diff -ru a/cipher.c b/cipher.c
--- a/cipher.c	2014-02-23 20:55:37.000000000 -0800
+++ b/cipher.c	2014-06-09 09:10:13.000000000 -0700
@@ -224,7 +224,8 @@
 	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
 	    (p = strsep(&cp, CIPHER_SEP))) {
 		c = cipher_by_name(p);
-		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
+		if (c == NULL || (c->number != SSH_CIPHER_SSH2 &&
+				  c->number != SSH_CIPHER_NONE)) {
 			debug("bad cipher %s [%s]", p, names);
 			free(cipher_list);
 			return 0;
@@ -479,6 +480,7 @@
 	}
 
 	switch (c->number) {
+	case SSH_CIPHER_NONE:
 	case SSH_CIPHER_SSH2:
 	case SSH_CIPHER_DES:
 	case SSH_CIPHER_BLOWFISH:
@@ -518,6 +520,7 @@
 		return;
 
 	switch (c->number) {
+	case SSH_CIPHER_NONE:
 	case SSH_CIPHER_SSH2:
 	case SSH_CIPHER_DES:
 	case SSH_CIPHER_BLOWFISH:
diff -ru a/kex.c b/kex.c
--- a/kex.c	2014-02-03 16:20:15.000000000 -0800
+++ b/kex.c	2014-06-09 09:12:20.000000000 -0700
@@ -146,7 +146,7 @@
 }
 
 /* put algorithm proposal into buffer */
-static void
+void
 kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
 {
 	u_int i;
@@ -460,6 +460,10 @@
 	int nenc, nmac, ncomp;
 	u_int mode, ctos, need, dh_need, authlen;
 	int first_kex_follows, type;
+	int auth_flag;
+
+	auth_flag = packet_authentication_state();
+	debug ("AUTH STATE IS %d", auth_flag);
 
 	my   = kex_buf2prop(&kex->my, NULL);
 	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
@@ -497,6 +501,11 @@
 		if (authlen == 0)
 			choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
 		choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
+                debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name);
+                if (strcmp(newkeys->enc.name, "none") == 0) {
+                        debug("Requesting NONE. Authflag is %d", auth_flag);
+			fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
+                }
 		debug("kex: %s %s %s %s",
 		    ctos ? "client->server" : "server->client",
 		    newkeys->enc.name,
diff -ru a/kex.h b/kex.h
--- a/kex.h	2014-02-03 16:02:43.000000000 -0800
+++ b/kex.h	2014-06-09 09:10:13.000000000 -0700
@@ -146,6 +146,7 @@
 };
 
 int	 kex_names_valid(const char *);
+void	 kex_prop2buf(Buffer *, char *proposal[PROPOSAL_MAX]);
 char	*kex_alg_list(char);
 
 Kex	*kex_setup(char *[PROPOSAL_MAX]);
diff -ru a/myproposal.h b/myproposal.h
--- a/myproposal.h	2013-12-06 16:24:02.000000000 -0800
+++ b/myproposal.h	2014-06-09 09:10:13.000000000 -0700
@@ -133,6 +133,8 @@
 #define	KEX_DEFAULT_COMP	"none,zlib@openssh.com,zlib"
 #define	KEX_DEFAULT_LANG	""
 
+#define KEX_ENCRYPT_INCLUDE_NONE KEX_DEFAULT_ENCRYPT \
+	",none"
 
 static char *myproposal[PROPOSAL_MAX] = {
 	KEX_DEFAULT_KEX,
diff -ru a/packet.c b/packet.c
--- a/packet.c	2014-02-03 16:20:15.000000000 -0800
+++ b/packet.c	2014-06-09 09:10:13.000000000 -0700
@@ -1938,12 +1938,25 @@
 	}
 }
 
+/* this supports the forced rekeying required for the NONE cipher */
+int rekey_requested = 0;
+void
+packet_request_rekeying(void)
+{
+	rekey_requested = 1;
+}
+
 #define MAX_PACKETS	(1U<<31)
 int
 packet_need_rekeying(void)
 {
 	if (datafellows & SSH_BUG_NOREKEY)
 		return 0;
+        if (rekey_requested == 1)
+	{
+               rekey_requested = 0;
+               return 1;
+        }
 	return
 	    (active_state->p_send.packets > MAX_PACKETS) ||
 	    (active_state->p_read.packets > MAX_PACKETS) ||
@@ -1955,6 +1968,12 @@
 		 active_state->rekey_interval <= monotime());
 }
 
+int
+packet_authentication_state(void)
+{
+	return(active_state->after_authentication);
+}
+
 void
 packet_set_rekey_limits(u_int32_t bytes, time_t seconds)
 {
diff -ru a/packet.h b/packet.h
--- a/packet.h	2013-07-17 23:12:45.000000000 -0700
+++ b/packet.h	2014-06-09 09:10:13.000000000 -0700
@@ -103,6 +103,10 @@
 int	 packet_set_maxsize(u_int);
 u_int	 packet_get_maxsize(void);
 
+/* for forced packet rekeying post auth */
+void	packet_request_rekeying(void);
+int	packet_authentication_state(void);
+
 /* don't allow remaining bytes after the end of the message */
 #define packet_check_eom() \
 do { \
diff -ru a/readconf.c b/readconf.c
--- a/readconf.c	2014-02-23 20:57:56.000000000 -0800
+++ b/readconf.c	2014-06-09 09:10:13.000000000 -0700
@@ -145,6 +145,7 @@
 	oSendEnv, oControlPath, oControlMaster, oControlPersist,
 	oHashKnownHosts,
 	oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
+	oNoneEnabled, oNoneSwitch,
 	oVisualHostKey, oUseRoaming,
 	oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
 	oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
@@ -255,6 +256,8 @@
 	{ "kexalgorithms", oKexAlgorithms },
 	{ "ipqos", oIPQoS },
 	{ "requesttty", oRequestTTY },
+	{ "noneenabled", oNoneEnabled },
+        { "noneswitch", oNoneSwitch },
 	{ "proxyusefdpass", oProxyUseFdpass },
 	{ "canonicaldomains", oCanonicalDomains },
 	{ "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
@@ -853,6 +856,24 @@
 		intptr = &options->check_host_ip;
 		goto parse_flag;
 
+        case oNoneEnabled:
+               	intptr = &options->none_enabled;
+               	goto parse_flag;
+ 
+       	/* we check to see if the command comes from the */
+       	/* command line or not. If it does then enable it */
+       	/* otherwise fail. NONE should never be a default configuration */
+       	case oNoneSwitch:
+               	if(strcmp(filename,"command-line") == 0) {
+                       	intptr = &options->none_switch;
+                       	goto parse_flag;
+               	} else {
+                       	error("NoneSwitch is found in %.200s.\nYou may only use this configuration option from the command line", filename);
+                       	error("Continuing...");
+                       	debug("NoneSwitch directive found in %.200s.", filename);
+                       	return 0;
+               	}
+
 	case oVerifyHostKeyDNS:
 		intptr = &options->verify_host_key_dns;
 		multistate_ptr = multistate_yesnoask;
@@ -1561,6 +1582,8 @@
 	options->ip_qos_interactive = -1;
 	options->ip_qos_bulk = -1;
 	options->request_tty = -1;
+	options->none_switch = -1;
+	options->none_enabled = -1;
 	options->proxy_use_fdpass = -1;
 	options->ignored_unknown = NULL;
 	options->num_canonical_domains = 0;
@@ -1707,6 +1730,10 @@
 		options->server_alive_interval = 0;
 	if (options->server_alive_count_max == -1)
 		options->server_alive_count_max = 3;
+        if (options->none_switch == -1)
+               options->none_switch = 0;
+        if (options->none_enabled == -1)
+               options->none_enabled = 0;
 	if (options->control_master == -1)
 		options->control_master = 0;
 	if (options->control_persist == -1) {
diff -ru a/readconf.h b/readconf.h
--- a/readconf.h	2014-02-23 20:57:56.000000000 -0800
+++ b/readconf.h	2014-06-09 09:10:13.000000000 -0700
@@ -115,7 +115,10 @@
 
 	int	enable_ssh_keysign;
 	int64_t rekey_limit;
+	int     none_switch;    /* Use none cipher */
+       	int     none_enabled;   /* Allow none to be used */
 	int	rekey_interval;
+
 	int	no_host_authentication_for_localhost;
 	int	identities_only;
 	int	server_alive_interval;
diff -ru a/servconf.c b/servconf.c
--- a/servconf.c	2014-02-03 16:12:57.000000000 -0800
+++ b/servconf.c	2014-06-09 09:10:13.000000000 -0700
@@ -150,6 +150,7 @@
 	options->revoked_keys_file = NULL;
 	options->trusted_user_ca_keys = NULL;
 	options->authorized_principals_file = NULL;
+	options->none_enabled = -1;
 	options->ip_qos_interactive = -1;
 	options->ip_qos_bulk = -1;
 	options->version_addendum = NULL;
@@ -294,6 +295,8 @@
 	}
 	if (options->permit_tun == -1)
 		options->permit_tun = SSH_TUNMODE_NO;
+	if (options->none_enabled == -1) 
+		options->none_enabled = 0;
 	if (options->ip_qos_interactive == -1)
 		options->ip_qos_interactive = IPTOS_LOWDELAY;
 	if (options->ip_qos_bulk == -1)
@@ -347,7 +350,7 @@
 	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
 	sKexAlgorithms, sIPQoS, sVersionAddendum,
 	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
-	sAuthenticationMethods, sHostKeyAgent,
+	sAuthenticationMethods, sNoneEnabled, sHostKeyAgent,
 	sDeprecated, sUnsupported
 } ServerOpCodes;
 
@@ -468,6 +471,7 @@
 	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
 	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
+	{ "noneenabled", sNoneEnabled, SSHCFG_ALL },
 	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
 	{ "ipqos", sIPQoS, SSHCFG_ALL },
 	{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
@@ -1046,6 +1050,10 @@
 		intptr = &options->ignore_user_known_hosts;
 		goto parse_flag;
 
+	case sNoneEnabled:
+		intptr = &options->none_enabled;
+		goto parse_flag;
+
 	case sRhostsRSAAuthentication:
 		intptr = &options->rhosts_rsa_authentication;
 		goto parse_flag;
diff -ru a/servconf.h b/servconf.h
--- a/servconf.h	2014-02-03 16:12:57.000000000 -0800
+++ b/servconf.h	2014-06-09 09:10:13.000000000 -0700
@@ -165,6 +165,8 @@
 
 	int	use_pam;		/* Enable auth via PAM */
 
+	int	none_enabled;		/* enable NONE cipher switch */	
+
 	int	permit_tun;
 
 	int	num_permitted_opens;
diff -ru a/sshconnect2.c b/sshconnect2.c
--- a/sshconnect2.c	2014-02-03 16:20:16.000000000 -0800
+++ b/sshconnect2.c	2014-06-09 09:11:30.000000000 -0700
@@ -79,6 +79,12 @@
 extern char *client_version_string;
 extern char *server_version_string;
 extern Options options;
+extern Kex *xxx_kex;
+
+/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
+/* if it is set then prevent the switch to the null cipher */
+
+extern int tty_flag;
 
 /*
  * SSH2 key exchange
@@ -409,6 +415,20 @@
 	pubkey_cleanup(&authctxt);
 	dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
 
+        /* if the user wants to use the none cipher do it */
+        /* post authentication and only if the right conditions are met */
+        /* both of the NONE commands must be true and there must be no */
+        /* tty allocated */
+        if ((options.none_switch == 1) && (options.none_enabled == 1))
+        {
+		debug("Requesting none rekeying...");
+		myproposal[PROPOSAL_ENC_ALGS_STOC] = "none";
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] = "none";
+		kex_prop2buf(&xxx_kex->my,myproposal);
+		packet_request_rekeying();
+		fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
+        }
+
 	debug("Authentication succeeded (%s).", authctxt.method->name);
 }
 
diff -ru a/sshd.c b/sshd.c
--- a/sshd.c	2014-02-26 15:20:08.000000000 -0800
+++ b/sshd.c	2014-06-09 09:10:13.000000000 -0700
@@ -2442,6 +2442,10 @@
 	if (options.ciphers != NULL) {
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
+        } else if (options.none_enabled == 1) {
+                debug ("WARNING: None cipher enabled");
+                myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+                myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_ENCRYPT_INCLUDE_NONE;
 	}
 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
diff -ru a/sshd_config b/sshd_config
--- a/sshd_config	2014-01-12 00:20:47.000000000 -0800
+++ b/sshd_config	2014-06-09 09:10:13.000000000 -0700
@@ -125,6 +125,9 @@
 # override default of no subsystems
 Subsystem	sftp	/usr/libexec/sftp-server
 
+# allow the use of the none cipher
+#NoneEnabled no
+
 # Example of overriding settings on a per-user basis
 #Match User anoncvs
 #	X11Forwarding no
