Decrypt TLS record layer using OpenSSL

Question

I am trying to decrypt a given TLS record layer sent by a client using OpenSSL. The TLS version is TLS 1.2 and the cipher suite is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.

The encrypted record layer is given by 16030300400325f41d3ebaf8986da712c82bcd4d5524be34e37fe65ad790c3499facf551714ffb066152448c8a185060c9ff09345c467850c85e299b8547cf1038ae3f1033 and was created by the MAC-then-PAD-then-ENCRYPT scheme. Hence, the first bytes correspond to the content type (16), the version (0303) and the length (0040), i.e. the actual encrypted message is given by 0325f41d3ebaf8986da712c82bcd4d5524be34e37fe65ad790c3499facf551714ffb066152448c8a185060c9ff09345c467850c85e299b8547cf1038ae3f1033.

In addition to that, I am given the key block 06 19 3E FB A9 03 A7 68 AB 43 22 F4 1B B1 40 E8 C0 F3 13 44 0A F8 13 1A 39 DC 43 9C 5A D1 B8 B0 D3 AA DA D6 AA 45 5B C8 2F 1B 9D 51 FD B2 69 CF C5 5A 3A 37 15 31 D4 52 AA BF 9A 20 82 16 FB 73 7E 09 C7 9E 86 0C D5 07 F5 F8 6F 5C FB 31 DE 16 93 65 ED 49 84 30 C3 FC D0 5C 6B 49 C6 04 F1 DA F6 EA BF CB FC 23 F6 21, which was created by a key derivation procedure.

Since AES-256-CBC is used for encryption, the initialization vector has a length of 16 bytes, the key material has a length of 32 bytes and the MAC has a length of 20 bytes according to RFC 5246 (page 83). Hence, I can extract the client_write_key from the given key_block, which is 2f1b9d51fdb269cfc55a3a371531d452aabf9a208216fb737e09c79e860cd507 and the IV from the record layer, which is 0325f41d3ebaf8986da712c82bcd4d55. (The client_wirte_key can be used for encryption and decryption of messages sent by the client, right?)

Now I am trying to use OpenSSL to decrypt the message with the following command:

openssl enc -nopad -d -aes-256-cbc -iv 0325f41d3ebaf8986da712c82bcd4d55 -K 2f1b9d51fdb269cfc55a3a371531d452aabf9a208216fb737e09c79e860cd507 -in content.txt

where content.txt only contains the actual encrypted message. However, this seems not to be the correct method, because all I get is some unreadable byte code. At this point, I have to idea, what I might have done wrong. Or is there some problem with my understanding of how the record layer encryption/decryption and the correct usage of the keys?

I would be very grateful, if someone could help me finding my problem.

Answer 1

Let me guess -- this is the first message sent by the client after CCS (Change Cipher Spec)? Note type 0x16 is handshake, not application data. And the result I get from decrypting is

00000000: 1400 000c 85a0 32d7 cb3a c5af 177e 11ce  ......2..:...~..
00000010: 96e6 4e87 524f 1ef3 5d3b d7c0 03fc bd82  ..N.RO..];......
00000020: b3fd 3627 0b0b 0b0b 0b0b 0b0b 0b0b 0b0b  ..6'............

which is the correctly HMAC-SHA1ed (with pseudoheader 0000000000000000 1603030010) and TLS-padded version of the following handshake message:

00000000: 1400 000c 85a0 32d7 cb3a c5af 177e 11ce  ......2..:...~..

which is a correctly-formatted Finished (see 5246 section 7.9) which is the first message (and record) that must be sent encrypted after CCS. (Your given data is insufficient to determine if it is fully correct, i.e. the value in it verifies the handshake.)