I've used wireshark to watch serveral SSL3.0 traffic and decrypt the messages transfered between client & server.

And what I've just found is very strange :

AFAIK, the encryption-key, MAC and encryption algorithm used in calculating client-Finished and application-data sent by client are exactly the same.

But, when I use the same client-write-key used to encrypt client-finished (Derived from MasterSecret) to encrypt application data, I get the different result from what the client (firefox) calculated.

The odd behavior also happened with server: I can use server-write-key (derive from MasterSecret) to decrypt successfully the "server-finished" message, but failed to decrypt any other encrypted message from server.

So, can you please tell me what happened to the client-write-key & server-write-key ? Did both client and server changed their write-key after "finished" message sent?

PS: I forced client (Firefox) to use SSL V3.0, cipherSuite = TLS_RSA_WITH_RC4_128_MD5


I found out the answer myself : the function RC4 I've used didn't save the cipher state, while SSL stream cipher required that. I've used a RC4 class and problem resolved!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.