On Tue, Apr 17, 2001 at 08:38:45PM -0400, Greg Stark wrote:
> What you need is the server private key (and of course the password to
> decrypt it). You appear to have it, but I would double check with the
> openssl rsa command. ssldump will silently ignore an incorrect password.
>
> Also, ssldump will not decrypt resumed ssl sessions. You can detect whether
> the session was resumed by looking at the session id's in the clear text
> handshake messages.
And ssldump can only decrypt sessions with static RSA. It cannot decrypt
communication with EDH cyphers. Since s_server has default DH parameters
built in, an openssl s_client connecting to an s_server will use a EDH
cipher and ssldump cannot decrypt the message, unless the cipher choice
is explicitely changed using the -cipher option. Netscape does not support
EDH ciphers and defaults to RC4-MD5 when using an openssl server, so
decryption is possible.
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
