From cd5c243f7b2f20d80082e858f832e1c1ed7ffe81 Mon Sep 17 00:00:00 2001 From: Patrick Fallberg Date: Mon, 6 Jun 2016 20:31:08 +0200 Subject: [PATCH] Handle inbound and outbound nonces simultaneously Two separate buffers are used for nonce storage. One for the nonce used for signing a message and one for the nonce used for verifying a message. --- .../MySensors/core/MySigningAtsha204.cpp | 87 ++++++++++--------- .../MySensors/core/MySigningAtsha204Soft.cpp | 32 +++---- 2 files changed, 62 insertions(+), 57 deletions(-) diff --git a/libraries/MySensors/core/MySigningAtsha204.cpp b/libraries/MySensors/core/MySigningAtsha204.cpp index 686708b..94dd91a 100644 --- a/libraries/MySensors/core/MySigningAtsha204.cpp +++ b/libraries/MySensors/core/MySigningAtsha204.cpp @@ -33,17 +33,18 @@ unsigned long _signing_timestamp; bool _signing_verification_ongoing = false; -uint8_t _signing_current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1]; +uint8_t _signing_verifying_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1]; +uint8_t _signing_signing_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1]; uint8_t _signing_temp_message[SHA_MSG_SIZE]; -uint8_t _singning_rx_buffer[SHA204_RSP_SIZE_MAX]; -uint8_t _singning_tx_buffer[SHA204_CMD_SIZE_MAX]; +uint8_t _signing_rx_buffer[SHA204_RSP_SIZE_MAX]; +uint8_t _signing_tx_buffer[SHA204_CMD_SIZE_MAX]; extern uint8_t _doWhitelist[32]; #ifdef MY_SIGNING_NODE_WHITELISTING const whitelist_entry_t _signing_whitelist[] = MY_SIGNING_NODE_WHITELISTING; #endif -static void signerCalculateSignature(MyMessage &msg); +static void signerCalculateSignature(MyMessage &msg, bool signing); static uint8_t* signerSha256(const uint8_t* data, size_t sz); @@ -94,7 +95,8 @@ bool signerAtsha204CheckTimer(void) { if (hwMillis() < _signing_timestamp || hwMillis() > _signing_timestamp + MY_VERIFICATION_TIMEOUT_MS) { DEBUG_SIGNING_PRINTBUF(F("Verification timeout"), NULL, 0); // Purge nonce - memset(_signing_current_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH); + memset(_signing_signing_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH); + memset(_signing_verifying_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH); _signing_verification_ongoing = false; return false; } @@ -109,22 +111,22 @@ bool signerAtsha204GetNonce(MyMessage &msg) { // This 32-byte random value is then hashed (SHA256) to produce the resulting nonce (void)atsha204_wakeup(_signing_temp_message); if (atsha204_execute(SHA204_RANDOM, RANDOM_SEED_UPDATE, 0, 0, NULL, - RANDOM_COUNT, _singning_tx_buffer, RANDOM_RSP_SIZE, _singning_rx_buffer) != SHA204_SUCCESS) { + RANDOM_COUNT, _signing_tx_buffer, RANDOM_RSP_SIZE, _signing_rx_buffer) != SHA204_SUCCESS) { DEBUG_SIGNING_PRINTBUF(F("Failed to generate nonce"), NULL, 0); return false; } for (int i = 0; i < 32; i++) { - _signing_current_nonce[i] = _singning_rx_buffer[SHA204_BUFFER_POS_DATA+i] ^ (hwMillis()&0xFF); + _signing_verifying_nonce[i] = _signing_rx_buffer[SHA204_BUFFER_POS_DATA+i] ^ (hwMillis()&0xFF); } - memcpy(_signing_current_nonce, signerSha256(_signing_current_nonce, 32), MAX_PAYLOAD); + memcpy(_signing_verifying_nonce, signerSha256(_signing_verifying_nonce, 32), MAX_PAYLOAD); atsha204_idle(); // We just idle the chip now since we expect to use it soon when the signed message arrives // We set the part of the 32-byte nonce that does not fit into a message to 0xAA - memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD); + memset(&_signing_verifying_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_verifying_nonce)-MAX_PAYLOAD); // Transfer the first part of the nonce to the message - msg.set(_signing_current_nonce, MAX_PAYLOAD); + msg.set(_signing_verifying_nonce, MAX_PAYLOAD); _signing_verification_ongoing = true; _signing_timestamp = hwMillis(); // Set timestamp to determine when to purge nonce // Be a little fancy to handle turnover (prolong the time allowed to timeout after turnover) @@ -137,9 +139,9 @@ bool signerAtsha204GetNonce(MyMessage &msg) { void signerAtsha204PutNonce(MyMessage &msg) { DEBUG_SIGNING_PRINTBUF(F("Signing backend: ATSHA204"), NULL, 0); - memcpy(_signing_current_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD); + memcpy(_signing_signing_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD); // We set the part of the 32-byte nonce that does not fit into a message to 0xAA - memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD); + memset(&_signing_signing_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_signing_nonce)-MAX_PAYLOAD); } bool signerAtsha204SignMsg(MyMessage &msg) { @@ -151,14 +153,14 @@ bool signerAtsha204SignMsg(MyMessage &msg) { // Calculate signature of message mSetSigned(msg, 1); // make sure signing flag is set before signature is calculated - signerCalculateSignature(msg); + signerCalculateSignature(msg, true); if (DO_WHITELIST(msg.destination)) { // Salt the signature with the senders nodeId and the unique serial of the ATSHA device - memcpy(_signing_current_nonce, &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed - _signing_current_nonce[32] = msg.sender; - atsha204_getSerialNumber(&_signing_current_nonce[33]); - (void)signerSha256(_signing_current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place + memcpy(_signing_signing_nonce, &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed + _signing_signing_nonce[32] = msg.sender; + atsha204_getSerialNumber(&_signing_signing_nonce[33]); + (void)signerSha256(_signing_signing_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place DEBUG_SIGNING_PRINTBUF(F("Signature salted with serial"), NULL, 0); } @@ -166,10 +168,10 @@ bool signerAtsha204SignMsg(MyMessage &msg) { atsha204_sleep(); // Overwrite the first byte in the signature with the signing identifier - _singning_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; + _signing_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; // Transfer as much signature data as the remaining space in the message permits - memcpy(&msg.data[mGetLength(msg)], &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); + memcpy(&msg.data[mGetLength(msg)], &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg)); return true; @@ -193,7 +195,7 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) { } DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg)); - signerCalculateSignature(msg); // Get signature of message + signerCalculateSignature(msg, false); // Get signature of message #ifdef MY_SIGNING_NODE_WHITELISTING // Look up the senders nodeId in our whitelist and salt the signature with that data @@ -201,10 +203,10 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) { for (j=0; j < NUM_OF(_signing_whitelist); j++) { if (_signing_whitelist[j].nodeId == msg.sender) { DEBUG_SIGNING_PRINTBUF(F("Sender found in whitelist"), NULL, 0); - memcpy(_signing_current_nonce, &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed - _signing_current_nonce[32] = msg.sender; - memcpy(&_signing_current_nonce[33], _signing_whitelist[j].serial, SHA204_SERIAL_SZ); - (void)signerSha256(_signing_current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place + memcpy(_signing_verifying_nonce, &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed + _signing_verifying_nonce[32] = msg.sender; + memcpy(&_signing_verifying_nonce[33], _signing_whitelist[j].serial, SHA204_SERIAL_SZ); + (void)signerSha256(_signing_verifying_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place break; } } @@ -220,11 +222,11 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) { atsha204_sleep(); // Overwrite the first byte in the signature with the signing identifier - _singning_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; + _signing_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; // Compare the caluclated signature with the provided signature - if (signerMemcmp(&msg.data[mGetLength(msg)], &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) { - DEBUG_SIGNING_PRINTBUF(F("Signature bad: "), &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); + if (signerMemcmp(&msg.data[mGetLength(msg)], &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) { + DEBUG_SIGNING_PRINTBUF(F("Signature bad: "), &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); #ifdef MY_SIGNING_NODE_WHITELISTING DEBUG_SIGNING_PRINTBUF(F("Is the sender whitelisted and serial correct?"), NULL, 0); #endif @@ -236,42 +238,43 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) { } } -// Helper to calculate signature of msg (returned in _singning_rx_buffer[SHA204_BUFFER_POS_DATA]) -static void signerCalculateSignature(MyMessage &msg) { +// Helper to calculate signature of msg (returned in _signing_rx_buffer[SHA204_BUFFER_POS_DATA]) +static void signerCalculateSignature(MyMessage &msg, bool signing) { (void)atsha204_wakeup(_signing_temp_message); memset(_signing_temp_message, 0, 32); memcpy(_signing_temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg))); // Program the data to sign into the ATSHA204 DEBUG_SIGNING_PRINTBUF(F("Message to process: "), (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg))); - DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), _signing_current_nonce, 32); + DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), signing ? _signing_signing_nonce : _signing_verifying_nonce, 32); (void)atsha204_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32, _signing_temp_message, - WRITE_COUNT_LONG, _singning_tx_buffer, WRITE_RSP_SIZE, _singning_rx_buffer); + WRITE_COUNT_LONG, _signing_tx_buffer, WRITE_RSP_SIZE, _signing_rx_buffer); // Program the nonce to use for the signature (has to be done just before GENDIG due to chip limitations) - (void)atsha204_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH, _signing_current_nonce, - NONCE_COUNT_LONG, _singning_tx_buffer, NONCE_RSP_SIZE_SHORT, _singning_rx_buffer); + (void)atsha204_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH, + signing ? _signing_signing_nonce : _signing_verifying_nonce, + NONCE_COUNT_LONG, _signing_tx_buffer, NONCE_RSP_SIZE_SHORT, _signing_rx_buffer); // Purge nonce when used - memset(_signing_current_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH); + memset(signing ? _signing_signing_nonce : _signing_verifying_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH); // Generate digest of data and nonce (void)atsha204_execute(SHA204_GENDIG, GENDIG_ZONE_DATA, 8, 0, NULL, - GENDIG_COUNT_DATA, _singning_tx_buffer, GENDIG_RSP_SIZE, _singning_rx_buffer); + GENDIG_COUNT_DATA, _signing_tx_buffer, GENDIG_RSP_SIZE, _signing_rx_buffer); // Calculate HMAC of message+nonce digest and secret key (void)atsha204_execute(SHA204_HMAC, HMAC_MODE_SOURCE_FLAG_MATCH, 0, 0, NULL, - HMAC_COUNT, _singning_tx_buffer, HMAC_RSP_SIZE, _singning_rx_buffer); + HMAC_COUNT, _signing_tx_buffer, HMAC_RSP_SIZE, _signing_rx_buffer); - DEBUG_SIGNING_PRINTBUF(F("HMAC: "), &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32); + DEBUG_SIGNING_PRINTBUF(F("HMAC: "), &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32); } // Helper to calculate a generic SHA256 digest of provided buffer (only supports one block) -// The pointer to the hash is returned, but the hash is also stored in _singning_rx_buffer[SHA204_BUFFER_POS_DATA]) +// The pointer to the hash is returned, but the hash is also stored in _signing_rx_buffer[SHA204_BUFFER_POS_DATA]) static uint8_t* signerSha256(const uint8_t* data, size_t sz) { // Initiate SHA256 calculator (void)atsha204_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL, - SHA_COUNT_SHORT, _singning_tx_buffer, SHA_RSP_SIZE_SHORT, _singning_rx_buffer); + SHA_COUNT_SHORT, _signing_tx_buffer, SHA_RSP_SIZE_SHORT, _signing_rx_buffer); // Calculate a hash memset(_signing_temp_message, 0x00, SHA_MSG_SIZE); @@ -281,8 +284,8 @@ static uint8_t* signerSha256(const uint8_t* data, size_t sz) { _signing_temp_message[SHA_MSG_SIZE-2] = (sz >> 5); _signing_temp_message[SHA_MSG_SIZE-1] = (sz << 3); (void)atsha204_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, _signing_temp_message, - SHA_COUNT_LONG, _singning_tx_buffer, SHA_RSP_SIZE_LONG, _singning_rx_buffer); + SHA_COUNT_LONG, _signing_tx_buffer, SHA_RSP_SIZE_LONG, _signing_rx_buffer); - DEBUG_SIGNING_PRINTBUF(F("SHA256: "), &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32); - return &_singning_rx_buffer[SHA204_BUFFER_POS_DATA]; + DEBUG_SIGNING_PRINTBUF(F("SHA256: "), &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32); + return &_signing_rx_buffer[SHA204_BUFFER_POS_DATA]; } diff --git a/libraries/MySensors/core/MySigningAtsha204Soft.cpp b/libraries/MySensors/core/MySigningAtsha204Soft.cpp index b6037e4..400895f 100644 --- a/libraries/MySensors/core/MySigningAtsha204Soft.cpp +++ b/libraries/MySensors/core/MySigningAtsha204Soft.cpp @@ -38,7 +38,8 @@ Sha256Class _signing_sha256; unsigned long _signing_timestamp; bool _signing_verification_ongoing = false; -uint8_t _signing_current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH]; +uint8_t _signing_verifying_nonce[32]; +uint8_t _signing_signing_nonce[32]; uint8_t _signing_temp_message[32]; static uint8_t _signing_hmac_key[32]; uint8_t _signing_hmac[32]; @@ -49,7 +50,7 @@ static uint8_t _signing_node_serial_info[9]; const whitelist_entry_t _signing_whitelist[] = MY_SIGNING_NODE_WHITELISTING; #endif -static void signerCalculateSignature(MyMessage &msg); +static void signerCalculateSignature(MyMessage &msg, bool signing); #ifdef MY_DEBUG_VERBOSE_SIGNING static char i2h(uint8_t i) @@ -102,7 +103,8 @@ bool signerAtsha204SoftCheckTimer(void) { if (hwMillis() < _signing_timestamp || hwMillis() > _signing_timestamp + MY_VERIFICATION_TIMEOUT_MS) { DEBUG_SIGNING_PRINTBUF(F("Verification timeout"), NULL, 0); // Purge nonce - memset(_signing_current_nonce, 0xAA, 32); + memset(_signing_signing_nonce, 0xAA, 32); + memset(_signing_verifying_nonce, 0xAA, 32); _signing_verification_ongoing = false; return false; } @@ -119,14 +121,14 @@ bool signerAtsha204SoftGetNonce(MyMessage &msg) { for (int i = 0; i < 32; i++) { _signing_sha256.write(random(256) ^ (hwMillis()&0xFF)); } - memcpy(_signing_current_nonce, _signing_sha256.result(), MAX_PAYLOAD); - DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_current_nonce, 32); + memcpy(_signing_verifying_nonce, _signing_sha256.result(), MAX_PAYLOAD); + DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_verifying_nonce, 32); // We set the part of the 32-byte nonce that does not fit into a message to 0xAA - memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD); + memset(&_signing_verifying_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_verifying_nonce)-MAX_PAYLOAD); // Transfer the first part of the nonce to the message - msg.set(_signing_current_nonce, MAX_PAYLOAD); + msg.set(_signing_verifying_nonce, MAX_PAYLOAD); _signing_verification_ongoing = true; _signing_timestamp = hwMillis(); // Set timestamp to determine when to purge nonce // Be a little fancy to handle turnover (prolong the time allowed to timeout after turnover) @@ -139,9 +141,9 @@ bool signerAtsha204SoftGetNonce(MyMessage &msg) { void signerAtsha204SoftPutNonce(MyMessage &msg) { DEBUG_SIGNING_PRINTBUF(F("Signing backend: ATSHA204Soft"), NULL, 0); - memcpy(_signing_current_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD); + memcpy(_signing_signing_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD); // We set the part of the 32-byte nonce that does not fit into a message to 0xAA - memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD); + memset(&_signing_signing_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_signing_nonce)-MAX_PAYLOAD); } bool signerAtsha204SoftSignMsg(MyMessage &msg) { @@ -153,7 +155,7 @@ bool signerAtsha204SoftSignMsg(MyMessage &msg) { // Calculate signature of message mSetSigned(msg, 1); // make sure signing flag is set before signature is calculated - signerCalculateSignature(msg); + signerCalculateSignature(msg, true); if (DO_WHITELIST(msg.destination)) { // Salt the signature with the senders nodeId and the (hopefully) unique serial The Creator has provided @@ -195,7 +197,7 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg) { // Get signature of message DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg)); - signerCalculateSignature(msg); + signerCalculateSignature(msg, false); #ifdef MY_SIGNING_NODE_WHITELISTING // Look up the senders nodeId in our whitelist and salt the signature with that data @@ -236,11 +238,11 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg) { } // Helper to calculate signature of msg (returned in hmac) -static void signerCalculateSignature(MyMessage &msg) { +static void signerCalculateSignature(MyMessage &msg, bool signing) { memset(_signing_temp_message, 0, 32); memcpy(_signing_temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg))); DEBUG_SIGNING_PRINTBUF(F("Message to process: "), (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg))); - DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), _signing_current_nonce, 32); + DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), signing ? _signing_signing_nonce : _signing_verifying_nonce, 32); // ATSHA204 calculates the HMAC with a PSK and a SHA256 digest of the following data: // 32 bytes zeroes @@ -275,9 +277,9 @@ static void signerCalculateSignature(MyMessage &msg) { _signing_sha256.write(0x01); // SN[0] _signing_sha256.write(0x23); // SN[1] for (int i=0; i<25; i++) _signing_sha256.write(0x00); - for (int i=0; i<32; i++) _signing_sha256.write(_signing_current_nonce[i]); + for (int i=0; i<32; i++) _signing_sha256.write(signing ? _signing_signing_nonce[i] : _signing_verifying_nonce[i]); // Purge nonce when used - memset(_signing_current_nonce, 0xAA, 32); + memset(signing ? _signing_signing_nonce : _signing_verifying_nonce, 0xAA, 32); memcpy(_signing_temp_message, _signing_sha256.result(), 32); // Feed "message" to HMAC calculator