Wireshark decryption support for QUIC
Peter Wu <peter@lekensteyn.nl> Thu, 29 March 2018 14:56 UTC
Return-Path: <peter@lekensteyn.nl>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1556812711A for <quic@ietfa.amsl.com>; Thu, 29 Mar 2018 07:56:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.31
X-Spam-Level:
X-Spam-Status: No, score=-4.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lekensteyn.nl
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OUHlc1TITdzw for <quic@ietfa.amsl.com>; Thu, 29 Mar 2018 07:56:05 -0700 (PDT)
Received: from mail.lekensteyn.nl (mail.lekensteyn.nl [IPv6:2a02:2308::360:1:25]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF9A6120454 for <quic@ietf.org>; Thu, 29 Mar 2018 07:56:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lekensteyn.nl; s=s2048-2015-q1; h=Content-Type:MIME-Version:Message-ID:Subject:Cc:To:From:Date; bh=Jx8dxsRZadqU2w+6qpZKMo9OoND87aJLYdANjK/uBeE=; b=dG11jbjwIoAC7ZZw4u+mxM/EemI4zc2Dd2y/0pTlAhPVQQzXFpZRy24uVlMUs95RWkZfjMo2ss2w996PXv1Uz+vUEwvDfi/UvaKf4kDZOHgLoL6rnZqbucdV1KWHt18qTtTiHkEUNdFEEvlLBE6UVAUpmacwv57fW9H/CIlYTLUWv44OFRWvq2LfZdLiix+QJkIIXgu3+8lvkzzapA21U2eeys76XV0Bu8wp8cFEn3Zwxu01ifsMbL2w/Od/Q1MxN5kj7l1ZvHEauJVtgVQfaHdX+B+FDVAHmUQgi5lUtCRyVmerxHIWC0UR/2iZO5I2CxhaVNU5obXtiPG8B0ae1Q==;
Received: by lekensteyn.nl with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from <peter@lekensteyn.nl>) id 1f1YyA-0001nV-Ip; Thu, 29 Mar 2018 16:56:03 +0200
Date: Thu, 29 Mar 2018 16:55:59 +0200
From: Peter Wu <peter@lekensteyn.nl>
To: quic@ietf.org
Cc: Alexis La Goutte <alexis.lagoutte@gmail.com>
Subject: Wireshark decryption support for QUIC
Message-ID: <20180329145559.GB14932@al>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/hPlYuItmf8qsW6_qeYJLXsnlniQ>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Mar 2018 14:56:08 -0000
Hi! In case you have not noticed, Alexis La Goutte and me have been working on adding support for IETF QUIC to Wireshark. The stable 2.4.x version only supports Google's QUIC variant (GQUIC), but the development version does support IETF QUIC. Since Wireshark v2.5.2rc0-67-g184b943fbd (soon to be released as 2.6.x), both handshake and payload decryption are fully supported for draft -09 and Key Update should be supported (but untested). 0-RTT decryption is not supported yet. Payload decryption relies on the QUIC library to provide secrets. Currently it requires the TLS (Early) Exporter secret, but if this is impractical, we could look into taking alternative secrets (such as client_pp_secret_0, etc.). The TLS Exporter secrets are taken from the TLS library using the "NSS Key log format" which is specified at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format It can be provided to Wireshark via the "SSL" protocol preferences, "(Pre)-Master-Secret log filename" option. For an example integration with ngtcp2 and OpenSSL, see https://github.com/ngtcp2/ngtcp2/pull/67 which is also referenced from https://github.com/quicwg/base-drafts/wiki/Tools If you have any questions or feature requests, please contact me, Alexis or ask in the quicdev #wireshark Slack channel. The current status can be tracked on https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13881 -- Kind regards, Peter Wu https://lekensteyn.nl