Encryption Keys, how to find it ?

project-chip / matter-dissector

Wireshark plugin for parsing Matter protocol messages. Status: Experimental

BSD 3-Clause "New" or "Revised" License

30 stars 10 forks source link

Encryption Keys, how to find it ? #6

Open tuppulix opened 2 months ago

tuppulix commented 2 months ago

Anyone know how to take the Encryption Keys to decrypt packet in wireshark using the dissector ? I try all in my knowledge but I'm not having success.

My scenario: I have a Matter plug "Sengled", and i use the chip-tool to connect with it. Everything work right, but my goal is create the Interaction Model for wireshark. And my problem is being able to find the decryption key, in particulary during the exchange.

Thank you very much for everyone who will help me in this work.

turon commented 2 months ago

@tuppulix unfortunately even if you instrument your chip-tool to output the session keys generated here, the current version of the dissector does not incorporate the nodeid in the nonce calculation, so decryption of production devices isn't supported.

tuppulix commented 2 months ago

@turon Is it possible during the connection to take the key that the device exchanges with the chip tool? Maybe printing it to a log file. And then use it on WireShark to decrypt it?