-
|
Hi I'm trying to decrypt the session data between a matter-node-shell and a matter-device using the matter-dissector Wireshark plugin and cannot find the keys to add to the plugin for decryption. Where should I look for them? Below is what I did. First I started Wireshark with the matter-dissector to capture the local host traffic between the two matter.js nodes I planned to run with Then I started the commissioner with: Then I started the socket node with Now I commissioned the Node with the command I stopped the capture and when viewing in Wireshark I can see the PASE and CASE commissioning, however I cannot view the encrypted data. I tried using the value of the I tried using the value of the I also tried the standard test keys (below), but that did not work either. Any thoughts on what I should be doing to decrypt the session data? Thanks! |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 2 replies
-
|
Honestly, no idea ... I never used that plugin. But that brings me to the question: Why you need that? Just set loglevel in matter.js to debug and the Logs should show anything you need - at least it logs all relevant stuff, the already decoded Tlv streams and also data as decoded and before being encoded. Why te plugin is needed? ;-) |
Beta Was this translation helpful? Give feedback.
-
|
The plugin is needed because I am interested in using Matter.js as a flexible way to generate point of comparison captures with over the air captures especially when commissioning is done. @Apollon77 I tried your logging suggestion and ran programs with the logging level as debug by running and running the command Although more logging information was generated, the session keys were not included. Section 4.13.2.6. of the Matter Core spec describes the input key material that is used to generate the session keys. At least some of the input key material is in the .device-node directory, but it is unclear if the session keys are available there. @Apollon77 do you have recommendations on how to determine if the session keys are being written (or can be written)? |
Beta Was this translation helpful? Give feedback.
-
|
I also did not said that the session key is logged, I just say that the debug log provides decoded information, but if you really want to decode via Wireshark then ... hhmmm ... you could check the code and add logs to log the session data. normally session keys are considered security relevant so I do not see any benefit to log them anywhere ;-) Somewhen later we plan to persist sessions for reasons and they we might store the data, but it is not in yet |
Beta Was this translation helpful? Give feedback.
-
|
Okay great. I'll take that approach and leave the question open so I can post how I did the logging in case others want to do the same. BTW thanks for the efforts you and the other contributors have made to grow matter.js into an impressive suite of code. |
Beta Was this translation helpful? Give feedback.
-
|
To print the session keys edit the function after this line: https://github.com/project-chip/matter.js/blob/0fb55780a0b260ed04dfcce718b3d2d8e0d13458/packages/matter.js/src/session/SecureSession.ts#L77 When performing commissioning and working with the node, multiple session key logs will be created. They will look like: To decrypt the Matter capture in Wireshark take only the hex values from decrypt and encrypt and enter these keys from all of the session key log lines as described in the section The Matter messages will then be decrypted. |
Beta Was this translation helpful? Give feedback.
To print the session keys edit the function
static async create<T>in the file/matter.js/packages/matter.js/src/session/SecureSession.ts in static async create(args: {
after this line: https://github.com/project-chip/matter.js/blob/0fb55780a0b260ed04dfcce718b3d2d8e0d13458/packages/matter.js/src/session/SecureSession.ts#L77
add the logging statement
When performing commissioning and working with the node, multiple session key logs will be created. They will look like: