4

In order to secure a packet capture, which method would you use to make all (or close to all) past captured packet utterly unaccessible unless a given password is given.

My habbits are

  • to mount an ecrypt partition

    mount -t ecryptfs /srv /srv

  • to run tshark with a buffer and save files on the encrypted filesystem /media/

    tshark -B 100k -i wlan0 -w /srv/capture-file.pcap

The problem with this method is that the file capture-file.pcap is only unaccessible once the ecryptfs system is unmounted.

How can I do a capture with no non-encrypted version of the capture on the system at all?

user196279
  • 71
  • 4

2 Answers2

1

The de facto standard tool for encrypting data is GnuPG (or the compatible proprietary program PGP.

Generate a key pair on the machine where you'll want to decrypt the data (gpg --gen-key). Export the public key (gpg --export …) and copy it to the machine where you'll be encrypting (of course you can skip this step if the encryption and the decryption will be done on the same machine). Then run

tshark … -w - | gpg -e >capture.pcap.gpg

To decrypt, just run gpg capture.pcap.gpg.

GnuPG can also do password-based encryption, with -c instead of -e. This is less secure for two reasons:

  • Because people tend to choose insufficiently strong passwords, and even the best memorable password isn't as strong as a randomly-generated key.
  • Because the information necessary to encrypt is also sufficient to decrypt, whereas using an asymmetric key pair makes it possible to encrypt without having the credentials to decrypt.
Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
-1

For encrypted capture

tshark -w - | openssl enc -des3 -out capture.pcap.des3

Reading with

openssl enc -d -des3 -out capture.pcap.des3 | wireshark -i - k
user196279
  • 71
  • 4
  • No. Don't do that. `openssl enc` is very bad: it doesn't use a proper password derivation function. See e.g. [Cryptosense](https://cryptosense.com/weak-key-derivation-in-openssl/), [how to securely hash passwords](http://security.stackexchange.com/questions/211/how-to-securely-hash-passwords) (deriving a key from a password is mostly the same as hasing a password). – Gilles 'SO- stop being evil' Nov 25 '16 at 01:00