Skip to content

SSLKEYLOGFILE is not containing TLSv1.3 secrets #3994

@br-olf

Description

@br-olf

When using mitmproxy with the SSLKEYLOGFILE environment variable TLSv1.3 keys are not exported or correctly labeled.

I want to analyze and decrypt TLSv1.3 traffic of an application with mitmproxy and Wireshark.
I configured a gateway running mitmproxy in transparent mode and inside mitmproxy the traffic gets decrypted but Wireshark can not decrypt the captured data using the keylogfile provided by mitmproxy.
After some research I found this presentation regarding the decryption of TLSv1.3 traffic with Wireshark. On Slide 9 there is a keylogfile example for decrypting TLSv1.3.
In the keylogfile provided by mitmproxy I can't find any lines starting with CLIENT_HANDSHAKE_TRAFFIC_SECRET, CLIENT_TRAFFIC_SECRET_0 nor EXPORTER_SECRET but only ones starting with CLIENT_RANDOM.

Steps to reproduce the behavior:

  1. Export the SSLKEYLOGFILE environment variable
  2. Setup mitmproxy in transparent monde
  3. Open a website using TLSv1.3
  4. Check the keylogfile

System Information

Mitmproxy: 5.1.1 binary
Python: 3.7.6
OpenSSL: OpenSSL 1.1.1f 31 Mar 2020
Platform: Linux-5.5.0-kali2-amd64-x86_64-with-debian-kali-rolling

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions