Decrypting SSL/TLS traffic

[raghvendra mishra]

Hello Geeks,

                    I'm trying to decrypt ssl traffic using wireshark. I'm making connection request to gmail on port 443 using openssl & capturing packet in wireshark. When the request goes to gmail it shows the master key used to encrypt the session. When I'm using this master key in wireshark then it is not decrypting the traffic.

Help me to decrypt the traffic. Openssl command is

openssl s_client -cipher AES256-SHA -connect www.google.com:443

--

 Thank You & Regards:-
 Raghvendra Mishra

 Computer Network & Internet Engineering Division(R&D)
 C-DAC, Electronic City, Bangalore
 Contact No.-  +91-8867404241
 email- raghav...@cdac.in
                    

[Sunil Kumar]

That master key its negotiated/generated for the session. The key will be different for every session.(replay attack).

===============
     SunilKumar
------------------------------
http://in.linkedin.com/in/sunilkr86/
http://30d4.blogspot.in/
===============

--
_______________________________________________________________________________
EMC Defenders League CTF - Play and Win - http://www.emcdefendersleague2013.com
_______________________________________________________________________________
null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
---
You received this message because you are subscribed to the Google Groups "null" group.
To unsubscribe from this group and stop receiving emails from it, send an email to null-co-in+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[raghvendra mishra]

yes it is right but client hello should be decrypted using the key that is shown when you run the opennssl.

[Sunil Kumar]

But the I guess client hello would be encrypted using server's public key.

[R@m@n]

hey misthra,

If u got answer for below question, pls share with me.

Thanks,

R@m@n

[raghvendra mishra]

Hey raman, 

                 I didn't get the answer.

The client hello message couldn't encrypted with the use of server's public key, because client will the get server's public key only when server hello message will come to the client, that is in the server certificate.

I have found some link that quite useful for ssl decryption

http://wirewatcher.wordpress.com/2010/07/20/decrypting-ssl-traffic-with-wireshark-and-ways-to-prevent-it/

http://www.root9.net/2012/11/ssl-decryption-with-wireshark-private.html

http://www.zinus.de/index.html%3Fp=114.html

And one paper is in SANS reading room.

--

_______________________________________________________________________________
EMC Defenders League CTF - Play and Win - http://www.emcdefendersleague2013.com
_______________________________________________________________________________
null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
---
You received this message because you are subscribed to the Google Groups "null" group.
To unsubscribe from this group and stop receiving emails from it, send an email to null-co-in+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.