MySmartHome/MySensors
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Whitelisting support in signing backend

Browse Source 
Whitelisting is enabled using MY_SECURE_NODE_WHITELISTING in MyConfig.h.
The whitelist is provided in backend constructors.
See the SecureActuator example for a typical usecase.
This commit is contained in:
Patrick Fallberg
2015-03-16 20:21:05 +01:00
parent cf31edcb81
commit f295ef2961
7 changed files with 177 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libraries/MySensors/MyConfig.h
+12
View File
@@ -21,11 +21,23 @@ typedef MyHwATMega328 MyHwDriver;
// which might vary, especially in networks with many hops. 5s ought to be enough for anyone.
#define MY_VERIFICATION_TIMEOUT_MS 5000
// Enable to turn on whitelisting
// When enabled, a signing node will salt the signature with it's unique signature and nodeId.
// The verifying node will look up the sender in a local table of trusted nodes and
// do the corresponding salting in order to verify the signature.
// For this reason, if whitelisting is enabled on one of the nodes in a sign-verify pair, both
// nodes have to implement whitelisting for this to work.
// Note that a node can still transmit a non-salted message (i.e. have whitelisting disabled)
// to a node that has whitelisting enabled (assuming the receiver does not have a matching entry
// for the sender in it's whitelist)
//#define MY_SECURE_NODE_WHITELISTING
// MySigningAtsha204 default setting
#define MY_ATSHA204_PIN 17 // A3 - pin where ATSHA204 is attached
// MySigningAtsha204Soft default settings
#define MY_RANDOMSEED_PIN 7 // A7 - Pin used for random generation (do not connect anything to this)
// Key to use for HMAC calculation in MySigningAtsha204Soft (32 bytes)
#define MY_HMAC_KEY 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,\
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
libraries/MySensors/MySigningAtsha204.cpp
+47 -21
View File
@@ -36,10 +36,18 @@ static void DEBUG_ATSHA_PRINTBUF(char* str, uint8_t* buf, uint8_t sz)
#endif
MySigningAtsha204::MySigningAtsha204(bool requestSignatures, uint8_t atshaPin)
MySigningAtsha204::MySigningAtsha204(bool requestSignatures,
#ifdef MY_SECURE_NODE_WHITELISTING
uint8_t nof_whitelist_entries, const whitelist_entry_t* the_whitelist,
#endif
uint8_t atshaPin)
:
MySigning(requestSignatures),
atsha204(atshaPin),
#ifdef MY_SECURE_NODE_WHITELISTING
whitelist(the_whitelist),
whitlist_sz(nof_whitelist_entries),
#endif
verification_ongoing(false)
{
}
@@ -50,21 +58,14 @@ bool MySigningAtsha204::getNonce(MyMessage &msg) {
// We used a basic whitening technique that takes the first byte of a new random value and builds up a 32-byte random value
// This 32-byte random value is then hashed (SHA256) to produce the resulting nonce
for (int i = 0; i < 32; i++) {
// Wake device before starting operations
if (atsha204.sha204c_wakeup(rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to wake device");
return false;
}
if (atsha204.sha204m_execute(SHA204_RANDOM, RANDOM_NO_SEED_UPDATE, 0, 0, NULL,
RANDOM_COUNT, tx_buffer, RANDOM_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to generate nonce");
return false;
}
atsha204.sha204c_sleep();
current_nonce[i] = rx_buffer[SHA204_BUFFER_POS_DATA];
}
pRnd = sha256(current_nonce, 32);
atsha204.sha204c_sleep();
if (!pRnd) {
DEBUG_ATSHA_PRINTLN("Failed to hash random value");
@@ -134,6 +135,19 @@ bool MySigningAtsha204::signMsg(MyMessage &msg) {
return false;
}
#ifdef MY_SECURE_NODE_WHITELISTING
// Salt the signature with the senders nodeId and the unique serial of the ATSHA device
memcpy(current_nonce, &rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
current_nonce[32] = msg.sender;
(void)atsha204.getSerialNumber(&current_nonce[33]);
(void)sha256(current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
memset(current_nonce, 0xAA, NONCE_NUMIN_SIZE_PASSTHROUGH);
DEBUG_ATSHA_PRINTLN("Signature salted");
#endif
// Overwrite the first byte in the signature with the signing identifier
rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
// Transfer as much signature data as the remaining space in the message permits
memcpy(&msg.data[mGetLength(msg)], &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
@@ -166,9 +180,29 @@ bool MySigningAtsha204::verifyMsg(MyMessage &msg) {
return false;
}
#ifdef MY_SECURE_NODE_WHITELISTING
// Look up the senders nodeId in our whitelist and salt the signature with that data
for (int j=0; j < whitlist_sz; j++) {
if (whitelist[j].nodeId == msg.sender) {
DEBUG_ATSHA_PRINTLN("Sender found in whitelist");
memcpy(current_nonce, &rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
current_nonce[32] = msg.sender;
memcpy(&current_nonce[33], whitelist[j].serial, SHA204_SERIAL_SZ);
(void)sha256(current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
break;
}
}
#endif
// Overwrite the first byte in the signature with the signing identifier
rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
// Compare the caluclated signature with the provided signature
if (memcmp(&msg.data[mGetLength(msg)], &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) {
DEBUG_ATSHA_PRINTBUF("Signature bad. Calculated signature:", &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
#ifdef MY_SECURE_NODE_WHITELISTING
DEBUG_ATSHA_PRINTLN("Is the sender whitelisted?");
#endif
return false;
} else {
DEBUG_ATSHA_PRINTLN("Signature ok");
@@ -182,9 +216,6 @@ bool MySigningAtsha204::calculateSignature(MyMessage &msg) {
memset(temp_message, 0, 32);
memcpy(temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
// Wake device before starting operations
if (atsha204.sha204c_wakeup(rx_buffer) != SHA204_SUCCESS) return false;
// Program the data to sign into the ATSHA204
if (atsha204.sha204m_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32, temp_message,
WRITE_COUNT_LONG, tx_buffer, WRITE_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) {
@@ -221,21 +252,12 @@ bool MySigningAtsha204::calculateSignature(MyMessage &msg) {
// Put device back to sleep
atsha204.sha204c_sleep();
// Overwrite the first byte in the signature with the signing identifier
rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
DEBUG_ATSHA_PRINTBUF("HMAC:", &rx_buffer[SHA204_BUFFER_POS_DATA], 32);
return true; // We return with the signature in rx_buffer[SHA204_BUFFER_POS_DATA]
}
// Helper to calculate a generic SHA256 digest of provided buffer (returned in rx_buffer[SHA204_BUFFER_POS_DATA]) (only supports one block)
uint8_t* MySigningAtsha204::sha256(const uint8_t* data, size_t sz) {
// Wake device before starting operations
if (atsha204.sha204c_wakeup(rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to wake device");
return NULL;
}
// Initiate SHA256 calculator
if (atsha204.sha204m_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL,
SHA_COUNT_SHORT, tx_buffer, SHA_RSP_SIZE_SHORT, rx_buffer) != SHA204_SUCCESS) {
@@ -250,12 +272,16 @@ uint8_t* MySigningAtsha204::sha256(const uint8_t* data, size_t sz) {
// Write length data to the last bytes
temp_message[SHA_MSG_SIZE-2] = (sz >> 5);
temp_message[SHA_MSG_SIZE-1] = (sz << 3);
DEBUG_ATSHA_PRINTBUF("Data to hash (padded):", temp_message, SHA_MSG_SIZE);
DEBUG_ATSHA_PRINTBUF("Data to hash:", temp_message, SHA_MSG_SIZE);
if (atsha204.sha204m_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, temp_message,
SHA_COUNT_LONG, tx_buffer, SHA_RSP_SIZE_LONG, rx_buffer) != SHA204_SUCCESS) {
DEBUG_ATSHA_PRINTLN("Failed to calculate sha256");
return NULL;
}
// Put device back to sleep
atsha204.sha204c_sleep();
DEBUG_ATSHA_PRINTBUF("SHA:", &rx_buffer[SHA204_BUFFER_POS_DATA], 32);
return &rx_buffer[SHA204_BUFFER_POS_DATA];
}
libraries/MySensors/MySigningAtsha204.h
+17 -2
View File
@@ -14,13 +14,24 @@
#define SIGNING_IDENTIFIER (1)
#ifdef MY_SECURE_NODE_WHITELISTING
typedef struct {
uint8_t nodeId;
uint8_t serial[SHA204_SERIAL_SZ];
} whitelist_entry_t;
#endif
// The ATSHA204 is capable of generating proper random numbers for nonce
// and can calculate HMAC-SHA256 signatures. This is enterprise-
// level of security and ought to implement the signing needs for anybody.
class MySigningAtsha204 : public MySigning
{
public:
MySigningAtsha204(bool requestSignatures=true, uint8_t atshaPin = MY_ATSHA204_PIN);
MySigningAtsha204(bool requestSignatures=true,
#ifdef MY_SECURE_NODE_WHITELISTING
uint8_t nof_whitelist_entries=0, const whitelist_entry_t* the_whitelist=NULL,
#endif
uint8_t atshaPin=MY_ATSHA204_PIN);
bool getNonce(MyMessage &msg);
bool checkTimer(void);
bool putNonce(MyMessage &msg);
@@ -30,12 +41,16 @@ private:
atsha204Class atsha204;
unsigned long timestamp;
bool verification_ongoing;
uint8_t current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH];
uint8_t current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1];
uint8_t temp_message[SHA_MSG_SIZE];
uint8_t rx_buffer[SHA204_RSP_SIZE_MAX];
uint8_t tx_buffer[SHA204_CMD_SIZE_MAX];
bool calculateSignature(MyMessage &msg);
uint8_t* sha256(const uint8_t* data, size_t sz);
#ifdef MY_SECURE_NODE_WHITELISTING
uint8_t whitlist_sz;
const whitelist_entry_t* whitelist;
#endif
};
#endif
libraries/MySensors/MySigningAtsha204Soft.cpp
+47 -6
View File
@@ -40,11 +40,21 @@ static void DEBUG_ATSHASOFT_PRINTBUF(char* str, uint8_t* buf, uint8_t sz)
#define DEBUG_ATSHASOFT_PRINTBUF(str, buf, sz)
#endif
MySigningAtsha204Soft::MySigningAtsha204Soft(bool requestSignatures, uint8_t randomseedPin)
MySigningAtsha204Soft::MySigningAtsha204Soft(bool requestSignatures,
#ifdef MY_SECURE_NODE_WHITELISTING
uint8_t nof_whitelist_entries, const whitelist_entry_t* the_whitelist,
const uint8_t* the_serial,
#endif
uint8_t randomseedPin)
:
MySigning(requestSignatures),
rndPin(randomseedPin),
hmacKey({MY_HMAC_KEY}),
#ifdef MY_SECURE_NODE_WHITELISTING
whitlist_sz(nof_whitelist_entries),
whitelist(the_whitelist),
node_serial_info(the_serial),
#endif
verification_ongoing(false),
Sha256()
@@ -124,6 +134,19 @@ bool MySigningAtsha204Soft::signMsg(MyMessage &msg) {
return false;
}
#ifdef MY_SECURE_NODE_WHITELISTING
// Salt the signature with the senders nodeId and the (hopefully) unique serial The Creator has provided
Sha256.init();
for (int i=0; i<32; i++) Sha256.write(hmac[i]);
Sha256.write(msg.sender);
for (int i=0; i<SHA204_SERIAL_SZ; i++) Sha256.write(node_serial_info[i]);
memcpy(hmac, Sha256.result(), 32);
DEBUG_ATSHASOFT_PRINTLN("Signature salted for whitelisting");
#endif
// Overwrite the first byte in the signature with the signing identifier
hmac[0] = SIGNING_IDENTIFIER;
// Transfer as much signature data as the remaining space in the message permits
memcpy(&msg.data[mGetLength(msg)], hmac, MAX_PAYLOAD-mGetLength(msg));
@@ -156,9 +179,30 @@ bool MySigningAtsha204Soft::verifyMsg(MyMessage &msg) {
return false;
}
#ifdef MY_SECURE_NODE_WHITELISTING
// Look up the senders nodeId in our whitelist and salt the signature with that data
for (int j=0; j < whitlist_sz; j++) {
if (whitelist[j].nodeId == msg.sender) {
DEBUG_ATSHASOFT_PRINTLN("Sender found in whitelist");
Sha256.init();
for (int i=0; i<32; i++) Sha256.write(hmac[i]);
Sha256.write(msg.sender);
for (int i=0; i<SHA204_SERIAL_SZ; i++) Sha256.write(whitelist[j].serial[i]);
memcpy(hmac, Sha256.result(), 32);
break;
}
}
#endif
// Overwrite the first byte in the signature with the signing identifier
hmac[0] = SIGNING_IDENTIFIER;
// Compare the caluclated signature with the provided signature
if (memcmp(&msg.data[mGetLength(msg)], hmac, MAX_PAYLOAD-mGetLength(msg))) {
DEBUG_ATSHASOFT_PRINTBUF("Signature bad. Calculated signature:", hmac, MAX_PAYLOAD-mGetLength(msg));
#ifdef MY_SECURE_NODE_WHITELISTING
DEBUG_ATSHASOFT_PRINTLN("Is the sender whitelisted?");
#endif
return false;
} else {
DEBUG_ATSHASOFT_PRINTLN("Signature ok");
@@ -167,7 +211,7 @@ bool MySigningAtsha204Soft::verifyMsg(MyMessage &msg) {
}
}
// Helper to calculate signature of msg (returned in rx_buffer[SHA204_BUFFER_POS_DATA])
// Helper to calculate signature of msg (returned in hmac)
bool MySigningAtsha204Soft::calculateSignature(MyMessage &msg) {
memset(temp_message, 0, 32);
memcpy(temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
@@ -225,10 +269,7 @@ bool MySigningAtsha204Soft::calculateSignature(MyMessage &msg) {
Sha256.write(0x23); // SN[1]
for (int i=0; i<2; i++) Sha256.write(0x00); // 2 bytes zeroes
hmac = Sha256.resultHmac();
// Overwrite the first byte in the signature with the signing identifier
hmac[0] = SIGNING_IDENTIFIER;
memcpy(hmac, Sha256.resultHmac(), 32);
DEBUG_ATSHASOFT_PRINTBUF("HMAC:", hmac, 32);
return true;
libraries/MySensors/MySigningAtsha204Soft.h
+19 -2
View File
@@ -18,6 +18,13 @@
#define SIGNING_IDENTIFIER (1)
#ifdef MY_SECURE_NODE_WHITELISTING
typedef struct {
uint8_t nodeId;
uint8_t serial[SHA204_SERIAL_SZ];
} whitelist_entry_t;
#endif
// This implementation is the pure software variant of the ATSHA204.
// It is designed to work fully compliant with nodes using ATSHA204 in the network
// and therefore uses the same signing identifier as ATSHA204.
@@ -28,7 +35,12 @@
class MySigningAtsha204Soft : public MySigning
{
public:
MySigningAtsha204Soft(bool requestSignatures=true, uint8_t randomseedPin = MY_RANDOMSEED_PIN);
MySigningAtsha204Soft(bool requestSignatures=true,
#ifdef MY_SECURE_NODE_WHITELISTING
uint8_t nof_whitelist_entries=0, const whitelist_entry_t* the_whitelist=NULL,
const uint8_t* the_serial=NULL, //SHA204_SERIAL_SZ sized buffer expected if provided
#endif
uint8_t randomseedPin=MY_RANDOMSEED_PIN);
bool getNonce(MyMessage &msg);
bool checkTimer(void);
bool putNonce(MyMessage &msg);
@@ -42,8 +54,13 @@ private:
uint8_t temp_message[32];
uint8_t hmacKey[32];
uint8_t rndPin;
uint8_t* hmac;
uint8_t hmac[32];
bool calculateSignature(MyMessage &msg);
#ifdef MY_SECURE_NODE_WHITELISTING
uint8_t whitlist_sz;
const whitelist_entry_t* whitelist;
const uint8_t* node_serial_info;
#endif
};
#endif
libraries/MySensors/examples/SecureActuator/SecureActuator.ino
+33 -4
View File
@@ -1,10 +1,17 @@
// Example sketch showing how to securely control locks.
// This example will remember lock state even after power failure.
#include <MySigningAtsha204Soft.h>
#define USE_SOFTWARE_ATSHA // Disable to use ATSHA204A circuit
#include <MyTransportNRF24.h>
#include <MyHwATMega328.h>
#include <MySensor.h>
#include <SPI.h>
#ifdef USE_SOFTWARE_ATSHA
#include <MySigningAtsha204Soft.h>
#else
#include <MySigningAtsha204.h>
#endif
#define LOCK_1 3 // Arduino Digital I/O pin number for first lock (second on pin+1 etc)
#define NOF_LOCKS 1 // Total number of attached locks
@@ -12,13 +19,35 @@
#define LOCK_UNLOCK 0 // GPIO value to write to unlock attached lock
MyTransportNRF24 radio; // NRFRF24L01 radio driver
MyHwATMega328 hw; // Select AtMega328 hardware profile
#ifdef MY_SECURE_NODE_WHITELISTING
#ifdef USE_SOFTWARE_ATSHA
// Change the soft_serial value to an arbitrary value for proper security
uint8_t soft_serial[SHA204_SERIAL_SZ] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09};
#endif
// We only use one whitelist entry (the gateway)
whitelist_entry_t node_whitelist[] = {
{ .nodeId = GATEWAY_ADDRESS,
.serial = {0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01} }
};
#ifdef USE_SOFTWARE_ATSHA
MySigningAtsha204Soft signer; // Message signing driver
MySensor gw(radio, signer);
#else
MySigningAtsha204 signer(true, 1, node_whitelist);
#endif
#else
#ifdef USE_SOFTWARE_ATSHA
MySigningAtsha204Soft signer;
#else
MySigningAtsha204 signer;
#endif
#endif
MySensor gw(radio, hw, signer);
void setup()
{
{
// Initialize library and add callback for incoming messages (signing is required)
gw.begin(incomingMessage, AUTO, true, AUTO);
gw.begin(incomingMessage, AUTO);
// Send the sketch version information to the gateway and Controller
gw.sendSketchInfo("Secure Lock", "1.0");
libraries/MySensors/utility/ATSHA204.h
+2
View File
@@ -218,6 +218,8 @@
#define ADDRESS_OTPMODE 18 // Sets the One-time-programmable mode
#define ADDRESS_SELECTOR 19 // Controls writability of Selector
#define SHA204_SERIAL_SZ 9 // The number of bytes the serial number consists of
class atsha204Class
{
private: