Subject: [IPP] Report on Wireshark IPPS issues...

From: Michael Sweet <[email-masked]>
Date: Wed, 16 Jan 2019 08:57:27 -0500

All,

I've done some testing with the current stable version of Wireshark on macOS to determine what is going on with IPPS support (one of my long-standing action items...)

The short of it is this: I am able to successfully decrypt IPPS traffic when I have the private key of the printer and RSA is used for the initial handshake.  However, if a more secure handshake is in use (e.g. ECDHE) that provides forward secrecy, this all breaks because, well, that's the nature of the security offered by TLS... :)  Short of getting a printer to log its session key (not something I'd recommend in production firmware!), there isn't anything that can be done in Wireshark to "fix" this.

I've filed a Github issue to track a possible future ipptool feature to log all network traffic to a file (decrypted) for analysis:

    https://github.com/istopwg/ippsample/issues/168

_________________________________________________________
Michael Sweet, Senior Printing System Engineer

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: "Kennedy, Smith (Wireless & Standards Architect)" <[email-masked]>
Date: Wed, 16 Jan 2019 15:31:43 +0000

Hi Mike,

Thanks for looking into that!

A slightly different problem I had previously observed with Wireshark releases that included your updated IPP dissector (starting with 2.4?) was that when IPP traffic captured communicating with an IPP Printer listening on a non-standard port (some port other than TCP 631) weren't being recognized as IPP for some reason. This happens a lot when sniffing ippserver. But I just tested this with Wireshark 2.6.5 and 2.6.6 and both seem to be working as I would expect. Just wanted to close the loop on that.

Cheers for the work!

Smith

/**
    Smith Kennedy
    Chair, IEEE ISTO Printer Working Group
    HP Inc.
*/

> On Jan 16, 2019, at 6:57 AM, Michael Sweet <[email-masked]> wrote:
> 
> All,
> 
> https://github.com/istopwg/ippsample/issues/168 <https://protect-us.mimecast.com/s/qd3iCVOrBrcqLo0wsy-2_L?domain=github.com>
> 
> https://www.pwg.org/mailman/listinfo/ipp <https://protect-us.mimecast.com/s/4P7uCW6vDvhrgmz9tnNAOw?domain=pwg.org>