Wireshark-users: Re: [Wireshark-users] How to save a decrypted SSL session in pcap
Thanks. Saving the symmetric key with the trace seems like the appropriate solution and would be acceptable for my circumstances. Until then I'll continue with text exports... also, Wireshark rocks :)
On Tue, May 5, 2009 at 11:11 AM, Sake Blok
<sake@xxxxxxxxxx> wrote:
On Tue, May 05, 2009 at 09:22:31AM -0700, Michael Ryerse wrote:
>
> I have a server's private key loaded to decrypt some SSL sessions with a
> server. I want to save this capture in pcap format so I can email the
> decrypted form to someone else without needing to send them the private
> key. So far I have found that I can export to text. However text is much
> harder to browse through so I am looking for a format that saves
> decrypted, but is loadable to Wireshark like a pcap is. Any help is
> appreciated.
(https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3444).
Short summary: there are ideas to save the master secret of each SSL
session so that these master keys can be provided together with the pcap
file. These keys will then be used to decrypt the sessions in the pcap
file at the receivers end without the need of the private key. Please
note that each SSL session is creating its own master secret, so these
master secrets will not be making it possible to decrypt other sessions.
Until this functionality has been developed, the best way is to supply
both the pcap file with unencrypted data in it and the export to text
with the decrypted output in it.
Cheers,
Sake
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
