I am trying to understand how the SSL handshake happens for HTTPS.
I did the following:
- Captured the packets for a HTTPS connection using Wireshark.
- examined the Client Hello for cipher suites supported (not important)
Examined the Server Hello for the cipher suite decided by the server. It is TLS_RSA_WITH_RC4_128_MD5. Which means Handshake algorithm is RSA. which means the master key is encrypted using the public key of the server and sent to server.
The next message Client key exchange is where I am facing the challenge. Exported the "Handshake protocol: Client Key exchange" encrypted byte stream. The byte stream in hex is:
10 00 01 00 8e 1b d9 49 6f 9e 15 8f b9 b6 8a 2e e0 90 f1 54 3b 54 7d d3 d5 2e 64 b5 37 cc ae 74 ec 3f 38 59 1a 42 78 98 3f e1 4e 7b 8b 84 74 a9 17 95 c0 b7 07 d9 b1 a1 d0 1f 5a a1 2e 71 b6 98 ea 4b 6c 62 f3 b3 8c 8e d7 20 9a 4b 6a a7 d7 4c f8 69 c9 6c d6 0b 8b d0 9f 59 28 f5 52 60 fa e9 72 52 4c 87 98 30 fe 6f ef a6 5b 11 fd 6b 0e 0d db 60 d5 d4 d8 a6 0e 6d 9f 02 58 01 a4 21 d5 aa 17 80 5f 42 ec 84 78 a8 41 ed bc 94 c5 83 ab 74 09 b9 91 9d bf 6d c1 4b 85 95 90 d8 b4 22 fb 00 a4 76 af 54 e2 c3 1e 84 6f 5e 02 18 05 f5 6c 83 7f dc a7 44 85 24 06 b6 89 6f 13 4e 25 f0 ce 59 23 8c 50 4d c2 56 11 b9 0d 63 b5 28 b8 ad e7 9c f2 16 96 f8 dd 4a f9 b5 72 8c 6f 6a 6c 8b 40 d7 03 c7 a8 d6 8e 88 38 00 d2 d3 9b 4a 04 3a 16 55 1f c9 58 c8 3f d3 7a 33 9a 3f 98 1c 74 83 3c 45 5a b2 9c da
I stripped off the first four bytes (message type and size)
Tried decrypting the client key using the server's private key using the command:
openssl rsautl -decrypt -inkey /etc/apache2/ssl/apache.key -in Clientkeyexchange_enc -out Clientkeyexchange_dec
The hex value of the result is:
03 00 E1 B9 2F 27 4F 85 46 AF 54 CC 5D 55 5E 92 71 CD 14 60 02 96 08 BA 8D E0 65 B7 A5 27 EF E4 F7 4E 4A 02 55 47 80 4E 36 FF 49 75 D2 B6 AB 83
I am unable to decrypt the application data using this value. I know I have misunderstood something. But unable to find out what.