Dynamically set encryption key from HA

[jesserockz]

• [api] Allow noise encryption key to be set at runtime esphome#7296
• Add dynamic encryption key aioesphomeapi#1151
• Fix (possible) bug in implementation wher setting it to dynamic raises a keyerror.
• Expose "encrypted wanted" in the aioesphome lib somehow (deviceinfo attribute?)
• Home Assistant Core PR

[marcelveldt]

@jesserockz is going to look if everything is in place on esphome side and the aioesphome lib and @marcelveldt will have a look at the HA side of things.

[marcelveldt]

ESPHome now has a config key for encryption and the actual encryption key has become optional.
So you can now configure the device with the encryption option present but no key actually set.

Home Assistant will detect that the device wants an encryption key but doesn't have one and then generate a key, send it over the api and store it in the config data.

When you try to connect to a ESPHome device with encryption we now ask for the encryption key but we should extend the text a bit that if you don't have the key, you need to either factory reset or reinstall the configuration.

[jesserockz]

If a device has encryption enabled and has a key it will have a txt record api_encryption as current.

If a device supports encryption but doesn't yet have a key, it will have a txt record api_encryption_supported.

#ifdef USE_API_NOISE
    if (api::global_api_server->get_noise_ctx()->has_psk()) {
      service.txt_records.push_back({"api_encryption", "Noise_NNpsk0_25519_ChaChaPoly_SHA256"});
    } else {
      service.txt_records.push_back({"api_encryption_supported", "Noise_NNpsk0_25519_ChaChaPoly_SHA256"});
    }
#endif

Harcdoded encryption key:

api:
  encryption:
    key: ...

Dynamic key that can be set by the client:

api:
  encryption:

[marcelveldt]

When HA auto configures an encryption key for a device, it stores the newly generated key into the config entry data but we should also store it elsewhere to prevent issues when the user deletes the config entry. For example a simple json file in the HA .storage directory.

The ESPHome dashboard could even access this file if we want.

[marcelveldt]

So, been poking into this today but a bit stuck....
DeviceInfo does not (yet?) return "api_encryption_supported" so not sure where to get that info ?

Basically what I want to do is;

• discover ESPHome device
• detect if it has the flag "api_encryption_supported" but it has no encryption key configured.
• create a random key, store it in the config folder or whatsoever
• connect to the device, push the encryption key
• store config flow with the encryption key

is it available as txt records on mdns only ?

[marcelveldt]

I figured I first need a device which has the dynamic encryption enabled and tried to test it but failed miserably:

This is with just adding the "encryption:" subkey underneath "api:"

So, it looks like it needs some more work on the ESPHome side as well, and we should expose it in the esphome api.

[jesserockz]

I came across this myself in the past and I'm sure I fixed it at the time, maybe I forgot to make a PR

• Fix api log client crashing when api encryption is dynamic esphome#9245

[jesserockz]

is it available as txt records on mdns only ?

Currently yes, I can add it though to DeviceInfo
It is added on the esphome side and api already, maybe missed from python side model.py

• Add missing field to model.py aioesphomeapi#1233