wiresharkjsse

How to log TLSv1.3 keys in JSSE for Wireshark to decode traffic

I've been (successfully) looking at TLSv1.2 traffic in Wireshark via a key logfile. But I'd like to do something similar to TLSv1.3.

TLSv1.2 key log

https://github.com/square/okhttp/pull/6060

wireshark output

This follows the approach described here https://security.stackexchange.com/questions/35639/decrypting-tls-in-wireshark-when-using-dhe-rsa-ciphersuites

I'm wondering if anyone has similar working with Java JSSE for TLSv1.3?

I know I need to log CLIENT_EARLY_TRAFFIC_SECRET, CLIENT_HANDSHAKE_TRAFFIC_SECRET, SERVER_HANDSHAKE_TRAFFIC_SECRET, CLIENT_TRAFFIC_SECRET_0 or SERVER_TRAFFIC_SECRET_0. But I'm not sure of the right hooks in JSSE.

Found prior art on https://wiki.wireshark.org/TLS#Using_the_.28Pre.29-Master-Secret

Specifically

https://github.com/neykov/extract-tls-secrets

and

http://jsslkeylog.sourceforge.net/

Solution

  • Found prior art on https://wiki.wireshark.org/TLS#Using_the_.28Pre.29-Master-Secret

    Specifically

    https://github.com/neykov/extract-tls-secrets

    and

    http://jsslkeylog.sourceforge.net/

    For The github project, download https://repo1.maven.org/maven2/name/neykov/extract-tls-secrets/4.0.0/extract-tls-secrets-4.0.0.jar

    Then run the following command before it attempts to connect. The sample program for OkHttp prints the PID and then has a 10 second delay for this reason.

    $ java -jar ~/Downloads/extract-tls-secrets-4.0.0.jar list
$ java -jar ~/Downloads/extract-tls-secrets-4.0.0.jar <pid> /tmp/secrets.log