Decrypting QUIC UDP Payloads in Wireshark

Question

I have a whole bunch of encrypted QUIC UDP packets I've managed to capture and narrow down from an online game. I believe these are the incoming chat messages.

I'd like to decrypt these packets to see if I can read the raw data being sent. Is this possible? What information/settings do I need?

Oliana

Wireshark does not support QUIC decryption at the moment. The drafts at tools.ietf.org/wg/quic are also not really detailled on the ciphers... Your best chance to understand how it works is probably docs.google.com/document/d/… – Derbent

@Derbent Cheers, I'll take a look – Oliana

I've read the document and it does not help at all, because it does not give any details.. in Wireshark you just can see CHLO, REJ from server, the second CHLO and the data is encrypted.. (and you aren't able to see the SHLO) :/ – Adelric

Answer 1

For decrypting QUIC packet in latest wireshark (not sure if works in older verison )

1. Go to Edit->Preferences->Protocols
2. select QUIC from drop down list
3. select " Force decode of all QUIC Payload"

In wireshark version 3.2.3 at Edit->Preferences->Protocols->QUIC, add the QUIC UDP port. The wireshark will now decode these UDP packets as QUIC packets. It will decode the non-encrypted plain header fields of QUIC, however the encrypted part of QUIC remains encrypted and is just displayed with label "remaining payload". These steps are for decoding a QUIC UDP packet header fields and not for there decryption.

Anzio

there's no such " Force decode of all QUIC Payload" option as of v3.6.7 – Pickpocket

Answer 2

1. In a terminal, type

   export SSLKEYLOGFILE="$HOME/sslkeylogfile.log"
   

   then restart chromium:

   chromium &
   

   Chromium will now save the encryption keys to this file.

2. In wireshark,

   Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log filename:

   $HOME/sslkeylogfile.log
   

   Wireshark will use the keys in this file to decrypt entire packets for TLS / QUIC / HTTP3.

Cashier