Extracting the keys about scapy-ssl_tls

[alexmgr]

Hi Chaitanya,

Glad the tool helps!

(b) is trivial. Keys are stored inside the TLSSessionCtx. This is accessible via the tls_ctx property of the TLSSocket, or you can just build a TLSSessionCtx yourself.
From there, you can access the crypto material using:

tls_socket_ctx = tls_socket.tls_ctx
client_mac = tls_socket_ctx.session.key.client.mac
# Repeat for other crypto material

You can also convert to hex using the standard binascii module

>>> a = '-a\xc4\xdc\xb8\xb0\r\x0ck\xabK\x93\xe4\x9b\xb4\x0b\x86\xeb\x1f'
>>> import binascii
>>> binascii.hexlify(a)
'2d61c4dcb8b00d0c6bab4b93e49bb40b86eb1f'
>>> binascii.unhexlify(_)
'-a\xc4\xdc\xb8\xb0\r\x0ck\xabK\x93\xe4\x9b\xb4\x0b\x86\xeb\x1f'

Regarding (a), to get access to the master key (I'm assuming you're using RSA as key exchange), you can access tls_ctx.crypto.session.premaster_secret after the client hello. That will allow you to seed the PRF and derive the keys you need. The thing is that we currently generate the keys after the ClientKeyExchange, so you'll have to override the generated crypto material with the one you generate after that (always in the TLSSessionCtx)

Hope that helps!

[ch4174nya]

Yes, thanks that helped!