I have wireshark dump of SSL session from client side. I have no control on server side. Should I be able to decrypt SSL session, get the session key, pre-master key?



If you only have a packet capture from a TLS session, then you will not be able to decrypt the traffic. A packet capture is the result of a passive attack where an attacker is just looking at the network traffic. If this would be sufficient to decrypt traffic, it would make TLS rather useless.

In modern configurations, the client and server will use a Diffie-Hellman key exchange to establish a shared secret (the TLS premaster secret). Each side generates a private value and computes the corresponding public value. The public value is sent over the network, and each side uses their own private value to establish the same shared secret. As the private value is never sent over the network, an attacker cannot calculate this secret.

Now, if you actually control the client (or server), then you could read keys from memory or modify the program such that it saves the (pre)master secret. With Firefox and Chrome, you can set environment variable SSLKEYLOGFILE to a file path and have all master secrets written to it. This file can then be loaded into Wireshark in order to decrypt the TLS traffic of your client.


No, if possible that would obviate the whole point of ssl.

  • 1
    can you expand this answer to explain why? – schroeder Mar 18 '18 at 9:28
  • the answer is too large and technical to fit in a comment. Google "design of ssl" – ddyer Mar 18 '18 at 17:55
  • Edit your answer to include more detail. As it sits now, it's at risk of being deleted – schroeder Mar 18 '18 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.