[security] Introducing signing support to MySensors
-
@alexsh1 Hm, it should not be a problem. Assuming your log snippet is from the GW, it basically says that it successfully transmit the nonce to your node as requested to, and then it expects the node to provide a signed message to the GW within a certain timeout. The node fails to do this within that time so the GW times out and will not accept the message if it arrives later on.
So there are two options;- The node takes too long to process the received nonce, sign the message and send it back (perhaps many repeater hops between node and gw, this can be resolved by increasing the signing timeout at the GW side).
- The node does transmit the signed message but fails with a NACK. The GW will never see this message and therefore assumes the node did not send it and correctly times out.
@Anticimex On the node, changing nrf24l01+ orientation (I have two nrf24l01+ sockets) 90 degrees changed signing from
0;255;3;0;9;120620 Transmitted nonce 0;255;3;0;9;120630 TSF:MSG:READ,4-4-0,s=1,c=1,t=0,pt=7,l=5,sg=1:24.0 0;255;3;0;9;120644 Current nonce: 415DAB5FF6170E67F5B180ADC827C062D35CBF2DCE1B6B0264AAAAAAAAAAAAAA 0;255;3;0;9;120745 HMAC: 759A77B66BAC8F0AEA542685F4EA12DEB66B27FE15F57788F1D1022508984896 0;255;3;0;9;120756 Signature bad 0;255;3;0;9;120766 Signature verification failed! 0;255;3;0;9;120776 !TSF:MSG:SIGN VERIFY FAIL 0;255;3;0;9;120981 TSF:MSG:READ,4-4-0,s=2,c=1,t=1,pt=2,l=2,sg=1:70 0;255;3;0;9;120991 No active verification session 0;255;3;0;9;121001 Signature verification failed! 0;255;3;0;9;121011 !TSF:MSG:SIGN VERIFY FAIL0;255;3;0;9;165728 Transmitted nonce 0;255;3;0;9;165944 TSF:MSG:READ,4-4-0,s=1,c=1,t=0,pt=7,l=5,sg=1:24.4 0;255;3;0;9;165958 Current nonce: BAC8828FEAAFB3A0C65DE6F8D4993E4D3D93F190B58AA3C737AAAAAAAAAAAAAA 0;255;3;0;9;166059 HMAC: 122222A7C324B3688BD98EC8EF9AD9557350B874CAB38F250A246EBB069805D3 0;255;3;0;9;166070 Signature OK -
@Anticimex On the node, changing nrf24l01+ orientation (I have two nrf24l01+ sockets) 90 degrees changed signing from
0;255;3;0;9;120620 Transmitted nonce 0;255;3;0;9;120630 TSF:MSG:READ,4-4-0,s=1,c=1,t=0,pt=7,l=5,sg=1:24.0 0;255;3;0;9;120644 Current nonce: 415DAB5FF6170E67F5B180ADC827C062D35CBF2DCE1B6B0264AAAAAAAAAAAAAA 0;255;3;0;9;120745 HMAC: 759A77B66BAC8F0AEA542685F4EA12DEB66B27FE15F57788F1D1022508984896 0;255;3;0;9;120756 Signature bad 0;255;3;0;9;120766 Signature verification failed! 0;255;3;0;9;120776 !TSF:MSG:SIGN VERIFY FAIL 0;255;3;0;9;120981 TSF:MSG:READ,4-4-0,s=2,c=1,t=1,pt=2,l=2,sg=1:70 0;255;3;0;9;120991 No active verification session 0;255;3;0;9;121001 Signature verification failed! 0;255;3;0;9;121011 !TSF:MSG:SIGN VERIFY FAIL0;255;3;0;9;165728 Transmitted nonce 0;255;3;0;9;165944 TSF:MSG:READ,4-4-0,s=1,c=1,t=0,pt=7,l=5,sg=1:24.4 0;255;3;0;9;165958 Current nonce: BAC8828FEAAFB3A0C65DE6F8D4993E4D3D93F190B58AA3C737AAAAAAAAAAAAAA 0;255;3;0;9;166059 HMAC: 122222A7C324B3688BD98EC8EF9AD9557350B874CAB38F250A246EBB069805D3 0;255;3;0;9;166070 Signature OK -
@Anticimex It seems to me that 90% of all issues is actually RF.
Very annoying!Thanks for your help!
-
I am using latest beta (2.2.0b). Does anyone know what this means in the log:
!SGN:NCE:GENI think this is related to signing
-
I am using latest beta (2.2.0b). Does anyone know what this means in the log:
!SGN:NCE:GENI think this is related to signing
@alexsh1 to be more specific; the backend failed to generate a nonce. If you use the soft backed, it did not initialize properly (and you should have a log entry for that failure as well).
If using atsha204a, it either failed init like described above, or it failed to communicate properly (which should also be visible in other failures in the log)Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)
-
@alexsh1 to be more specific; the backend failed to generate a nonce. If you use the soft backed, it did not initialize properly (and you should have a log entry for that failure as well).
If using atsha204a, it either failed init like described above, or it failed to communicate properly (which should also be visible in other failures in the log) -
@Anticimex Spot on -> there was a mistake :
#define MY_SIGNING_ATSHA204_PIN 3and should have been
#define MY_SIGNING_ATSHA204_PIN 17I was wondering why nonce was all zeros...
@alexsh1 excellent. Signing won't work well without proper communication with the chip :)
I considered just hanging if that happened but decided it was a bit too harsh and might disguise the problem in case UART debug isn't enabled. -
I cannot get my china USB to Serial device to work with the arduino boards, so I cannot program the board to run the personalization. As a work around a use a Arduino Uno board as the "USB to Serial" and now I can upload the sketch and the personalizer writes to serial output fine at 115200 baud.
But, when it wants me to press SPACE, it responds with "Unexpected answer. Skipping lock."I tried an other sketch that does Serial.read() and echos back the result. It does not work at 115200 but works at 9600 baud. At 9600 I get char 32 back as SPACE, but 160 or 130 or 254 at 115200. Maybe the Uno board cannot handle 115200?
So, question: Can the personalizer sketch be changed to use 9600 (or something slower than 115200)? I tried to change the Serial.begin(115200) to 9600, but it is still 115200.
(of course, I can alter the code to bypass the press SPACE to press any key, but I want to get to the bottom with the problem)
-
I cannot get my china USB to Serial device to work with the arduino boards, so I cannot program the board to run the personalization. As a work around a use a Arduino Uno board as the "USB to Serial" and now I can upload the sketch and the personalizer writes to serial output fine at 115200 baud.
But, when it wants me to press SPACE, it responds with "Unexpected answer. Skipping lock."I tried an other sketch that does Serial.read() and echos back the result. It does not work at 115200 but works at 9600 baud. At 9600 I get char 32 back as SPACE, but 160 or 130 or 254 at 115200. Maybe the Uno board cannot handle 115200?
So, question: Can the personalizer sketch be changed to use 9600 (or something slower than 115200)? I tried to change the Serial.begin(115200) to 9600, but it is still 115200.
(of course, I can alter the code to bypass the press SPACE to press any key, but I want to get to the bottom with the problem)
@Magnus-Pernemark
Question 1: so you run stable release or beta?
Answer 1: yes you can change baud rate but it is handled differently between stable and beta. -
I cannot get my china USB to Serial device to work with the arduino boards, so I cannot program the board to run the personalization. As a work around a use a Arduino Uno board as the "USB to Serial" and now I can upload the sketch and the personalizer writes to serial output fine at 115200 baud.
But, when it wants me to press SPACE, it responds with "Unexpected answer. Skipping lock."I tried an other sketch that does Serial.read() and echos back the result. It does not work at 115200 but works at 9600 baud. At 9600 I get char 32 back as SPACE, but 160 or 130 or 254 at 115200. Maybe the Uno board cannot handle 115200?
So, question: Can the personalizer sketch be changed to use 9600 (or something slower than 115200)? I tried to change the Serial.begin(115200) to 9600, but it is still 115200.
(of course, I can alter the code to bypass the press SPACE to press any key, but I want to get to the bottom with the problem)
@Magnus-Pernemark there is a configuration switch to disable UART verification you can use
-
I cannot get my china USB to Serial device to work with the arduino boards, so I cannot program the board to run the personalization. As a work around a use a Arduino Uno board as the "USB to Serial" and now I can upload the sketch and the personalizer writes to serial output fine at 115200 baud.
But, when it wants me to press SPACE, it responds with "Unexpected answer. Skipping lock."I tried an other sketch that does Serial.read() and echos back the result. It does not work at 115200 but works at 9600 baud. At 9600 I get char 32 back as SPACE, but 160 or 130 or 254 at 115200. Maybe the Uno board cannot handle 115200?
So, question: Can the personalizer sketch be changed to use 9600 (or something slower than 115200)? I tried to change the Serial.begin(115200) to 9600, but it is still 115200.
(of course, I can alter the code to bypass the press SPACE to press any key, but I want to get to the bottom with the problem)
-
@Magnus-Pernemark which version are you using?
The development version from github supports#define MY_BAUD_RATE 9600at the start of the sketch.
The 2.1.1 version has
Serial.begin(115200);in the sketch. Just change that.
@Anticimex I am so not familiar with the arduino/mysensors development yet, but I guess I use 2.1.1, since i used "Sketch / Include Library / Manage Library" and it had 2.1.1
@mfalkvidd Since I have the line Serial.begin(115200) I assume it is 2.1.1, but changing it to 9600 and uploading the sketch does nothing. I still need to open serial window with 115200, else I just see garbage as output from the mini pro.
I will try the development version and see if that helps.
-
@Anticimex I am so not familiar with the arduino/mysensors development yet, but I guess I use 2.1.1, since i used "Sketch / Include Library / Manage Library" and it had 2.1.1
@mfalkvidd Since I have the line Serial.begin(115200) I assume it is 2.1.1, but changing it to 9600 and uploading the sketch does nothing. I still need to open serial window with 115200, else I just see garbage as output from the mini pro.
I will try the development version and see if that helps.
-
@Magnus-Pernemark or you can just disable the confirmation altogether. Just define SKIP_UART_CONFIRMATION
@Anticimex hehe, true... but I am a developer by trade, and bypassing something just because it would be easier, feels so wrong. I might end up doing so, but I'll give it some more tries first. Problems are a very good way to learn, and in arduino development I am a total noobie, more used to C# and the .NET world.
-
@Anticimex hehe, true... but I am a developer by trade, and bypassing something just because it would be easier, feels so wrong. I might end up doing so, but I'll give it some more tries first. Problems are a very good way to learn, and in arduino development I am a total noobie, more used to C# and the .NET world.
-
@Magnus-Pernemark as a developer by trade, you should be bold enough to use the beta releases and live on the bleeding edge then ;)
@Anticimex I'll start living on the edge immediately. It's the way to go!
I switched to develop and could change the band rate, however develop version skips UART confirmation by default so I never had the problem there. Never needed to send any keys. Got the chip configured atleast.
I kind of started in the wrong end - designed my own pcbs, then start to know the development environment.
But I'll figure it out... just takes time.. thanks for the help!! -
@Anticimex I'll start living on the edge immediately. It's the way to go!
I switched to develop and could change the band rate, however develop version skips UART confirmation by default so I never had the problem there. Never needed to send any keys. Got the chip configured atleast.
I kind of started in the wrong end - designed my own pcbs, then start to know the development environment.
But I'll figure it out... just takes time.. thanks for the help!!@Magnus-Pernemark that's correct. Or, it is correct if you follow the "guided mode". If you wanna be hardcore, you drop the guided defines and set the individual flags according to your specific needs, and then you get to enable (or more precisely, not disable) UART confirmation (in case you want to test it).
-
Hi!
Starting to learn signing. I use a parallell system (with another channel) where I could test signing before I went on my live system. For now I just use soft signing, it works perfect!Now, I just want to test a node (motionsensor) that include:
#define MY_SIGNING_REQUEST_SIGNATURESThe gateway has no signing feature (it has not gone thru personalition process) In my head, the node shall reject to connect to this gateway, but after the signing fails, it start to send data to the gateway. Did I miss something here?
Debug text on node:
0 MCO:BGN:INIT NODE,CP=RNNNAS--,VER=2.2.0-beta 49 SGN:PER:OK 83 SGN:INI:BND OK 83 TSM:INIT 86 TSF:WUR:MS=0 94 TSM:INIT:TSP OK 96 TSM:INIT:STATID=101 98 TSF:SID:OK,ID=101 100 TSM:FPAR 102 SGN:SGN:NREQ=255 139 TSF:MSG:SEND,101-101-255-255,s=255,c=3,t=7,pt=0,l=0,sg=0,ft=0,st=OK: 684 TSF:MSG:READ,0-0-101,s=255,c=3,t=8,pt=1,l=1,sg=0:0 690 SGN:SKP:MSG CMD=3,TYPE=8 692 TSF:MSG:FPAR OK,ID=0,D=1 2148 TSM:FPAR:OK 2148 TSM:ID 2150 TSM:ID:OK 2152 TSM:UPL 2154 SGN:SGN:NREQ=0 2158 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=24,pt=1,l=1,sg=0,ft=0,st=OK:1 2168 TSF:MSG:READ,0-0-101,s=255,c=3,t=25,pt=1,l=1,sg=0:1 2174 SGN:SKP:MSG CMD=3,TYPE=25 2177 TSF:MSG:PONG RECV,HP=1 2181 TSM:UPL:OK 2183 TSM:READY:ID=101,PAR=0,DIS=1 2187 SGN:PRE:SGN REQ 2189 SGN:PRE:WHI NREQ 2191 SGN:SGN:NREQ=0 2195 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=15,pt=6,l=2,sg=0,ft=0,st=OK:0101 2203 SGN:PRE:XMT,TO=0 2205 SGN:PRE:WAIT GW 2207 TSF:MSG:READ,0-0-101,s=255,c=3,t=15,pt=6,l=2,sg=0:0100 2213 SGN:SKP:MSG CMD=3,TYPE=15 2217 SGN:SGN:NREQ=0 2222 TSF:MSG:SEND,101-101-0-0,s=255,c=0,t=17,pt=0,l=10,sg=0,ft=0,st=OK:2.2.0-beta 2232 SGN:SGN:NREQ=0 2234 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=6,pt=1,l=1,sg=0,ft=0,st=OK:0 2248 TSF:MSG:READ,0-0-101,s=255,c=3,t=6,pt=0,l=1,sg=0:M 2254 !SGN:VER:NSG 2256 !TSF:MSG:SIGN VERIFY FAIL 2258 SGN:SGN:NREQ=0 2263 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=11,pt=0,l=13,sg=0,ft=0,st=OK:Motion Sensor 2273 SGN:SGN:NREQ=0 2277 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=12,pt=0,l=3,sg=0,ft=0,st=OK:1.0 2285 SGN:SGN:NREQ=0 2289 TSF:MSG:SEND,101-101-0-0,s=1,c=0,t=1,pt=0,l=0,sg=0,ft=0,st=OK: 2295 MCO:REG:REQ 2297 SGN:SGN:NREQ=0 2301 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=26,pt=1,l=1,sg=0,ft=0,st=OK:2 2310 TSF:MSG:READ,0-0-101,s=255,c=3,t=27,pt=1,l=1,sg=0:1 2316 !SGN:VER:NSG 2318 !TSF:MSG:SIGN VERIFY FAIL 2322 MCO:BGN:STP 2324 MCO:BGN:INIT OK,TSP=1 1 2326 SGN:SGN:NREQ=0 2330 TSF:MSG:SEND,101-101-0-0,s=1,c=1,t=16,pt=0,l=1,sg=0,ft=0,st=OK:1 2338 MCO:SLP:MS=120000,SMS=0,I1=1,M1=1,I2=255,M2=255 2344 TSF:TDI:TSL 2347 MCO:SLP:WUP=1 2349 TSF:TRI:TSB 0 2351 SGN:SGN:NREQ=0 2355 TSF:MSG:SEND,101-101-0-0,s=1,c=1,t=16,pt=0,l=1,sg=0,ft=0,st=OK:0 2363 MCO:SLP:MS=120000,SMS=0,I1=1,M1=1,I2=255,M2=255 2367 TSF:TDI:TSL -
Hi!
Starting to learn signing. I use a parallell system (with another channel) where I could test signing before I went on my live system. For now I just use soft signing, it works perfect!Now, I just want to test a node (motionsensor) that include:
#define MY_SIGNING_REQUEST_SIGNATURESThe gateway has no signing feature (it has not gone thru personalition process) In my head, the node shall reject to connect to this gateway, but after the signing fails, it start to send data to the gateway. Did I miss something here?
Debug text on node:
0 MCO:BGN:INIT NODE,CP=RNNNAS--,VER=2.2.0-beta 49 SGN:PER:OK 83 SGN:INI:BND OK 83 TSM:INIT 86 TSF:WUR:MS=0 94 TSM:INIT:TSP OK 96 TSM:INIT:STATID=101 98 TSF:SID:OK,ID=101 100 TSM:FPAR 102 SGN:SGN:NREQ=255 139 TSF:MSG:SEND,101-101-255-255,s=255,c=3,t=7,pt=0,l=0,sg=0,ft=0,st=OK: 684 TSF:MSG:READ,0-0-101,s=255,c=3,t=8,pt=1,l=1,sg=0:0 690 SGN:SKP:MSG CMD=3,TYPE=8 692 TSF:MSG:FPAR OK,ID=0,D=1 2148 TSM:FPAR:OK 2148 TSM:ID 2150 TSM:ID:OK 2152 TSM:UPL 2154 SGN:SGN:NREQ=0 2158 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=24,pt=1,l=1,sg=0,ft=0,st=OK:1 2168 TSF:MSG:READ,0-0-101,s=255,c=3,t=25,pt=1,l=1,sg=0:1 2174 SGN:SKP:MSG CMD=3,TYPE=25 2177 TSF:MSG:PONG RECV,HP=1 2181 TSM:UPL:OK 2183 TSM:READY:ID=101,PAR=0,DIS=1 2187 SGN:PRE:SGN REQ 2189 SGN:PRE:WHI NREQ 2191 SGN:SGN:NREQ=0 2195 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=15,pt=6,l=2,sg=0,ft=0,st=OK:0101 2203 SGN:PRE:XMT,TO=0 2205 SGN:PRE:WAIT GW 2207 TSF:MSG:READ,0-0-101,s=255,c=3,t=15,pt=6,l=2,sg=0:0100 2213 SGN:SKP:MSG CMD=3,TYPE=15 2217 SGN:SGN:NREQ=0 2222 TSF:MSG:SEND,101-101-0-0,s=255,c=0,t=17,pt=0,l=10,sg=0,ft=0,st=OK:2.2.0-beta 2232 SGN:SGN:NREQ=0 2234 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=6,pt=1,l=1,sg=0,ft=0,st=OK:0 2248 TSF:MSG:READ,0-0-101,s=255,c=3,t=6,pt=0,l=1,sg=0:M 2254 !SGN:VER:NSG 2256 !TSF:MSG:SIGN VERIFY FAIL 2258 SGN:SGN:NREQ=0 2263 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=11,pt=0,l=13,sg=0,ft=0,st=OK:Motion Sensor 2273 SGN:SGN:NREQ=0 2277 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=12,pt=0,l=3,sg=0,ft=0,st=OK:1.0 2285 SGN:SGN:NREQ=0 2289 TSF:MSG:SEND,101-101-0-0,s=1,c=0,t=1,pt=0,l=0,sg=0,ft=0,st=OK: 2295 MCO:REG:REQ 2297 SGN:SGN:NREQ=0 2301 TSF:MSG:SEND,101-101-0-0,s=255,c=3,t=26,pt=1,l=1,sg=0,ft=0,st=OK:2 2310 TSF:MSG:READ,0-0-101,s=255,c=3,t=27,pt=1,l=1,sg=0:1 2316 !SGN:VER:NSG 2318 !TSF:MSG:SIGN VERIFY FAIL 2322 MCO:BGN:STP 2324 MCO:BGN:INIT OK,TSP=1 1 2326 SGN:SGN:NREQ=0 2330 TSF:MSG:SEND,101-101-0-0,s=1,c=1,t=16,pt=0,l=1,sg=0,ft=0,st=OK:1 2338 MCO:SLP:MS=120000,SMS=0,I1=1,M1=1,I2=255,M2=255 2344 TSF:TDI:TSL 2347 MCO:SLP:WUP=1 2349 TSF:TRI:TSB 0 2351 SGN:SGN:NREQ=0 2355 TSF:MSG:SEND,101-101-0-0,s=1,c=1,t=16,pt=0,l=1,sg=0,ft=0,st=OK:0 2363 MCO:SLP:MS=120000,SMS=0,I1=1,M1=1,I2=255,M2=255 2367 TSF:TDI:TSL@gus what is it that you think is not working? Just because your node require signatures does not prevent the node from sending data to your gateway which does not require signatures.
And as you can see in the log you get errors about missing signatures (and hence failed verifications) so it looks as expected to me.
You could try to paste your log into the log parser to get a easier to read output.Do you feel secure today? No? Start requiring some signatures and feel better tomorrow ;)
