I've used wireshark to watch serveral SSL3.0 traffic and decrypt the messages transfered between client & server.
And what I've just found is very strange :
AFAIK, the encryption-key, MAC and encryption algorithm used in calculating client-Finished and application-data sent by client are exactly the same.
But, when I use the same client-write-key used to encrypt client-finished (Derived from MasterSecret) to encrypt application data, I get the different result from what the client (firefox) calculated.
The odd behavior also happened with server: I can use server-write-key (derive from MasterSecret) to decrypt successfully the "server-finished" message, but failed to decrypt any other encrypted message from server.
So, can you please tell me what happened to the client-write-key & server-write-key ? Did both client and server changed their write-key after "finished" message sent?
PS: I forced client (Firefox) to use SSL V3.0, cipherSuite = TLS_RSA_WITH_RC4_128_MD5