TLS decryption with NSS key log but without handshake frames

edit

I did the following test with my TLS stream which start with a TLS handshake and then a lot of encrypted data. I create a "gap" in the middle of this TLS stream removing some encrypted data. (the handshake is still available in the stream). Wireshark is able to decrypt everything even the encrypted data following the "gap"..

The application data can be considered two independent streams. For example when removing data from server to client, then the stream from client to server will indeed be decrypted completely but the server to client data should be truncated.

That is exactly what I get when creating a gap by filtering out some frames C>S and exporting that to a new file with the option “Include depended upon packets” disabled.

Can you share a sample pcap so we can take a look in more detail?

Ok, my use case is on DTLS (UDP), it's a client which sent periodically data to a server (without any response from server).

Anyway, your first response answer to my initial question:
-> If we have a DTLS1.2 pcap without the handshake stream but only with the stream of some encrypted applicative data, there is no way to decrypt it. (To fullfil this need (= decrypt without having access to handshake stream) theoretically Whireshark would need master secret, client random (=NSS key log) and also "server random", but there is no way to give the server random to wireshark.

The second question was : if we switch on DTLS1.3, does Wireshark will be able to decrypt application data without having access to handshake stream (and using TLS1.3 NSS key log (CLIENT_EARLY_TRAFFIC_SECRET, CLIENT_HANDSHAKE_TRAFFIC_SECRET, SERVER_HANDSHAKE_TRAFFIC_SECRET, CLIENT_TRAFFIC_SECRET_0, SERVER_TRAFFIC_SECRET_0, EXportER_SECRET) )

Right, so DTLS instead of TLS. Then failure in TCP reassembly is not an issue and using a block cipher should work.

You could try to craft the needed handshake with the keys using text2pcap and prepend that to the capture.

And is it plan that wireshark will one day allow user to also import server_random ?

Having access to both: - NSS key log (CLIENT_RANDOM & SECRET) - SERVER_RANDOM will allow wireshak to decryp "application data" without needing the handshake stream in the pcap.