To decrypt TLS traffic in Wireshark, which input is required?

• A. You must install a decryption plugin
• B. You must use the server's private key
• C. You must provide the appropriate keys via SSLKEYLOGFILE or pre-master secret
• D. TLS cannot be decrypted

Answer: (C)

Decrypting TLS in Wireshark requires access to the session keys that were used to encrypt the data. In practice, you provide these keys from the client side—typically as the pre-master secret or the derived session keys—so Wireshark can reconstruct the encryption keys and decrypt the traffic.

This is usually done by supplying a key log (such as SSLKEYLOGFILE) that logs the pre-master secret for each TLS session, or by otherwise providing the pre-master secret to Wireshark. Merely using the server’s private key isn’t sufficient in most modern TLS connections because of forward secrecy (ephemeral key exchange). Without the correct keys, the traffic remains encrypted, and decrypting isn’t possible.