SSL Decrypt works on my station but not those captured elsewhere on others

I've successfully set up ssl decrypt to work on my systems sessions with an ssl server by getting the private key. Works!

I have traces of other stations traffic that I need to analyze. I can't get those other stations traffic to decode. What's the unknown I'm missing?

Thanks!

ssl

asked 12 Dec '13, 11:56

packetman007
11●2●2●3
accept rate: 0%

One Answer:

For SSL decryption to work, there are three main conditions that need to be fulfilled:

You must have the private key matching the certificate used in the session. And it needs to be in the proper format for wireshark to read. As I assume the other stations go to the same server, this condition is fulfilled.
You need to have the full SSL handshake in the tracefile (so including the Certificate and the ClientKeyExchange messages). When you see ServerHello immediately followed by a ChangeCipherspec, then you have a reused SSL session and you can not decrypt it in Wireshark (unless the full handhshake is in the same tracefile).
The client and server must have chosen a non-diffie-hellman key exchange. When DH is used, the master secret is encrypted with dynamically setup keys instead of the public key from the certificate and can therefor not be decrypted by wireshark. And without the cleartext master secret for the session, wireshark can not decrypt the session. A DH key exchange can be recognized by an extra "ServerKeyExchange" message in the SSL handshake.

What do your SSL handshakes look like?

permanent link

answered 13 Dec '13, 03:11

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

Your answer

toggle preview

community wiki:

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

Question tags:

ssl ×319

question asked: 12 Dec '13, 11:56

question was seen: 1,323 times

last updated: 13 Dec '13, 03:11

You have a trillion packets.