4 ms·
Only if you also disable all ciphers with perfect forward secrecy and hope that there is still a cipher overlap with the server.
by mr_mitm 5y ago
Only if you also disable all ciphers with perfect forward secrecy and hope that there is still a cipher overlap with the server.
- netresec 5y agoMitM'ing the traffic using a trusted root CA allows TLS traffic to be decrypted, even if perfect forward secrecy is used. That's what we did to produce the decrypted PCAP shown in the Wireshark screenshot.
- mr_mitm 5y agoIf you use an HTTP proxy or terminate the TLS connection in some other way, yes. I was thinking of the situation where you use Wireshark directly on one of the endpoints, i.e. a passive MitM attack.