1
$\begingroup$

There is some https traffic from a specific server (which I have the certificate and private key) that I need legitimately be able to read.

This traffic doesn’t come via browser so besides the ephemeral protocol being used using a pre-master secret key is not an option.

Is there any way it is possible to decrypt and analyze the traffic without downgrading the cypher suite to some deprecated RSA non ephemeral one?

Ideally using wireshark, but open to something else as well.

Improve this question
$\endgroup$
2
  • $\begingroup$ So what kind of "legitimacy" it is? $\endgroup$
    – Vadym Fedyukovych
    Commented Sep 25, 2021 at 12:30
  • $\begingroup$ Legitimacy meaning we have done tests with http and now https testing is needed so we need to be able to read the traffic. The other side ask for it and provided us the certificate and private key. $\endgroup$
    – Nacionarte
    Commented Sep 25, 2021 at 12:54

1 Answer 1

Reset to default
2
$\begingroup$

There's nothing that you can do from a purely passive point of view. The private information relating to the certificate does not directly provide any information about the ephemeral keys used in the ECDHE exchange. This is part of the promise of forward security that ephemeral schemes provide.

You can actively set up a man-in-the-middle gateway that intercepts all incoming requests and responds to the handshake as the server would (using the certificate and private keys). You can then set up your own connection with the server and relay information between client and server. The this would then provide you with access to all of the decrypted information.

Note that this advice is purely technical. There may be legal restrictions according to your jurisdiction and obviously you are beholden to your own ethical code as to whether this is appropriate handling of information.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Thanks for the information Daniel. Can you point me as to how to actively set up the Mitm gw? This is work, nothing ilegal here; it is just I’m the person assigned to accomplish this task. The client asked for this and it is already informed of the implications of a infrastructure of this kind. $\endgroup$
    – Nacionarte
    Commented Sep 25, 2021 at 14:43
  • $\begingroup$ Currently RTFM SSLsplit as my hopes of doing it with wireshark are done. Open to suggestions about the most simple way of accomplish this tasks. $\endgroup$
    – Nacionarte
    Commented Sep 25, 2021 at 14:52
  • $\begingroup$ A quick google threw up this website: mitmproxy.org I have no experience of this product nor this vendor. $\endgroup$
    – Daniel S
    Commented Sep 25, 2021 at 20:41
  • $\begingroup$ Addition: an alternative to an active MitM attack is to instrument the software at one of the end to output something that should otherwise remain secret, therefore allowing decryption of a passive intercept. If interested in the DHE exchange, that can be the private ephemeral secret generated by that software. If interested only in later data, that can be the shared secret before or even after it goes thru the KDF. $\endgroup$
    – fgrieu ♦
    Commented Sep 26, 2021 at 17:44
  • $\begingroup$ Thanks fgrieu. It looks this the way will follow. Thankyou. $\endgroup$
    – Nacionarte
    Commented Oct 7, 2021 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.