MySmartHome/MySensors
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
7e6db413c7a9efe45e2fc927e0438fd55d5179d3
MySensors/core/MySigningAtsha204.cpp
T
Patrick Fallberg 7e6db413c7 Security personalizer rewritten (#794) 
* Removed ability to lock data section
* Introduced "guided mode" to simplify process
* Refactored the sketch to be less monolithic
* Print details and instructions in tables
* Use device unique ID as serial when
* Calculate and store personalization checksum
* Print serial in a copy+paste friendly manner (fixes #804)
* Clarify meaning of UART confirmation (fixes #805)
2017-04-02 15:37:21 +02:00

411 lines
19 KiB
C++
Raw Blame History

/**
* The MySensors Arduino library handles the wireless radio link and protocol
* between your home built sensors/actuators and HA controller of choice.
* The sensors forms a self healing radio network with optional repeaters. Each
* repeater and gateway builds a routing tables in EEPROM which keeps track of the
* network topology allowing messages to be routed to nodes.
*
* Created by Henrik Ekblad <henrik.ekblad@mysensors.org>
* Copyright (C) 2013-2017 Sensnology AB
* Full contributor list: https://github.com/mysensors/Arduino/graphs/contributors
*
* Documentation: http://www.mysensors.org
* Support Forum: http://forum.mysensors.org
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* version 2 as published by the Free Software Foundation.
*
*******************************
*
* DESCRIPTION
* Signing support created by Patrick "Anticimex" Fallberg <patrick@fallberg.net>
* ATSHA204 signing backend. The Atmel ATSHA204 offers true random number generation and
* HMAC-SHA256 authentication with a readout-protected key.
*
*/
#include "MySigning.h"
#define SIGNING_IDENTIFIER (1) //HMAC-SHA256
#if defined(MY_DEBUG_VERBOSE_SIGNING)
#define SIGN_DEBUG(x,...) hwDebugPrint(x, ##__VA_ARGS__)
#else
#define SIGN_DEBUG(x,...)
#endif
// Define MY_DEBUG_VERBOSE_SIGNING in your sketch to enable signing backend debugprints
unsigned long _signing_timestamp;
bool _signing_verification_ongoing = false;
uint8_t _signing_verifying_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1];
uint8_t _signing_signing_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1];
uint8_t _signing_temp_message[SHA_MSG_SIZE];
uint8_t _signing_rx_buffer[SHA204_RSP_SIZE_MAX];
uint8_t _signing_tx_buffer[SHA204_CMD_SIZE_MAX];
extern uint8_t _doWhitelist[32];
#ifdef MY_SIGNING_NODE_WHITELISTING
const whitelist_entry_t _signing_whitelist[] = MY_SIGNING_NODE_WHITELISTING;
#endif
static void signerCalculateSignature(MyMessage &msg, bool signing);
static uint8_t* signerSha256(const uint8_t* data, size_t sz);
static bool init_ok = false;
bool signerAtsha204Init(void)
{
init_ok = true;
atsha204_init(MY_SIGNING_ATSHA204_PIN);
(void)atsha204_wakeup(_signing_temp_message);
// Read the configuration lock flag to determine if device is personalized or not
if (atsha204_read(_signing_tx_buffer, _signing_rx_buffer,
SHA204_ZONE_CONFIG, 0x15<<2) != SHA204_SUCCESS) {
SIGN_DEBUG(PSTR("Could not read ATSHA204A lock config, refusing to use backend\n"));
init_ok = false;
} else if (_signing_rx_buffer[SHA204_BUFFER_POS_DATA+3] != 0x00) {
SIGN_DEBUG(PSTR("ATSHA204A not personalized, refusing to use backend\n"));
init_ok = false;
}
return init_ok;
}
bool signerAtsha204CheckTimer(void)
{
if (!init_ok) {
SIGN_DEBUG(PSTR("Backend not initialized\n"));
return false;
}
if (_signing_verification_ongoing) {
if (hwMillis() < _signing_timestamp ||
hwMillis() > _signing_timestamp + MY_VERIFICATION_TIMEOUT_MS) {
SIGN_DEBUG(PSTR("Verification timeout\n"));
// Purge nonce
memset(_signing_signing_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
memset(_signing_verifying_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
_signing_verification_ongoing = false;
return false;
}
}
return true;
}
bool signerAtsha204GetNonce(MyMessage &msg)
{
if (!init_ok) {
SIGN_DEBUG(PSTR("Backend not initialized\n"));
return false;
}
SIGN_DEBUG(PSTR("Signing backend: ATSHA204\n"));
// Generate random number for use as nonce
// We used a basic whitening technique that XORs each byte in a 32byte random value with current hwMillis() counter
// This 32-byte random value is then hashed (SHA256) to produce the resulting nonce
(void)atsha204_wakeup(_signing_temp_message);
if (atsha204_execute(SHA204_RANDOM, RANDOM_SEED_UPDATE, 0, 0, NULL,
RANDOM_COUNT, _signing_tx_buffer, RANDOM_RSP_SIZE, _signing_rx_buffer) != SHA204_SUCCESS) {
SIGN_DEBUG(PSTR("Failed to generate nonce\n"));
return false;
}
for (int i = 0; i < 32; i++) {
_signing_verifying_nonce[i] = _signing_rx_buffer[SHA204_BUFFER_POS_DATA+i] ^ (hwMillis()&0xFF);
}
memcpy(_signing_verifying_nonce, signerSha256(_signing_verifying_nonce, 32), MAX_PAYLOAD);
atsha204_idle(); // We just idle the chip now since we expect to use it soon when the signed message arrives
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
memset(&_signing_verifying_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_verifying_nonce)-MAX_PAYLOAD);
// Transfer the first part of the nonce to the message
msg.set(_signing_verifying_nonce, MAX_PAYLOAD);
_signing_verification_ongoing = true;
_signing_timestamp = hwMillis(); // Set timestamp to determine when to purge nonce
// Be a little fancy to handle turnover (prolong the time allowed to timeout after turnover)
// Note that if message is "too" quick, and arrives before turnover, it will be rejected
// but this is consider such a rare case that it is accepted and rejects are 'safe'
if (_signing_timestamp + MY_VERIFICATION_TIMEOUT_MS < hwMillis()) {
_signing_timestamp = 0;
}
return true;
}
void signerAtsha204PutNonce(MyMessage &msg)
{
if (!init_ok) {
SIGN_DEBUG(PSTR("Backend not initialized\n"));
return;
}
SIGN_DEBUG(PSTR("Signing backend: ATSHA204\n"));
memcpy(_signing_signing_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
memset(&_signing_signing_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_signing_nonce)-MAX_PAYLOAD);
}
bool signerAtsha204SignMsg(MyMessage &msg)
{
// If we cannot fit any signature in the message, refuse to sign it
if (mGetLength(msg) > MAX_PAYLOAD-2) {
SIGN_DEBUG(PSTR("Message too large\n"));
return false;
}
// Calculate signature of message
mSetSigned(msg, 1); // make sure signing flag is set before signature is calculated
signerCalculateSignature(msg, true);
if (DO_WHITELIST(msg.destination)) {
// Salt the signature with the senders nodeId and the unique serial of the ATSHA device
memcpy(_signing_signing_nonce, &_signing_rx_buffer[SHA204_BUFFER_POS_DATA],
32); // We can reuse the nonce buffer now since it is no longer needed
_signing_signing_nonce[32] = msg.sender;
atsha204_getSerialNumber(&_signing_signing_nonce[33]);
(void)signerSha256(_signing_signing_nonce,
32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
SIGN_DEBUG(PSTR("Signature salted with serial: %02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
_signing_signing_nonce[33], _signing_signing_nonce[34], _signing_signing_nonce[35],
_signing_signing_nonce[36], _signing_signing_nonce[37], _signing_signing_nonce[38],
_signing_signing_nonce[39], _signing_signing_nonce[40], _signing_signing_nonce[41]);
}
// Put device back to sleep
atsha204_sleep();
// Overwrite the first byte in the signature with the signing identifier
_signing_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
// Transfer as much signature data as the remaining space in the message permits
memcpy(&msg.data[mGetLength(msg)], &_signing_rx_buffer[SHA204_BUFFER_POS_DATA],
MAX_PAYLOAD-mGetLength(msg));
return true;
}
bool signerAtsha204VerifyMsg(MyMessage &msg)
{
if (!_signing_verification_ongoing) {
SIGN_DEBUG(PSTR("No active verification session\n"));
return false;
} else {
// Make sure we have not expired
if (!signerCheckTimer()) {
return false;
}
_signing_verification_ongoing = false;
if (msg.data[mGetLength(msg)] != SIGNING_IDENTIFIER) {
SIGN_DEBUG(PSTR("Incorrect signing identifier\n"));
return false;
}
signerCalculateSignature(msg, false); // Get signature of message
#ifdef MY_SIGNING_NODE_WHITELISTING
// Look up the senders nodeId in our whitelist and salt the signature with that data
size_t j;
for (j=0; j < NUM_OF(_signing_whitelist); j++) {
if (_signing_whitelist[j].nodeId == msg.sender) {
SIGN_DEBUG(PSTR("Sender found in whitelist\n"));
memcpy(_signing_verifying_nonce, &_signing_rx_buffer[SHA204_BUFFER_POS_DATA],
32); // We can reuse the nonce buffer now since it is no longer needed
_signing_verifying_nonce[32] = msg.sender;
memcpy(&_signing_verifying_nonce[33], _signing_whitelist[j].serial, SHA204_SERIAL_SZ);
(void)signerSha256(_signing_verifying_nonce,
32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
break;
}
}
if (j == NUM_OF(_signing_whitelist)) {
SIGN_DEBUG(PSTR("Sender not found in whitelist, message rejected!\n"));
// Put device back to sleep
atsha204_sleep();
return false;
}
#endif
// Put device back to sleep
atsha204_sleep();
// Overwrite the first byte in the signature with the signing identifier
_signing_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
// Compare the caluclated signature with the provided signature
if (signerMemcmp(&msg.data[mGetLength(msg)], &_signing_rx_buffer[SHA204_BUFFER_POS_DATA],
MAX_PAYLOAD-mGetLength(msg))) {
SIGN_DEBUG(PSTR("Signature bad\n"));
#ifdef MY_SIGNING_NODE_WHITELISTING
SIGN_DEBUG(PSTR("Is the sender whitelisted and serial correct?\n"));
#endif
return false;
} else {
SIGN_DEBUG(PSTR("Signature OK\n"));
return true;
}
}
}
// Helper to calculate signature of msg (returned in _signing_rx_buffer[SHA204_BUFFER_POS_DATA])
static void signerCalculateSignature(MyMessage &msg, bool signing)
{
(void)atsha204_wakeup(_signing_temp_message);
memset(_signing_temp_message, 0, 32);
memcpy(_signing_temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE],
MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
// Program the data to sign into the ATSHA204
SIGN_DEBUG(PSTR("Current nonce: "
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X"
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
signing ? _signing_signing_nonce[0] : _signing_verifying_nonce[0],
signing ? _signing_signing_nonce[1] : _signing_verifying_nonce[1],
signing ? _signing_signing_nonce[2] : _signing_verifying_nonce[2],
signing ? _signing_signing_nonce[3] : _signing_verifying_nonce[3],
signing ? _signing_signing_nonce[4] : _signing_verifying_nonce[4],
signing ? _signing_signing_nonce[5] : _signing_verifying_nonce[5],
signing ? _signing_signing_nonce[6] : _signing_verifying_nonce[6],
signing ? _signing_signing_nonce[7] : _signing_verifying_nonce[7],
signing ? _signing_signing_nonce[8] : _signing_verifying_nonce[8],
signing ? _signing_signing_nonce[9] : _signing_verifying_nonce[9],
signing ? _signing_signing_nonce[10] : _signing_verifying_nonce[10],
signing ? _signing_signing_nonce[11] : _signing_verifying_nonce[11],
signing ? _signing_signing_nonce[12] : _signing_verifying_nonce[12],
signing ? _signing_signing_nonce[13] : _signing_verifying_nonce[13],
signing ? _signing_signing_nonce[14] : _signing_verifying_nonce[14],
signing ? _signing_signing_nonce[15] : _signing_verifying_nonce[15],
signing ? _signing_signing_nonce[16] : _signing_verifying_nonce[16],
signing ? _signing_signing_nonce[17] : _signing_verifying_nonce[17],
signing ? _signing_signing_nonce[18] : _signing_verifying_nonce[18],
signing ? _signing_signing_nonce[19] : _signing_verifying_nonce[19],
signing ? _signing_signing_nonce[20] : _signing_verifying_nonce[20],
signing ? _signing_signing_nonce[21] : _signing_verifying_nonce[21],
signing ? _signing_signing_nonce[22] : _signing_verifying_nonce[22],
signing ? _signing_signing_nonce[23] : _signing_verifying_nonce[23],
signing ? _signing_signing_nonce[24] : _signing_verifying_nonce[24],
signing ? _signing_signing_nonce[25] : _signing_verifying_nonce[25],
signing ? _signing_signing_nonce[26] : _signing_verifying_nonce[26],
signing ? _signing_signing_nonce[27] : _signing_verifying_nonce[27],
signing ? _signing_signing_nonce[28] : _signing_verifying_nonce[28],
signing ? _signing_signing_nonce[29] : _signing_verifying_nonce[29],
signing ? _signing_signing_nonce[30] : _signing_verifying_nonce[30],
signing ? _signing_signing_nonce[31] : _signing_verifying_nonce[31]
);
(void)atsha204_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32,
_signing_temp_message,
WRITE_COUNT_LONG, _signing_tx_buffer, WRITE_RSP_SIZE, _signing_rx_buffer);
// Program the nonce to use for the signature (has to be done just before GENDIG due to chip limitations)
(void)atsha204_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH,
signing ? _signing_signing_nonce : _signing_verifying_nonce,
NONCE_COUNT_LONG, _signing_tx_buffer, NONCE_RSP_SIZE_SHORT, _signing_rx_buffer);
// Purge nonce when used
memset(signing ? _signing_signing_nonce : _signing_verifying_nonce, 0x00,
NONCE_NUMIN_SIZE_PASSTHROUGH);
// Generate digest of data and nonce
(void)atsha204_execute(SHA204_GENDIG, GENDIG_ZONE_DATA, 8, 0, NULL,
GENDIG_COUNT_DATA, _signing_tx_buffer, GENDIG_RSP_SIZE, _signing_rx_buffer);
// Calculate HMAC of message+nonce digest and secret key
(void)atsha204_execute(SHA204_HMAC, HMAC_MODE_SOURCE_FLAG_MATCH, 0, 0, NULL,
HMAC_COUNT, _signing_tx_buffer, HMAC_RSP_SIZE, _signing_rx_buffer);
SIGN_DEBUG(PSTR("HMAC: "
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X"
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+0],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+1],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+2],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+3],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+4],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+5],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+6],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+7],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+8],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+9],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+10],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+11],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+12],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+13],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+14],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+15],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+16],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+17],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+18],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+19],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+20],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+21],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+22],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+23],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+24],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+25],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+26],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+27],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+28],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+29],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+30],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+31]
);
}
// Helper to calculate a generic SHA256 digest of provided buffer (only supports one block)
// The pointer to the hash is returned, but the hash is also stored in _signing_rx_buffer[SHA204_BUFFER_POS_DATA])
static uint8_t* signerSha256(const uint8_t* data, size_t sz)
{
// Initiate SHA256 calculator
(void)atsha204_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL,
SHA_COUNT_SHORT, _signing_tx_buffer, SHA_RSP_SIZE_SHORT, _signing_rx_buffer);
// Calculate a hash
memset(_signing_temp_message, 0x00, SHA_MSG_SIZE);
memcpy(_signing_temp_message, data, sz);
_signing_temp_message[sz] = 0x80;
// Write length data to the last bytes
_signing_temp_message[SHA_MSG_SIZE-2] = (sz >> 5);
_signing_temp_message[SHA_MSG_SIZE-1] = (sz << 3);
(void)atsha204_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, _signing_temp_message,
SHA_COUNT_LONG, _signing_tx_buffer, SHA_RSP_SIZE_LONG, _signing_rx_buffer);
SIGN_DEBUG(PSTR("SHA256: "
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X"
"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X\n"),
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+0],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+1],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+2],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+3],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+4],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+5],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+6],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+7],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+8],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+9],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+10],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+11],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+12],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+13],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+14],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+15],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+16],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+17],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+18],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+19],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+20],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+21],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+22],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+23],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+24],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+25],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+26],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+27],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+28],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+29],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+30],
_signing_rx_buffer[SHA204_BUFFER_POS_DATA+31]
);
return &_signing_rx_buffer[SHA204_BUFFER_POS_DATA];
}
Reference in New Issue View Git Blame Copy Permalink