<div dir="ltr">Hi!<div><br></div><div>There is currently no supported way. ERL-166 <a href="https://bugs.erlang.org/browse/ERL-166">https://bugs.erlang.org/browse/ERL-166</a> talks about the possibility to add such a feature. We have not had time to look further into this as yet.</div><div>Of course, it is possible to provide such an API, although it seems to me that the use case is violating the concept of using TLS in the first place. It can, of course, be argued that if you have access to the erlang node you may dig out the information anyway even if it might be a dirty hack. </div><div><br></div><div>Regards Ingela Erlang/OTP team - Ericsson AB</div><div> </div><div><div class="gmail_extra"><br><div class="gmail_quote">2017-01-06 0:13 GMT+01:00 Technion <span dir="ltr"><<a href="mailto:technion@lolware.net" target="_blank">technion@lolware.net</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_-2976021733040612702divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:calibri,arial,helvetica,sans-serif" dir="ltr">
<p>Hi,</p>
<p><br>
</p>
<p>Is it a solution to for you to deal with it on the client side?</p>
<p><br>
</p>
<p><a class="gmail-m_-2976021733040612702OWAAutoLink" id="gmail-m_-2976021733040612702LPlnk962117" href="https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/" target="_blank">https://jimshaver.net/2015/02/<wbr>11/decrypting-tls-browser-<wbr>traffic-with-wireshark-the-<wbr>easy-way/</a></p>
<br>
<p>Chrome lets you write keys out.<br>
</p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-2976021733040612702x_divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> <a href="mailto:erlang-questions-bounces@erlang.org" target="_blank">erlang-questions-bounces@<wbr>erlang.org</a> <<a href="mailto:erlang-questions-bounces@erlang.org" target="_blank">erlang-questions-bounces@<wbr>erlang.org</a>> on behalf of Roger Lipscombe <<a href="mailto:roger@differentpla.net" target="_blank">roger@differentpla.net</a>><br>
<b>Sent:</b> Friday, 6 January 2017 1:20 AM<br>
<b>To:</b> <a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<b>Subject:</b> [erlang-questions] SSL: Getting master_secret and client_random (or premaster_secret)</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt">
<div class="gmail-m_-2976021733040612702PlainText"><span class="gmail-">We're using ECDHE and DHE ciphers for our SSL connections. This<br>
provides perfect forward secrecy, which is good, but it makes it<br>
impossible to decipher packet captures in wireshark, which is<br>
expected, and also good, almost all of the time.<br>
<br>
Sometimes, however, we *do* need to decipher the traffic.<br>
<br>
Note that we own both the client (which is embedded) and the server<br>
(which uses Erlang -- otherwise I wouldn't be asking here -- and<br>
ranch). We *could* offer a different cipher suite on the server, which<br>
would disable PFS, but would do it for all connections. I'd prefer<br>
something a bit more fine-grained.<br>
<br>
You can feed a key log to Wireshark, as documented at<br>
<a id="gmail-m_-2976021733040612702LPlnk105502" href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format" target="_blank">https://developer.mozilla.org/<wbr>en-US/docs/Mozilla/Projects/<wbr>NSS/Key_Log_Format</a>,
</span><div id="gmail-m_-2976021733040612702LPBorder_GT_14836579749510.7550493720960958" style="width:100%;text-indent:0px;overflow:auto;margin-bottom:20px">
<table id="gmail-m_-2976021733040612702LPContainer_14836579749480.09298413908458358" style="width:90%;overflow:auto;padding-top:20px;padding-bottom:20px;margin-top:20px;border-top:1px dotted rgb(200,200,200);border-bottom:1px dotted rgb(200,200,200);background-color:rgb(255,255,255)" cellspacing="0">
<tbody>
<tr valign="top">
<td id="gmail-m_-2976021733040612702ImageCell_14836579749480.8447368874211827" style="width:250px;padding-right:20px;display:table-cell" colspan="1">
<div id="gmail-m_-2976021733040612702LPImageContainer_14836579749490.25111797783830303" style="margin:auto;width:250px;height:250px;display:table;background-color:rgb(255,255,255)">
<a id="gmail-m_-2976021733040612702LPImageAnchor_14836579749490.8039190045842564" style="text-align:center;display:table-cell" href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format" target="_blank"><img width="250" height="250" id="gmail-m_-2976021733040612702LPThumbnailImageID_14836579749490.7090204134466074" style="border-width: 0px; width: 250px; height: 250px; vertical-align: bottom; display: inline-block; max-height: 250px; max-width: 250px;" src="https://developer.cdn.mozilla.net/static/img/opengraph-logo.dc4e08e2f6af.png"></a></div>
</td>
<td id="gmail-m_-2976021733040612702TextCell_14836579749500.29855108854098766" style="padding:0px;vertical-align:top;display:table-cell" colspan="2">
<div id="gmail-m_-2976021733040612702LPRemovePreviewContainer_14836579749500.9195631725782705"></div>
<div id="gmail-m_-2976021733040612702LPTitle_14836579749500.6988805004338934" style="color:rgb(0,120,215);line-height:21px;font-family:wf_segoe-ui_light,"segoe ui light","segoe wp light","segoe ui","segoe wp",tahoma,arial,sans-serif;font-size:21px;font-weight:400">
<a id="gmail-m_-2976021733040612702LPUrlAnchor_14836579749500.7745176820296251" style="text-decoration:none" href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format" target="_blank">NSS Key Log Format - Mozilla | MDN</a></div>
<div id="gmail-m_-2976021733040612702LPMetadata_14836579749500.03182663631745308" style="margin:10px 0px 16px;color:rgb(102,102,102);line-height:14px;font-family:wf_segoe-ui_normal,"segoe ui","segoe wp",tahoma,arial,sans-serif;font-size:14px;font-weight:400">
<a href="http://developer.mozilla.org" target="_blank">developer.mozilla.org</a></div>
<div id="gmail-m_-2976021733040612702LPDescription_14836579749510.1172308378173681" style="color:rgb(102,102,102);line-height:20px;overflow:hidden;font-family:wf_segoe-ui_normal,"segoe ui","segoe wp",tahoma,arial,sans-serif;font-size:14px;font-weight:400;display:block;max-height:100px">
Key logs can be written by NSS so that external programs can decrypt TLS connections. Wireshark 1.6.0 and above can use these log files to decrypt packets.</div>
</td>
</tr>
</tbody>
</table>
</div><span class="gmail-">
<br>
<br>
and it'll correctly decipher the traffic for that connection.<br>
<br>
I'd like to find a way to generate a key log file. This requires<br>
either (client_random, master_secret) or (encrypted_premaster_secret,<br>
premaster_secret).<br>
<br>
Note that I'm looking at the OTP 17.5 source, because that's what we're using.<br>
<br>
It would seem that premaster_secret is not stored past the initial<br>
negotiation, but the client_random and master_secret values are in the<br>
#security_parameters record in the #connection_state record in the<br>
#connection_states record, which is in the #state record of the SSL<br>
connection pid.<br>
<br>
But I can't see any (clean) way to retrieve these values, in order to<br>
generate a key log suitable for Wireshark.<br>
<br>
Is there any clean way to do this in OTP 17.5, or is there a supported<br>
way to do this in OTP 18.x or 19.x?<br>
<br>
Regards,<br>
Roger.<br>
______________________________<wbr>_________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a id="gmail-m_-2976021733040612702LPlnk900480" href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/<wbr>listinfo/erlang-questions</a>
</span><div id="gmail-m_-2976021733040612702LPBorder_GT_14836579749570.8380948533698385" style="width:100%;text-indent:0px;overflow:auto;margin-bottom:20px">
<table id="gmail-m_-2976021733040612702LPContainer_14836579749560.5839414675615475" style="width:90%;overflow:auto;padding-top:20px;padding-bottom:20px;margin-top:20px;border-top:1px dotted rgb(200,200,200);border-bottom:1px dotted rgb(200,200,200);background-color:rgb(255,255,255)" cellspacing="0">
<tbody>
<tr valign="top">
<td id="gmail-m_-2976021733040612702TextCell_14836579749560.6789299028237197" style="padding:0px;vertical-align:top;display:table-cell" colspan="2">
<div id="gmail-m_-2976021733040612702LPRemovePreviewContainer_14836579749560.14563166379937442"></div>
<div id="gmail-m_-2976021733040612702LPTitle_14836579749560.907391741878246" style="color:rgb(0,120,215);line-height:21px;font-family:wf_segoe-ui_light,"segoe ui light","segoe wp light","segoe ui","segoe wp",tahoma,arial,sans-serif;font-size:21px;font-weight:400">
<a id="gmail-m_-2976021733040612702LPUrlAnchor_14836579749570.8216478403417253" style="text-decoration:none" href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">erlang-questions Info Page</a></div>
<div id="gmail-m_-2976021733040612702LPMetadata_14836579749570.7748328154702788" style="margin:10px 0px 16px;color:rgb(102,102,102);line-height:14px;font-family:wf_segoe-ui_normal,"segoe ui","segoe wp",tahoma,arial,sans-serif;font-size:14px;font-weight:400">
<a href="http://erlang.org" target="_blank">erlang.org</a></div>
<div id="gmail-m_-2976021733040612702LPDescription_14836579749570.874842404560624" style="color:rgb(102,102,102);line-height:20px;overflow:hidden;font-family:wf_segoe-ui_normal,"segoe ui","segoe wp",tahoma,arial,sans-serif;font-size:14px;font-weight:400;display:block;max-height:100px">
Mailing list for general discussions about Erlang/OTP, the language, implementation, usage, beginners questions, etc... To see the collection of prior postings to the ...</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
</div>
</span></font></div>
</div>
</div>
<br>______________________________<wbr>_________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/<wbr>listinfo/erlang-questions</a><br>
<br></blockquote></div><br></div></div></div>