MySmartHome/MySensors
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Slimmed down memory footprint of signing backends

Browse Source
This commit is contained in:
Patrick Fallberg
2015-03-16 20:24:42 +01:00
parent f295ef2961
commit 611ba0cf44
7 changed files with 92 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libraries/MySensors/MySigningAtsha204.cpp
+47 -89
View File
@@ -8,18 +8,17 @@
#include "MySigningAtsha204.h"
// Uncomment this to get some useful serial debug info (Serial.print and Serial.println expected)
//#define DEBUG_ATSHA_SIGNING
//#define DEBUG_SIGNING
#ifdef DEBUG_ATSHA_SIGNING
#define DEBUG_ATSHA_PRINTLN(args) Serial.println(args)
#ifdef DEBUG_SIGNING
#define DEBUG_SIGNING_PRINTLN(args) Serial.println(args)
#else
#define DEBUG_ATSHA_PRINTLN(args)
#define DEBUG_SIGNING_PRINTLN(args)
#endif
#ifdef DEBUG_ATSHA_SIGNING
static void DEBUG_ATSHA_PRINTBUF(char* str, uint8_t* buf, uint8_t sz)
#ifdef DEBUG_SIGNING
static void DEBUG_SIGNING_PRINTBUF(const __FlashStringHelper* str, uint8_t* buf, uint8_t sz)
{
int i;
Serial.println(str);
for (int i=0; i<sz; i++)
{
@@ -32,7 +31,7 @@ static void DEBUG_ATSHA_PRINTBUF(char* str, uint8_t* buf, uint8_t sz)
Serial.println();
}
#else
#define DEBUG_ATSHA_PRINTBUF(str, buf, sz)
#define DEBUG_SIGNING_PRINTBUF(str, buf, sz)
#endif
@@ -54,25 +53,17 @@ MySigningAtsha204::MySigningAtsha204(bool requestSignatures,
bool MySigningAtsha204::getNonce(MyMessage &msg) {
// Generate random number for use as nonce
uint8_t* pRnd = NULL;
// We used a basic whitening technique that takes the first byte of a new random value and builds up a 32-byte random value
// This 32-byte random value is then hashed (SHA256) to produce the resulting nonce
for (int i = 0; i < 32; i++) {
if (atsha204.sha204m_execute(SHA204_RANDOM, RANDOM_NO_SEED_UPDATE, 0, 0, NULL,
RANDOM_COUNT, tx_buffer, RANDOM_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to generate nonce");
DEBUG_SIGNING_PRINTLN(F("FTGN")); // FTGN = Failed to generate nonce
return false;
}
current_nonce[i] = rx_buffer[SHA204_BUFFER_POS_DATA];
}
pRnd = sha256(current_nonce, 32);
if (!pRnd) {
DEBUG_ATSHA_PRINTLN("Failed to hash random value");
return false;
}
memcpy(current_nonce, pRnd, MAX_PAYLOAD);
memcpy(current_nonce, sha256(current_nonce, 32), MAX_PAYLOAD);
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
memset(&current_nonce[MAX_PAYLOAD], 0xAA, sizeof(current_nonce)-MAX_PAYLOAD);
@@ -94,9 +85,9 @@ bool MySigningAtsha204::getNonce(MyMessage &msg) {
bool MySigningAtsha204::checkTimer() {
if (verification_ongoing) {
if (millis() < timestamp || millis() > timestamp + MY_VERIFICATION_TIMEOUT_MS) {
DEBUG_ATSHA_PRINTLN("Verification timeout");
DEBUG_SIGNING_PRINTLN(F("VT")); // VT = Verification timeout
// Purge nonce
memset(current_nonce, 0xAA, NONCE_NUMIN_SIZE_PASSTHROUGH);
memset(current_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
verification_ongoing = false;
return false;
}
@@ -105,44 +96,35 @@ bool MySigningAtsha204::checkTimer() {
}
bool MySigningAtsha204::putNonce(MyMessage &msg) {
if (mGetLength(msg) != MAX_PAYLOAD) {
DEBUG_ATSHA_PRINTLN("Incoming nonce with incorrect size");
return false; // We require as big nonce as possible
}
if (((uint8_t*)msg.getCustom())[0] != SIGNING_IDENTIFIER) {
DEBUG_ATSHA_PRINTLN("Incorrect signing identifier");
DEBUG_SIGNING_PRINTLN(F("ISI")); // ISI = Incorrect signing identifier
return false;
}
memcpy(current_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
memset(&current_nonce[MAX_PAYLOAD], 0xAA, sizeof(current_nonce)-MAX_PAYLOAD);
return true;
}
bool MySigningAtsha204::signMsg(MyMessage &msg) {
// If we cannot fit any signature in the message, refuse to sign it
if (mGetLength(msg) > MAX_PAYLOAD-2) {
DEBUG_ATSHA_PRINTLN("Cannot fit any signature to this message");
DEBUG_SIGNING_PRINTLN(F("MTOL")); // Message too large for signature to fit
return false;
}
// Calculate signature of message
mSetSigned(msg, 1); // make sure signing flag is set before signature is calculated
DEBUG_ATSHA_PRINTBUF("Message to sign:", (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
if (!calculateSignature(msg)) {
DEBUG_ATSHA_PRINTLN("Failed to calculate signature");
mSetSigned(msg, 0); // make sure signing flag is truthful
return false;
}
calculateSignature(msg);
#ifdef MY_SECURE_NODE_WHITELISTING
// Salt the signature with the senders nodeId and the unique serial of the ATSHA device
memcpy(current_nonce, &rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
current_nonce[32] = msg.sender;
(void)atsha204.getSerialNumber(&current_nonce[33]);
atsha204.getSerialNumber(&current_nonce[33]);
(void)sha256(current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
memset(current_nonce, 0xAA, NONCE_NUMIN_SIZE_PASSTHROUGH);
DEBUG_ATSHA_PRINTLN("Signature salted");
DEBUG_SIGNING_PRINTLN(F("SWS")); // SWS = Signature whitelist salted
#endif
// Overwrite the first byte in the signature with the signing identifier
@@ -156,7 +138,7 @@ bool MySigningAtsha204::signMsg(MyMessage &msg) {
bool MySigningAtsha204::verifyMsg(MyMessage &msg) {
if (!verification_ongoing) {
DEBUG_ATSHA_PRINTLN("No active verification session");
DEBUG_SIGNING_PRINTLN(F("NAVS")); // NAVS = No active verification session
return false;
} else {
// Make sure we have not expired
@@ -167,24 +149,18 @@ bool MySigningAtsha204::verifyMsg(MyMessage &msg) {
verification_ongoing = false;
if (msg.data[mGetLength(msg)] != SIGNING_IDENTIFIER) {
DEBUG_ATSHA_PRINTLN("Incorrect signing identifier");
DEBUG_SIGNING_PRINTLN(F("ISI")); // ISI = Incorrect signing identifier
return false;
}
DEBUG_ATSHA_PRINTBUF("Message to verify:", (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
DEBUG_ATSHA_PRINTBUF("Signature in message:", (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg));
// Get signature of message
if (!calculateSignature(msg)) {
DEBUG_ATSHA_PRINTLN("Failed to calculate signature");
return false;
}
DEBUG_SIGNING_PRINTBUF(F("SIM:"), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg)); // SIM = Signature in message
calculateSignature(msg); // Get signature of message
#ifdef MY_SECURE_NODE_WHITELISTING
// Look up the senders nodeId in our whitelist and salt the signature with that data
for (int j=0; j < whitlist_sz; j++) {
if (whitelist[j].nodeId == msg.sender) {
DEBUG_ATSHA_PRINTLN("Sender found in whitelist");
DEBUG_SIGNING_PRINTLN(F("SIW")); // SIW = Sender found in whitelist
memcpy(current_nonce, &rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
current_nonce[32] = msg.sender;
memcpy(&current_nonce[33], whitelist[j].serial, SHA204_SERIAL_SZ);
@@ -199,71 +175,56 @@ bool MySigningAtsha204::verifyMsg(MyMessage &msg) {
// Compare the caluclated signature with the provided signature
if (memcmp(&msg.data[mGetLength(msg)], &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) {
DEBUG_ATSHA_PRINTBUF("Signature bad. Calculated signature:", &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
DEBUG_SIGNING_PRINTBUF(F("SNOK:"), &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); // SNOK = Signature bad
#ifdef MY_SECURE_NODE_WHITELISTING
DEBUG_ATSHA_PRINTLN("Is the sender whitelisted?");
DEBUG_SIGNING_PRINTLN(F("W?")); // W? = Is the sender whitelisted?
#endif
return false;
} else {
DEBUG_ATSHA_PRINTLN("Signature ok");
DEBUG_SIGNING_PRINTLN(F("SOK")); // SOK = Signature OK
return true;
}
}
}
// Helper to calculate signature of msg (returned in rx_buffer[SHA204_BUFFER_POS_DATA])
bool MySigningAtsha204::calculateSignature(MyMessage &msg) {
void MySigningAtsha204::calculateSignature(MyMessage &msg) {
memset(temp_message, 0, 32);
memcpy(temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
// Program the data to sign into the ATSHA204
if (atsha204.sha204m_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32, temp_message,
WRITE_COUNT_LONG, tx_buffer, WRITE_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to program data");
return false;
}
DEBUG_SIGNING_PRINTBUF(F("MSG:"), (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg))); // MSG = Message to sign
DEBUG_SIGNING_PRINTBUF(F("CNC:"), current_nonce, 32); // CNC = Current nonce
(void)atsha204.sha204m_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32, temp_message,
WRITE_COUNT_LONG, tx_buffer, WRITE_RSP_SIZE, rx_buffer);
// Program the nonce to use for the signature (has to be done just before GENDIG due to chip limitations)
if (atsha204.sha204m_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH, current_nonce,
NONCE_COUNT_LONG, tx_buffer, NONCE_RSP_SIZE_SHORT, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to program nonce");
// Purge nonce when used
memset(current_nonce, 0xAA, NONCE_NUMIN_SIZE_PASSTHROUGH);
return false;
}
(void)atsha204.sha204m_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH, current_nonce,
NONCE_COUNT_LONG, tx_buffer, NONCE_RSP_SIZE_SHORT, rx_buffer);
// Purge nonce when used
memset(current_nonce, 0xAA, NONCE_NUMIN_SIZE_PASSTHROUGH);
memset(current_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
// Generate digest of data and nonce
if (atsha204.sha204m_execute(SHA204_GENDIG, GENDIG_ZONE_DATA, 8, 0, NULL,
GENDIG_COUNT_DATA, tx_buffer, GENDIG_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to generate digest");
return false;
}
(void)atsha204.sha204m_execute(SHA204_GENDIG, GENDIG_ZONE_DATA, 8, 0, NULL,
GENDIG_COUNT_DATA, tx_buffer, GENDIG_RSP_SIZE, rx_buffer);
// Calculate HMAC of message+nonce digest and secret key
if (atsha204.sha204m_execute(SHA204_HMAC, HMAC_MODE_SOURCE_FLAG_MATCH, 0, 0, NULL,
HMAC_COUNT, tx_buffer, HMAC_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to generate HMAC");
return false;
}
(void)atsha204.sha204m_execute(SHA204_HMAC, HMAC_MODE_SOURCE_FLAG_MATCH, 0, 0, NULL,
HMAC_COUNT, tx_buffer, HMAC_RSP_SIZE, rx_buffer);
// Put device back to sleep
atsha204.sha204c_sleep();
DEBUG_ATSHA_PRINTBUF("HMAC:", &rx_buffer[SHA204_BUFFER_POS_DATA], 32);
return true; // We return with the signature in rx_buffer[SHA204_BUFFER_POS_DATA]
DEBUG_SIGNING_PRINTBUF(F("HMAC:"), &rx_buffer[SHA204_BUFFER_POS_DATA], 32);
}
// Helper to calculate a generic SHA256 digest of provided buffer (returned in rx_buffer[SHA204_BUFFER_POS_DATA]) (only supports one block)
// Helper to calculate a generic SHA256 digest of provided buffer (only supports one block)
// The pointer to the hash is returned, but the hash is also stored in rx_buffer[SHA204_BUFFER_POS_DATA])
uint8_t* MySigningAtsha204::sha256(const uint8_t* data, size_t sz) {
// Initiate SHA256 calculator
if (atsha204.sha204m_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL,
SHA_COUNT_SHORT, tx_buffer, SHA_RSP_SIZE_SHORT, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to initiate sha256");
return NULL;
}
(void)atsha204.sha204m_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL,
SHA_COUNT_SHORT, tx_buffer, SHA_RSP_SIZE_SHORT, rx_buffer);
// Calculate a hash
memset(temp_message, 0x00, SHA_MSG_SIZE);
@@ -272,16 +233,13 @@ uint8_t* MySigningAtsha204::sha256(const uint8_t* data, size_t sz) {
// Write length data to the last bytes
temp_message[SHA_MSG_SIZE-2] = (sz >> 5);
temp_message[SHA_MSG_SIZE-1] = (sz << 3);
DEBUG_ATSHA_PRINTBUF("Data to hash:", temp_message, SHA_MSG_SIZE);
if (atsha204.sha204m_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, temp_message,
SHA_COUNT_LONG, tx_buffer, SHA_RSP_SIZE_LONG, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to calculate sha256");
return NULL;
}
DEBUG_SIGNING_PRINTBUF(F("DTH:"), temp_message, SHA_MSG_SIZE); // DTH = Data to hash
(void)atsha204.sha204m_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, temp_message,
SHA_COUNT_LONG, tx_buffer, SHA_RSP_SIZE_LONG, rx_buffer);
// Put device back to sleep
atsha204.sha204c_sleep();
DEBUG_ATSHA_PRINTBUF("SHA:", &rx_buffer[SHA204_BUFFER_POS_DATA], 32);
DEBUG_SIGNING_PRINTBUF(F("SHA:"), &rx_buffer[SHA204_BUFFER_POS_DATA], 32);
return &rx_buffer[SHA204_BUFFER_POS_DATA];
}