Signing improvements package (#871)

* Signing support with MAX_PAYLOAD>32

Support in the signing backends to handle configurations
where MAX_PAYLOAD is more than 32 bytes.

Fixes #748

* Support big message signatures

Support for signing messages larger than 32 bytes.
This is not fully testable with the current version of
the library but the change would add theoretical support
for signing any sized messages.

Fixes #749

* Have gw properly indicate whitelisting preferences

If the gateway hold a signing whitelist, inform all
nodes of this requirement and not just nodes that hold
whitelists themselves.

Fixes #806

* Harden security

The flag MY_SIGNING_GW_REQUEST_SIGNATURES_FROM_ALL
has been removed. Gateway will now request signatures
from everyone by default.
In addition to this, no nodes in the network will allow
clearing of signing/whitelisting preferences by OTA
commands by default.
If the old behaviour is needed (suitable for gradual
signing roll out and development purposes) a new flag,
MY_SIGNING_WEAK_SECURITY can be set.

Fixes #807

* Signing debug messages rewritten

All signing related debug has been rewritten to
better match other core debug printouts.
Also, backends are updated to have a smaller
implementation delta.

* Simplified signing option implemented

Enable by MY_SIGNING_SIMPLE_PASSWD. Signing, and signing requirements
will be enabled, as will encryption. Whitelisting is optional.
The value provided to MY_SIGNING_SIMPLE_PASSWD is used as HMAC and AES
key. Whitelists use the first 8 bytes of the password and the ninth
byte from the node ID as serial.
Password is required to be at least 8 characters wide. It is zero
padded if it is not long enough to cover the AES (16 bytes) and HMAC
(32 bytes) keys. It is not recommended to have a password shorter than
32 bytes, and there is no need for a password longer than 32 bytes.

* Add documentation section for signing debug

* Add nRF5 encryption to simple signing option

* Restructure MySigning documentation

* Minor fixes for Linux

MyConfig.h

@@ -400,17 +400,44 @@
 *  Message Signing Settings
 ***********************************/
 /**
- * @def MY_DEBUG_VERBOSE_SIGNING
- * @brief Flag for verbose debug prints related to signing. Requires DEBUG to be enabled.
- * This will add even more to the size of the final sketch!
- */
+* @def MY_DEBUG_VERBOSE_SIGNING
+* @brief Flag for verbose debug prints related to signing. Requires DEBUG to be enabled.
+ *       This will add even more to the size of the final sketch!
+*/
 //#define MY_DEBUG_VERBOSE_SIGNING
 
+/**
+ * @def MY_SIGNING_SIMPLE_PASSWD
+ * @brief Enables SW backed signing functionality in library and uses provided password as key.
+ *
+ * This flag will enable signing, signature requests and encryption. It has to be identical on ALL
+ * nodes in the network.<br>
+ * Whitelisting is supported and serial will be the first 8 characters of the password, the ninth
+ * character will be the node ID (to make each node have a unique serial).<br>
+ * As with the regular signing modes, whitelisting is only activated if a whitelist is specified in
+ * the sketch.
+ * No personalization is required for this mode.<br>
+ * It is allowed to set @ref MY_SIGNING_WEAK_SECURITY for deployment purposes in this mode as it is
+ * with the regular software and ATSHA204A based modes.<br>
+ * If the provided password is shorter than the size of the HMAC or AES key, it will be null-padded
+ * to accomodate the key size in question. A 32 character password is the maximum length. Any
+ * password longer than that will be truncated.
+ */
+//#define MY_SIGNING_SIMPLE_PASSWD "MyInsecurePassword"
+#if defined(MY_SIGNING_SIMPLE_PASSWD)
+#define MY_SIGNING_SOFT
+#define MY_SIGNING_REQUEST_SIGNATURES
+#define MY_RF24_ENABLE_ENCRYPTION
+#define MY_RFM69_ENABLE_ENCRYPTION
+#define MY_NRF5_ESB_ENABLE_ENCRYPTION
+#endif
+
 /**
  * @def MY_SIGNING_ATSHA204
  * @brief Enables HW backed signing functionality in library.
  *
- * For any signing related functionality to be included, this define or @ref MY_SIGNING_SOFT has to be enabled.
+ * For any signing related functionality to be included, this define or @ref MY_SIGNING_SOFT has to
+ * be enabled.
  */
 //#define MY_SIGNING_ATSHA204
 
@@ -418,7 +445,8 @@
  * @def MY_SIGNING_SOFT
  * @brief Enables SW backed signing functionality in library.
  *
- * For any signing related functionality to be included, this define or @ref MY_SIGNING_ATSHA204 has to be enabled.
+ * For any signing related functionality to be included, this define or @ref MY_SIGNING_ATSHA204 has
+ * to be enabled.
  */
 //#define MY_SIGNING_SOFT
 
@@ -432,14 +460,21 @@
 //#define MY_SIGNING_REQUEST_SIGNATURES
 
 /**
- * @def MY_SIGNING_GW_REQUEST_SIGNATURES_FROM_ALL
- * @brief Enable this to have gateway require all nodes in the network to sign messages sent to it.
- * @ref MY_SIGNING_REQUEST_SIGNATURES must also be set.
+ * @def MY_SIGNING_WEAK_SECURITY
+ * @brief Enable this to permit downgrade of security preferences and relaxed gateway signing
+ *        requirements.
  *
- * Use this for maximum security, but be aware that every single node will have to be personalized before they can be used.
- * Note that if this is enabled, and whitelisting is also enabled, whitelisting will also be in effect for all nodes.
+ * Use this for evaluating security. It allows for gradual introduction of signing requirements in
+ * a network. Nodes that present themselves as not requiering signing or whitelisting will be
+ * cleared of this requirement at the receiving end. A gateway which require signatures will only do
+ * so from nodes that in turn require signatures.<br>
+ * When not set, any node that has presented themselves as a node that require signatures or
+ * whitelisting, will be permanently remembered as doing so at the receiver until EEPROM is cleared
+ * or the receiver is reconfigured with this flag set or has signing disabled alltogether.
+ *
+ * @warning This flag when set will weaken security significantly
  */
-//#define MY_SIGNING_GW_REQUEST_SIGNATURES_FROM_ALL
+//#define MY_SIGNING_WEAK_SECURITY
 
 /**
  * @def MY_VERIFICATION_TIMEOUT_MS
@@ -1294,10 +1329,11 @@
 #define MY_INDICATION_HANDLER
 #define MY_DISABLE_REMOTE_RESET
 // signing
+#define MY_SIGNING_SIMPLE_PASSWD
 #define MY_SIGNING_ATSHA204
 #define MY_SIGNING_SOFT
 #define MY_SIGNING_REQUEST_SIGNATURES
-#define MY_SIGNING_GW_REQUEST_SIGNATURES_FROM_ALL
+#define MY_SIGNING_WEAK_SECURITY
 #define MY_SIGNING_NODE_WHITELISTING {{.nodeId = GATEWAY_ADDRESS,.serial = {0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01}}}
 #define MY_DEBUG_VERBOSE_SIGNING
 // RS485