Description:

I am attempting to perform a TLS handshake using a PSK cipher (TLS_PSK_WITH_AES_256_CBC_SHA), and I’m encountering issues where the OpenSSL server sends a "Decode Error" alert at the end of the handshake. Additionally, when trying to decrypt the captured trace in Wireshark, only the "Finished" message from the OpenSSL server is being decrypted successfully.

Scenario:

TLS-Attacker Client Command:
java -jar apps/TLS-Client.jar -connect 127.0.0.1:4433 -version TLS12 -config client_config.xml -cipher TLS_PSK_WITH_AES_256_CBC_SHA -debug

OpenSSL Server Command:
openssl s_server -tls1_2 -accept 4433 -nocert -psk 316132623363346435653666 -psk_identity Client_Identity -cipher PSK-AES256-CBC-SHA -keylogfile /tmp/.ssl-key.log -no_ticket
client_config.xml

server_config.xml

Observations:

• The handshake is initiated successfully, but at the end, the OpenSSL server sends an Alert(Decode Error).

• When trying to decrypt the trace in Wireshark, it is only able to decrypt the "Finished" message sent by the OpenSSL server.

• Similar behavior is observed when using both TLS-Attacker’s client and server: despite not receiving the Decode Error, none of the Finished messages are decrypted in Wireshark.

In addition, in Wireshark it appears the Decrypted TLS tag and the packet seems to be fine:

Any guidance or support would be greatly appreciated. Thank you!