Resumed SSL session and decryption

Hi,

I was under impression that if RSA key exchange is used - so no Forward Secrecy or Perfect Forward Secrecy involved then master secret is always the same, generated by both sides using shared pre-master secret. That is reason to use FS or PFS.

That is as well info in all great videos about PFS posted on your site (John, thanks again).

So knowing pre-master should be enough to decrypt resumed session - of course if pre-master was captured when full SSL handshake was performed for that session.

All the logic for session resumption (at least my understanding) is to not go through new master secret generation and use master secret that is still in both client and server memory (identified by Session ID).

So it seems some limitation of Wireshark, which refuses to use pre-master configured if it can't see full SSL handshake, maybe because it can't connect configured pre-master with resumed session because of not being aware that Session ID send by client to use resume is the one for which configured pre-master should be used?

If above is true then it's quite a problem, but probably one that can be overcome - but not using Wireshark?

Piotr

Based on what I'm seeing in RFC5246, this would be a more complete statement:

generated by both sides using shared pre-master secret and the client_random and server_random headers exchanged during the initial SSL handshake.

Still when session is resumed I doubt there is any pre-master exchange (will have to verify using packet capture), sure for generating pre-master in full SSL handshake random number is used - I can clearly recall it.

But if for resumed session again random number is exchanged then it will force recalculation of master secret, so for me denying benefits of resume - which if I am not wrong is to avoid costly master secret calculation, but maybe I am wrong?

Anyway, from tests when pre-master is configured and trace contains full SSL handshake session all resumed sessions are ddecrypted.

If new trace is started, so not SSL full handshake in the trace then nothing can be decrypted.

If new random number would be used for resumed session then pre-master from full handshake should not change anything in decrypting trace - even containing full handshake - or I am wrong here?

Piotr

Below stating "session's master_secret" seem to indicate new randoms are associated with an existing master_secret:

When a connection is established by resuming a session, new ClientHello.random and ServerHello.random values are hashed with the session's master_secret.

https://tools.ietf.org/html/rfc5246appendix-F.1.4

But the question remains (for me); does Wireshark need the randoms from the initial, full handshake?

Well, so in short, it's only possible to decrypt resumed session when:

• There is full handshake session in the trace along with resumed sessions
• There is either private key or pre-master from full handshake configured in Wireshark

If trace does not contain full handshake session, resumed session are not possible to be decrypted even having private key or pre-master from original full handshake session.

Is above true?

Piotr