OpenSSL - Find the AES key

Question

I created a SSL socket in C between a client and a host using the OpenSSL library. I need the AES key of a SSL session to encrypt correctly a message and I can't use the standard functions ssl_write and ssl_read. I found that there is a struct called AES_KEY, but I don't know how I can found it!

SSL_write and SSL_read work correctly only with packet type: 23 ("Application protocol")

How can I decrypt, for example, an SSL Hello Message that come from server (i opened the SSL channel with this server)? How can I encrypt an SSL Hello Client (it's in clair) that comes from an other client?

I'm trying to demonstrate an attack during the phase of "TLS Renegotiation" of TLS Protocol. I'm trying to simulate an attack MITM with a custom proxy.

Now, the server send to proxy a certain number of encrypted messages of type 22 (Handshake) and 20 (ChangeCipherSpec). How can I read these messages and decrypt them? The standard library ssl_read works only with messages 23 (Application).

Moreover, the client send to proxy a client Hello and other messages of type 22 and 20. How can I write these messages and encrypt them? I tried using ssl_write, but the server doesn't understand these messages.

Answer 1

Instead of manually (en|de)crypting records, you should use SSL_CTX_set_info_callback to get at the information you want.

Answer 2

I found the solution. The functions are:

int ssl3_read_bytes (SSL *s, int type, unsigned char *buf, int len, int peek);
int ssl3_write_bytes (SSL *s, int type, const void *buf_, int len);