# Is it possible to create an SSL key which doesn't actually encrypt the data? **URL:** \ **Category:** Factual Questions\ **Created:** [December 4, 2014, 9:24pm UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348 "2014-12-04T21:24:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [December 4, 2014, 9:24pm UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/1 "2014-12-04T21:24:27Z")
The SSL key is typically used to encrypt data sent over a network to prevent someone from being able to snoop and read the data. But what if you wanted all the SSL infrastructure but didn’t want the data actually encrypted. Would there be a way to create a valid, standard SSL key which would not actually cause the data to be encrypted? A certain algorithm or keylength=0 perhaps? In my environment, I often have to work with client-server programs which talk over secure sockets. Some of these programs are written here, some of them are external programs (database, webserver, etc). Sometimes I need to debug a problem and it would be extremely useful to be able to view the network data in clear text to see what’s going on. Sometimes I can modify or configure a program to use normal sockets, but that’s not always the case, and it’s not always simple. Not all programs have that option and source code changes would be necessary. However, one thing I can always easily do is configure the SSL keys that the programs use. If I can create an SSL key which didn’t actually encrypt the data, I can easily configure the programs to use that and I could then view the network data. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [December 4, 2014, 11:02pm UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/2 "2014-12-04T23:02:30Z")
What are you using to view the data? Looks like [Wireshark](http://wiki.wireshark.org/SSL) will let you import a key and use that to decrypt your capture. So, rather than encrypting with no key, you can encrypt with a known key and then view the cleartext. I should point out that I have little idea of the actual implementation of wireshark, ssl, or most network protocols, so it’s possible that I’ve missed the point entirely. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [December 4, 2014, 11:04pm UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/3 "2014-12-04T23:04:10Z")
Can you configure WireShark to decrypt the SSL traffic with your private key? [http://wiki.wireshark.org/SSL](http://wiki.wireshark.org/SSL) and [http://support.citrix.com/article/CTX116557](http://support.citrix.com/article/CTX116557) From the command line, this article describes other tools you can use to decrypt SSL traffic so higher level protocols can be seen: [http://prefetch.net/articles/debuggingssl.html](http://prefetch.net/articles/debuggingssl.html) You could conceivably modify your stuff to use SSL only for authentication and not content encryption, but that’s harder when you don’t control all the devices/services in question because they will just use the regular implementation, not your custom one. ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [December 4, 2014, 11:33pm UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/4 "2014-12-04T23:33:57Z")
> [@filmore](#): > > The SSL key is typically used to encrypt data sent over a network to prevent someone from being able to snoop and read the data. But what if you wanted all the SSL infrastructure but didn’t want the data actually encrypted. Would there be a way to create a valid, standard SSL key which would not actually cause the data to be encrypted? A certain algorithm or keylength=0 perhaps? > > In my environment, I often have to work with client-server programs which talk over secure sockets. Some of these programs are written here, some of them are external programs (database, webserver, etc). Sometimes I need to debug a problem and it would be extremely useful to be able to view the network data in clear text to see what’s going on. Sometimes I can modify or configure a program to use normal sockets, but that’s not always the case, and it’s not always simple. Not all programs have that option and source code changes would be necessary. However, one thing I can always easily do is configure the SSL keys that the programs use. If I can create an SSL key which didn’t actually encrypt the data, I can easily configure the programs to use that and I could then view the network data. Not a key. You can configure the SSL server to accept a NULL cipher, and the client to request it. The NULL cipher enables the use of SSL connections without any encryption. In most circumstances, using it is a terrible mistake. If your servers accept the NULL cipher, all you have to do is configure clients to ask for it. If your servers don’t accept the NULL cipher, and you don’t control the servers, you’re out of luck. But at least the administrators of the servers aren’t hosting an active vulnerability. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [December 5, 2014, 1:29am UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/5 "2014-12-05T01:29:29Z")
> [@iamthewalrus\_3](#): > > What are you using to view the data? > > Looks like [Wireshark](http://wiki.wireshark.org/SSL) will let you import a key and use that to decrypt your capture. So, rather than encrypting with no key, you can encrypt with a known key and then view the cleartext. To view the data, I typically just use a proxy server that I wrote myself to sit in the middle. I configure the client to connect to my proxy’s port and then I forward the data back and forth to the server. I have my proxy print the data it receives and I can see what is being sent. I wish I could use 3rd-party tools like Wireshark, but I’m typically debugging on all kinds of varied operating systems and hardware platforms in labs that are scattered everywhere. I’m just using platform-independent languages like java and python that I can easily copy over and run. But I guess I could do the same thing as Wireshark. Since I have the server’s keys, I can use them to decrypt and encrypt the data. It would be like a man-in-the-middle attack. ---
**Author:** ![kferr](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kferr](https://boards.straightdope.com/u/kferr)\ **Post date:** [December 5, 2014, 11:37am UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/6 "2014-12-05T11:37:55Z")
Just to be pedantic - it’s not the SSL private key that’s used to encrypt the traffic. The private key is used to encrypt a session key that is then used to encrypt the traffic. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [December 5, 2014, 3:34pm UTC](https://boards.straightdope.com/t/is-it-possible-to-create-an-ssl-key-which-doesnt-actually-encrypt-the-data/706348/7 "2014-12-05T15:34:13Z")
> [@filmore](#): > > To view the data, I typically just use a proxy server that I wrote myself to sit in the middle. I configure the client to connect to my proxy’s port and then I forward the data back and forth to the server. I have my proxy print the data it receives and I can see what is being sent. > > I wish I could use 3rd-party tools like Wireshark, but I’m typically debugging on all kinds of varied operating systems and hardware platforms in labs that are scattered everywhere. I’m just using platform-independent languages like java and python that I can easily copy over and run. > > But I guess I could do the same thing as Wireshark. Since I have the server’s keys, I can use them to decrypt and encrypt the data. It would be like a man-in-the-middle attack. You can also configure Wireshark, on a laptop you control, to use “promiscuous mode” and listen to all traffic on the network it’s connected to. Then you can filter by source/destination IP. And I bet there are Linux distros that can help you with all this, although it wouldn’t be hard to install all the tools on any standard distro.