Extract master key from TLS Session with Network.framework

Question

ecnepsnai OP

Created May ’22

Replies 1

Boosts 0

Views 1.3k

Participants 2

Is it possible to extract the master key from a TLS session when using the network framework?

libssl 1.1.1 and newer offers a native way using SSL_CTX_set_keylog_callback, does the network framework offer something similar?

The master key is quite useful for debugging TLS connections as it can be fed into programs like Wireshark to decrypt captured messages.

Answered by Systems Engineer in 712593022

The API that you're looking for here is sec_protocol_metadata_create_secret which correlates with SSL_export_keying_material in BoringSSL. I have tried this between two BoringSSL backed connections that use Network Framework and everything did work correctly when using TLS 1.2. When using a BoringSSL based client and a OpenSSL based server there have been some known issues getting the master key and that is being tracked in (r. 78510866). If you experience and issue here, please open a bug report.

Boost

Answer 1

Systems Engineer OP

Apple

May ’22

Accepted Answer

The API that you're looking for here is sec_protocol_metadata_create_secret which correlates with SSL_export_keying_material in BoringSSL. I have tried this between two BoringSSL backed connections that use Network Framework and everything did work correctly when using TLS 1.2. When using a BoringSSL based client and a OpenSSL based server there have been some known issues getting the master key and that is being tracked in (r. 78510866). If you experience and issue here, please open a bug report.

1