How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the messages in Wireshark?
migrated from crypto.stackexchange.com May 9 '13 at 15:08
This question came from our site for software developers, mathematicians and others interested in cryptography.
A key log file created by the NSS library, you can use it for decrypting SSL traffic. Find the (Pre)-Master-Secret log filename option at Edit -> Preferences, Protocols ->
I originally found this trick in this blog entry which described the use of the environment variable
Should you encounter a situation where you still cannot decrypt traffic, check whether:
If you still cannot decrypt all traffic, it is possible that Wireshark contains a bug (in my case it was missing support for Camellia). To start debugging, save your capture and start wireshark with SSL logging enabled:
After the capture has been loaded, you can close the program again. (You do not actually need to save the capture, but it makes it easier to reproduce the issue and avoid further noise in the log dump.) You might see something similar to the line below:
These numbers are a combination of the constants defined in
As you can see, I am missing the
This cipher suite is indeed missing from the
There is pretty scare documentation on this, this should help you to get your cipher faster supported:
While developing, it may be useful to generate some packets. For that purpose, see have a look at the
If you can "expose the premaster secret", though the key exchange uses ephemeral Diffie-Hellman, then you have privileged access to either the client or the server. That's one of the points of DHE: the actual key exchange uses newly generated DH key pairs, which neither client or server stores anywhere except in its own RAM. Having a copy of the permanent server's key would give you nothing, as a passive attacker with Wireshark, since it is used only for signatures. That key could be used to impersonate the server, and thus mount an active Man-in-the-Middle attack.
However you put it, if you have access to the premaster secret, then you should also have direct access to the clear data, without having to resort to crude packet capture; therefore, your question is weird.
Anyway, subsequent data records can be decrypted by following the standard (or one of the previous versions, when applicable), which is an interesting programming exercise. It is possible that ssldump's source code might be reused for that task.