Cannot Decrypt SSL/TLS Packets Using Pre-Master Secret Log File

Decrypt_SSL-TLS

asked 2024-10-23 18:46:43 +0000

dave_w
1 ●1 ●1

Hi,

I'm trying to decode SSL/TLS packets in WireShark.

I set the Windows environmental variable SSLKEYLOGFILE=C:\Users\Dave\ssl-keys.log Just in case, I rebooted.

I then visited several web sites including the one I'm trying to decrypt messages. I did see the log file was written and the contents appear to be normal.

I then started a capture and used a curl command. I find the encrypted packets and my Pre-Master Secret log filename is correct, as shown in the banner above the packets.

Yet, I'm still not able to see decrypted messages.

What am I doing wrong?

Thanks,

Dave

edit retag flag offensive close merge delete

Comments

Where does your version of "curl" come from? Look at the Properties -> Details of the file to find out.

I ask, because there's a possibility it's a binary that's linked to SChannel which does not observe the SSLKEYLOGFILE env var.

grahamb ( 2024-10-24 08:24:00 +0000 )edit

Hi grahamb,

Thanks for the reply. Here's the curl version information. I honestly don't remember where I got curl.

curl 8.9.1 (Windows) libcurl/8.9.1 Schannel zlib/1.3 WinIDN
Release-Date: 2024-07-31
Protocols: dict file ftp ftps http https imap imaps ipfs ipns mqtt pop3 pop3s smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL SSPI threadsafe Unicode UnixSockets

Thanks again,

Dave

dave_w ( 2024-10-24 16:55:47 +0000 )edit

Same as mine, and as you can see in the version info it's using Schannel, so won't emit pre-master secrets.

Not sure where I got mine, I think it's part of the "standard" Windows install these days. Ahh, see here for more info about the MS build.

grahamb ( 2024-10-24 17:06:27 +0000 )edit

Have you tried a bigger hammer?
https://learn.microsoft.com/en-us/win...

$ curl -V
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3

Kind of overkill to load WSL and a linux image just for curl but it does work.
(currently using ancient ubuntu 18.04)

Chuckc ( 2024-10-24 19:31:23 +0000 )edit

Yeah, actually went that route. Installed WSL but got UBUNTU errors. Investigated those, requiring updates to the BIOS. Searched into that, but couldn't find what was needed by UBUNTU, so I gave up and backed that all out.

dave_w ( 2024-10-24 22:26:41 +0000 )edit

see more comments

answered 2024-10-24 17:10:51 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●972 ●227 https://www.wireshark.org

As per the comments above, the curl binary used is built with Schannel so won't emit the secrets to the log file.

edit flag offensive delete link

Comments

Just downloaded directly from curl.de to get this:

curl 8.10.1 (x86_64-w64-mingw32) libcurl/8.10.1 LibreSSL/4.0.0 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 WinIDN libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.64.0 ngtcp2/1.8.1 nghttp3/1.6.0
Release-Date: 2024-09-18
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli CAcert HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd

Still does not decrypt.

dave_w ( 2024-10-24 17:30:56 +0000 )edit

May work for TLS 1.2 but not 1.3?
13672: SSLKEYLOGFILE not working with curl-for-win build

https://github.com/curl/curl/blob/mas...

SSLKEYLOGFILE
If you set this environment variable to a filename, curl stores TLS secrets from its connections in that file when invoked to enable you to analyze the TLS traffic in real time using network analyzing tools such as Wireshark. This works with the following TLS backends: OpenSSL, LibreSSL (TLS 1.2 max), BoringSSL, GnuTLS and wolfSSL.

Chuckc ( 2024-10-24 19:06:12 +0000 )edit

add a comment

Cannot Decrypt SSL/TLS Packets Using Pre-Master Secret Log File

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Cannot Decrypt SSL/TLS Packets Using Pre-Master Secret Log File edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Cannot Decrypt SSL/TLS Packets Using Pre-Master Secret Log File