Scribd
Upload
15 views12 pages

Analyzing MQTT with TLS Handshake

The document outlines the process of analyzing mutual TLS handshake and MQTT traffic using Wireshark, detailing the tools and setup involved. It describes the phases of the TLS protocol, including the handshake and data transfer, and provides a step-by-step procedure for capturing and decrypting MQTT messages. The results highlight the successful establishment of a secure MQTT connection using TLS 1.2 and the visibility of encrypted messages after decryption.

Uploaded by

steventanshaoxiang20
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
15 views12 pages

Analyzing MQTT with TLS Handshake

The document outlines the process of analyzing mutual TLS handshake and MQTT traffic using Wireshark, detailing the tools and setup involved. It describes the phases of the TLS protocol, including the handshake and data transfer, and provides a step-by-step procedure for capturing and decrypting MQTT messages. The results highlight the successful establishment of a secure MQTT connection using TLS 1.2 and the visibility of encrypted messages after decryption.

Uploaded by

steventanshaoxiang20
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Introduction

Objective: Analyzing mutual TLS handshake and MQTT traffic using Wireshark

Tools Used: Two mini-PC running Ubuntu with TPM1.2 chip, mosquito, wireshark

Transport Layer Security (TLS) is a cryptographic protocol designed to provide secure


communication over a network, typically the Internet. It ensures the confidentiality, integrity, and
authenticity of data exchanged between clients and servers by encrypting the data and verifying the
identities of the communicating parties. TLS operates in two main phases: the handshake phase, where
encryption keys are exchanged and verified, and the data transfer phase, where encrypted data is
exchanged using the agreed-upon keys. TLS is widely used in various applications, including web browsing
(HTTPS), email, and instant messaging, to protect sensitive information from eavesdropping, tampering,
and forgery.

Setup and Config

Broker

Client
Procedure
Broker

Start broker as an application, refer to config file, and dump tls keylog

Start wireshark as sudo to access device network interface used by MQTT, and select that interface, in this
case is enp1s0

Filter using [Link] == 8883 to only see MQTT related packets

Client

Run python code on client to connect with broker

When connected, the client will subscribe to the topic “test/topic”

The client will display simple status when connected, disconnected or when receive a message.
Publishing message

The client is already subscribed to test/topic when successfully connected to broker

Use broker to publish some message to test/topic

Received by client
Include SSL Keylogfile to decrypt MQTT application data

Handshake and message captured by Wireshark, but MQTT application data is encrypted

Add the [Link] into wireshark TLS protocol settings

Now the message is visible


Result
Packet 548: Client Hello

The client initializes the TLS handshake.

- TLS Version: The client specifies the highest version of TLS it supports (TLS 1.2)
- Cipher Suites: A list of cryptographic algorithms (cipher suites) that the client supports.
Packet 551: Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done

The broker responds with a packet containing a series of messages,

The server hello selects the cipher suites that both supports

The server presents its own certificate for the client to authenticate its identity

The server includes its ephemeral DH public key to generate a shared secret and derive a session key for
encryption
The server also requests a certificate from the client to perform mutual authentication, it specifies the types
of certificates that it is willing to accept

End with server hello done, the server tells the client that it is finished with its initial negotiation messages.
Packet 553: Certificate, Client key exchange, Certificate verity, Change cipher spec, Finished

The client responds with a packet containing a series of messages

The client presents its own certificate along with CA certificate just in case for helping the server
authenticate its identity

The client also includes its own ephemeral DH public key to the server

Certificate verify contains a digitally signed hash of previous handshake messages, proving the client has
the private key, so the server can verify this with the client public key

Change cipher spec indicates the switch to encrypted communication using the negotiated cipher suite
and keys derived from the pre-master secret.
Finished, the client tells the server that it is ready for secure data communication to begin.
Packet 555: New Session Ticket, Change Cipher Spec, Finished

This session ticket is kept by the client to use for future connections, no need to go through full handshake
again, speeding up connection process, balancing security with ux, this ticket will last for 2 hours.

The broker also changes to encrypted mode

Finished, the broker tells the client that it is ready for secure data communication to begin. End of TLS
handshake.
The MQTT connection secured using TLS1.2 and decrypted using sslkeylogfile
These captured packets reflected the actions done before (connecting/subscribing/publishing)

MQTT message is in hexadecimal ASCII format,

68656c6c6f21 = hello!

686168616861 = hahaha,

686568656865 = hehehe
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

Common questions

Powered by AI

The TLS handshake phase in MQTT traffic analysis ensures that encryption keys are securely exchanged and verified between the client and server. This phase includes client and server hello messages, certificate exchanges, and mutual authentication steps where both parties verify each other's identities. This facilitates the establishment of a secure channel for message exchange, supporting confidentiality and integrity in MQTT traffic .

The ephemeral Diffie-Hellman (DH) public key is used during the TLS handshake to enable forward secrecy by allowing parties to generate a shared secret key for encryption, which is used only for that specific session. This DH key is uniquely generated for each session and used along with each party's private key to produce a pre-master secret. The session key derived from this pre-master secret is utilized for encrypting communication, making it difficult for attackers to decrypt past communications even if they obtain private keys .

Challenges in setting up mutual TLS authentication in a broker-client MQTT environment include ensuring both the broker and client possess valid, trusted digital certificates from a recognized Certificate Authority (CA); managing certificate issuance and revocation; and handling certificate validation errors due to mismatched or expired certificates. Configuring systems to properly handle certificate exchange and processing requirements for secure mutual authentication can be complex and error-prone .

The New Session Ticket during the TLS handshake improves user experience by allowing the client to reuse a session for subsequent connections within a ticket's lifespan, typically two hours. This reduces the need for a full handshake in future connections, making the connection process faster while maintaining a balance between security and efficiency. The session ticket includes encrypted state information that ensures the security of reused sessions .

Converting message content to hexadecimal ASCII format in MQTT communication provides a universal representation of the data, which can be useful for debugging and analysis. Hexadecimal encoding is platform-independent and helps in avoiding data corruption when displaying binary or special/non-visible characters in human-readable logs or network traffic analysis tools like Wireshark .

The primary purpose of the Transport Layer Security (TLS) protocol is to provide secure communication over a network by ensuring the confidentiality, integrity, and authenticity of data exchanged between clients and servers. TLS operates in two main phases: the handshake phase, during which encryption keys are exchanged and verified, and the data transfer phase, where encrypted data is exchanged using the agreed-upon keys .

Changing the cipher spec during the TLS handshake signifies the transition from an unencrypted to an encrypted communication mode. After this change, all subsequent messages are encrypted using the negotiated cipher suite and keys, which increases data security by ensuring that communication remains confidential and integrity-protected against unauthorized access or tampering .

Adding the SSL Keylogfile to Wireshark enhances the analysis of encrypted MQTT application data by providing the necessary keys to decrypt the captured encrypted traffic. This allows analysts to view the content of MQTT messages that are transmitted under TLS encryption, aiding in troubleshooting and validation of secure communication setups .

In the TLS handshake, a certificate serves to authenticate the identity of the communicating parties. The server presents its certificate for the client to verify its identity, and may request a client certificate to perform mutual authentication. This involves verifying the digital signature on the certificate, ensuring it is signed by a trusted Certificate Authority (CA), and checking its validity. By ensuring each party's identity is authenticated, certificates help establish a secure communication channel .

The TLS protocol ensures the integrity and authenticity of data exchanged over MQTT traffic by using cryptographic hash functions and digital certificates. During the handshake, certificates are used to authenticate identities, and hash functions are used to integrate message authentication codes (MACs) within exchanged messages. This prevents eavesdropping and unauthorized data modification, protecting both integrity and authenticity .

You might also like