decrypt ssl encrypted data in python

Question

I'm analyzing a packet capture with python using dpkt. The application layer is encrypted with ssl. I'd like to decrypt the ssl data (i.e., the tcp payload). I have the private key, so I should be able to use the key to decrypt the data. Here's my script:

#!/bin/python
import sys
import dpkt

def main():

    if not len(sys.argv) == 2:
        print "need a pcap file"
        return 1

    filename = sys.argv[1]
    f = open(filename)
    pcap = dpkt.pcap.Reader(f)

    framenum = 1
    for ts, buf in pcap:

        if framenum == 123:
            eth = dpkt.ethernet.Ethernet(buf)
            ip = eth.data
            tcp =  ip.data
            ssl =  tcp.data

            # decrypt ssl

        framenum += 1



if __name__ == '__main__':
    sys.exit( main() )

What can I put in place of that "decrypt ssl" comment to get the decrypted ssl bytes? I'm guessing there should be some library that can do this for me, but all my searches for ssl and python give information about writing socket programs that can receive ssl connections. I'm not interested in that. Rather, I need to decrypt data that is encrypted with ssl.

Thanks!

can you decrypt it by hand e.g., using wireshark?

jfs
– jfs

2013-12-06 20:51:26 +00:00
Commented Dec 6, 2013 at 20:51 — jfs
– jfs, Commented Dec 6, 2013 at 20:51

Mr_Pink · Accepted Answer · 2013-12-06 20:56:46Z

1

You're not likely going to find a ready-made library to do this. Decrypting from a packet dump is rather involved, and I believe the best featured tool right now is still Wireshark.

Note that you will also need to have the entire TLS session captured, from the handshake onward. Also, if the connection used an ephemeral mode which offers forward secrecy (anything with DHE or ECDHE), the data cannot be decrypted.

answered Dec 6, 2013 at 20:56

Mr_Pink

110k17 gold badges287 silver badges275 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

firebush Over a year ago

I started with Wireshark, but sadly wireshark doesn't help me because it doesn't have a way to export the decrypted packet capture to a new pcap file that has the decrypted data. I was hopeful I could do this myself in a python script since wireshark couldn't. Thus my question.

Mr_Pink Over a year ago

exporting it to a new pcap doesn't make sense, since there is no 1-1 relationship between encrypted and decrypted packets. All you could do is export the plaintext from the stream.

firebush Over a year ago

Thanks for the input. It's helpful to know to give up.

Collectives™ on Stack Overflow

decrypt ssl encrypted data in python

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related