the Anonymous user authentication (e.g. it supports username/password), it must always send a certificate/public-key. The client encrypts e.g. the user password using the public key the server gives, then the server can decrypt it (using the private key). Thus the password is still encrypted even though the other communication is not. However, without a Nonce used as additional data for the encrypting operations, the encrypted binary blob would end up being the same each time. Thus, if anyone is able to monitor the network traffic they would get an effective password to the user. It is not the cleartext, but since the blob would be the same each time without the nonce, an attacker could just send that to get in.