decrypt saved capture with private key

asked 2019-07-16 15:44:58 +0000

notquitestr8t
1 ●1 ●2 ●1

updated 2019-07-16 15:51:14 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

I am using wireshark 64 bit. version 3.0.2. I am trying to decrypt an https capture file that is using port 8443 for https. I have the private key. I can't seem to get a straight answer on how this works despite multiple posts. First, there is no SSL so I have selected TLS in the Protocols section of Preferences. Just below that is RSA Keys. I assume that is where I put the location of the key file. (with .key extension) I also put in the following information in the TLS Decrypt under protocols:

IP address: source IP listed in the capture
Port: 8443
Protocol: http
Key File: same private key located on desktop that I listed under RSA Keys.

Clicked on OK, OK. but nothing happens. What did I miss?

answered 2019-07-16 16:03:46 +0000

grahamb

23790 ●4 ●950 ●227 https://www.wireshark.org

Firstly, the SSL dissector has been renamed to TLS, so everything else, e.g. preferences, has been adjusted accordingly.

Secondly, the configuration is slightly simpler now if using a private RSA server key, only the RSA Keys entry is listed. The key file should be in PEM format, i.e. it should be text and has "-----BEGIN RSA PRIVATE KEY-----", or a PKCS#12 store, i.e. a pfx file.

Thirdly, a private RSA key can only be used to decrypt the traffic if the following are true:

The cipher suite selected by the server is not using (EC)DHE.
The protocol version is SSLv3, (D)TLS 1.0-1.2. It does not work with TLS 1.3.
The private key matches the server certificate. It does not work with the client certificate, nor the Certificate Authority (CA) certificate.
The session has not been resumed. The handshake must include the ClientKeyExchange handshake message.

See the wiki TLS page for more info.

edit flag offensive delete link

Comments

Thank you very much for the clarification. Since this capture is using TLS1.2 and all our cipher suites are TLS_DHE_RSA or TLS_ECDHE_RSA than I guess I am SOL. At least I know why. Thanks again for the link and the information.

notquitestr8t ( 2019-07-16 16:26:14 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

decrypt saved capture with private key

1 Answer

Comments

Your Answer

Question Tools

Stats

decrypt saved capture with private key edit

1 Answer

Comments

Your Answer

Question Tools

Stats

decrypt saved capture with private key