Decrypting Post-Quantum TLS Traffic For Debugging

[y0un92 (youngz)]

There is a new key-share algorithm X25519MLKEM768 in go1.24.2.But when I’m trying to use KeyLogWriter which outputs a tls_key.log,I put the log into wireshark and it can’t decrypt the tls traffic. So, which tool i can use to decrypt the PQ-tls traffic. This is my setting for tls.Config

func createTLSConfig(cert tls.Certificate) *tls.Config {
    keyLogFile, err := os.OpenFile("tls_keys.log", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
    if err != nil {
        log.Fatalf("error: %v", err)
    }

    return &tls.Config{
        Certificates: []tls.Certificate{cert},
        MinVersion:   tls.VersionTLS13,
        MaxVersion:   tls.VersionTLS13,
        CurvePreferences: []tls.CurveID{tls.X25519MLKEM768},
        KeyLogWriter: keyLogFile, 
    }
}

[suzi574 (Suzi)]

Hello,

You’re encountering this issue because Wireshark does not currently support decrypting TLS 1.3 traffic that uses post-quantum (PQ) hybrid key exchange mechanisms like X25519MLKEM768, which was added in Go 1.24.2 and is part of the ongoing PQ-TLS1.3 experiments.

Why Wireshark can’t decrypt PQ-TLS
The KeyLogWriter outputs standard NSS-style TLS secrets , but Wireshark expects key exchange algorithms it understands, and it currently does not support hybrid PQ algorithms like X25519MLKEM768. As a result, even with the right tls_keys.log, Wireshark cannot use it to decrypt the traffic because it doesn’t recognize the key derivation flow.

Best Regards
Best Dog Translator App