I guess I just wasn't waiting long enough. I don't know if ssldump is in
need of some fflushs (maybe FreeBSD cashes too much stdout) or the process
of decryption is that slow but everything works as expected.
I'll be using Netscape for now since it uses RSA.
Thanks,
roberto.
-----Original Message-----
From: Lutz Jaenicke [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 18, 2001 3:52 AM
To: [EMAIL PROTECTED]
Subject: Re: ssl/ssldump question
On Tue, Apr 17, 2001 at 08:38:45PM -0400, Greg Stark wrote:
> What you need is the server private key (and of course the password to
> decrypt it). You appear to have it, but I would double check with the
> openssl rsa command. ssldump will silently ignore an incorrect password.
>
> Also, ssldump will not decrypt resumed ssl sessions. You can detect
whether
> the session was resumed by looking at the session id's in the clear text
> handshake messages.
And ssldump can only decrypt sessions with static RSA. It cannot decrypt
communication with EDH cyphers. Since s_server has default DH parameters
built in, an openssl s_client connecting to an s_server will use a EDH
cipher and ssldump cannot decrypt the message, unless the cipher choice
is explicitely changed using the -cipher option. Netscape does not support
EDH ciphers and defaults to RC4-MD5 when using an openssl server, so
decryption is possible.
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
