Hi,

I am wondering whether the TLSv1 traffic for the webapp I am working on can be decrypted. More precisely I am interested in decrypting the traffic that contains HTTP messages.

Here’s the environment info:

o IE (but I can use Firefox if needed) talking to a JBoss-contained webapp

o all traffic over SSL (TLSv1)

o TLS’s “Server Hello”-message says:

Secure Socket Layer

    TLSv1 Record Layer: Handshake Protocol: Server Hello

        Content Type: Handshake (22)

        Version: TLS 1.0 (0x0301)

        Length: 74

        Handshake Protocol: Server Hello

            Handshake Type: Server Hello (2)

            Length: 70

            Version: TLS 1.0 (0x0301)

            Random

            Session ID Length: 32

            Session ID: DFC934A0A89626A9FF048DBC2D9B9595EFE88AFEB078E06D...

            Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)

            Compression Method: null (0)

I saw a blog post somewhere discussing that you can “pass” the path to the file which stores the negotiated encryption key to wireshark and (given that wireshark has been linked against a given library) get the encrypted payload decrypted. I don’t know if this applies to my scenario (not sure whether IE writes the key to the file system,…)…

Thanks for your help,

-nik