[security] Introducing signing support to MySensors

[alexsh1]

This is the sketch:

/**
* The MySensors Arduino library handles the wireless radio link and protocol
* between your home built sensors/actuators and HA controller of choice.
* The sensors forms a self healing radio network with optional repeaters. Each
* repeater and gateway builds a routing tables in EEPROM which keeps track of the
* network topology allowing messages to be routed to nodes.
*
* Created by Henrik Ekblad <henrik.ekblad@mysensors.org>
* Copyright (C) 2013-2015 Sensnology AB
* Full contributor list: https://github.com/mysensors/Arduino/graphs/contributors
*
* Documentation: http://www.mysensors.org
* Support Forum: http://forum.mysensors.org
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* version 2 as published by the Free Software Foundation.
*
*******************************
*
* DESCRIPTION
* The ArduinoGateway prints data received from sensors on the serial link.
* The gateway accepts input on seral which will be sent out on radio network.
*
* This GW code is designed for Sensebender GateWay / (Arduino Zero variant)
*
* Wire connections (OPTIONAL):
* - Inclusion button should be connected to SW2
*
* LEDs on board (default assignments):
* - Orange: USB RX/TX - Blink when receiving / transmitting on USB CDC device
* - Yellow: RX  - Blink fast on radio message recieved. In inclusion mode will blink fast only on presentation recieved
* - Green : TX  - Blink fast on radio message transmitted. In inclusion mode will blink slowly
* - Red   : ERR - Fast blink on error during transmission error or recieve crc error
* - Blue  : free - (use with LED_BLUE macro)
*
*/

#define SKETCH_VERSION "0.2"
// Enable debug prints to serial monitor
#define MY_DEBUG

// Enable and select radio type attached
#define MY_RADIO_NRF24
//#define MY_RADIO_RFM69

// Set LOW transmit power level as default, if you have an amplified NRF-module and
// power your radio separately with a good regulator you can turn up PA level.
#define MY_RF24_PA_LEVEL RF24_PA_HIGH

// Enable serial gateway
#define MY_GATEWAY_SERIAL

//#define MY_SIGNING
#define MY_SIGNING_ATSHA204
#define MY_SIGNING_REQUEST_SIGNATURES
#define MY_SIGNING_ATSHA204_PIN 17

// Define a lower baud rate for Arduino's running on 8 MHz (Arduino Pro Mini 3.3V & SenseBender)
#if F_CPU == 8000000L
#define MY_BAUD_RATE 38400
#endif

// Enable inclusion mode
#define MY_INCLUSION_MODE_FEATURE
// Enable Inclusion mode button on gateway
#define MY_INCLUSION_BUTTON_FEATURE

// Inverses behavior of inclusion button (if using external pullup)
//#define MY_INCLUSION_BUTTON_EXTERNAL_PULLUP

// Set inclusion mode duration (in seconds)
#define MY_INCLUSION_MODE_DURATION 60
// Digital pin used for inclusion mode button
//#define MY_INCLUSION_MODE_BUTTON_PIN  3

// Set blinking period
#define MY_DEFAULT_LED_BLINK_PERIOD 300

// Inverses the behavior of leds
//#define MY_WITH_LEDS_BLINKING_INVERSE

// Flash leds on rx/tx/err
// Uncomment to override default HW configurations
//#define MY_DEFAULT_ERR_LED_PIN 4  // Error led pin
//#define MY_DEFAULT_RX_LED_PIN  6  // Receive led pin
//#define MY_DEFAULT_TX_LED_PIN  5  // the PCB, on board LED

#include <MySensors.h>
#include <SD.h>
#include <drivers/ATSHA204/ATSHA204.cpp>

Sd2Card card;

#define EEPROM_VERIFICATION_ADDRESS 0x01

static uint8_t num_of_leds = 5;
static uint8_t leds[] = {LED_BLUE, LED_RED, LED_GREEN, LED_YELLOW, LED_ORANGE};

void setup()
{
	// Setup locally attached sensors
}

void presentation()
{
	// Present locally attached sensors
}

void loop()
{
	// Send locally attached sensor data here
}


void preHwInit()
{

	pinMode(MY_SWC1, INPUT_PULLUP);
	pinMode(MY_SWC2, INPUT_PULLUP);
	if (digitalRead(MY_SWC1) && digitalRead(MY_SWC2)) {
		return;
	}

	uint8_t tests = 0;

	for (int i=0; i< num_of_leds; i++) {
		pinMode(leds[i], OUTPUT);
	}
	uint8_t led_state = 0;
	if (digitalRead(MY_SWC1)) {
		while (!Serial) {
			digitalWrite(LED_BLUE, led_state);
			led_state ^= 0x01;
			delay(500);
		} // Wait for USB to be connected, before spewing out data.
	}
	digitalWrite(LED_BLUE, LOW);
	if (Serial) {
		Serial.println("Sensebender GateWay test routine");
		Serial.print("Mysensors core version : ");
		Serial.println(MYSENSORS_LIBRARY_VERSION);
		Serial.print("GateWay sketch version : ");
		Serial.println(SKETCH_VERSION);
		Serial.println("----------------------------------");
		Serial.println();
	}
	if (testSha204()) {
		digitalWrite(LED_GREEN, HIGH);
		tests++;
	}
	if (testSDCard()) {
		digitalWrite(LED_YELLOW, HIGH);
		tests++;
	}

	if (testEEProm()) {
		digitalWrite(LED_ORANGE, HIGH);
		tests++;
	}
	if (testAnalog()) {
		digitalWrite(LED_BLUE, HIGH);
		tests++;
	}
	if (tests == 4) {
		while(1) {
			for (int i=0; i<num_of_leds; i++) {
				digitalWrite(leds[i], HIGH);
				delay(200);
				digitalWrite(leds[i], LOW);
			}
		}
	} else {
		while (1) {
			digitalWrite(LED_RED, HIGH);
			delay(200);
			digitalWrite(LED_RED, LOW);
			delay(200);
		}
	}

}

bool testSha204()
{
	uint8_t rx_buffer[SHA204_RSP_SIZE_MAX];
	uint8_t ret_code;
	if (Serial) {
		Serial.print("- > SHA204 ");
	}
	atsha204_init(MY_SIGNING_ATSHA204_PIN);
	ret_code = atsha204_wakeup(rx_buffer);

	if (ret_code == SHA204_SUCCESS) {
		ret_code = atsha204_getSerialNumber(rx_buffer);
		if (ret_code != SHA204_SUCCESS) {
			if (Serial) {
				Serial.println(F("Failed to obtain device serial number. Response: "));
			}
			Serial.println(ret_code, HEX);
		} else {
			if (Serial) {
				Serial.print(F("Ok (serial : "));
				for (int i=0; i<9; i++) {
					if (rx_buffer[i] < 0x10) {
						Serial.print('0'); // Because Serial.print does not 0-pad HEX
					}
					Serial.print(rx_buffer[i], HEX);
				}
				Serial.println(")");
			}
			return true;
		}
	} else {
		if (Serial) {
			Serial.println(F("Failed to wakeup SHA204"));
		}
	}
	return false;
}

bool testSDCard()
{
	if (Serial) {
		Serial.print("- > SD CARD ");
	}
	if (!card.init(SPI_HALF_SPEED, MY_SDCARD_CS)) {
		if (Serial) {
			Serial.println("SD CARD did not initialize!");
		}
	} else {
		if (Serial) {
			Serial.print("SD Card initialized correct! - ");
			Serial.print("type detected : ");
			switch(card.type()) {
			case SD_CARD_TYPE_SD1:
				Serial.println("SD1");
				break;
			case SD_CARD_TYPE_SD2:
				Serial.println("SD2");
				break;
			case SD_CARD_TYPE_SDHC:
				Serial.println("SDHC");
				break;
			default:
				Serial.println("Unknown");
			}
		}
		return true;
	}
	return false;
}

bool testEEProm()
{
	uint8_t eeprom_d1, eeprom_d2;
	SerialUSB.print(" -> EEPROM ");
	Wire.begin();
	eeprom_d1 = i2c_eeprom_read_byte(EEPROM_VERIFICATION_ADDRESS);
	delay(500);
	eeprom_d1 = ~eeprom_d1; // invert the bits
	i2c_eeprom_write_byte(EEPROM_VERIFICATION_ADDRESS, eeprom_d1);
	delay(500);
	eeprom_d2 = i2c_eeprom_read_byte(EEPROM_VERIFICATION_ADDRESS);
	if (eeprom_d1 == eeprom_d2) {
		SerialUSB.println("PASSED");
		i2c_eeprom_write_byte(EEPROM_VERIFICATION_ADDRESS, ~eeprom_d1);
		return true;
	}
	SerialUSB.println("FAILED!");
	return false;
}

bool testAnalog()
{
	int bat_detect = analogRead(MY_BAT_DETECT);
	Serial.print("-> analog : ");
	Serial.print(bat_detect);
	if (bat_detect < 400 || bat_detect > 650) {
		Serial.println(" Failed");
		return false;
	}
	Serial.println(" Passed");
	return true;
}

[Anticimex]

The gateway sketch include a test of the atsha which I don't think belong there. You can probably remove the include and the test function.

[alexsh1]

@tbowmo it compiles with this:

#include <drivers/ATSHA204/ATSHA204.h>

However, I cannot confirm that the singing is working - I need more time to set-up a node to test it.

[tbowmo]

@Anticimex

It's the default sketch, that itead is putting in the gateway, including a simple hardware self-test routine.

I would like to keep it there, in case people run into troubles.. Then they can go back to factory stock firmware...

[alexsh1]

@Anticimex You suggest to remote it? It compiles fine if I remove it. I will set-up a node tomorrow to test signing with #include <drivers/ATSHA204/ATSHA204.cpp> removed.

[Anticimex]

@tbowmo may I suggest an update which would switch out the include of the cpp file and the test if atsha based signing is enabled? Or is it too late to ship firmware updates to iTead?

[tbowmo]

@Anticimex

Such a change won't affect the firmware that is put into the sensebender GW per se, as we don't use signing in the default sketch. I was about to suggest the same :)

[Anticimex]

@tbowmo then we have a way forward :)

[meddie]

@Anticimex
sorry i didnt let hear anything from me for the last few days.
i had the same problems with compiling the sketch. It depends on the signing. When you remove the #define MY_SIGNING_ATSHA204 the you can compile but when the singning is defined you get an error until you remove this line:
#include <drivers/ATSHA204/ATSHA204.cpp>

i have removed the line and defined the signing and for me works the singing and encryption.

but i have an another problem, i dont know if i am right here or i better have to post in the sensebender micro forum, i posted that i had some troubles with the space on the sb micro, i have removed the #define my_debug that solved my space problem, but now i have observed that the node is starting and sends few times the temp and humidity but after the few times nothing happens anymore.

[meddie]

i observed, when i hold the sensor in the fingers so that it will be worm, and start the node then it sends all minute the temp, but when the temp goes donw to the room temperature the the node sends only when the humidity or temp changes over the threshhold, but in the room i dont have much changes and i think that when the node does not send about longer time, that the the problem comes up.
I tested it in some different distances, on another floor but in very short distance too. I dont think that is a radio problem.
What do you think about?
The Problem is, that i cant debug the node because i disabled it because of space problems.
Thank you

[Anticimex]

Please post these kind of things in the sensebender thread, they are not signing related.

[alexsh1]

@Anticimex I have a quick question. I have the following in the node log:

2076 Will not sign message for destination 255 as it does not require it
2117 TSF:MSG:SEND,6-6-255-255,s=255,c=3,t=7,pt=0,l=0,sg=0,ft=0,st=OK:
2779 TSF:MSG:READ,0-0-6,s=255,c=3,t=8,pt=1,l=1,sg=0:0
2785 Skipping security for command 3 type 8
2789 TSF:MSG:FPAR OK,ID=0,D=1
4126 TSM:FPAR:OK
4126 TSM:ID
4128 TSM:ID:OK
4130 TSM:UPL
4132 Will not sign message for destination 0 as it does not require it
4143 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=24,pt=1,l=1,sg=0,ft=0,st=OK:1
4161 TSF:MSG:READ,0-0-6,s=255,c=3,t=25,pt=1,l=1,sg=0:1
4165 Skipping security for command 3 type 25

both the GW and the node have #define MY_SIGNING_REQUEST_SIGNATURES
Am I missing anything? Why signing is skipped?

[Anticimex]

@alexsh1 has the node and gateway successfully exchanged their signing preferences? It is done at node startup.

[alexsh1]

@Anticimex No, straight at the beginning I got this:

0 MCO:BGN:INIT NODE,CP=RNONAA-,VER=2.1.1
4 TSM:INIT
4 TSF:WUR:MS=0
12 TSM:INIT:TSP OK
14 TSM:INIT:STATID=6
16 TSF:SID:OK,ID=6
18 TSM:FPAR
20 Will not sign message for destination 255 as it does not require it
61 TSF:MSG:SEND,6-6-255-255,s=255,c=3,t=7,pt=0,l=0,sg=0,ft=0,st=OK:
538 TSF:MSG:READ,0-0-6,s=255,c=3,t=8,pt=1,l=1,sg=0:0
544 Skipping security for command 3 type 8
548 TSF:MSG:FPAR OK,ID=0,D=1
2070 TSM:FPAR:OK
2070 TSM:ID
2072 TSM:ID:OK
2074 TSM:UPL
2076 Will not sign message for destination 0 as it does not require it
2086 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=24,pt=1,l=1,sg=0,ft=0,st=OK:1
2103 TSF:MSG:READ,0-0-6,s=255,c=3,t=25,pt=1,l=1,sg=0:1
2109 Skipping security for command 3 type 25
2115 TSF:MSG:PONG RECV,HP=1
2117 TSM:UPL:OK
2119 TSM:READY:ID=6,PAR=0,DIS=1
2123 ‘"
Yð·
�æ–à”]-”ô*“"
2125 TSM:INIT
2 MCO:BGN:INIT NODE,CP=RNONAA-,VER=2.1.1```

[Anticimex]

@alexsh1 is that all? It looks like it has not reached the signing setup part yet. Is node and gw alive or are one of them hanging?

[alexsh1]

@Anticimex Yes, I am afraid. The GW is showing
"0;255;3;0;9;Message is not signed, but it should have been!
0;255;3;0;9;!TSF:MSG:SIGN VERIFY FAIL"

Yes, both node and GW are fine, but messages are not reaching the GW as signing is required.

[Anticimex]

@alexsh1 at startup of the node, it sends its signing preferences to the GW (assuming you have selected a signing backend, atsha204a or soft signing). The GW will then reply with its own preference to inform the node that it should sign messages. If the GW said that it rejects messages because they are unsigned, it suggests that the GW require signatures from that node, but the node does not realize that it needs to sign them. So either the node is not properly configured to sign messages or there have been a radio issue preventing message exchange during startup.

[alexsh1]

@Anticimex After forcing all nodes to sign with #define MY_SIGNING_GW_REQUEST_SIGNATURES_FROM_ALL
got this:

0 MCO:BGN:INIT NODE,CP=RNNNAA-,VER=2.1.1
4 TSM:INIT
4 TSF:WUR:MS=0
12 TSM:INIT:TSP OK
14 TSM:INIT:STATID=6
16 TSF:SID:OK,ID=6
18 TSM:FPAR
18 Will not sign message for destination 255 as it does not require it
61 TSF:MSG:SEND,6-6-255-255,s=255,c=3,t=7,pt=0,l=0,sg=0,ft=0,st=OK:
1044 TSF:MSG:READ,0-0-6,s=255,c=3,t=8,pt=1,l=1,sg=0:0
1050 TSF:MSG:FPAR OK,ID=0,D=1
2070 TSM:FPAR:OK
2070 TSM:ID
2072 TSM:ID:OK
2074 TSM:UPL
2076 Skipping security for command 3 type 24
2082 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=24,pt=1,l=1,sg=0,ft=0,st=OK:1
2103 TSF:MSG:READ,0-0-6,s=255,c=3,t=25,pt=1,l=1,sg=0:1
2109 TSF:MSG:PONG RECV,HP=1
2113 TSM:UPL:OK
2115 TSM:READY:ID=6,PAR=0,DIS=1
2117 Skipping security for command 3 type 15
2123 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=15,pt=6,l=2,sg=0,ft=0,st=OK:0100
2131 Waiting for GW to send signing preferences...
2164 TSF:MSG:READ,0-0-6,s=255,c=3,t=15,pt=6,l=2,sg=0:0101
2170 Mark node 0 as one that require signed messages
2177 Mark node 0 as one that do not require whitelisting
2183 Skipping security for command 3 type 16
2189 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=16,pt=0,l=0,sg=0,ft=0,st=OK:
2197 Nonce requested from 0. Waiting...
2201 Message to send could not be signed!
2205 !TSF:MSG:SIGN FAIL
2207 Skipping security for command 3 type 16
2213 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=16,pt=0,l=0,sg=0,ft=1,st=OK:
2222 Nonce requested from 0. Waiting...
2226 Message to send could not be signed!
2230 !TSF:MSG:SIGN FAIL
2232 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:A03E832C91BD0CC2C02E2A16D834F9CA91816D234ABB1188A2
2244 Nonce received from 0.
2246 Proceeding with signing...
Message to process: 06000E2306FF00
Current nonce: A03E832C91BD0CC2C02E2A16D834F9CA91816D234ABB1188A2AAAAAAAAAAAAAA
HMAC: AF54D68677672C45B3E1329A9A1B4E7517D0A0FF340569C633D5DC52207F8DDA
Signature in message: 0154D68677672C45B3E1329A9A1B4E7517D0A0FF340569C6
2371 Message signed
2379 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:C1FACC7B2E3B538E31853CB92C73A87E3240FBC2253CE63A9E
2392 Nonce received from 0.
2394 Proceeding with signing...
Message to process: 06000E2306FF00
Current nonce: C1FACC7B2E3B538E31853CB92C73A87E3240FBC2253CE63A9EAAAAAAAAAAAAAA
HMAC: 9EE43EA4A510354CB2D3A0AB2C0D13D106CD9B666103E7B7115B73B646DB20DD
Signature in message: 01E43EA4A510354CB2D3A0AB2C0D13D106CD9B666103E7B7
2519 Message signed
4233 Skipping security for command 3 type 16
4239 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=16,pt=0,l=0,sg=1,ft=1,st=OK:
4247 Nonce requested from 0. Waiting...
4280 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:25E2116C25EBB38BB5F87AFFC892073803D818F07FB1E36738
4292 Nonce received from 0.
4294 Proceeding with signing...
4298 Failed to sign message!
4300 Message to send could not be signed!
4304 !TSF:MSG:SIGN FAIL
4306 Skipping security for command 3 type 16
4315 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=16,pt=0,l=0,sg=0,ft=1,st=OK:
4321 Nonce requested from 0. Waiting...
4354 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:6FE06CCBD9098A24D65907C9C7CF62062DA365227E5A836108
4366 Nonce received from 0.
4368 Proceeding with signing...
Message to process: 06001E030CFF312E31
Current nonce: 6FE06CCBD9098A24D65907C9C7CF62062DA365227E5A836108AAAAAAAAAAAAAA
HMAC: 564EF68106E0B7333A233F7C396BEDBE537F9AF012C78856F3BD37753B9F096E
Signature in message: 014EF68106E0B7333A233F7C396BEDBE537F9AF012C7
4491 Message signed
4499 Message to send has been signed
4505 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=12,pt=0,l=3,sg=1,ft=0,st=OK:1.1
4513 Skipping security for command 3 type 16
4519 TSF:MSG:SEND,6-6-0-0,s=0,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
4528 Nonce requested from 0. Waiting...
4651 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:67AD75E666FB63B0A606CCA15003152448DE5D66C1EA34E541
4663 Nonce received from 0.
4665 Proceeding with signing...
Message to process: 060006000800
Current nonce: 67AD75E666FB63B0A606CCA15003152448DE5D66C1EA34E541AAAAAAAAAAAAAA
HMAC: 4901D9D648B90185224D2256EADC4C607543E698EC2252B7E88BAD91696824CB
Signature in message: 0101D9D648B90185224D2256EADC4C607543E698EC2252B7E8
4790 Message signed
4798 Message to send has been signed
4804 TSF:MSG:SEND,6-6-0-0,s=0,c=0,t=8,pt=0,l=0,sg=1,ft=0,st=OK:
4812 Skipping security for command 3 type 16
4818 TSF:MSG:SEND,6-6-0-0,s=1,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
4827 Nonce requested from 0. Waiting...
4950 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:44DC6983F5E93696CEFD0B73423B33946AE1BC3DC40F562012
4962 Nonce received from 0.
4964 Proceeding with signing...
Message to process: 060006000601
Current nonce: 44DC6983F5E93696CEFD0B73423B33946AE1BC3DC40F562012AAAAAAAAAAAAAA
HMAC: 4D37001CE6A4C2E5C7C5B8995C871DA6386E9C7ADD90D3AF36D83C98C1E98166
Signature in message: 0137001CE6A4C2E5C7C5B8995C871DA6386E9C7ADD90D3AF36
5091 Message signed
5099 Message to send has been signed
5105 TSF:MSG:SEND,6-6-0-0,s=1,c=0,t=6,pt=0,l=0,sg=1,ft=0,st=OK:
5113 Skipping security for command 3 type 16
5122 TSF:MSG:SEND,6-6-0-0,s=2,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
5128 Nonce requested from 0. Waiting...
5253 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:B6C405695A2B551DE4C1AFC02125F42528209A3DF9013820E2
5263 Nonce received from 0.
5267 Proceeding with signing...
Message to process: 060006000702
Current nonce: B6C405695A2B551DE4C1AFC02125F42528209A3DF9013820E2AAAAAAAAAAAAAA
HMAC: B767B39D7B5F78422608CCF763DA7C94B333DA95C07087D896DFB36CACF0CE77
Signature in message: 0167B39D7B5F78422608CCF763DA7C94B333DA95C07087D896
5392 Message signed
5398 Message to send has been signed
5404 TSF:MSG:SEND,6-6-0-0,s=2,c=0,t=7,pt=0,l=0,sg=1,ft=0,st=OK:
5412 Skipping security for command 3 type 16
5421 TSF:MSG:SEND,6-6-0-0,s=3,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
5427 Nonce requested from 0. Waiting...
5554 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:9A92C415D6BE672E588BE107BE88637D9D3551A029796C12EF
5566 Nonce received from 0.
5568 Proceeding with signing...
Message to process: 060006000D03
Current nonce: 9A92C415D6BE672E588BE107BE88637D9D3551A029796C12EFAAAAAAAAAAAAAA
HMAC: B75B0F0C356378B1EEC25726EE552581F98B1957ADE9A82EF48408FD528927E6
Signature in message: 015B0F0C356378B1EEC25726EE552581F98B1957ADE9A82EF4
5693 Message signed
5699 Message to send has been signed
5707 TSF:MSG:SEND,6-6-0-0,s=3,c=0,t=13,pt=0,l=0,sg=1,ft=0,st=OK:
5713 MCO:REG:REQ
5715 Skipping security for command 3 type 26
5724 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=26,pt=1,l=1,sg=1,ft=0,st=OK:2
5830 TSF:MSG:READ,0-0-6,s=255,c=3,t=27,pt=1,l=1,sg=0:1
5836 MCO:PIM:NODE REG=1
5838 MCO:BGN:STP
BME280 Pressure Sensor1.1isMetric: 1
6160 Skipping security for command 3 type 16
6168 TSF:MSG:SEND,6-6-0-0,s=3,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
6174 Nonce requested from 0. Waiting...
6207 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:F7F1A5F6C487947D093E7676AA05AF1BE65AFE31B4223034C2
6219 Nonce received from 0.
6221 Proceeding with signing...
Message to process: 06002EE12603EE7C4F4002
Current nonce: F7F1A5F6C487947D093E7676AA05AF1BE65AFE31B4223034C2AAAAAAAAAAAAAA
HMAC: DF2217C08446766ECC9CD41D4C9643B546CC921AEAA9E1971DF314F965D2D0FE
Signature in message: 012217C08446766ECC9CD41D4C9643B546CC921A
6346 Message signed
6354 Message to send has been signed
6361 TSF:MSG:SEND,6-6-0-0,s=3,c=1,t=38,pt=7,l=5,sg=1,ft=0,st=OK:3.24
6369 Skipping security for command 3 type 16
6377 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
6383 Nonce requested from 0. Waiting...
6508 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:027634E4197B49C4FDB8059CB6D34AA6D81EB340D934252BBF
6518 Nonce received from 0.
6522 Proceeding with signing...
Message to process: 06000E2300FF67
Current nonce: 027634E4197B49C4FDB8059CB6D34AA6D81EB340D934252BBFAAAAAAAAAAAAAA
HMAC: 572A1585F50CE39199035088548A9877A08B8B3FA8404FA31B8B55B5190320C1
Signature in message: 012A1585F50CE39199035088548A9877A08B8B3FA8404FA3
6645 Message signed
6651 Message to send has been signed
6660 TSF:MSG:SEND,6-6-0-0,s=255,c=3,t=0,pt=1,l=1,sg=1,ft=0,st=OK:103
6666 MCO:BGN:INIT OK,TSP=1
Temperature = 24.90 *C
Humidity = 48.62 %
Pressure = 994.33 hPa
Forecast = unknown
6678 Skipping security for command 3 type 16
6688 TSF:MSG:SEND,6-6-0-0,s=1,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
6696 Nonce requested from 0. Waiting...
6805 TSF:MSG:READ,0-0-6,s=255,c=3,t=17,pt=6,l=25,sg=0:988D1BCE8B949E24FA8D7FE18200429C16B01AF0B927CE0709
6815 Nonce received from 0.
6819 Proceeding with signing...
Message to process: 06002EE1149307E4071493
Current nonce: 988D1BCE8B949E24FA8D7FE18200429C16B01AF0B927CE0709AAAAAAAAAAAAAA
HMAC: EAB0E2B8ECF6B95E6D07BE2651BECF977C53DDB8516DD847CFE6688DD61140ED
Signature in message: 01B0E2B8ECF6B95E6D07BE2651BECF977C53DDB8
6944 Message signed
6952 Message to send has been signed
6959 TSF:MSG:SEND,6-6-0-0,s=147,c=1,t=20,pt=7,l=5,sg=1,ft=0,st=OK:0.00000000
6967 Skipping security for command 3 type 16
6975 TSF:MSG:SEND,6-6-0-0,s=2,c=3,t=16,pt=0,l=0,sg=1,ft=0,st=OK:
6981 Nonce requested from 0. Waiting...
6985 Message to send could not be signed!
6989 !TSF:MSG:SIGN FAIL
6993 Skipping security for command 3 type 16
7000 TSF:MSG:SEND,6-6-0-0,s=0,c=3,t=16,pt=0,l=0,sg=0,ft=1,st=OK:
7006 Nonce requested from 0. Waiting...
7010 Message to send could not be signed!
7014 !TSF:MSG:SIGN FAIL
7018 Skipping security for command 3 type 16
7024 TSF:MSG:SEND,6-6-0-0,s=0,c=3,t=16,pt=0,l=0,sg=0,ft=1,st=OK:
7030 Nonce requested from 0. Waiting...
7034 Message to send could not be signed!
7038 !TSF:MSG:SIGN FAIL
7092 MCO:SLP:MS=300000,SMS=0,I1=255,M1=255,I2=255,M2=255
7098 MCO:SLP:TPD

What do you think the problem is?
Why is it still MSG:SIGN FAIL

EDIT: this is the GW log:

0;255;3;0;9;MCO:BGN:INIT GW,CP=RNNGAS-,VER=2.1.1
0;255;3;0;9;TSM:INIT
0;255;3;0;9;TSF:WUR:MS=0
0;255;3;0;9;TSM:INIT:TSP OK
0;255;3;0;9;TSM:INIT:GW MODE
0;255;3;0;9;TSM:READY:ID=0,PAR=0,DIS=0
0;255;3;0;9;MCO:REG:NOT NEEDED
IP: 10.1.1.120
0;255;3;0;9;MCO:BGN:STP
0;255;3;0;9;MCO:BGN:INIT OK,TSP=1
0;255;3;0;9;TSF:MSG:READ,15-15-0,s=1,c=1,t=0,pt=7,l=5,sg=0:27.0
0;255;3;0;9;Message is not signed, but it should have been!
0;255;3;0;9;!TSF:MSG:SIGN VERIFY FAIL
0;255;3;0;9;TSF:MSG:READ,15-15-0,s=0,c=1,t=4,pt=7,l=5,sg=0:996
0;255;3;0;9;Message is not signed, but it should have been!
0;255;3;0;9;!TSF:MSG:SIGN VERIFY FAIL
0;255;3;0;9;TSF:MSG:READ,6-6-255,s=255,c=3,t=7,pt=0,l=0,sg=0:
0;255;3;0;9;TSF:MSG:BC
0;255;3;0;9;TSF:MSG:FPAR REQ,ID=6
0;255;3;0;9;TSF:PNG:SEND,TO=0
0;255;3;0;9;TSF:CKU:OK
0;255;3;0;9;TSF:MSG:GWL OK
0;255;3;0;9;Skipping security for command 3 type 8
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=8,pt=1,l=1,sg=0,ft=0,st=OK:0
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=24,pt=1,l=1,sg=0:1
0;255;3;0;9;Skipping security for command 3 type 24
0;255;3;0;9;TSF:MSG:PINGED,ID=6,HP=1
0;255;3;0;9;Skipping security for command 3 type 25
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=25,pt=1,l=1,sg=0,ft=0,st=OK:1
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=15,pt=6,l=2,sg=0:0101
0;255;3;0;9;Skipping security for command 3 type 15
0;255;3;0;9;Mark node 6 as one that require signed messages
0;255;3;0;9;Mark node 6 as one that do not require whitelisting
0;255;3;0;9;Informing node 6 that we require signatures
0;255;3;0;9;Informing node 6 that we do not require whitelisting
0;255;3;0;9;Skipping security for command 3 type 15
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=15,pt=6,l=2,sg=0,ft=0,st=OK:0101
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=16,pt=0,l=0,sg=0:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: BB0EE26FC4C35E155CA36591DFC8DF866D188923ADCCA99ED700000000000000
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=0,ft=0,st=OK:BB0EE26FC4C35E155CA36591DFC8DF866D188923ADCCA99ED7
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=16,pt=0,l=0,sg=0:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: C62553080FACCBBA84B0BE05AEA1871324370BD8BBF431D38CAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=0,ft=0,st=OK:C62553080FACCBBA84B0BE05AEA1871324370BD8BBF431D38C
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: AA4BF678F8D0BE6885E67795A8D6E001CF8E0AFECD0D6146B0AAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:AA4BF678F8D0BE6885E67795A8D6E001CF8E0AFECD0D6146B0
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=16,pt=0,l=0,sg=0:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: 6122BFB72296B95B45E44C2B4D43A3CE1C9D1F43F24137149AAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=0,ft=0,st=OK:6122BFB72296B95B45E44C2B4D43A3CE1C9D1F43F24137149A
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=12,pt=0,l=3,sg=1:1.1
0;255;3;0;9;Signature in message: 016583B112FED6ED3698EB4A4AE12B319ACC2755CF92
0;255;3;0;9;Message to process: 06001E030CFF312E31
0;255;3;0;9;Current nonce: 6122BFB72296B95B45E44C2B4D43A3CE1C9D1F43F24137149AAAAAAAAAAAAAAA
0;255;3;0;9;HMAC: DD6583B112FED6ED3698EB4A4AE12B319ACC2755CF9239836E845A5B3DD186FF
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=0,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: D3F6004F4966A6D33936AC7EBCEEBF9CE919AD644BFA33289AAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:D3F6004F4966A6D33936AC7EBCEEBF9CE919AD644BFA33289A
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=0,c=0,t=8,pt=0,l=0,sg=1:
0;255;3;0;9;Signature in message: 01CF6F511AAA6A0F2750F6437F3DEA644A13335E155EC94488
0;255;3;0;9;Message to process: 060006000800
0;255;3;0;9;Current nonce: D3F6004F4966A6D33936AC7EBCEEBF9CE919AD644BFA33289AAAAAAAAAAAAAAA
0;255;3;0;9;HMAC: D6CF6F511AAA6A0F2750F6437F3DEA644A13335E155EC944884A4A6D7C667140
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=1,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: E310DE1F44902508B12558EB2C3C51066F381572694AD4D7CEAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:E310DE1F44902508B12558EB2C3C51066F381572694AD4D7CE
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=1,c=0,t=6,pt=0,l=0,sg=1:
0;255;3;0;9;Signature in message: 012F140689293B434B043699F131C397F629633FD7D9E9D489
0;255;3;0;9;Message to process: 060006000601
0;255;3;0;9;Current nonce: E310DE1F44902508B12558EB2C3C51066F381572694AD4D7CEAAAAAAAAAAAAAA
0;255;3;0;9;HMAC: 942F140689293B434B043699F131C397F629633FD7D9E9D48992B327A0CB9BB8
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=2,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: 0EB8A85D42109C29EBE8E78BF9B8C66092845EB7D92AC1B381AAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:0EB8A85D42109C29EBE8E78BF9B8C66092845EB7D92AC1B381
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=2,c=0,t=7,pt=0,l=0,sg=1:
0;255;3;0;9;Signature in message: 018D9FBD8E3E4730D1932EE4E4BB998B10B593631551BBB575
0;255;3;0;9;Message to process: 060006000702
0;255;3;0;9;Current nonce: 0EB8A85D42109C29EBE8E78BF9B8C66092845EB7D92AC1B381AAAAAAAAAAAAAA
0;255;3;0;9;HMAC: 798D9FBD8E3E4730D1932EE4E4BB998B10B593631551BBB575BEC03A5C759E36
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=3,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: F8F8706BAAAD66823E6048248088515F8083EB545EBAF8C1DFAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:F8F8706BAAAD66823E6048248088515F8083EB545EBAF8C1DF
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,10-10-0,s=1,c=1,t=17,pt=5,l=4,sg=0:332
0;255;3;0;9;Message is not signed, but it should have been!
0;255;3;0;9;!TSF:MSG:SIGN VERIFY FAIL
0;255;3;0;9;TSF:MSG:READ,10-10-0,s=1,c=1,t=24,pt=5,l=4,sg=0:51270118
0;255;3;0;9;Message is not signed, but it should have been!
0;255;3;0;9;!TSF:MSG:SIGN VERIFY FAIL
0;255;3;0;9;TSF:MSG:READ,10-10-0,s=1,c=1,t=18,pt=7,l=5,sg=0:51270.1210
0;255;3;0;9;Message is not signed, but it should have been!
0;255;3;0;9;!TSF:MSG:SIGN VERIFY FAIL
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=3,c=0,t=13,pt=0,l=0,sg=1:
0;255;3;0;9;Signature in message: 0137F7F5A35542631C67BB42381A81FAB165AE75D7B5C7408F
0;255;3;0;9;Message to process: 060006000D03
0;255;3;0;9;Current nonce: F8F8706BAAAD66823E6048248088515F8083EB545EBAF8C1DFAAAAAAAAAAAAAA
0;255;3;0;9;HMAC: 1237F7F5A35542631C67BB42381A81FAB165AE75D7B5C7408F3EE91419294238
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=26,pt=1,l=1,sg=1:2
0;255;3;0;9;Skipping security for command 3 type 26
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=16,pt=0,l=0,sg=0,ft=0,st=OK:
0;255;3;0;9;Nonce requested from 6. Waiting...
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=17,pt=6,l=25,sg=0:84A969C4138F0268D8E015A27E2306F288252601FE54AE62A6
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;Nonce received from 6.
0;255;3;0;9;Proceeding with signing...
0;255;3;0;9;Message to process: 00060E231BFF01
0;255;3;0;9;Current nonce: 84A969C4138F0268D8E015A27E2306F288252601FE54AE62A6AAAAAAAAAAAAAA
0;255;3;0;9;HMAC: DB6CBDAB2875D284BE0CEA1518B86988A8CE3DC36A0B38E4BF1A35C416295EB3
0;255;3;0;9;Signature in message: 016CBDAB2875D284BE0CEA1518B86988A8CE3DC36A0B38E4
0;255;3;0;9;Message signed
0;255;3;0;9;Message to send has been signed
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=27,pt=1,l=1,sg=1,ft=0,st=OK:1
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=3,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: D38475550145574228E4E252AB0608F22CFADB55C307F076C4AAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:D38475550145574228E4E252AB0608F22CFADB55C307F076C4
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=3,c=1,t=38,pt=7,l=5,sg=1:3.29
0;255;3;0;9;Signature in message: 01A48C0E185B8B50EDA96A7C905C0778B16D2C78
0;255;3;0;9;Message to process: 06002EE126035C8F524002
0;255;3;0;9;Current nonce: D38475550145574228E4E252AB0608F22CFADB55C307F076C4AAAAAAAAAAAAAA
0;255;3;0;9;HMAC: 8BA48C0E185B8B50EDA96A7C905C0778B16D2C78707A2959F86F0DBAF3FFE851
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: 028248EABB9E64FD89808ED98032CB650D3DCB81525A43BB31AAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=OK:028248EABB9E64FD89808ED98032CB650D3DCB81525A43BB31
0;255;3;0;9;Transmitted nonce
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=255,c=3,t=0,pt=1,l=1,sg=1:106
0;255;3;0;9;Signature in message: 01D5CB11EFD24211E2CDCED741211AE9FF3E0AFE0AA9BBEE
0;255;3;0;9;Message to process: 06000E2300FF6A
0;255;3;0;9;Current nonce: 028248EABB9E64FD89808ED98032CB650D3DCB81525A43BB31AAAAAAAAAAAAAA
0;255;3;0;9;HMAC: F5D5CB11EFD24211E2CDCED741211AE9FF3E0AFE0AA9BBEE96970EB2EF247BB5
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=1,c=3,t=16,pt=0,l=0,sg=1:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: 6DE60F283CD99033EEC6DF5DE044BE08F5151149E6DFD04FEAAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;!TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=1,ft=0,st=NACK:6DE60F283CD99033EEC6DF5DE044BE08F5151149E6DFD04FEA
0;255;3;0;9;Failed to transmit nonce!
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=2,c=3,t=16,pt=0,l=0,sg=0:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: 21D7B27EEF84BF6A8ABEA9264986E7637435C28952B4477F7AAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;!TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=0,ft=0,st=NACK:21D7B27EEF84BF6A8ABEA9264986E7637435C28952B4477F7A
0;255;3;0;9;Failed to transmit nonce!
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=0,c=3,t=16,pt=0,l=0,sg=0:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: 3B83A566EB5C3E32546BE372D5913CB3FA8596A2F61DC57F1FAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;!TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=0,ft=0,st=NACK:3B83A566EB5C3E32546BE372D5913CB3FA8596A2F61DC57F1F
0;255;3;0;9;Failed to transmit nonce!
0;255;3;0;9;TSF:MSG:READ,6-6-0,s=0,c=3,t=16,pt=0,l=0,sg=0:
0;255;3;0;9;Skipping security for command 3 type 16
0;255;3;0;9;SHA256: B6A6160EAF37C79EBCAEEE7701A6D798E2244CEB8B067A1FADAAAAAAAAAAAAAA
0;255;3;0;9;Skipping security for command 3 type 17
0;255;3;0;9;!TSF:MSG:SEND,0-0-6-6,s=255,c=3,t=17,pt=6,l=25,sg=0,ft=0,st=NACK:B6A6160EAF37C79EBCAEEE7701A6D798E2244CEB8B067A1FAD
0;255;3;0;9;Failed to transmit nonce!

RF issue?

[Anticimex]

@alexsh1 I think the problem is that you use the GW you reported was malfunctioning where the self test reported that the atsha204a did not answer as expected. And that you now try to use that device. Since the log said that a message failed to be signed.

[alexsh1]

@Anticimex No, the GW I am using is Mega 2560 with W5100 not the sensebender GW.
It has been working for many months after I resolved a power issue. However, signing is a different thing...