mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-27 05:21:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

updating docs to reflect security risks for SSLKEYLOGFILE

Browse Source 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25297)
This commit is contained in:
Neil Horman 2024-10-09 10:16:49 -04:00 committed by Matt Caswell
parent 6f7273a9b0
commit 5dffe6afb0
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
INSTALL.md
View File

@ -1083,7 +1083,10 @@ See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details
Build with support for the SSLKEYLOGFILE environment variable
When enabled, setting SSLKEYLOGFILE to a file path records the keys exchanged
during a TLS handshake for use in analysis tools like wireshark.
during a TLS handshake for use in analysis tools like wireshark. Note that the
use of this mechanism allows for decryption of application payloads found in
captured packets using keys from the key log file. See Section 3 of
[the draft standard for SSLKEYLOGFILE](https://datatracker.ietf.org/doc/draft-thomson-tls-keylogfile/)
### no-ts

6
doc/man7/openssl-env.pod
View File

@ -194,7 +194,11 @@ Used to produce the standard format output file for SSL key logging. Optionally
set this variable to a filename to log all secrets produced by SSL connections.
Note, use of the environment variable is predicated on configuring OpenSSL at
build time with the enable-sslkeylog feature. The file format standard can be
found at L<https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/>
found at L<https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/>.
Note: the use of B<SSLKEYLOGFILE> poses an explicit security risk. By recording
the exchanged keys during an SSL session, it allows any available party with
read access to the file to decrypt application traffic sent over that session.
Use of this feature should be restricted to test and debug environments only.
=back