I'm trying to decrypte a SBC vs. Skype for Business (MediationServer) connection. The Server Private Key is loaded into wireshark and SSL ist set to IP Address of the Server (SBC) --> SBC is The Server, because the TLS Handshake starts with a Client Hello __form__ Skype for Business.
The Debugfile is attached --> Is pasted below...
Skype for Business uses Port 5067 (SIP Trunk) but still I cannot decrypt the File. Did I do something wrong?
I have installed Wireshark V2.6.1
Wireshark SSL debug log
Wireshark version: 2.6.1 (v2.6.1-0-g860a78b3) GnuTLS version: 3.4.11 Libgcrypt version: 1.7.6
KeyID[20]: | b5 26 c9 74 2e a0 dx cx bx 1x 2x 26 6f 18 18 62 |.&.t......'&o..b| | 3e x7 54 90 |>.T. | ssl_init private key file C:xxxxxxxx/test.pem successfully loaded.
dissect_ssl enter frame #3 (first time) packet_from_server: is from server - FALSE conversation = 00000270F64E4B50, ssl_session = 00000270F64E5560 record: offset = 0, reported_length_remaining = 174 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 169, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 165 bytes, remaining 174 Calculating hash with offset 5 169 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01
dissect_ssl enter frame #4 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 00000270F64E5560 record: offset = 0, reported_length_remaining = 1460 ssl_try_set_version found version 0x0303 -> state 0x91 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 49, ssl state 0x91 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 45 bytes, remaining 54 ssl_try_set_version found version 0x0303 -> state 0x91 Calculating hash with offset 5 49 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 ssl_set_cipher found CIPHER 0x009F TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 -> state 0x97 ssl_load_keyfile dtls/ssl.keylog_file is not configured! tls13_load_secret TLS version 0x303 is not 1.3 tls13_load_secret TLS version 0x303 is not 1.3 record: offset = 54, reported_length_remaining = 1406 need_desegmentation: offset = 54, reported_length_remaining = 1406
dissect_ssl enter frame #7 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 00000270F64E5560 record: offset = 0, reported_length_remaining = 4177 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4172, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4168 bytes, remaining 4177 Calculating hash with offset 5 4172 lookup(KeyID)[20]: | 13 16 e1 a5 3c 5b 84 5c 57 06 03 09 61 98 26 65 |....<[.\W...a.&e| | 81 ed f3 2c |..., | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000
dissect_ssl enter frame #7 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 00000270F64E5560 record: offset = 0, reported_length_remaining = 149 need_desegmentation: offset = 0, reported_length_remaining = 149
dissect_ssl enter frame #8 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 00000270F64E5560 record: offset = 0, reported_length_remaining = 532 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 5 length 523 bytes, remaining 532 Calculating hash with offset 5 527
dissect_ssl enter frame #8 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 00000270F64E5560 record: offset = 0, reported_length_remaining = 42 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 37, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 13 offset 5 length 29 bytes, remaining 42 Calculating hash with offset 5 33 dissect_ssl3_handshake iteration 0 type 14 offset 38 length 0 bytes, remaining 42 Calculating hash with offset 38 4
dissect_ssl enter frame #17 (first time) packet_from_server: is from server - FALSE conversation = 00000270F64E6940, ssl_session = 00000270F64E90B0 record: offset = 0, reported_length_remaining = 174 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 169, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 165 bytes, remaining 174 Calculating hash with offset 5 169 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01
dissect_ssl enter frame #18 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 00000270F64E90B0 record: offset = 0, reported_length_remaining = 1460 ssl_try_set_version found version 0x0303 -> state 0x91 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 49, ssl state 0x91 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 45 bytes, remaining 54 ssl_try_set_version found version 0x0303 -> state 0x91 Calculating hash with offset 5 49 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 ssl_set_cipher found CIPHER 0x009F TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 -> state 0x97 ssl_load_keyfile dtls/ssl.keylog_file is not configured! tls13_load_secret TLS version 0x303 is not 1.3 tls13_load_secret TLS version 0x303 is not 1.3 record: offset = 54, reported_length_remaining = 1406 need_desegmentation: offset = 54, reported_length_remaining = 1406
dissect_ssl enter frame #21 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 00000270F64E90B0 record: offset = 0, reported_length_remaining = 4177 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4172, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4168 bytes, remaining 4177 Calculating hash with offset 5 4172 lookup(KeyID)[20]: | 13 16 e1 a5 3c 5b 84 5c 57 06 03 09 61 98 26 65 |....<[.\W...a.&e| | 81 ed f3 2c |..., | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000
dissect_ssl enter frame #21 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 00000270F64E90B0 record: offset = 0, reported_length_remaining = 149 need_desegmentation: offset = 0, reported_length_remaining = 149
dissect_ssl enter frame #22 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 00000270F64E90B0 record: offset = 0, reported_length_remaining = 532 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 5 length 523 bytes, remaining 532 Calculating hash with offset 5 527
dissect_ssl enter frame #22 (first time) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 00000270F64E90B0 record: offset = 0, reported_length_remaining = 42 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 37, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 13 offset 5 length 29 bytes, remaining 42 Calculating hash with offset 5 33 dissect_ssl3_handshake iteration 0 type 14 offset 38 length 0 bytes, remaining 42 Calculating hash with offset 38 4
dissect_ssl enter frame #3 (already visited) packet_from_server: is from server - FALSE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 174 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 165 bytes, remaining 174
dissect_ssl enter frame #4 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 45 bytes, remaining 54 record: offset = 54, reported_length_remaining = 1406 need_desegmentation: offset = 54, reported_length_remaining = 1406
dissect_ssl enter frame #7 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4168 bytes, remaining 4177
dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 532 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 5 length 523 bytes, remaining 532
dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 42 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 13 offset 5 length 29 bytes, remaining 42 dissect_ssl3_handshake iteration 0 type 14 offset 38 length 0 bytes, remaining 42
dissect_ssl enter frame #17 (already visited) packet_from_server: is from server - FALSE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 174 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 165 bytes, remaining 174
dissect_ssl enter frame #18 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 45 bytes, remaining 54 record: offset = 54, reported_length_remaining = 1406 need_desegmentation: offset = 54, reported_length_remaining = 1406
dissect_ssl enter frame #21 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4168 bytes, remaining 4177
dissect_ssl enter frame #22 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 532 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 5 length 523 bytes, remaining 532
dissect_ssl enter frame #22 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 42 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 13 offset 5 length 29 bytes, remaining 42 dissect_ssl3_handshake iteration 0 type 14 offset 38 length 0 bytes, remaining 42
dissect_ssl enter frame #3 (already visited) packet_from_server: is from server - FALSE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 174 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 165 bytes, remaining 174
dissect_ssl enter frame #4 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 45 bytes, remaining 54 record: offset = 54, reported_length_remaining = 1406 need_desegmentation: offset = 54, reported_length_remaining = 1406
dissect_ssl enter frame #7 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4168 bytes, remaining 4177
dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 532 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 5 length 523 bytes, remaining 532
dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E4B50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 42 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 13 offset 5 length 29 bytes, remaining 42 dissect_ssl3_handshake iteration 0 type 14 offset 38 length 0 bytes, remaining 42
dissect_ssl enter frame #17 (already visited) packet_from_server: is from server - FALSE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 174 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 165 bytes, remaining 174
dissect_ssl enter frame #18 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 45 bytes, remaining 54 record: offset = 54, reported_length_remaining = 1406 need_desegmentation: offset = 54, reported_length_remaining = 1406
dissect_ssl enter frame #21 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4168 bytes, remaining 4177
dissect_ssl enter frame #22 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 532 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 5 length 523 bytes, remaining 532
dissect_ssl enter frame #22 (already visited) packet_from_server: is from server - TRUE conversation = 00000270F64E6940, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 42 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 13 offset 5 length 29 bytes, remaining 42 dissect_ssl3_handshake iteration 0 type 14 offset 38 length 0 bytes, remaining 42
