Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Export TLS Session keys

Wireshark has an option file->export TLS session keys

From testing I can see that this either requires the (pre)master key file to be set up OR the pcapng itself must have embedded secrets

So I tried this and don't know why it failed: set up the TLS (Pre)Master secret file Browse (and successfully decrypt) data file->export TLS session keys editcap --inject-secrets tls,<file created="" by="" export=""> <mypcap> <newpcap>

When I opened the new file nothing would decrypt If I opened the new file, removed the key file from TLS preferences and then exported keys from the file menu I got the same contents as before (the ones now embedded in the file).

I can therefore see no real use for the file->export TLS session keys What have I missed? Could it be made to work the way I suggest ? Even better could we add an "import TLS session keys" to wireshark so that I don't have to use editcap?

Export TLS Session keys

Wireshark has an option file->export TLS session keys

From testing I can see that this either requires the (pre)master key file to be set up OR the pcapng itself must have embedded secrets

So I tried this and don't know why it failed: failed:

set up the TLS (Pre)Master secret file
Browse (and successfully decrypt)  data
 file->export TLS session keys
editcap --inject-secrets tls,<file created="" by="" export=""> created by export>  <mypcap>    <newpcap>

<newpcap>

When I opened the new file nothing would decrypt If I opened the new file, removed the key file from TLS preferences and then exported keys from the file menu I got the same contents as before (the ones now embedded in the file).

I can therefore see no real use for the file->export TLS session keys What have I missed? Could it be made to work the way I suggest ? Even better could we add an "import TLS session keys" to wireshark so that I don't have to use editcap?