I want to know if it is possible to do remote decryption with wireshark ? A more structured approach to what I want to do is this - Setup: 2 computers (comp A and comp B) with one computer acting as a network gateway. That is all traffic from comp A goes to comp B. Any firewall rules set on comp B applies to comp A. Objective: Generate the TLS secrets on a local PC (comp A) and then send the secrets to comp B (via file transer/ssh/nc). Comp B should be able to decrypt encrypted traffic given the TLS secret information (the actual 6 keys generated from master secret). Current Approach - Print out the TLS secrets/ SSLdecoder variable in a file using a modified version of wireshark. Send this file to comp B via netcat/ssh. On comp B, use a modified version of wireshark to read these secrets and decrypt data. Problems: There is a delay in sending the secrets from comp A to comp B. As a result the decryption code on wireshark runs before the secrets are sent by comp A. That is the packets are already captured and dissected by wireshark on comp B as when I browse a website on comp A. There is a manual delay for sending TLS secrets to comp B Question: Is there a way to solve this problem without tweaking anything at comp A side (one tweak is adding delay in sending packets at network level to comp B) Why this problem: I am trying to study security for fine grained proxies. Here comp A is a local PC and comp B is a proxy. Instead of using certificates, now only specific TLS sessions can be decrypted by the proxy with some secrets asked 01 Nov '16, 11:02  mac9393 |
2 Answers:
What is your "modified version" of Wireshark? Wireshark already supports linking session secrets to a SSL/TLS session using the "(Pre-)master secrets keylog file" approach (see Wireshark wiki - SSL). This method will also suffer from the same problem though. When the keylog file entry is added after the Client Key Exchange message has been dissected, there will be no more attempts to load the secrets. A possible idea is to delay dissection of the Client Key Exchange record type until the keylog file has gained a session secret for the Random value from the Client Hello. This requires either modification to the SSL dissector or a custom dissector that is invoked before the SSL dissector (and interprets the record layer first). Sketch of the approach:
answered 01 Nov '16, 13:05  Lekensteyn |
Maybe you want to consider a different approach. This is an interesting article about the subject. Fiddler is a well known tool, as is MitM Proxy. answered 01 Nov '16, 12:35  Jaap ♦ |
The article is really related to this project. However, I would like to use TLS encryption keys instead of the master secret/certificate to decrypt info by the proxies.