[TLS] Volunteers to Alpha Test Wireshark Dissector for (D)TLS1.3

<nalini.elkins@insidethestack.com> Tue, 10 May 2016 16:01 UTC

Date: Tue, 10 May 2016 16:00:27 +0000
From: nalini.elkins@insidethestack.com
To: Tls <tls@ietf.org>
Message-ID: <886089111.1623873.1462896027238.JavaMail.yahoo@mail.yahoo.com>
In-Reply-To: <1459732673.1664099.1462895921403.JavaMail.yahoo@mail.yahoo.com>
References: <1459732673.1664099.1462895921403.JavaMail.yahoo.ref@mail.yahoo.com> <1459732673.1664099.1462895921403.JavaMail.yahoo@mail.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_1623872_593345573.1462896027235"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/xJCmHRHT6ho_i1Yv1s0OiaCBjbk>
Cc: Martin Thomson <mt@mozilla.com>, Christian O'Flaherty <oflaherty@isoc.org>
Subject: [TLS] Volunteers to Alpha Test Wireshark Dissector for (D)TLS1.3
Precedence: list
Reply-To: nalini.elkins@insidethestack.com

All,



I have modified the Wireshark dissectors for TLS and DTLS to recognize and parse a fair amount of (D)TLS1.3 traffic.

I took a debug trace that Martin Thomson gave me with (D)TLS1.3 payload data only & created PCAP traces with fake IP and TCP/UDP headers so that I could have something to dissect. I think I am ready for some other people to look at this, if they would like to next week.  Would love to have you guys let me know what you think of the decoding & if anything should be changed.

Also, if anyone else has PCAP files with (D)TLS1.3, that will be wonderful.  I have only two trace files!   Down the road, I would like to have quite a few that are set up.  If you even have debug output with payload, I can use that.  But, it has to be what actually is sent on the wire.  (Pls let me know if questions.)

We have set up a server that we will make available to the entire TLS group once the bugs are shaken out.  We will put the various traces on that server so that people can see actual packet traffic.  We will also modify the dissectors as needed as the spec finalizes.

What I have done for both TLS and DTLS: 

- Client Hello should be good (including Random bytes decoding)
- Server Hello should be good (including Random bytes decoding)
- New Key Share extension added
- New PSK extension added- New Version Negotiation extension added- New cipher suites added
- New alert types added

What is left to be done:

- Bug Martin found in TLS1.2 and before for Server Key Share
- I think there may be some problems with some DTLS packets.  Could use some help in figuring out exactly what. 
Please let me know unicast if you would like to help.  I am thinking 3 or 4 people will be good.  The Alpha testing will start Wed. May 18th. 
Please let me know if you want some screen shots of a TLS1.3 Client Hello / Server Hello.  I am not able to attach to email. 
Thanks,

Nalini Elkins
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

[TLS] Volunteers to Alpha Test Wireshark Dissecto… nalini.elkins