openssl 명령줄 도구 8을 사용하여 SSL 트래픽을 해독합니다.

Question

내 스크립트의 마지막 단계에서는 해독을 수행하는 데 사용할 클라이언트 암호화 키를 얻기 위해 다음 단계를 수행했습니다.

클라이언트.랜덤 xxd -p crnd.bin

5b689404b500456eef2f1a79ec782eb3eeaac3a8d7c02ae03c8426f363b1
8a33

server.random xxd - srnd.bin

5b6894043bb1289e158b0278ef66dc53c9fa71e75e900739af2657cd4476
ec1e

(echo -n 키 확장 ; cat srnd.bin crnd.bin) > master_seed.key
xxd -p master_seed.key

6b657920657870616e73696f6e 5b6894043bb1289e158b0278ef66dc53c9
fa71e75e900739af2657cd4476ec1e 5b689404b500456eef2f1a79ec782e
b3eeaac3a8d7c02ae03c8426f363b18a33
note: as before the spaces are not there I added them for clarity

key=$(cat master_secret.hex)                                                                        
openssl dgst -sha256 -mac hmac -macopt hexkey:$key <master_seed.key -binary >a1
openssl dgst -sha256 -mac hmac -macopt hexkey:$key <a1 -binary >a2
openssl dgst -sha256 -mac hmac -macopt hexkey:$key <a2 -binary >a3
openssl dgst -sha256 -mac hmac -macopt hexkey:$key <a3 -binary >a4
##
cat a1 master_seed.key | openssl dgst -sha256 -mac hmac -macopt hexkey:$key -binary >k1
cat a2 master_seed.key | openssl dgst -sha256 -mac hmac -macopt hexkey:$key -binary >k2
cat a3 master_seed.key | openssl dgst -sha256 -mac hmac -macopt hexkey:$key -binary >k3
cat a4 master_seed.key | openssl dgst -sha256 -mac hmac -macopt hexkey:$key -binary >k4
cat k1 k2 k3 k4 | head -c104 | xxd -p -c104 > k1_k4.hex
truncate -s-1 k1_k4.hex

$cat k1_k4.hex
64666eafe1cbd51f2e2b50799b40f6007c3dc56fe0aac1312d35b5e8b6bf9af6ecf07e1dff27c784
4bf20108190203c4210ff9df6c4eb6e907ddd1f49646ab4b243c80a6ae9b4808ca94445e3d771d3e
06b71ee0deb4c1879986c4c6a4b78bf1c3c1083a6ddce9ff
dd bs=40 count=1 if=k1_k4.hex of=cmackey.hex 2>/dev/null
dd bs=40 count=1 skip=1 if=k1_k4.hex of=smackey.hex 2>/dev/null
dd bs=80 skip=1 if=k1_k4.hex 2>/dev/null | dd bs=64 count=1 of=cenckey.hex 2>/dev/null
dd bs=80 skip=1 if=k1_k4.hex 2>/dev/null | dd bs=64 skip=1 count=1 of=senckey.hex 2>/dev/null

$cat cmackey.hex

64666eafe1cbd51f2e2b50799b40f6007c3dc56f

$cat smakey.hex

e0aac1312d35b5e8b6bf9af6ecf07e1dff27c784

$cat 센키.hex

4bf20108190203c4210ff9df6c4eb6e907ddd1f49646ab4b243c80a6ae9b4808

$cat 센키.hex

ca94445e3d771d3e06b71ee0deb4c1879986c4c6a4b78bf1c3c1083a6ddce9ff

암호화된 핸드셰이크 Wireshark 로그

TLSv1.2 Record Layer: Handshake Protocol: Encrypted Handshake Message
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 64
    Handshake Protocol: Encrypted Handshake Message

Handshake Protocol: Encrypted Handshake Message
16030300409a1bf36b786c3b5985617c76afd985d68ffdaf
6d9f1a25ef40159702b5adef402bdb5196ce76a93fd73049
3accf929447fa9c6f1172d6b4035f5578ebfe95c6d

암호화된 데이터만 저장(cenc.dat의 마지막 64바이트) $xxd -p cenc.dat

9a1bf36b786c3b5985617c76afd985d6 8ffdaf6d9f1a25ef40159702b5ad
ef402bdb5196ce76a93fd730493accf929447fa9c6f1172d6b4035f5578e
bfe95c6d
Note: space added again for clarity

$xxd -p iv.bin

9a1bf36b786c3b5985617c76afd985d6

$xxd -p encmsg.bin

8ffdaf6d9f1a25ef40159702b5adef402bdb5196ce76a93fd730493accf9
29447fa9c6f1172d6b4035f5578ebfe95c6d

마지막

$cat encmsg.bin | openssl aes-256-cbc -d -K $key -iv $iv -nopad |xxd
gives the same result of bad decrypted data not a finished (14) record

Dave, 내 출력 바이트를 바이트 단위로 비교할 때 내 단계에는 아무런 문제가 없습니다. 나는 이 작업을 수동으로 12번 이상 검토하고 스크립트를 호출했는데 완료 메시지까지 해독되지 않는다고 지적한 것과 동일한 잘못된 출력을 얻었습니다. 여기서 뭔가 발견하셨나요? 감사해요