Re-implement PKI from #1509 (#4379)

* Re-implement PKI from #1509
co-authored-by: edinnen <ethanjdinnen@protonmail.com>

* Set the key lengnth to actually make PKI work.

* Remove unused variable and initialize keys to null

* move printBytes() to meshUtils

* Don't reset PKI key son reboot unless needed.

* Remove double encryption for PKI messages

* Cleanup encrypt logic

* Add the MESHTASTIC_EXCLUDE_PKI option, and set it for minimal builds. Required for STM32 targets for now.

* Use SHA-256 for PKI key hashing, and add MESHTASTIC_EXCLUDE_PKI_KEYGEN for STM32

* Fix a crash when node is null

* Don't send PKI encrypted packets while licensed

* use chIndex 8 for PKI

* Don't be so clever, that you corrupt incoming packets

* Pass on channel 8 for now

* Typo

* Lock keys once non-zero

* We in fact need 2 scratch buffers, to store the encrypted bytes, unencrypted bytes, and decoded protobuf.

* Lighter approach to retaining known key

* Attach the public key to PKI decrypted packets in device memory

* Turn PKI back off for STM32 :(

* Don't just memcp over a protobuf

* Don't PKI encrypt nodeinfo packets

* Add a bit more memory logging around nodeDB

* Use the proper macro to refer to NODENUM_BROADCAST

* Typo fix

* Don't PKI encrypt ROUTING (naks and acks)

* Adds SecurityConfig protobuf

* Add admin messages over PKI

* Disable PKI for the WIO-e5

* Add MINIMUM_SAFE_FREE_HEAP macro and set to safe 1.5k

* Add missed "has_security"

* Add the admin_channel_enabled option

* STM32 again

* add missed configuration.h at the top of files

* Add EXCLUDE_TZ and RTC

* Enable PKI build on STM32 once again

* Attempt 1 at moving PKI to aes-ccm

* Fix buffers for encrypt/decrypt

* Eliminate unused aes variable

* Add debugging lines

* Set hash to 0 for PKI

* Fix debug lines so they don't print pointers.

* logic fix and more debug

* Rather important typo

* Check for short packets before attempting decrypt

* Don't forget to give cryptoEngine the keys!

* Use the right scratch buffer

* Cleanup

* moar cleanups

* Minor hardening

* Remove some in-progress stuff

* Turn PKI back off on STM32

* Return false

* 2.5 protos

* Sync up protos

* Add initial cryptography test vector tests

* re-add MINIMUM_SAFE_FREE_HEAP

* Housekeeping and comment fixes

* Add explanatory comment about weak dh25519 keys

---------

Co-authored-by: Ben Meadors <benmmeadors@gmail.com>

arch/esp32/esp32.ini

@@ -48,6 +48,7 @@ lib_deps =
   https://github.com/dbSuS/libpax.git#7bcd3fcab75037505be9b122ab2b24cc5176b587
   https://github.com/lewisxhe/XPowersLib.git#84b7373faea3118b6c37954d52f98b8a337148d6
   https://github.com/meshtastic/ESP32_Codec2.git#633326c78ac251c059ab3a8c430fcdf25b41672f
+  rweather/Crypto@^0.4.0
 
 lib_ignore = 
   segger_rtt

arch/nrf52/nrf52.ini

@@ -20,6 +20,7 @@ build_src_filter =
 
 lib_deps=
   ${arduino_base.lib_deps}
+  rweather/Crypto@^0.4.0
 
 lib_ignore =
   BluetoothOTA

platformio.ini

@@ -45,6 +45,7 @@ extra_configs =
   variants/*/platformio.ini
 
 [env]
+test_build_src = true
 extra_scripts = bin/platformio-custom.py
 
 ; note: we add src to our include search path so that lmic_project_config can override

src/RedirectablePrint.cpp

@@ -39,7 +39,7 @@ size_t RedirectablePrint::write(uint8_t c)
     SEGGER_RTT_PutChar(SEGGER_STDOUT_CH, c);
 #endif
 
-    if (!config.has_lora || config.device.serial_enabled)
+    if (!config.has_lora || config.security.serial_enabled)
         dest->write(c);
 
     return 1; // We always claim one was written, rather than trusting what the
@@ -180,7 +180,7 @@ void RedirectablePrint::log_to_syslog(const char *logLevel, const char *format,
 void RedirectablePrint::log_to_ble(const char *logLevel, const char *format, va_list arg)
 {
 #if !MESHTASTIC_EXCLUDE_BLUETOOTH
-    if (config.bluetooth.device_logging_enabled && !pauseBluetoothLogging) {
+    if (config.security.bluetooth_logging_enabled && !pauseBluetoothLogging) {
         bool isBleConnected = false;
 #ifdef ARCH_ESP32
         isBleConnected = nimbleBluetooth && nimbleBluetooth->isActive() && nimbleBluetooth->isConnected();

src/SerialConsole.cpp

@@ -83,7 +83,7 @@ bool SerialConsole::checkIsConnected()
 bool SerialConsole::handleToRadio(const uint8_t *buf, size_t len)
 {
     // only talk to the API once the configuration has been loaded and we're sure the serial port is not disabled.
-    if (config.has_lora && config.device.serial_enabled) {
+    if (config.has_lora && config.security.serial_enabled) {
         // Switch to protobufs for log messages
         usingProtobufs = true;
         canWrite = true;
@@ -96,7 +96,7 @@ bool SerialConsole::handleToRadio(const uint8_t *buf, size_t len)
 
 void SerialConsole::log_to_serial(const char *logLevel, const char *format, va_list arg)
 {
-    if (usingProtobufs && config.device.debug_log_enabled) {
+    if (usingProtobufs && config.security.debug_log_api_enabled) {
         meshtastic_LogRecord_Level ll = meshtastic_LogRecord_Level_UNSET; // default to unset
         switch (logLevel[0]) {
         case 'D':

src/configuration.h

@@ -193,6 +193,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #define DEFAULT_SHUTDOWN_SECONDS 2
 #endif
 
+#ifndef MINIMUM_SAFE_FREE_HEAP
+#define MINIMUM_SAFE_FREE_HEAP 1500
+#endif
+
 /* Step #3: mop up with disabled values for HAS_ options not handled by the above two */
 
 #ifndef HAS_WIFI
@@ -256,6 +260,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #define MESHTASTIC_EXCLUDE_MQTT 1
 #define MESHTASTIC_EXCLUDE_POWERMON 1
 #define MESHTASTIC_EXCLUDE_I2C 1
+#define MESHTASTIC_EXCLUDE_PKI 1
 #define MESHTASTIC_EXCLUDE_POWER_FSM 1
 #define MESHTASTIC_EXCLUDE_TZ 1
 #endif

src/main.cpp

@@ -227,7 +227,7 @@ void printInfo()
 {
     LOG_INFO("S:B:%d,%s\n", HW_VENDOR, optstr(APP_VERSION));
 }
-
+#ifndef PIO_UNIT_TESTING
 void setup()
 {
     concurrency::hasBeenSetup = true;
@@ -1052,7 +1052,7 @@ void setup()
     powerFSMthread = new PowerFSMThread();
     setCPUFast(false); // 80MHz is fine for our slow peripherals
 }
-
+#endif
 uint32_t rebootAtMsec;   // If not zero we will reboot at this time (used to reboot shortly after the update completes)
 uint32_t shutdownAtMsec; // If not zero we will shutdown at this time (used to shutdown from python or mobile client)
 
@@ -1075,7 +1075,7 @@ extern meshtastic_DeviceMetadata getDeviceMetadata()
     deviceMetadata.hasRemoteHardware = moduleConfig.remote_hardware.enabled;
     return deviceMetadata;
 }
-
+#ifndef PIO_UNIT_TESTING
 void loop()
 {
     runASAP = false;
@@ -1120,4 +1120,5 @@ void loop()
         mainDelay.delay(delayMsec);
     }
     // if (didWake) LOG_DEBUG("wake!\n");
-}
+}
+#endif

src/mesh/CryptoEngine.cpp

@@ -1,6 +1,176 @@
 #include "CryptoEngine.h"
+#include "NodeDB.h"
+#include "RadioInterface.h"
 #include "configuration.h"
 
+#if !(MESHTASTIC_EXCLUDE_PKI)
+#include "aes-ccm.h"
+#include "meshUtils.h"
+#include <Crypto.h>
+#include <Curve25519.h>
+#include <SHA256.h>
+#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN)
+/**
+ * Create a public/private key pair with Curve25519.
+ *
+ * @param pubKey The destination for the public key.
+ * @param privKey The destination for the private key.
+ */
+void CryptoEngine::generateKeyPair(uint8_t *pubKey, uint8_t *privKey)
+{
+    LOG_DEBUG("Generating Curve25519 key pair...\n");
+    Curve25519::dh1(public_key, private_key);
+    memcpy(pubKey, public_key, sizeof(public_key));
+    memcpy(privKey, private_key, sizeof(private_key));
+}
+#endif
+uint8_t shared_key[32];
+void CryptoEngine::clearKeys()
+{
+    memset(public_key, 0, sizeof(public_key));
+    memset(private_key, 0, sizeof(private_key));
+}
+
+/**
+ * Encrypt a packet's payload using a key generated with Curve25519 and SHA256
+ * for a specific node.
+ *
+ * @param bytes is updated in place
+ */
+bool CryptoEngine::encryptCurve25519(uint32_t toNode, uint32_t fromNode, uint64_t packetNum, size_t numBytes, uint8_t *bytes,
+                                     uint8_t *bytesOut)
+{
+    uint8_t *auth;
+    auth = bytesOut + numBytes;
+    meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(toNode);
+    if (node->num < 1 || node->user.public_key.size == 0) {
+        LOG_DEBUG("Node %d or their public_key not found\n", toNode);
+        return false;
+    }
+    if (!crypto->setDHKey(toNode)) {
+        return false;
+    }
+    initNonce(fromNode, packetNum);
+
+    // Calculate the shared secret with the destination node and encrypt
+    printBytes("Attempting encrypt using nonce: ", nonce, 16);
+    printBytes("Attempting encrypt using shared_key: ", shared_key, 32);
+    aes_ccm_ae(shared_key, 32, nonce, 8, bytes, numBytes, nullptr, 0, bytesOut, auth);
+    return true;
+}
+
+/**
+ * Decrypt a packet's payload using a key generated with Curve25519 and SHA256
+ * for a specific node.
+ *
+ * @param bytes is updated in place
+ */
+bool CryptoEngine::decryptCurve25519(uint32_t fromNode, uint64_t packetNum, size_t numBytes, uint8_t *bytes, uint8_t *bytesOut)
+{
+    uint8_t *auth; // set to last 8 bytes of text?
+    auth = bytes + numBytes - 8;
+    meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(fromNode);
+
+    if (node == nullptr || node->num < 1 || node->user.public_key.size == 0) {
+        LOG_DEBUG("Node or its public key not found in database\n");
+        return false;
+    }
+
+    // Calculate the shared secret with the sending node and decrypt
+    if (!crypto->setDHKey(fromNode)) {
+        return false;
+    }
+    initNonce(fromNode, packetNum);
+    printBytes("Attempting decrypt using nonce: ", nonce, 16);
+    printBytes("Attempting decrypt using shared_key: ", shared_key, 32);
+    return aes_ccm_ad(shared_key, 32, nonce, 8, bytes, numBytes - 8, nullptr, 0, auth, bytesOut);
+}
+
+void CryptoEngine::setPrivateKey(uint8_t *_private_key)
+{
+    memcpy(private_key, _private_key, 32);
+}
+/**
+ * Set the PKI key used for encrypt, decrypt.
+ *
+ * @param nodeNum the node number of the node who's public key we want to use
+ */
+bool CryptoEngine::setDHKey(uint32_t nodeNum)
+{
+    meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(nodeNum);
+    if (node->num < 1 || node->user.public_key.size == 0) {
+        LOG_DEBUG("Node %d or their public_key not found\n", nodeNum);
+        return false;
+    }
+
+    uint8_t *pubKey = node->user.public_key.bytes;
+    uint8_t local_priv[32];
+    memcpy(shared_key, pubKey, 32);
+    memcpy(local_priv, private_key, 32);
+    // Calculate the shared secret with the specified node's public key and our private key
+    // This includes an internal weak key check, which among other things looks for an all 0 public key and shared key.
+    if (!Curve25519::dh2(shared_key, local_priv)) {
+        LOG_WARN("Curve25519DH step 2 failed!\n");
+        return false;
+    }
+
+    printBytes("DH Output: ", shared_key, 32);
+
+    /**
+     * D.J. Bernstein reccomends hashing the shared key. We want to do this because there are
+     * at least 128 bits of entropy in the 256-bit output of the DH key exchange, but we don't
+     * really know where. If you extract, for instance, the first 128 bits with basic truncation,
+     * then you don't know if you got all of your 128 entropy bits, or less, possibly much less.
+     *
+     * No exploitable bias is really known at that point, but we know enough to be wary.
+     * Hashing the DH output is a simple and safe way to gather all the entropy and spread
+     * it around as needed.
+     */
+    crypto->hash(shared_key, 32);
+    return true;
+}
+
+/**
+ * Hash arbitrary data using SHA256.
+ *
+ * @param bytes
+ * @param numBytes
+ */
+void CryptoEngine::hash(uint8_t *bytes, size_t numBytes)
+{
+    SHA256 hash;
+    size_t posn, len;
+    uint8_t size = numBytes;
+    uint8_t inc = 16;
+    hash.reset();
+    for (posn = 0; posn < size; posn += inc) {
+        len = size - posn;
+        if (len > inc)
+            len = inc;
+        hash.update(bytes + posn, len);
+    }
+    hash.finalize(bytes, 32);
+}
+
+void CryptoEngine::aesSetKey(const uint8_t *key_bytes, size_t key_len)
+{
+    if (aes) {
+        delete aes;
+        aes = nullptr;
+    }
+    if (key_len != 0) {
+        aes = new AESSmall256();
+        aes->setKey(key_bytes, key_len);
+    }
+}
+
+void CryptoEngine::aesEncrypt(uint8_t *in, uint8_t *out)
+{
+    aes->encryptBlock(out, in);
+}
+
+#endif
+
 concurrency::Lock *cryptLock;
 
 void CryptoEngine::setKey(const CryptoKey &k)

src/mesh/CryptoEngine.h

@@ -1,6 +1,8 @@
 #pragma once
-
+#include "AES.h"
 #include "concurrency/LockGuard.h"
+#include "configuration.h"
+#include "mesh-pb-constants.h"
 #include <Arduino.h>
 
 extern concurrency::Lock *cryptLock;
@@ -26,9 +28,34 @@ class CryptoEngine
     uint8_t nonce[16] = {0};
 
     CryptoKey key = {};
+#if !(MESHTASTIC_EXCLUDE_PKI)
+    uint8_t private_key[32] = {0};
+#endif
 
   public:
+#if !(MESHTASTIC_EXCLUDE_PKI)
+    uint8_t public_key[32] = {0};
+#endif
+
     virtual ~CryptoEngine() {}
+#if !(MESHTASTIC_EXCLUDE_PKI)
+#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN)
+    virtual void generateKeyPair(uint8_t *pubKey, uint8_t *privKey);
+#endif
+    void clearKeys();
+    void setPrivateKey(uint8_t *_private_key);
+    virtual bool encryptCurve25519(uint32_t toNode, uint32_t fromNode, uint64_t packetNum, size_t numBytes, uint8_t *bytes,
+                                   uint8_t *bytesOut);
+    virtual bool decryptCurve25519(uint32_t fromNode, uint64_t packetNum, size_t numBytes, uint8_t *bytes, uint8_t *bytesOut);
+    virtual bool setDHKey(uint32_t nodeNum);
+    virtual void hash(uint8_t *bytes, size_t numBytes);
+
+    virtual void aesSetKey(const uint8_t *key, size_t key_len);
+
+    virtual void aesEncrypt(uint8_t *in, uint8_t *out);
+    AESSmall256 *aes = NULL;
+
+#endif
 
     /**
      * Set the key used for encrypt, decrypt.
@@ -61,4 +88,4 @@ class CryptoEngine
     void initNonce(uint32_t fromNode, uint64_t packetId);
 };
 
-extern CryptoEngine *crypto;
+extern CryptoEngine *crypto;