5

Assuming you have a PCAP file with HTTPS traffic and having the key pair (private & public), it is possible to decrypt the traffic if it uses Diffie Hellman Ephemeral? Using openSSL lib for example.

As far as I know the answer is no because DHE generates a new pair for each connection, so it do not uses the key that we put in our apache configuration, isn't it?

My task is, knowing the private and public keys, decrypt the traffic. Of course there are many CipherSuites. I'm studying the limitations of this objective.

6

When TLS/SSL handshake starts, the first step is, server is authenticated using a private key associated to the server's certificate. In a 2nd step, client and server exchange a session key used to encrypt the payload of the connection. The session key is used for one session means when the session is closed the same key can't be used to encrypt the traffic of another session. Now the problem is SSL/TLS often use RSA cipher suites in which the session key is derived from private key. So the session key can be calculated in future if the underlying private is known.

DHE and ECDHE provides Perfect Forward Secrecy(PFS), means session keys are not derived from private key. So the attacker can not decrypt the traffic even when he has the private key used in the session handshake.

In DHE(not DH) the session keys are calculated using the Random Numbers.

Conclusion

You can't decrypt the traffic using private key when DHE or ECDHE is used.

| improve this answer | |
  • OK, so as I expected, I cannot. Thank you very much for your answer and the rest of them. ;) – Carlos Vega Oct 27 '14 at 0:23
  • The session key is not generated by the client; is not encrypted; is not transmitted; and is not decrypted. It is calculated independently by both peers via a key agreement protocol. Nor is it derived from the RSA private key. – Marquis of Lorne Mar 21 '17 at 4:14
4

just for the records: cloudflare released some good charts on how RSA and DH handshakes work:

https://blog.cloudflare.com/content/images/2014/Sep/ssl_handshake_rsa.jpg

https://blog.cloudflare.com/content/images/2014/Sep/ssl_handshake_diffie_hellman.jpg

| improve this answer | |
2

To summarize: no, you cannot. This is the exact point of DHE. In pompous terms, DHE provides perfect forward secrecy, which means that knowledge of the permanent server's private key (the one corresponding to the public key in the server's certificate) is not sufficient to decrypt past sessions.

Technically, when DHE is used, the server's certificate and private key are used only for a signature: the server signs its transient, newly generated DH public key; the client verifies that signature. So the private key is used; only not for encryption purposes. By having a copy of the server's private key, you could forge a fake signature, meaning that you could impersonate the server; but signatures do not hide data, so a passive-only attack (as you are proposing to do) cannot learn anything that way.

If the server uses DHE and you need to see the data, then you must mount an active attack, usually known as a Man-in-the-Middle attack. You pose as a fake server; you use your knowledge of the server's private key to impersonate the server; when a client connects, you also connect as a client to the true server, and relay data in both direction. The MitM decrypts data received from the client and reencrypts it into the SSL connection opened with the true server, and does the same in the server-to-client direction. That way, the MitM gets to see all the data, but he must actively work at the moment of the connection. He cannot do that after the fact, i.e. decrypt a past session that he recorded passively. Hence PFS.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.