What is TLS and how you can passively decrypt it with Wireshark

Transport Layer Security (TLS) is a cryptographic protocol designed to provide secure communication over a computer network. It’s most often used to secure web traffic on the Internet, allowing for privacy and data integrity between two communicating applications.

Here’s how it works:

1.Protocol Version: Both the client (like a web browser) and the server agree on the highest version of the TLS protocol that they both support. The latest version as of my knowledge cutoff in September 2021 is TLS 1.3.

2. Cipher Suite Negotiation: Both parties agree on a specific set of cryptographic algorithms (a “cipher suite”) that they will use to secure the communication. This suite includes algorithms for key exchange, data encryption, and data integrity checking.

3. Authentication: The server sends its digital certificate to the client to prove its identity. The digital certificate includes the server’s public key and is typically signed by a trusted Certificate Authority (CA). The client can choose to authenticate itself to the server as well, but this is less common.

4. Key Exchange: The client and server use the agreed-upon key exchange algorithm and the server’s public key to securely generate a shared secret, known as the “premaster secret”. This is done in such a way that even if someone else is listening to the communication, they can’t figure out the premaster secret.

5. Encryption: The client and server derive a set of symmetric session keys from the premaster secret. These keys are used to encrypt and decrypt the actual communication data. Since symmetric encryption is faster than asymmetric encryption (which uses the server’s public and private keys), this allows for efficient secure communication.

6. Data Transfer: The client and server can now exchange data, which is encrypted and decrypted using the session keys. Even if someone else intercepts the data, they won’t be able to read it without the session keys.

7. Closure: When the client and server are done communicating, they send special messages to each other to safely close the secure connection.

When you see “https” in a URL, it means your web browser is using TLS (or the older SSL, Secure Sockets Layer) to securely communicate with the web server. This ensures that any data you exchange with the server, like passwords or credit card numbers, can’t be read by anyone else.

If you have the necessary permissions and you want to decrypt TLS traffic for legitimate reasons (like network troubleshooting or performance monitoring), you would need the following:

1. The private key from the server used to establish the secure TLS session.
2. A tool to capture and decrypt the network traffic, such as Wireshark.

Here are the steps you can follow using Wireshark:

1. Set up the server to allow session key logging: This depends on the server software being used. For servers using OpenSSL (like Apache and nginx), you can often set the `SSLKEYLOGFILE` environment variable to a file path, and the server will write session keys to this file.

2. Capture network traffic: Start Wireshark and begin a capture on the network interface that is carrying the TLS traffic.

3. Perform network activity: Generate the TLS traffic you’re interested in decrypting. This could be done by accessing a secure website hosted on the server or performing any other network activity that would generate TLS traffic.

4. Stop the capture: Once you have captured the traffic you’re interested in, stop the capture in Wireshark.

5. Configure Wireshark to use the key log file: Go to `Edit` -> `Preferences` -> `Protocols` -> `SSL` (or `TLS`, in more recent versions of Wireshark). Here, you can specify the path to the key log file that the server has been writing to.

6. Inspect the decrypted traffic: Now, when you click on a TLS packet in Wireshark, you should see an ‘Decrypted SSL Data’ tab in the packet details. This will contain the decrypted data from the TLS packet.

Remember that this only works if you have the private keys from the server. Also, modern web browsers often employ techniques like perfect forward secrecy (PFS), which ensure that even if someone has the private key, they cannot decrypt past sessions. It’s worth noting that the `SSLKEYLOGFILE` method works around this by logging ephemeral session keys, not by using the server’s long-term private key.

These steps are all ethically and legally sound when performed on your own network or with explicit permission from the network’s owner. However, they should never be used to decrypt others’ data without their knowledge and permission.