I am trying to decode a simple HTTPS session on wireshark 1.8.2 (sorry, it's a bit old). I have the server key file (no password). Went to wireshark preference for SSL and added an entry for RSA list: IP:port:protocol:KeyFile as 127.0.0.1:443:http:/home/user/server.key. I thought I did everything right, but it just won't decrypt. Wonder what could have gone wrong. Thanks. asked 07 Aug '15, 16:33  pktUser1001 |
One Answer:
The problem is shown here:
cipher suite 0x94 is a Diffie Hellman based cipher (DHE-RSA-AES128-GCM-SHA256). Due to the nature of Diffie Hellman, you can't decrypt the SSL traffic with only the private key of the server. Diffie Hellmann is made and used to prevent exactly that. This is not a limitation of Wireshark, it's how it is supposed to work. If you want to decrypt the traffic, you would need the so called session keys, generated by the client (browser). Some browsers will export those keys if told to do so.
Regards answered 11 Aug '15, 16:26  Kurt Knochner ♦ |
