Help decrypting TLS between socket client and server
I built a socket server and socket client whose sole purpose is to communicate back and forth using TLS so I can learn how to decrypt the communication using Wireshark. While both are on the same Linux box, I will later use different machines, and they will pass back and form JSON. I've been really struggling on this and would very much appreciate some help. I've included everything I could think of but if I am missing something, please let me know. Thank you, thank you, thank you in advance.
The client has the server's certificate and the server has both the certificate and private key, and a passphrase is not being used, and I have included how I created the keys as well as the actual keys at the end of this post.
The following communication successfully occurs between the server and client.
Client connects to Server.
Server sends message to Client:
Hello tls://127.0.0.1:38280!
Welcome to this amazing server!
Here's a tip: don't say anything.
Client sends message to Server:
Hello server, how are you?
Server disconnects client.
I captured it using tshark on the remote Linux box using the following command and moved the pcap file to my Windows PC which is running wireshark Version 3.0.1 (see details shown at the end of this post) and also copied the server's private key to the Windows PC.
tshark -w /var/www/testing/public/test/filename.pcap -P -f "port 8080" -i lo
I went to Edit/Preferences/Protocols/TLS, clicked Edit near RSA Keys List, and added the private key (I also added IP 127.0.0.1, port 8080, and protocol data even though it is my understanding that Wireshark ignores it). I think this used to work before people used forward secrecy, but no longer does, and https://redflagsecurity.net/2019/03/1... a solution for using Firefox or Chrome to log the symmetric key and configure Wireshark's (Pre)-Master-Secrete log filename to point to it. This doesn't work for me, however, as both machines are headless and are not using browsers to access the data. Maybe some other means to capture the symmetric key is possible?
The output is below. As far as I can tell, nothing has been decrypted and I cannot find any text other than regarding the rsa key.
The debug log is listed below (however, I removed some of the repeated checking as it was originally 394kb).
Any recommendations? Thank you!
EDIT 6/15/2019 11:54 AM
Looks like the pem key is not needed when using the master secret, right? Any ideas what I am doing wrong? I am not certain when I need to get the session key so am doing both before and after I run the capture. As far as I can tell, nothing is decrypted. I see a note how the (pre-)master secret is empty which seems important, and other ...
The TLS session is using DHE key exchange so the RSA private key from the server isn't relevant:
To decypt such a session requires the pre-master secret from the SSLKEYLOGFILE. Your debug log seems to be indicating a match, not sure why it's not decrypting. Can you share the capture and the
sslkeylog.log
file on a public share somewhere?@grahamb. Why no match? Because I wasn't thinking and the sslkeylogfile is related to my window's PC and not the remote linux client connecting to the remote linux server.