This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can’t Decrypt TLSv1 Traffic

0

I’m using Wireshark v1.10.1.

I have provided the private key to Wireshark SSL protocol preference. But the TLS traffic isn’t decrypted. Here is my Wireshark SSL debug file.

Wireshark SSL debug log

ssl_association_remove removing TCP 443 - http handle 03B40638
Private key imported: KeyID 9d:d0:e4:66:dd:8e:fb:cf:ea:e4:96:52:cc:92:29:67:...
ssl_load_key: swapping p and q parameters and recomputing u
ssl_init IPv4 addr '172.16.0.254' (172.16.0.254) port '443' filename 'C:\test\cert.pem' password(only for p12 file) ''
ssl_init private key file C:\test\cert.pem successfully loaded.
association_add TCP port 443 protocol http handle 03B40638
Private key imported: KeyID 9d:d0:e4:66:dd:8e:fb:cf:ea:e4:96:52:cc:92:29:67:...
ssl_load_key: swapping p and q parameters and recomputing u
ssl_init IPv4 addr '172.16.252.1' (172.16.252.1) port '443' filename 'C:\test\cert.pem' password(only for p12 file) ''
ssl_init private key file C:\test\cert.pem successfully loaded.
association_add TCP port 443 protocol http handle 03B40638

dissect_ssl enter frame #8 (first time) ssl_session_init: initializing ptr 06041F98 size 592 conversation = 06041D84, ssl_session = 06041F98 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 104, ssl state 0x00 association_find: TCP port 4287 found 00000000 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 100 bytes, remaining 109 packet_from_server: is from server - FALSE ssl_find_private_key server 172.16.0.254:443 dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #10 (first time) conversation = 06041D84, ssl_session = 06041F98 record: offset = 0, reported_length_remaining = 137 dissect_ssl3_record found version 0x0301(TLS 1.0) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session can't find stored session trying to use SSL keylog in failed to open SSL keylog cannot find master secret in keylog file either dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 92, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 40, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 188 offset 97 length 1583727 bytes, remaining 137 ………………..

asked 29 Jul ‘13, 21:08

Yuji's gravatar image

Yuji
11112
accept rate: 0%

edited 30 Jul ‘13, 00:51

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245


One Answer:

3

Since the "ChangeCipherSpec" handshake message comes directly after the "ServerHello" handshake message, this is a resumed SSL session. Wireshark needs the full SSL handshake to be able to decrypt the packets. You can accomplish this by closing all the client application (browser?) windows and then start capturing before opening the client application.

answered 30 Jul '13, 00:57

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%