Method and apparatus for decryption of encrypted SSL data from packet traces

A computer readable memory comprising computer readable instructions that, when executed by a processor of a first device, cause the processor to perform operations, the operations comprising:

• obtaining, from a library of the first device, a pre-master secret value and a master secret value associated with a session key for a communication session between the first device and a second device, the library being instrumented to log the pre-master secret value and the master secret value during handshaking between the first device and the second device, and the session key being based on the pre-master secret value, the master secret value and data strings exchanged between the first device and the second device during the handshaking;
• capturing a packet level trace corresponding to the communication session, the packet level trace including the data strings and encrypted data associated with the communication session;
• determining the session key based on the pre-master secret value, the master secret value and the data strings without use of a proxy, wherein the determining of the session key includes:
• evaluating a function with the pre-master secret value and the data strings to determine an output value of the function;
• and
• comparing the output value of the function with the master secret value to determine that the master secret value is associated with the encrypted data;
• and
• decrypting the encrypted data of the packet level trace with the session key to obtain decrypted data for traffic measurement.

A method comprising:

• obtaining, from a library of a first device, a pre-master secret value and a master secret value associated with a session key for a communication session between the first device and a second device, the library being instrumented to log the pre-master secret value and the master secret value during handshaking between the first device and the second device, and the session key being based on the pre-master secret value, the master secret value and data strings exchanged between the first device and the second device during the handshaking;
• capturing, by executing first instructions with a processor of the first device, a packet level trace corresponding to the communication session, the packet level trace including the data strings and encrypted data associated with the communication session;
• determining, by executing second instructions with the processor of the first device, the session key based on the pre-master secret value, the master secret value and the data strings without use of a proxy, wherein the determining of the session key includes:
• evaluating a function with the pre-master secret value and the data strings to determine an output value of the function;
• and
• comparing the output value of the function with the master secret value to determine that the master secret value is associated with the encrypted data;
• and
• decrypting, by executing third instructions with the processor of the first device, the encrypted data of the packet level trace with the session key to obtain decrypted data for traffic measurement.