query about a possible "KRB5KEYLOGFILE" feature, to log session keys

Greg Hudson ghudson at mit.edu
Tue Mar 19 10:27:51 EDT 2024


On 3/17/24 23:33, Richard E. Silverman wrote:
> I have a patch to libkrb5 which implements a feature similar to the 
> SSLKEYLOGFILE environment variable that’s now in pretty wide use for 
> TLS: it logs session keys to a keytab named by KRB5KEYLOGFILE. The main 
> use for this, just as with the TLS version, is to decrypt packet 
> captures with Wireshark; the latter’s KRB5 dissector takes a keytab as 
> input.

I think that would be a reasonable feature to add.



More information about the Kerberos mailing list