TLS decryption is not working

asked 2019-12-15 13:01:03 +0000

pa_ddii
3 ●1 ●1 ●2

Hey,

I'm trying using Wireshark for analyzing a WebRTC-Connection but I have problems with the TLS decryption. I followed some instructions and did:

create a File tls-key.log
Set the SSLKEYLOGFILE-environment variable to the file
Set the path in the Wireshark-Settings
Re-started PC
Start Wireshark-Capture
Start Browser (Chrome or Firefox), opened the WebRCT-App

But after recording the traffic, I'm not able to see the decryptet data. Did I something wrong or forgot something?

Debug-File: https://drive.google.com/open?id=1bZH...

Key-File: https://drive.google.com/open?id=1hR8...

pcapng: https://drive.google.com/open?id=1vBr...

edit retag flag offensive close merge delete

add a comment

answered 2019-12-15 13:30:15 +0000

SYN-bit

18528 ●9 ●344 ●255 https://SYN-b.it

The command grep -f <(tshark -r Capture01.pcapng -Y tls.handshake.type==1 -T fields -e tls.handshake.random) tlskeys.log does not show any output. This means none of the client_random values from the ClientHello are present in the key-log file.

In other words, your TLS session key collection did not work properly.

Did you start Chrome/Firefox from a CMD window that has the SSLKEYLOGFILE environment variable set?
Does the "WebRCT-App" use its own TLS library that does not look at the SSLKEYLOGFILE environment variable?

edit flag offensive delete link

Comments

"Did you start Chrome/Firefox from a CMD window that has the SSLKEYLOGFILE environment variable set? " -> No I did not. I thought the Browser would write the keys automatically by every start. How do I start the Browser with that settings from CMD?

pa_ddii ( 2019-12-15 13:44:04 +0000 )edit

I might have spoken too soon (I'm not a windows user). Here are two links on how to the the environment variable on Windows. Is this what you have done already?

Also interesting is @Lekensteyn's remark in another similar question:

My guess is that you have some kind of "antivirus software" installed that intercepts traffic from Chrome and then performs its own external connection. The SSLKEYLOGFILE environment variable likely has no effect on this other piece of software as it requires support from the application (such as Firefox or Chrome).

SYN-bit ( 2019-12-15 14:27:45 +0000 )edit

Oh yes, you helped me a lot. It was my fu Avast Antivirus. But now I have a reason to uninstall it. Now it works! Thank you very much!!!

pa_ddii ( 2019-12-15 14:46:10 +0000 )edit

add a comment

TLS decryption is not working

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

TLS decryption is not working edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

TLS decryption is not working