使用Pre-Master-Secret日志和/或RSA密钥无法使用Wireshark解密TLS

编程问答 2022-06-03

问题描述

我需要解密同一Web服务器上两个Web API之间的交换数据（）。 我已经执行了以下文章中描述的所有步骤： https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/

我尝试仅使用（Pre）-Master-Secret日志，仅使用RSA密钥，并且同时使用这两个日志，但是结果始终相同：在“数据包字节”视图中，该视图下方的选项卡是不显示。未显示“解密的SSL数据”和“未压缩的实体主体”选项卡，如下图所示： Tabs not displayed image

我期望看到下图所示的选项卡： Expected tabs image

在SSL调试日志文件中，出现以下错误：

dissect_ssl frame #93 (first time) 
packet_from_server: is from server - TRUE 
  conversation = 0E4B2598,ssl_session = 0E4B2C50 
  record: offset = 0,reported_length_remaining = 145 
ssl_try_set_version found version 0x0303 -> state 0x91 
dissect_ssl3_record: content_type 22 Handshake 
decrypt_ssl3_record: app_data len 89,ssl state 0x91 
packet_from_server: is from server - TRUE 
decrypt_ssl3_record: using server decoder 
decrypt_ssl3_record: no decoder available 
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 85 bytes 
ssl_try_set_version found version 0x0303 -> state 0x91 
Calculating hash with offset 5 89 
ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 
ssl_set_cipher found CIPHER 0xC030 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 -> state 0x97 
trying to use TLS keylog in C:\Temp\ssl-keys.log 
  checking keylog line: CLIENT_HANDSHAKE_TRAFFIC_SECRET ... 
    matched client_handshake 
  checking keylog line: SERVER_HANDSHAKE_TRAFFIC_SECRET ... 
    matched server_handshake 
  checking keylog line: CLIENT_TRAFFIC_SECRET_0 ... 
    matched client_appdata 
  checking keylog line: SERVER_TRAFFIC_SECRET_0 ... 
    matched server_appdata 
  checking keylog line: EXPORTER_SECRET ... 
    matched exporter 
  checking keylog line: CLIENT_HANDSHAKE_TRAFFIC_SECRET ... 
    matched client_handshake 
  checking keylog line: SERVER_HANDSHAKE_TRAFFIC_SECRET ... 
    matched server_handshake 
  checking keylog line: CLIENT_TRAFFIC_SECRET_0 ... 
    matched client_appdata 
  checking keylog line: SERVER_TRAFFIC_SECRET_0 ... 
    matched server_appdata 
  checking keylog line: EXPORTER_SECRET ... 
    matched exporter 
tls13_load_secret TLS version 0x303 is not 1.3 
tls13_load_secret TLS version 0x303 is not 1.3 
  record: offset = 94,reported_length_remaining = 51 
dissect_ssl3_record: content_type 20 Change Cipher Spec 
decrypt_ssl3_record: app_data len 1,ssl state 0x197 
packet_from_server: is from server - TRUE 
decrypt_ssl3_record: using server decoder 
decrypt_ssl3_record: no decoder available 
ssl_dissect_change_cipher_spec Session resumption using Session ID 
trying to use TLS keylog in C:\Temp\ssl-keys.log 
ssl_finalize_decryption state = 0x197 
ssl_restore_master_key can't find master secret by Session ID 
ssl_restore_master_key can't restore master secret using an empty Session Ticket 
ssl_restore_master_key can't find master secret by Client Random 
  Cannot find master secret 
packet_from_server: is from server - TRUE 
ssl_change_cipher SERVER (No decoder found - retransmission?) 
  record: offset = 100,reported_length_remaining = 45 
dissect_ssl3_record: content_type 22 Handshake 
decrypt_ssl3_record: app_data len 40,ssl state 0x197 
packet_from_server: is from server - TRUE 
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）

encryptiontls1.2wiresharkwireshark