At the moment I have an EC private key in my possession and also some traffic that was encrypted using the aforementioned private key. I have been trying to use OpenSSL to turn the private key into something Wireshark can work with. For example, going from the original:

-----BEGIN EC PRIVATE KEY-----
/* BASE 64 ENCODED *\
-----END EC PRIVATE KEY-----

To the following:

-----BEGIN CERTIFICATE-----
/* BASE 64 ENCODED */
-----END CERTIFICATE-----

Via the command:

openssl req -new -x509 -key private_key.pem -out server.pem -days 730

However Wireshark doesn't seem to enjoy this either. Is there a way to decrypt ECDSA traffic using wireshark?

  • 1
    Which cipher was used? If it is an ECDHE or DHE cipher then the private key of the certificate is not sufficient to decrypt the traffic because of forward secrecy. – Steffen Ullrich Jun 25 '16 at 10:54
  • I'm afraid I'm rather new to this and don't entirely know how to work out what the type is. Could you shed some light on how to find out? I didn't generate the private key myself. @SteffenUllrich – Alexander Craggs Jun 25 '16 at 10:57
  • 2
    In this case I would recommend to first study How does SSL/TLS work? because it contains the information you need to understand how encryption works and what is needed for decryption, the role of certificates and ciphers etc. – Steffen Ullrich Jun 25 '16 at 11:00
  • Aha, thank you for the reference, I'll look over that now @SteffenUllrich – Alexander Craggs Jun 25 '16 at 11:24
  • @SteffenUllrich Read both that article and most of the ones attached to that. Still not quite understanding how to get access to the key used via Wireshark. I can find the protocol is indeed TCP, but nothing else (I'm looking at the more indepth view of each packet of Wireshark, picture. – Alexander Craggs Jun 25 '16 at 12:42

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.