5

I am debugging a client/server TLS communication issue with a 3rd party server vendor. For the client-side, I've captured a pcapng dump along with saved via a SSLKEYLOGFILE-like utility. Can I share the files in order to perform a Wireshark analysis?

The RFC 5246 describes Master Secret as being based on pseudo-random input per TLS session. Thus it seems it should be safe to share and not expose the risk of disclosure to other sessions.

I just need to make sure I don't cause a security breach.

0

1 Answer 1

7

The (Pre-)Master-Secret is unique per TLS session. If you want a third party to be able to decrypt a specific pcap with this TLS session but not anything else it is safe to give the party this secret, as long as the session is not reused anywhere else.

Note that a TLS session can span multiple TCP connections. To make sure that the session will not be reused anymore by the client it is usually enough to close the client, i.e. the client usually does not preserve session information over restarts. But you should also make sure that the third party has no access to other data captures from the same TLS session apart from the ones they are explicitly allowed to analyze.

Since a TLS session is always between a specific client and target you don't have to worry about the TLS session reused between the same target and another client or between the same client and another target. But "target" does not necessarily mean a single server - it is not uncommon that a domain has multiple servers and that these share TLS session information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.