Wireshark v4 now has the option to embed TLS secrets into a trace file within the GUI.
We could do this before in editcap, but who wants to jump out to the command prompt to run the clunky process there - and what are the chances of a typo? (Pretty damn near 80% in my case.)
Once you've set up your system to log keys before you start your local capture, you can now select Edit | Inject TLS Secrets.
Wireshark embeds only the keys used in the trace file. (This is nice because some of my key files are pretty large after forgetting I've set them up.)
You'll only know if this process worked by looking at your trace file. (No "X keys were injected" message" or any other confirmation will appear.)
Luckily, an asterisk is placed before the file name on the menubar to indicate the file has been edited. You will be prompted to save changes to the file if you try to close it without saving.
This change makes sharing unencrypted files I've captured on my system is easy.
LAB: Decrypt with a Log File and Embed TLS Secrets
Step 1: Get the Files
Grab sjsharks.zip. Unzip the file - you now have an unencrypted HTTP/2 session and the .key file to decrypt it. (Note the size of the trace file and the size of the key file. My system has been saving keys to that same file for a while.)
Open sj-sharksmini2.pcapng in the latest version of Wireshark - notice that the TCP streams are encrypted.
Step 2: Decrypt with the Pre-Master-Secret Log File
Select frame 4 and, in the Packet Details pane, and right-click on the TLS section. Select Protocol Preferences | Pre-(Master)-Secret Log Filename. Up by your display filter area, you are prompted to enter the path/name of the key file to use. Point Wireshark to the key file you downloaded. Click OK.
Wireshark will rescan the trace file and ... if all works well, voila! The HTTP/2 traffic should be decrypted.
Step 3: Inject TLS Secrets
You aren't done yet!
Select Edit | Inject TLS Secrets. Save this trace file as a new file (maybe add "-key" to the file name to indicate it has embedded keys). If you remove the Pre-(Master)-Secret Log Filename setting or change to a different profile that doesn't have that TLS preference setting, the file will remain decrypted because the keys are embedded in the file.
Notice the size of the new "-keys" file. Wireshark only included the keys used for the decryption process. Sweet!
Enjoy!
-Laura