diff --git a/libraries/MySensors/MyConfig.h b/libraries/MySensors/MyConfig.h index 0b4d806..e68709a 100644 --- a/libraries/MySensors/MyConfig.h +++ b/libraries/MySensors/MyConfig.h @@ -21,11 +21,23 @@ typedef MyHwATMega328 MyHwDriver; // which might vary, especially in networks with many hops. 5s ought to be enough for anyone. #define MY_VERIFICATION_TIMEOUT_MS 5000 +// Enable to turn on whitelisting +// When enabled, a signing node will salt the signature with it's unique signature and nodeId. +// The verifying node will look up the sender in a local table of trusted nodes and +// do the corresponding salting in order to verify the signature. +// For this reason, if whitelisting is enabled on one of the nodes in a sign-verify pair, both +// nodes have to implement whitelisting for this to work. +// Note that a node can still transmit a non-salted message (i.e. have whitelisting disabled) +// to a node that has whitelisting enabled (assuming the receiver does not have a matching entry +// for the sender in it's whitelist) +//#define MY_SECURE_NODE_WHITELISTING + // MySigningAtsha204 default setting #define MY_ATSHA204_PIN 17 // A3 - pin where ATSHA204 is attached // MySigningAtsha204Soft default settings #define MY_RANDOMSEED_PIN 7 // A7 - Pin used for random generation (do not connect anything to this) + // Key to use for HMAC calculation in MySigningAtsha204Soft (32 bytes) #define MY_HMAC_KEY 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,\ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 diff --git a/libraries/MySensors/MySigningAtsha204.cpp b/libraries/MySensors/MySigningAtsha204.cpp index 2a966fa..e9fcd42 100644 --- a/libraries/MySensors/MySigningAtsha204.cpp +++ b/libraries/MySensors/MySigningAtsha204.cpp @@ -36,10 +36,18 @@ static void DEBUG_ATSHA_PRINTBUF(char* str, uint8_t* buf, uint8_t sz) #endif -MySigningAtsha204::MySigningAtsha204(bool requestSignatures, uint8_t atshaPin) +MySigningAtsha204::MySigningAtsha204(bool requestSignatures, +#ifdef MY_SECURE_NODE_WHITELISTING + uint8_t nof_whitelist_entries, const whitelist_entry_t* the_whitelist, +#endif + uint8_t atshaPin) : MySigning(requestSignatures), atsha204(atshaPin), +#ifdef MY_SECURE_NODE_WHITELISTING + whitelist(the_whitelist), + whitlist_sz(nof_whitelist_entries), +#endif verification_ongoing(false) { } @@ -50,21 +58,14 @@ bool MySigningAtsha204::getNonce(MyMessage &msg) { // We used a basic whitening technique that takes the first byte of a new random value and builds up a 32-byte random value // This 32-byte random value is then hashed (SHA256) to produce the resulting nonce for (int i = 0; i < 32; i++) { - // Wake device before starting operations - if (atsha204.sha204c_wakeup(rx_buffer) != SHA204_SUCCESS) { - DEBUG_ATSHA_PRINTLN("Failed to wake device"); - return false; - } if (atsha204.sha204m_execute(SHA204_RANDOM, RANDOM_NO_SEED_UPDATE, 0, 0, NULL, RANDOM_COUNT, tx_buffer, RANDOM_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) { DEBUG_ATSHA_PRINTLN("Failed to generate nonce"); return false; } - atsha204.sha204c_sleep(); current_nonce[i] = rx_buffer[SHA204_BUFFER_POS_DATA]; } pRnd = sha256(current_nonce, 32); - atsha204.sha204c_sleep(); if (!pRnd) { DEBUG_ATSHA_PRINTLN("Failed to hash random value"); @@ -134,6 +135,19 @@ bool MySigningAtsha204::signMsg(MyMessage &msg) { return false; } +#ifdef MY_SECURE_NODE_WHITELISTING + // Salt the signature with the senders nodeId and the unique serial of the ATSHA device + memcpy(current_nonce, &rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed + current_nonce[32] = msg.sender; + (void)atsha204.getSerialNumber(¤t_nonce[33]); + (void)sha256(current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place + memset(current_nonce, 0xAA, NONCE_NUMIN_SIZE_PASSTHROUGH); + DEBUG_ATSHA_PRINTLN("Signature salted"); +#endif + + // Overwrite the first byte in the signature with the signing identifier + rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; + // Transfer as much signature data as the remaining space in the message permits memcpy(&msg.data[mGetLength(msg)], &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); @@ -166,9 +180,29 @@ bool MySigningAtsha204::verifyMsg(MyMessage &msg) { return false; } +#ifdef MY_SECURE_NODE_WHITELISTING + // Look up the senders nodeId in our whitelist and salt the signature with that data + for (int j=0; j < whitlist_sz; j++) { + if (whitelist[j].nodeId == msg.sender) { + DEBUG_ATSHA_PRINTLN("Sender found in whitelist"); + memcpy(current_nonce, &rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed + current_nonce[32] = msg.sender; + memcpy(¤t_nonce[33], whitelist[j].serial, SHA204_SERIAL_SZ); + (void)sha256(current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place + break; + } + } +#endif + + // Overwrite the first byte in the signature with the signing identifier + rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; + // Compare the caluclated signature with the provided signature if (memcmp(&msg.data[mGetLength(msg)], &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) { DEBUG_ATSHA_PRINTBUF("Signature bad. Calculated signature:", &rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg)); +#ifdef MY_SECURE_NODE_WHITELISTING + DEBUG_ATSHA_PRINTLN("Is the sender whitelisted?"); +#endif return false; } else { DEBUG_ATSHA_PRINTLN("Signature ok"); @@ -182,9 +216,6 @@ bool MySigningAtsha204::calculateSignature(MyMessage &msg) { memset(temp_message, 0, 32); memcpy(temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg))); - // Wake device before starting operations - if (atsha204.sha204c_wakeup(rx_buffer) != SHA204_SUCCESS) return false; - // Program the data to sign into the ATSHA204 if (atsha204.sha204m_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32, temp_message, WRITE_COUNT_LONG, tx_buffer, WRITE_RSP_SIZE, rx_buffer) != SHA204_SUCCESS) { @@ -221,21 +252,12 @@ bool MySigningAtsha204::calculateSignature(MyMessage &msg) { // Put device back to sleep atsha204.sha204c_sleep(); - // Overwrite the first byte in the signature with the signing identifier - rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER; - DEBUG_ATSHA_PRINTBUF("HMAC:", &rx_buffer[SHA204_BUFFER_POS_DATA], 32); return true; // We return with the signature in rx_buffer[SHA204_BUFFER_POS_DATA] } // Helper to calculate a generic SHA256 digest of provided buffer (returned in rx_buffer[SHA204_BUFFER_POS_DATA]) (only supports one block) uint8_t* MySigningAtsha204::sha256(const uint8_t* data, size_t sz) { - // Wake device before starting operations - if (atsha204.sha204c_wakeup(rx_buffer) != SHA204_SUCCESS) { - DEBUG_ATSHA_PRINTLN("Failed to wake device"); - return NULL; - } - // Initiate SHA256 calculator if (atsha204.sha204m_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL, SHA_COUNT_SHORT, tx_buffer, SHA_RSP_SIZE_SHORT, rx_buffer) != SHA204_SUCCESS) { @@ -250,12 +272,16 @@ uint8_t* MySigningAtsha204::sha256(const uint8_t* data, size_t sz) { // Write length data to the last bytes temp_message[SHA_MSG_SIZE-2] = (sz >> 5); temp_message[SHA_MSG_SIZE-1] = (sz << 3); - DEBUG_ATSHA_PRINTBUF("Data to hash (padded):", temp_message, SHA_MSG_SIZE); + DEBUG_ATSHA_PRINTBUF("Data to hash:", temp_message, SHA_MSG_SIZE); if (atsha204.sha204m_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, temp_message, SHA_COUNT_LONG, tx_buffer, SHA_RSP_SIZE_LONG, rx_buffer) != SHA204_SUCCESS) { DEBUG_ATSHA_PRINTLN("Failed to calculate sha256"); return NULL; } + + // Put device back to sleep + atsha204.sha204c_sleep(); + DEBUG_ATSHA_PRINTBUF("SHA:", &rx_buffer[SHA204_BUFFER_POS_DATA], 32); return &rx_buffer[SHA204_BUFFER_POS_DATA]; } diff --git a/libraries/MySensors/MySigningAtsha204.h b/libraries/MySensors/MySigningAtsha204.h index d6b3465..b96386a 100644 --- a/libraries/MySensors/MySigningAtsha204.h +++ b/libraries/MySensors/MySigningAtsha204.h @@ -14,13 +14,24 @@ #define SIGNING_IDENTIFIER (1) +#ifdef MY_SECURE_NODE_WHITELISTING +typedef struct { + uint8_t nodeId; + uint8_t serial[SHA204_SERIAL_SZ]; +} whitelist_entry_t; +#endif + // The ATSHA204 is capable of generating proper random numbers for nonce // and can calculate HMAC-SHA256 signatures. This is enterprise- // level of security and ought to implement the signing needs for anybody. class MySigningAtsha204 : public MySigning { public: - MySigningAtsha204(bool requestSignatures=true, uint8_t atshaPin = MY_ATSHA204_PIN); + MySigningAtsha204(bool requestSignatures=true, +#ifdef MY_SECURE_NODE_WHITELISTING + uint8_t nof_whitelist_entries=0, const whitelist_entry_t* the_whitelist=NULL, +#endif + uint8_t atshaPin=MY_ATSHA204_PIN); bool getNonce(MyMessage &msg); bool checkTimer(void); bool putNonce(MyMessage &msg); @@ -30,12 +41,16 @@ private: atsha204Class atsha204; unsigned long timestamp; bool verification_ongoing; - uint8_t current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH]; + uint8_t current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1]; uint8_t temp_message[SHA_MSG_SIZE]; uint8_t rx_buffer[SHA204_RSP_SIZE_MAX]; uint8_t tx_buffer[SHA204_CMD_SIZE_MAX]; bool calculateSignature(MyMessage &msg); uint8_t* sha256(const uint8_t* data, size_t sz); +#ifdef MY_SECURE_NODE_WHITELISTING + uint8_t whitlist_sz; + const whitelist_entry_t* whitelist; +#endif }; #endif diff --git a/libraries/MySensors/MySigningAtsha204Soft.cpp b/libraries/MySensors/MySigningAtsha204Soft.cpp index 465cd93..4d56cf1 100644 --- a/libraries/MySensors/MySigningAtsha204Soft.cpp +++ b/libraries/MySensors/MySigningAtsha204Soft.cpp @@ -40,11 +40,21 @@ static void DEBUG_ATSHASOFT_PRINTBUF(char* str, uint8_t* buf, uint8_t sz) #define DEBUG_ATSHASOFT_PRINTBUF(str, buf, sz) #endif -MySigningAtsha204Soft::MySigningAtsha204Soft(bool requestSignatures, uint8_t randomseedPin) +MySigningAtsha204Soft::MySigningAtsha204Soft(bool requestSignatures, +#ifdef MY_SECURE_NODE_WHITELISTING + uint8_t nof_whitelist_entries, const whitelist_entry_t* the_whitelist, + const uint8_t* the_serial, +#endif + uint8_t randomseedPin) : MySigning(requestSignatures), rndPin(randomseedPin), hmacKey({MY_HMAC_KEY}), +#ifdef MY_SECURE_NODE_WHITELISTING + whitlist_sz(nof_whitelist_entries), + whitelist(the_whitelist), + node_serial_info(the_serial), +#endif verification_ongoing(false), Sha256() @@ -124,6 +134,19 @@ bool MySigningAtsha204Soft::signMsg(MyMessage &msg) { return false; } +#ifdef MY_SECURE_NODE_WHITELISTING + // Salt the signature with the senders nodeId and the (hopefully) unique serial The Creator has provided + Sha256.init(); + for (int i=0; i<32; i++) Sha256.write(hmac[i]); + Sha256.write(msg.sender); + for (int i=0; i +#define USE_SOFTWARE_ATSHA // Disable to use ATSHA204A circuit + #include +#include #include #include +#ifdef USE_SOFTWARE_ATSHA +#include +#else +#include +#endif #define LOCK_1 3 // Arduino Digital I/O pin number for first lock (second on pin+1 etc) #define NOF_LOCKS 1 // Total number of attached locks @@ -12,13 +19,35 @@ #define LOCK_UNLOCK 0 // GPIO value to write to unlock attached lock MyTransportNRF24 radio; // NRFRF24L01 radio driver +MyHwATMega328 hw; // Select AtMega328 hardware profile +#ifdef MY_SECURE_NODE_WHITELISTING +#ifdef USE_SOFTWARE_ATSHA +// Change the soft_serial value to an arbitrary value for proper security +uint8_t soft_serial[SHA204_SERIAL_SZ] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09}; +#endif +// We only use one whitelist entry (the gateway) +whitelist_entry_t node_whitelist[] = { + { .nodeId = GATEWAY_ADDRESS, + .serial = {0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01} } +}; +#ifdef USE_SOFTWARE_ATSHA MySigningAtsha204Soft signer; // Message signing driver -MySensor gw(radio, signer); +#else +MySigningAtsha204 signer(true, 1, node_whitelist); +#endif +#else +#ifdef USE_SOFTWARE_ATSHA +MySigningAtsha204Soft signer; +#else +MySigningAtsha204 signer; +#endif +#endif +MySensor gw(radio, hw, signer); void setup() -{ +{ // Initialize library and add callback for incoming messages (signing is required) - gw.begin(incomingMessage, AUTO, true, AUTO); + gw.begin(incomingMessage, AUTO); // Send the sketch version information to the gateway and Controller gw.sendSketchInfo("Secure Lock", "1.0"); diff --git a/libraries/MySensors/utility/ATSHA204.h b/libraries/MySensors/utility/ATSHA204.h index d29f884..f4499b4 100644 --- a/libraries/MySensors/utility/ATSHA204.h +++ b/libraries/MySensors/utility/ATSHA204.h @@ -218,6 +218,8 @@ #define ADDRESS_OTPMODE 18 // Sets the One-time-programmable mode #define ADDRESS_SELECTOR 19 // Controls writability of Selector +#define SHA204_SERIAL_SZ 9 // The number of bytes the serial number consists of + class atsha204Class { private: