How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the messages in Wireshark?
migrated from crypto.stackexchange.com May 9 '13 at 15:08
This question came from our site for software developers, mathematicians and others interested in cryptography.
Some background: Wireshark supports decryption of SSL sessions when you provide the private RSA key of the server. This works for cipher suites using a RSA key exchange where the pre-master secret is encrypted using the RSA public key of the server. For ephemeral Diffie-Hellman (DHE) cipher suites, the RSA public key is only used for signing the DH parameters which are generated during the handshake. As the private DH key is not transmitted on the wire nor written to disk and the public RSA key is only used for signing, you cannot decrypt traffic by just having the private RSA key.
Wireshark supports various methods to decrypt SSL:
To generate such a SSL key log file for a session, set the
On Windows you need to set a global environment variable, either via
The SSL key log file can be configured for Wireshark at Edit -> Preferences, Protocols -> SSL, field (Pre)-Master-Secret log filename (or pass the
After doing this, you can decrypt SSL sessions for previous and live captures. Should you encounter a situation where you still cannot decrypt traffic, check:
If you still cannot decrypt all traffic, it is possible that Wireshark contains a bug (in my case it was missing support for Camellia). To start debugging, save your capture and start wireshark with SSL logging enabled:
After the capture has been loaded, you can close the program again. (You do not actually need to save the capture, but it makes it easier to reproduce the issue and avoid further noise in the log dump.) You might see something similar to the line below:
These numbers are a combination of the constants defined in
As you can see, I am missing the
This cipher suite is indeed missing from the
There is pretty scare documentation on this, this should help you to get your cipher faster supported:
While developing, it may be useful to generate some packets. For that purpose, see have a look at the
If you can "expose the premaster secret", though the key exchange uses ephemeral Diffie-Hellman, then you have privileged access to either the client or the server. That's one of the points of DHE: the actual key exchange uses newly generated DH key pairs, which neither client or server stores anywhere except in its own RAM. Having a copy of the permanent server's key would give you nothing, as a passive attacker with Wireshark, since it is used only for signatures. That key could be used to impersonate the server, and thus mount an active Man-in-the-Middle attack.
However you put it, if you have access to the premaster secret, then you should also have direct access to the clear data, without having to resort to crude packet capture; therefore, your question is weird.
Anyway, subsequent data records can be decrypted by following the standard (or one of the previous versions, when applicable), which is an interesting programming exercise. It is possible that ssldump's source code might be reused for that task.