[TLS 1.3] I am getting an error while decrypting the SSL Handshake Traffic -
The TLS 1.3 capture I was trying to decrypt using the Pre-master secret Log file. But it is giving me an error. I have generated this Log File from my code (not using OpenSSL) and have tried to adhere to the format of one that has got generated using OpenSSL. But in my case the following error comes and I can not decrypt.
Can anyone provide me with pointers like what could be the issue? What is the format in which Wireshark expects this.
checking keylog line: SERVER_HANDSHAKE_TRAFFIC_SECRET 5f12353b21fe65825874863a0df58d0ba845d831d68ce9ae7d75300d6bd 15244eacb350a999429ff3537525ebcaf9bb7d81c5a2d253a35764ca88fbb
unrecognized line
checking keylog line: SERVER_TRAFFIC_SECRET_0 5f12353b21fe65825874863a0df58d0ba845d831d68ce9ae7d75300d6bd dcf3be2a68c96931588f4d4cfed12c1f9ec2d66eaad080275d97cc3fea2340
unrecognized line
checking keylog line: CLIENT_HANDSHAKE_TRAFFIC_SECRET 5f12353b21fe65825874863a0df58d0ba845d831d68ce9ae7d75300d6bd c7fc236396c653d73c487356dbf0f7b75fd1a34287d6992d88302ccffe4fe7c1
unrecognized line
checking keylog line: CLIENT_TRAFFIC_SECRET_0 5f12353b21fe65825874863a0df58d0ba845d831d68ce9ae7d75300d6bd 4ea73c973b3306b12a388d35eaaccefc678f4d762ca42ceb999ed844dc70a
unrecognized line
A quick search found the format specification, does your file adhere to this?
Also use blending edge (2.5.1) Wireshark for this, stable (2.4.6) may not be enough.
I'm experiencing a similar issue. It appears that Wireshark fails in decrypting TLS data if in the same TLS record layer there is more than one HandShake Protoco message. In pratice it stops decrypting from that point. This case may happen and I attach a capture and the Key log.
I'm using Wireshark 2.4.6 on Ubuntu (but the same issue is present for Wireshark 2.6.0 for Windows). The capture is done with Firefox 59 that visits www.facebook.com and uses TLS 1.3 Draft 23.
The problem happens (in this case) in the Server Hello. The third Record Layers contains several Messages: Extensions (ALPN), Certificates, etc... Wireshark stops decrypting from the first Message (ALPN), and Certificates are not shown. It fails decrypting also all the subsequent data from the server, but still decrypts data from client.
Capture: https://www.dropbox.com/s/ym8lzyn4z65... Key.Log: https://www.dropbox.com/s/y29e4odd0dn...