How to decrypt QUIC??

[bruno-silva-dtx]

Hello,
My question is if there is currently any way to Quic decrypt packets, to better understand the connection, using for example wireshark, this protocol has been around for so long and I don't see how to do it?

[qzhuyan]

yes, we do.

check the Decrypt traffic with Wireshark part in README.md

[bruno-silva-dtx]

Yes,

I see it now, but will this decrypt the protected payload? Or we will start to see some http3 links.
I will test and give feedback, tks

[qzhuyan]

Yes. as long as you set the SSLKEYLOGFILE file in wireshark (you could google how, it is common method for all browsers as well) and ask wireshark to 'deocde' the udps as quic, you will get decrypted payload.

note that you must ensure you captured the handshakes at the beginning of the QUIC connection.

[bruno-silva-dtx]

Hello,
I'm sure the method works. But I'm using MQTT over QUIC, that is, I'm connecting to a bocker, what I've been trying to do is capture section keys. What I'm doing now is

export SSLKEYLOGFILE=/tmp/SSLKEYLOGFILE.log

but without results you don't capture anything.Now I'm running out of ideas, how to capture.

[qzhuyan]

currently we require client to set conn opt: {sslkeylogfile, "/tmp/SSLKEYLOGFILE"} (as in README) if your client use quicer.