policy/protocols/ssl/decryption.zeek¶
- SSL¶
This script allows for the decryption of certain TLS 1.2 connections, if the user is in possession of the private key material for the session. Key material can either be provided via a file (useful for processing trace files) or via sending events via Broker (for live decoding).
Please note that this feature is experimental and can change without guarantees to our typical deprecation timeline. Please also note that currently only TLS 1.2 connections that use the TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipher suite are supported.
- Namespace
SSL
- Imports
base/frameworks/input, base/frameworks/notice, base/protocols/conn, base/protocols/ssl
Summary¶
Redefinable Options¶
This can be set to a file that contains the session secrets for decryption, when parsing a pcap file. |
|
Secrets expire after this time of not being used. |
Redefinitions¶
Events¶
This event can be triggered, e.g., via Broker to add known keys to the TLS key database. |
|
This event can be triggered, e.g., via Broker to add known secrets to the TLS secret database. |
Detailed Interface¶
Redefinable Options¶
- SSL::keylog_file¶
-
This can be set to a file that contains the session secrets for decryption, when parsing a pcap file. Please note that, when using this feature, you probably want to pause processing of data till this file has been read.
- SSL::secret_expiration¶
-
Secrets expire after this time of not being used.
Events¶
- SSL::add_keys¶
-
This event can be triggered, e.g., via Broker to add known keys to the TLS key database.
- Parameters
client_random – client random for which the key is set
keys – key material
- SSL::add_secret¶
-
This event can be triggered, e.g., via Broker to add known secrets to the TLS secret database.
- Parameters
client_random – client random for which the secret is set
secrets – derived TLS secrets material