Wireshark · Wireshark-users: Re: [Wireshark-users] Decrypt SSL fails withtestcaseSampleCaptures/snakeoil2_070531.tgz

["Kukosa, Tomas" <tomas.kukosa@xxxxxxxxxxx>]

Unfortunately I have no idea what could go wrong and I am not able to
investigate it as I have only Windows environment.

Tomas

 

> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx 
> [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of 
> Daniel Kabs
> Sent: Tuesday, July 17, 2007 11:50 AM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] Decrypt SSL fails 
> withtestcaseSampleCaptures/snakeoil2_070531.tgz
> 
> Hello Tomas,
> 
> On Tuesday 17 July 2007 08:46, Kukosa, Tomas wrote:
> > it is strange as it works fine for me (on Windows).
> > My debug output is attached. Could you try to compare it 
> with your one?
> > Where the difference starts?
> 
> Thanks for sending your debug output. I compared your output 
> against mine:
> 
> The first difference occurs right at the start, where the 
> private key is 
> associated:
> 
>   ssl_init keys string:
>   127.0.0.1,443,http,/tmp/rsasnakeoil2.key
>   ssl_init found host entry 127.0.0.1,443,http,/tmp/rsasnakeoil2.key
>   ssl_init addr 127.0.0.1 port 443 filename /tmp/rsasnakeoil2.key
>   ssl_init private key file /tmp/rsasnakeoil2.key successfully loaded
>   association_add TCP port 443 protocol http handle 0x8353a00
>   association_find: TCP port 443 found 0x86b4f58
>   ssl_association_remove removing TCP 443 - http handle 0x8353a00
>   association_add TCP port 443 protocol http handle 0x8353a00
>   association_find: TCP port 636 found 0x8671f98
>   ssl_association_remove removing TCP 636 - ldap handle 0x8391600
>   association_add TCP port 636 protocol ldap handle 0x8391600
>   association_find: TCP port 993 found 0x8671fd0
>   ssl_association_remove removing TCP 993 - imap handle 0x837c6d8
>   association_add TCP port 993 protocol imap handle 0x837c6d8
>   association_find: TCP port 995 found 0x8672008
>   ssl_association_remove removing TCP 995 - pop handle 0x842b7e0
>   association_add TCP port 995 protocol pop handle 0x842b7e0
> 
> I think this output is ok as the private key file was loaded 
> successfully.
> 
> The debug output continues with only minor differences in the 
> "association 
> find" lines. Example:
> 
> yours (Windows):
>   association_find: TCP port 443 found 02CBB520
> 
> mine (Linux):
>   association_find: TCP port 443 found 0x86b4f58
> 
> Again I think this output is ok. The different pointer 
> addresses are due 
> to the different operating systems. 
> 
> The output continues without other differences. Event the "pre master 
> encrypted[128]" in frame #8 is the same.
> 
> After those lines, the following major differences show up.
> 
> yours (Windows):
>   pcry_private_decrypt: stripping 79 bytes, decr_len 127
>   decypted_unstrip_pre_master[127]:
>   02 c8 3b d5 a5 24 3c 40 c7 6e 95 b9 46 da b2 79 
>   b1 06 ec 61 2d f7 f5 4a b7 62 b6 33 4b b3 05 ef 
>   90 14 59 72 08 d5 34 88 41 cc a6 96 f4 dd 97 9a 
>   dc 3a 6e 92 1f 3a e4 6b 5b fb 3f ee 46 59 62 f3 
>   f3 06 0f d1 1f f4 9d b2 29 08 c6 01 f5 c3 00 03 
>   00 ff 84 56 6d a0 fb cc fd c6 c8 20 d5 f0 65 18 
>   87 b0 44 45 9c e3 92 f0 4d 32 cd 41 85 10 24 cb 
>   7a b3 01 36 3d 93 27 12 a4 7e 00 29 96 59 d8 
>   pre master secret[48]:
>   03 00 ff 84 56 6d a0 fb cc fd c6 c8 20 d5 f0 65 
>   18 87 b0 44 45 9c e3 92 f0 4d 32 cd 41 85 10 24 
>   cb 7a b3 01 36 3d 93 27 12 a4 7e 00 29 96 59 d8 
> 
> mine (Linux):
>   pcry_private_decrypt: stripping 3 bytes, decr_len 128
>   decypted_unstrip_pre_master[128]:
>   05 06 00 58 14 ed 5f e1 ca 0d 53 d9 87 43 80 4d 
>   4f 9e 10 67 24 fc 60 eb f1 ff 3d 1c 74 ef b5 52 
>   13 01 cf 06 53 89 ca 80 a2 b8 ee 20 ff 90 92 3a 
>   17 c7 0c db fe dd 99 c2 f2 47 21 c1 b7 fa 66 59 
>   bc 61 22 0d 58 e2 64 35 63 1e 71 32 c5 aa 26 18 
>   ba c8 e4 e2 c2 10 de ab 78 25 b4 d7 de 3b 26 c4 
>   8c 24 c5 32 39 a2 08 76 3e d5 55 29 ca 12 da fe 
>   2b 9c 32 b5 b9 1a 88 0d d8 01 df 31 75 6f a7 cb 
>   ssl_decrypt_pre_master_secret wrong pre_master_secret lenght (125,
>   expected 48)
>   dissect_ssl3_handshake can't decrypt pre master secret
> 
> The first line 
> 
>   pcry_private_decrypt: stripping 3 bytes, decr_len 128
> 
> is from ssl_private_decrypt() (in packet-ssl-utils.c). I - 
> with my limited 
> knowlege of the SSL internals gained from reading the 
> wireshark source 
> code - interpret it as follows: the pre master secret has 
> been decrypted. 
> It contains padding data. The padding data ends with a byte 
> containing 
> zero. The padding is searched and stripped from the decrypted 
> data. On my 
> computer, the decrypted data contains only three bytes of 
> padding. This 
> is too short.
> 
> So I guess decryption in libgcrypt[1] is defective on my computer.
> 
> Any ideas what I can do about it?
> 
> Cheers
> Daniel
> 
> [1] libgcrypt version 1.2.3 api-version 1 
> 
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
>