Hi all, I have a pcap file which I want to decrypt in wireshark. The file has full tcp & tls handshake. But to decrypt it I dont have keys. Any ideas how can it be done ? Thanks & Regards, nm asked 28 Mar '15, 00:41  nm04 |
One Answer:
It can't be done without the keys. answered 28 Mar '15, 09:29  Jasper ♦♦ |
Jasper, I read on internet that if I have full capture it can be done. Apart from this cipher suites used is RSA and DHE.
you can't, if you don't have the keys. That what crypto is good for - preventing reading the content when you're not authorized (meaning: have no keys).
What you have read is that you need the TLS handshake to be able decrypt the conversation with the keys. Because if you have the keys but not the handshake you can't decrypt the conversation either.
the NSA claims it can be done ;-))