# More crypto ID
**URL:** https://community.zeek.org/t/more-crypto-id/4233
**Category:** Zeek
**Created:** [July 8, 2016, 8:13pm UTC](https://community.zeek.org/t/more-crypto-id/4233 "2016-07-08T20:13:09Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [July 8, 2016, 8:13pm UTC](https://community.zeek.org/t/more-crypto-id/4233/1 "2016-07-08T20:13:09Z")
FYI:
2016-07-01T12:35:15-0600 CyqleS3tHf607yRdrj 192.168.1.101 38151 31.13.76.102 443 TLSv12 unknown-52393 - [graph.facebook.com](http://graph.facebook.com) F- h2 T Fq3gsi3bxz1RdtYqej,FiQmMNkbUAqhiOOkk (empty) CN=\*.facebook.com,O=Facebook\\, Inc.,L=Menlo Park,ST=CA,C=US CN=DigiCert SHA2 High Assurance Server CA,[OU=www.digicert.com](http://OU=www.digicert.com),O=DigiCert Inc,C=US - - ok
unkonwn-52393 is apparently QUIC crypto.
James
---
### Author:  [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [July 8, 2016, 8:21pm UTC](https://community.zeek.org/t/more-crypto-id/4233/2 "2016-07-08T20:21:21Z")
Hello James,
it is TLS\_ECDHE\_ECDSA\_WITH\_CHACHA20\_POLY1305\_SHA256 and should be correctly identified by master. The use of that number is newer than Bro 2.4, which is why it is not present there. That cipher is specified in RFC7905.
Thanks,
Johanna
---
### Author:  [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [July 8, 2016, 8:30pm UTC](https://community.zeek.org/t/more-crypto-id/4233/3 "2016-07-08T20:30:57Z")
Argh...yea you're right wrong stream. I am including a QUIC crypto session that bro does not seem to recognize. Only thing I have for bro seeing this stream is:
2016-07-02T14:46:30-0600 CWaKhQ3UAvIEem73fj 192.168.1.101 38848 31.13.76.102 443 tcp - 0.026353 1725 0 RSTR TF 0 ShADar 5 1993 5 268 (empty)
Thank you.
James
[quic\_working.pcapng](https://community.zeek.org/uploads/short-url/bxc3VfUk9w9mH9YbtwK6SLJ5ADb.pcapng) (3.46 KB)
---
### Author:  [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [July 8, 2016, 9:09pm UTC](https://community.zeek.org/t/more-crypto-id/4233/4 "2016-07-08T21:09:32Z")
Bro currently does not support parsing QUIC at all - so you are correct - you won't get any data outside of conn.log for QUIC sessions.
Johanna
---
### Author:  [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [July 8, 2016, 9:12pm UTC](https://community.zeek.org/t/more-crypto-id/4233/5 "2016-07-08T21:12:45Z")
Ok cool...I haven't seen many tools that do support QUIC crypto yet...thanks Johanna!
James
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/more-crypto-id/4233/6 "2022-05-06T15:43:49Z")