https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3444
--- Comment #7 from Sake <[email protected]> 2009-04-30 00:07:11 PDT --- (In reply to comment #6) > I guess, it is not necessary (and useful) to save all decrypted data. > It should be enough to save master key, server IP:port, client IP:port for > each > session. > Then the Wireshark should be able to decrypt SSL without server private key. That's a great idea Tomas, why don't we implement it something like this: 1) add a preference to point to a master-key output file 2) write all the srcip:sport,dstip:dport,naster-key entries found in the tracefile to this master-key output file 3) make the private key reader routine aware of this master-key output format and read the master-keys into a list/array 4) additionally use this list/array to find keys to decrypt This was you can provide the capture file and the master-key list, which only contains decryption info specific for the sessions in the trace file, but not for new traffic towards the ssl host. This would also pave the way for decrypting traffic that was using a DH cipher, as long as the client or server is capable of logging the master-keys (as was mentioned earlier on one of the mailing lists). No all we need to do is find time to implement this :-) -- Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. ___________________________________________________________________________ Sent via: Wireshark-bugs mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://wireshark.org/mailman/options/wireshark-bugs mailto:[email protected]?subject=unsubscribe
