MySmartHome/MySensors
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security personalizer rewritten (#794)

Browse Source 
* Removed ability to lock data section
* Introduced "guided mode" to simplify process
* Refactored the sketch to be less monolithic
* Print details and instructions in tables
* Use device unique ID as serial when
* Calculate and store personalization checksum
* Print serial in a copy+paste friendly manner (fixes #804)
* Clarify meaning of UART confirmation (fixes #805)
This commit is contained in:
Patrick Fallberg
2017-04-02 15:37:21 +02:00
committed by GitHub
parent 3350d79fe6
commit 7e6db413c7
14 changed files with 1794 additions and 954 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/MySigningAtsha204Soft.cpp
+94 -74
View File
@@ -31,7 +31,13 @@
#include "MySigning.h"
#include "drivers/ATSHA204/sha256.h"
#define SIGNING_IDENTIFIER (1)
#define SIGNING_IDENTIFIER (1) //HMAC-SHA256
#if defined(MY_DEBUG_VERBOSE_SIGNING)
#define SIGN_DEBUG(x,...) hwDebugPrint(x, ##__VA_ARGS__)
#else
#define SIGN_DEBUG(x,...)
#endif
// Define MY_DEBUG_VERBOSE_SIGNING in your sketch to enable signing backend debugprints
@@ -52,69 +58,39 @@ const whitelist_entry_t _signing_whitelist[] = MY_SIGNING_NODE_WHITELISTING;
static void signerCalculateSignature(MyMessage &msg, bool signing);
#ifdef MY_DEBUG_VERBOSE_SIGNING
static char i2h(uint8_t i)
{
uint8_t k = i & 0x0F;
if (k <= 9) {
return '0' + k;
} else {
return 'A' + k - 10;
}
}
static bool init_ok = false;
static const uint8_t reset_serial[9] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
#ifdef __linux__
#define __FlashStringHelper char
#define MY_SERIALDEVICE.print debug
#endif
static void DEBUG_SIGNING_PRINTBUF(const __FlashStringHelper* str, uint8_t* buf, uint8_t sz)
bool signerAtsha204SoftInit(void)
{
static char printBuffer[300];
if (NULL == buf) {
return;
}
#if defined(MY_GATEWAY_FEATURE) && !defined(__linux__)
// prepend debug message to be handled correctly by controller (C_INTERNAL, I_LOG_MESSAGE)
snprintf_P(printBuffer, 299, PSTR("0;255;%d;0;%d;"), C_INTERNAL, I_LOG_MESSAGE);
MY_SERIALDEVICE.print(printBuffer);
#endif
for (int i=0; i<sz; i++) {
printBuffer[i * 2] = i2h(buf[i] >> 4);
printBuffer[(i * 2) + 1] = i2h(buf[i]);
}
printBuffer[sz * 2] = '\0';
#if defined(MY_GATEWAY_FEATURE) && !defined(__linux__)
// Truncate message if this is gateway node
printBuffer[MY_GATEWAY_MAX_SEND_LENGTH-1-strlen_P((const char*)str)] = '\0';
#endif
MY_SERIALDEVICE.print(str);
if (sz > 0) {
MY_SERIALDEVICE.print(printBuffer);
}
#if !defined(__linux__)
MY_SERIALDEVICE.println("");
#endif
}
#else
#define DEBUG_SIGNING_PRINTBUF(str, buf, sz)
#endif
init_ok = true;
void signerAtsha204SoftInit(void)
{
// initialize pseudo-RNG
hwRandomNumberInit();
// Set secrets
hwReadConfigBlock((void*)_signing_hmac_key, (void*)EEPROM_SIGNING_SOFT_HMAC_KEY_ADDRESS, 32);
hwReadConfigBlock((void*)_signing_node_serial_info, (void*)EEPROM_SIGNING_SOFT_SERIAL_ADDRESS, 9);
if (!memcmp(_signing_node_serial_info, reset_serial, 9)) {
unique_id_t uniqueID;
// There is no serial, attempt to get unique ID for serial instead
if (hwUniqueID(&uniqueID)) {
// There is a unique serial, use that
memcpy(_signing_node_serial_info, uniqueID, 9);
}
}
return init_ok;
}
bool signerAtsha204SoftCheckTimer(void)
{
if (!init_ok) {
SIGN_DEBUG(PSTR("Backend not initialized\n"));
return false;
}
if (_signing_verification_ongoing) {
if (hwMillis() < _signing_timestamp ||
hwMillis() > _signing_timestamp + MY_VERIFICATION_TIMEOUT_MS) {
DEBUG_SIGNING_PRINTBUF(F("Verification timeout"), NULL, 0);
SIGN_DEBUG(PSTR("Verification timeout\n"));
// Purge nonce
memset(_signing_signing_nonce, 0xAA, 32);
memset(_signing_verifying_nonce, 0xAA, 32);
@@ -127,7 +103,11 @@ bool signerAtsha204SoftCheckTimer(void)
bool signerAtsha204SoftGetNonce(MyMessage &msg)
{
DEBUG_SIGNING_PRINTBUF(F("Signing backend: ATSHA204Soft"), NULL, 0);
if (!init_ok) {
SIGN_DEBUG(PSTR("Backend not initialized\n"));
return false;
}
SIGN_DEBUG(PSTR("Signing backend: ATSHA204Soft\n"));
// We used a basic whitening technique that XORs a random byte with the current hwMillis() counter and then the byte is
// hashed (SHA256) to produce the resulting nonce
@@ -136,7 +116,6 @@ bool signerAtsha204SoftGetNonce(MyMessage &msg)
_signing_sha256.write(random(256) ^ (hwMillis()&0xFF));
}
memcpy(_signing_verifying_nonce, _signing_sha256.result(), MAX_PAYLOAD);
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_verifying_nonce, 32);
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
memset(&_signing_verifying_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_verifying_nonce)-MAX_PAYLOAD);
@@ -156,7 +135,10 @@ bool signerAtsha204SoftGetNonce(MyMessage &msg)
void signerAtsha204SoftPutNonce(MyMessage &msg)
{
DEBUG_SIGNING_PRINTBUF(F("Signing backend: ATSHA204Soft"), NULL, 0);
if (!init_ok) {
SIGN_DEBUG(PSTR("Backend not initialized\n"));
}
SIGN_DEBUG(PSTR("Signing backend: ATSHA204Soft\n"));
memcpy(_signing_signing_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
@@ -167,7 +149,7 @@ bool signerAtsha204SoftSignMsg(MyMessage &msg)
{
// If we cannot fit any signature in the message, refuse to sign it
if (mGetLength(msg) > MAX_PAYLOAD-2) {
DEBUG_SIGNING_PRINTBUF(F("Message too large"), NULL, 0);
SIGN_DEBUG(PSTR("Message too large\n"));
return false;
}
@@ -186,8 +168,10 @@ bool signerAtsha204SoftSignMsg(MyMessage &msg)
_signing_sha256.write(_signing_node_serial_info[i]);
}
memcpy(_signing_hmac, _signing_sha256.result(), 32);
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_hmac, 32);
DEBUG_SIGNING_PRINTBUF(F("Signature salted with serial"), NULL, 0);
SIGN_DEBUG(PSTR("Signature salted with serial: %02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
_signing_node_serial_info[0], _signing_node_serial_info[1], _signing_node_serial_info[2],
_signing_node_serial_info[3], _signing_node_serial_info[4], _signing_node_serial_info[5],
_signing_node_serial_info[6], _signing_node_serial_info[7], _signing_node_serial_info[8]);
}
// Overwrite the first byte in the signature with the signing identifier
@@ -195,8 +179,6 @@ bool signerAtsha204SoftSignMsg(MyMessage &msg)
// Transfer as much signature data as the remaining space in the message permits
memcpy(&msg.data[mGetLength(msg)], _signing_hmac, MAX_PAYLOAD-mGetLength(msg));
DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)],
MAX_PAYLOAD-mGetLength(msg));
return true;
}
@@ -204,7 +186,7 @@ bool signerAtsha204SoftSignMsg(MyMessage &msg)
bool signerAtsha204SoftVerifyMsg(MyMessage &msg)
{
if (!_signing_verification_ongoing) {
DEBUG_SIGNING_PRINTBUF(F("No active verification session"), NULL, 0);
SIGN_DEBUG(PSTR("No active verification session\n"));
return false;
} else {
// Make sure we have not expired
@@ -215,21 +197,18 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg)
_signing_verification_ongoing = false;
if (msg.data[mGetLength(msg)] != SIGNING_IDENTIFIER) {
DEBUG_SIGNING_PRINTBUF(F("Incorrect signing identifier"), NULL, 0);
SIGN_DEBUG(PSTR("Incorrect signing identifier\n"));
return false;
}
// Get signature of message
DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)],
MAX_PAYLOAD-mGetLength(msg));
signerCalculateSignature(msg, false);
signerCalculateSignature(msg, false); // Get signature of message
#ifdef MY_SIGNING_NODE_WHITELISTING
// Look up the senders nodeId in our whitelist and salt the signature with that data
size_t j;
for (j=0; j < NUM_OF(_signing_whitelist); j++) {
if (_signing_whitelist[j].nodeId == msg.sender) {
DEBUG_SIGNING_PRINTBUF(F("Sender found in whitelist"), NULL, 0);
SIGN_DEBUG(PSTR("Sender found in whitelist\n"));
_signing_sha256.init();
for (int i=0; i<32; i++) {
_signing_sha256.write(_signing_hmac[i]);
@@ -239,12 +218,11 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg)
_signing_sha256.write(_signing_whitelist[j].serial[i]);
}
memcpy(_signing_hmac, _signing_sha256.result(), 32);
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_hmac, 32);
break;
}
}
if (j == NUM_OF(_signing_whitelist)) {
DEBUG_SIGNING_PRINTBUF(F("Sender not found in whitelist, message rejected!"), NULL, 0);
SIGN_DEBUG(PSTR("Sender not found in whitelist, message rejected!\n"));
return false;
}
#endif
@@ -254,13 +232,13 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg)
// Compare the caluclated signature with the provided signature
if (signerMemcmp(&msg.data[mGetLength(msg)], _signing_hmac, MAX_PAYLOAD-mGetLength(msg))) {
DEBUG_SIGNING_PRINTBUF(F("Signature bad: "), _signing_hmac, MAX_PAYLOAD-mGetLength(msg));
SIGN_DEBUG(PSTR("Signature bad\n"));
#ifdef MY_SIGNING_NODE_WHITELISTING
DEBUG_SIGNING_PRINTBUF(F("Is the sender whitelisted and serial correct?"), NULL, 0);
SIGN_DEBUG(PSTR("Is the sender whitelisted and serial correct?\n"));
#endif
return false;
} else {
DEBUG_SIGNING_PRINTBUF(F("Signature OK"), NULL, 0);
SIGN_DEBUG(PSTR("Signature OK\n"));
return true;
}
}
@@ -272,10 +250,42 @@ static void signerCalculateSignature(MyMessage &msg, bool signing)
memset(_signing_temp_message, 0, 32);
memcpy(_signing_temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE],
MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
DEBUG_SIGNING_PRINTBUF(F("Message to process: "), (uint8_t*)&msg.data[1-HEADER_SIZE],
MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
DEBUG_SIGNING_PRINTBUF(F("Current nonce: "),
signing ? _signing_signing_nonce : _signing_verifying_nonce, 32);
SIGN_DEBUG(PSTR("Current nonce: "
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X"
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
signing ? _signing_signing_nonce[0] : _signing_verifying_nonce[0],
signing ? _signing_signing_nonce[1] : _signing_verifying_nonce[1],
signing ? _signing_signing_nonce[2] : _signing_verifying_nonce[2],
signing ? _signing_signing_nonce[3] : _signing_verifying_nonce[3],
signing ? _signing_signing_nonce[4] : _signing_verifying_nonce[4],
signing ? _signing_signing_nonce[5] : _signing_verifying_nonce[5],
signing ? _signing_signing_nonce[6] : _signing_verifying_nonce[6],
signing ? _signing_signing_nonce[7] : _signing_verifying_nonce[7],
signing ? _signing_signing_nonce[8] : _signing_verifying_nonce[8],
signing ? _signing_signing_nonce[9] : _signing_verifying_nonce[9],
signing ? _signing_signing_nonce[10] : _signing_verifying_nonce[10],
signing ? _signing_signing_nonce[11] : _signing_verifying_nonce[11],
signing ? _signing_signing_nonce[12] : _signing_verifying_nonce[12],
signing ? _signing_signing_nonce[13] : _signing_verifying_nonce[13],
signing ? _signing_signing_nonce[14] : _signing_verifying_nonce[14],
signing ? _signing_signing_nonce[15] : _signing_verifying_nonce[15],
signing ? _signing_signing_nonce[16] : _signing_verifying_nonce[16],
signing ? _signing_signing_nonce[17] : _signing_verifying_nonce[17],
signing ? _signing_signing_nonce[18] : _signing_verifying_nonce[18],
signing ? _signing_signing_nonce[19] : _signing_verifying_nonce[19],
signing ? _signing_signing_nonce[20] : _signing_verifying_nonce[20],
signing ? _signing_signing_nonce[21] : _signing_verifying_nonce[21],
signing ? _signing_signing_nonce[22] : _signing_verifying_nonce[22],
signing ? _signing_signing_nonce[23] : _signing_verifying_nonce[23],
signing ? _signing_signing_nonce[24] : _signing_verifying_nonce[24],
signing ? _signing_signing_nonce[25] : _signing_verifying_nonce[25],
signing ? _signing_signing_nonce[26] : _signing_verifying_nonce[26],
signing ? _signing_signing_nonce[27] : _signing_verifying_nonce[27],
signing ? _signing_signing_nonce[28] : _signing_verifying_nonce[28],
signing ? _signing_signing_nonce[29] : _signing_verifying_nonce[29],
signing ? _signing_signing_nonce[30] : _signing_verifying_nonce[30],
signing ? _signing_signing_nonce[31] : _signing_verifying_nonce[31]
);
// ATSHA204 calculates the HMAC with a PSK and a SHA256 digest of the following data:
// 32 bytes zeroes
@@ -348,5 +358,15 @@ static void signerCalculateSignature(MyMessage &msg, bool signing)
memcpy(_signing_hmac, _signing_sha256.resultHmac(), 32);
DEBUG_SIGNING_PRINTBUF(F("HMAC: "), _signing_hmac, 32);
SIGN_DEBUG(PSTR("HMAC: "
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X"
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
_signing_hmac[0], _signing_hmac[1], _signing_hmac[2], _signing_hmac[3],
_signing_hmac[4], _signing_hmac[5], _signing_hmac[6], _signing_hmac[7],
_signing_hmac[8], _signing_hmac[9], _signing_hmac[10], _signing_hmac[11],
_signing_hmac[12], _signing_hmac[13], _signing_hmac[14], _signing_hmac[15],
_signing_hmac[16], _signing_hmac[17], _signing_hmac[18], _signing_hmac[19],
_signing_hmac[20], _signing_hmac[21], _signing_hmac[22], _signing_hmac[23],
_signing_hmac[24], _signing_hmac[25], _signing_hmac[26], _signing_hmac[27],
_signing_hmac[28], _signing_hmac[29], _signing_hmac[30], _signing_hmac[31]);
}