DUnderstanding the Pitfalls of SSLv2 - Implementing SSL/TLS Using Cryptography and PKI - page 625

To complete the handshake, the server sends an (encrypted) ServerFinished
message. Notice that, to decrypt this packet, you need to keep track of the IV
changes to do CBC correctly. The read IV is now b45c557c70509a14 — the last
eight bytes that were sent by the server.
15:57:38.916884 IP localhost.localdomain.pcsync-https >
localhost.localdomain.50704: P 936:979(43) ack 164
win 256 <nop,nop,timestamp 24215214 24215214>
0x0000: 4500 005f 8fa2 4000 4006 acf4 7f00 0001
0x0010: 7f00 0001 20fb c610 9bb0 f5a0 9b92 7f22
0x0020: 8018 0100 fe53 0000 0101 080a 0171 7eae
0x0030: 0171 7eae 0028 07e1 227d cfc0 67d8 3e3b
0x0040: a0ec af96 31af 6ba9 089b 40b7 ad2b f6e9
0x0050: 8272 2097 4a63 0981 1b60 7c28 512a cf
[jdavies@localhost ssl]$ ./des -d 0x14f258c2fe6bf291 \
0xb45c557c70509a14 \
0xe1227dcfc067d83e3ba0ecaf9631af6ba9089b40b7ad2bf6e9\
827220974a6309811b607c28512acf
852597cc4bd2463be5f8672e62b3a703060427efed281ba93999
9ff8a8f1f1ddd600000000000000
[jdavies@localhost ssl]$ ./digest -md5 \
0x14f258c2fe6bf291060427efed281ba939999ff8a8f1\
f1ddd60000000000000000000002
852597cc4bd2463be5f8672e62b3a703
You can verify that the supplied session ID matches the one in the response page.
At this point, the handshake is complete, and the application takes over.
The application acts as though nothing has changed; it submits an HTTP GET
request just as if it had simply negotiated an unprotected connection. The SSL
code takes care of encrypting and MAC'ing it.
15:57:38.917953 IP localhost.localdomain.50704 >
localhost.localdomain.pcsync-https: P 164:215(51)
ack 979 win 271 <nop,nop,timestamp 24215215 24215214>
0x0000: 4500 0067 001f 4000 4006 3c70 7f00 0001
0x0010: 7f00 0001 c610 20fb 9b92 7f22 9bb0 f5cb
0x0020: 8018 010f fe5b 0000 0101 080a 0171 7eaf
0x0030: 0171 7eae 0030 067b eb63 de21 6de7 ed5b
0x0040: 45b7 969a 26a6 6d47 fbae 036d 4351 4def
0x0050: 8e67 dcf3 c8e7 3ce4 52f7 9b26 f822 bad1
0x0060: 942a 2ea0 6bb3 6e
[jdavies@localhost ssl]$ ./des -d 0x0xb84ce9aeebc6d4d8 \
0x5cb4cdf646399c5e \
0x7beb63de216de7ed5b45b7969a26a66d47fbae036d43514def8e6\
7dcf3c8e73ce452f79b26f822bad1942a2ea06bb36e
2d5720761aa3d1b19909972bd870e7c4474554202f696e6465782e68
746d6c20485454502f312e310d0a000000000000