C#•16mo ago

HTTPS payload decryption using root authorized private key

How could one decrypt HTTPS payload using a root authorized private-key in a .NET application?

canton7•9/21/24, 12:11 PM

$details

Ccanton7 $details

MODiX•9/21/24, 12:11 PM

When you ask a question, make sure you include as much detail as possible. Such as code, the issue you are facing, what you expect the result to be, what .NET version you are using and what platform/environment (if any) are relevant to your question. Upload code here https://paste.mod.gg/, save, and copy the link into chat for others to see your shared code! (see $code for more information on how to paste your code)

canton7•9/21/24, 12:11 PM

About the only thing I can say in response to a question that vague is ".NET provides classes to encrypt and decrypt data. Use them"

canton7•9/21/24, 12:12 PM

Where did this encrypted payload come from? Why wasn't it decrypted automatically using TLS when you downloaded it?

canton7•9/21/24, 12:14 PM

(For example, you rarely use asymmetric crypto to encrypt something big, like a HTTP payload. You use the asymmetric keys to share some private session-specific symmetric keys, and then use those, as symmetric crypto is a lot quicker. So the question itself doesn't really make sense anyway, as normally HTTPS payloads aren't encrypted with asymmetric keys)

OliwerOP•9/21/24, 12:22 PM

HTTPS payloads captured using sharppcap. I have the private key from a trusted root certificate, I am just not sure of how to decrypt the array of bytes appropriately. I've tried researching for quite a while, but to no avail.

canton7•9/21/24, 12:23 PM

You can't, AFAIK.

canton7•9/21/24, 12:24 PM

Well, unless you capture the TLS handshake

OliwerOP•9/21/24, 12:24 PM

I got the handshake.

OliwerOP•9/21/24, 12:24 PM

private static void Device_OnPacketArrival(object sender, PacketCapture e)
{
  if (!next)
  {
    return;
  }

  var capture = e.GetPacket();
  if (capture == null)
  {
    return;
  }

  var packet = capture.GetPacket();
  if (packet is not EthernetPacket ethernetPacket || !packet.HasPayloadPacket)
  {
    return;
  }

  var payloadPacket = packet.PayloadPacket;
  if (payloadPacket.PayloadPacket is TcpPacket tcp)
  {
    // HANDSHAKE
    if (tcp.PayloadData.Length > 0 && tcp.PayloadData[0] == 0x16)
    {
      // TODO
    }
  }
}

private static void Device_OnPacketArrival(object sender, PacketCapture e)
{
  if (!next)
  {
    return;
  }

  var capture = e.GetPacket();
  if (capture == null)
  {
    return;
  }

  var packet = capture.GetPacket();
  if (packet is not EthernetPacket ethernetPacket || !packet.HasPayloadPacket)
  {
    return;
  }

  var payloadPacket = packet.PayloadPacket;
  if (payloadPacket.PayloadPacket is TcpPacket tcp)
  {
    // HANDSHAKE
    if (tcp.PayloadData.Length > 0 && tcp.PayloadData[0] == 0x16)
    {
      // TODO
    }
  }
}

OliwerOP•9/21/24, 12:24 PM

Here's my current situation.

OliwerOP•9/21/24, 12:26 PM

I'm assuming this (but a lot more complex) is how Fiddler does it, since they also use a trusted root certificate key.

canton7•9/21/24, 12:28 PM

IIRC fiddler MITM's the traffic?

OliwerOP•9/21/24, 12:30 PM

It seems it does.

canton7•9/21/24, 12:30 PM

I have the private key from a trusted root certificate

So you have the actual private key that the server used for the TLS connection? But you don't have the private key which the browser used?

OliwerOP•9/21/24, 12:30 PM

dangit

OliwerOP•9/21/24, 12:30 PM

I generated a self-signed one and added it to the trusted root certificates and do not have the browser one.

canton7•9/21/24, 12:31 PM

So the server was running on localhost, or...?

OliwerOP•9/21/24, 12:31 PM

Yes.

canton7•9/21/24, 12:31 PM

Googling around, it seems the normal wya to do this is to configure the browser to create a key log file, which contains the various TLS session keys that it used. Wireshark at least can then use those to decrypt the traffic

OliwerOP•9/21/24, 12:34 PM

I'll have a look at giving that a shot, thanks.

canton7•9/21/24, 12:35 PM

This looks like your question: https://security.stackexchange.com/questions/71309/it-is-possible-to-decrypt-https-with-the-private-public-pair-if-it-uses-dhe

Information Security Stack Exchange

it is possible to decrypt HTTPS with the (private, public) pair if ...

Assuming you have a PCAP file with HTTPS traffic and having the key pair (private & public), it is possible to decrypt the traffic if it uses Diffie Hellman Ephemeral? Using openSSL lib for exa...

OliwerOP•9/21/24, 12:40 PM

Going out on a whim here, it's more or less the MITM route recommended?

OliwerOP•9/21/24, 12:40 PM

The only thing is, I can't do that cause it would slow down the networking so it wouldn't be able to run infinitely while doing other stuff. It's meant to be a user application.

canton7•9/21/24, 12:41 PM

I don't know if there is a "recommended" way to decrypt all encrypted traffic. That rather defeats the point of the encryption, no?

OliwerOP•9/21/24, 12:42 PM

Of course.

canton7•9/21/24, 12:42 PM

It's explicitly meant to be hard to decrypt it, so it's likely that there are no "good" options

OliwerOP•9/21/24, 12:43 PM

That's unfortunate. I'll have to stick with the chrome extension route of capturing the requests.

OliwerOP•9/21/24, 12:43 PM

Thank you for your time once again, canton.

private static void Device_OnPacketArrival(object sender, PacketCapture e) { if (!next) { return; } var capture = e.GetPacket(); if (capture == null) { return; } var packet = capture.GetPacket(); if (packet is not EthernetPacket ethernetPacket || !packet.HasPayloadPacket) { return; } var payloadPacket = packet.PayloadPacket; if (payloadPacket.PayloadPacket is TcpPacket tcp) { // HANDSHAKE if (tcp.PayloadData.Length > 0 && tcp.PayloadData[0] == 0x16) { // TODO } } }

HTTPS payload decryption using root authorized private key

Similar Threads

Similar Threads

Similar Threads