Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Can wireshark decrypt PEAP

From: "Yakan, Medhat" <medhat.yakan@xxxxxxxxxxxxx>
Date: Wed, 30 Jan 2008 14:32:42 -0800
I am trying to get wireshark to decrypt the SSL encrypted application
data in the PEAP phase 2 exchange, but no luck using the SSL dissector.
Any feedback is appreciated.
Here is the contents of my SSL debug file.
 
ssl_association_remove removing TCP 8812 - radius handle 02DDC2A8
ssl_init keys string:
192.168.10.44,8812,RADIUS,c:\temp\serverkey.key
ssl_init found host entry
192.168.10.44,8812,RADIUS,c:\temp\serverkey.key
ssl_init addr 192.168.10.44 port 8812 filename c:\temp\serverkey.key
ssl_init private key file c:\temp\serverkey.key successfully loaded
association_add TCP port 8812 protocol RADIUS handle 00000000
association_add could not find handle for protocol 'RADIUS', try to find
'data' dissector
association_find: TCP port 636 found 06979E48
ssl_association_remove removing TCP 636 - ldap handle 02D45C10
association_add TCP port 636 protocol ldap handle 02D45C10
association_find: TCP port 993 found 06979E88
ssl_association_remove removing TCP 993 - imap handle 02C38638
association_add TCP port 993 protocol imap handle 02C38638
association_find: TCP port 995 found 06979EC8
ssl_association_remove removing TCP 995 - pop handle 02DB6D90
association_add TCP port 995 protocol pop handle 02DB6D90
 
dissect_ssl enter frame #5 (first time)
ssl_session_init: initializing ptr 078A18F8 size 564
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
dissect_ssl server 192.168.10.44:8812
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 67 ssl, state 0x00
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 1 offset 5 length 63 bytes,
remaining 72 
dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
 
dissect_ssl enter frame #8 (first time)
dissect_ssl3_record found version 0x0301 -> state 0x11
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 42 ssl, state 0x11
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 38 bytes,
remaining 47 
dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
ssl_restore_session can't find stored session
dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x17
dissect_ssl3_hnd_srv_hello not enough data to generate key (required
0x37)
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 566 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 11 offset 52 length 562 bytes,
remaining 618 
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 397 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 12 offset 623 length 393 bytes,
remaining 1020 
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 4 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 14 offset 1025 length 0 bytes,
remaining 1029 
 
dissect_ssl enter frame #9 (first time)
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 134 ssl, state 0x17
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes,
remaining 139 
dissect_ssl3_handshake found SSL_HND_CLIENT_KEY_EXCHG state 0x17
ssl_decrypt_pre_master_secret key 17 diferent from KEX_RSA(16)
dissect_ssl3_handshake can't decrypt pre master secret
dissect_ssl3_record: content_type 20
dissect_ssl3_change_cipher_spec
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 40 ssl, state 0x17
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 90 offset 150 length 14195706
bytes, remaining 190 
 
dissect_ssl enter frame #10 (first time)
dissect_ssl3_record: content_type 20
dissect_ssl3_change_cipher_spec
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
dissect_ssl3_record: content_type 22
decrypt_ssl3_record: app_data len 40 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 129 offset 11 length 4325887
bytes, remaining 51 
 
dissect_ssl enter frame #12 (first time)
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 24 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 8812 found 00000000
association_find: UDP port 2060 found 00000000
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 32 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 8812 found 00000000
association_find: UDP port 2060 found 00000000
 
dissect_ssl enter frame #13 (first time)
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 40 ssl, state 0x17
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 2060 found 00000000
association_find: UDP port 8812 found 00000000
 
dissect_ssl enter frame #14 (first time)
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 24 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 8812 found 00000000
association_find: UDP port 2060 found 00000000
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 32 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 8812 found 00000000
association_find: UDP port 2060 found 00000000
 
dissect_ssl enter frame #15 (first time)
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 40 ssl, state 0x17
association_find: UDP port 2060 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 2060 found 00000000
association_find: UDP port 8812 found 00000000
 
dissect_ssl enter frame #16 (first time)
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 24 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 8812 found 00000000
association_find: UDP port 2060 found 00000000
dissect_ssl3_record: content_type 23
decrypt_ssl3_record: app_data len 32 ssl, state 0x17
association_find: UDP port 8812 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: UDP port 8812 found 00000000
association_find: UDP port 2060 found 00000000
 
dissect_ssl enter frame #15 (already visited)
dissect_ssl3_record: content_type 23
association_find: UDP port 2060 found 00000000
association_find: UDP port 8812 found 00000000

 
---
M. Yakan