[security] Introducing signing support to MySensors

[Anticimex]

@Proyectos-Integrasoft another thing you did not mention is if you have personalized your nodes? Signing require personalization to store certain data. Please read the documentation (linked on the top of this thread).

[Proyectos Integrasoft]

@Anticimex Thnks!

As you can see in the sketch, I'm using a Nrf24L01 module for the node and for the gateway. They are connected to their designed boards (Node and Gateway) respectively. The power, for now, I am doing through the Ftdi232 that I use to connect it to the PC to do debugging. Before adding the signature to the sketch, they were working perfect. What do you suggest doing then?

Also, I have read about the customization of the nodes, but I feel honest I have not managed to understand how to do it ... Could you explain me easily how to personalize it? Truthfully, I have not been able to use the guide.

Thanks for answering me! : D

[Anticimex]

@Proyectos-Integrasoft then please let me know what parts are unclear. I try to make it as easy to follow as possible. You can also read the beta documentation but be aware that personalization has been rewritten on the beta track. I have provided a step by step instruction for personalization in the signing module in the documentation. It should give you all information needed.
Regarding powering, have you followed the guides available here in the forum for powering the radio? NACKs is not a signing problem. It is a radio problem.

[Proyectos Integrasoft]

@Anticimex What I understand is the following:

1. I must choose the backend that I am going to use. (In my case, I'll use the software firm)
2. Then I must choose a free pin to establish a random seed for the pseudorandom generator. (In my case I chose pin A3 that is completely free on the plate).
3. Then I request that all the messages that enter the node will be signed. (I do this using MY_SIGNING_REQUEST_SIGNATURES on the gateway and on the node)
4. finally says that if I am not going to use MY_SIGNING_SIMPLE_PASSWD, I need to customize the node. This is where I get confused ...

First of all, ask me to enable GENERATE_KEYS_SOFT, saying that this will provide random keys for HMAC and AES, and that I should copy and replace them in the corresponding definitions in "User-defined key data". What do you mean by "user-defined key data"? When I enable this, in the LOG of my node nothing strange comes out, the same thing I posted previously.

Second, you tell me to disable the key generator by software and enable the PERSONALIZE_SOFT ... And that this will keep the keys in the EEPROM ... When you talk about enabling and disabling you mean that I must burn the sketch first with Generate_Keys_Soft and then burn again but now with the hmac and aes keys that were generated, while enabling the Personalize_Soft?

This is what I do not understand. I do not get the keys with the GENERATE_KEYS_SOFT ... And I do not clearly understand what I should do next.

You apologize for my lack of knowledge or understanding. And I thank you for your help.

[Proyectos Integrasoft]

@Anticimex And as for the radio. I followed the connection guide that comes out at https://www.mysensors.org/build/serial_gateway, even watching the video. I do not know if you mean another guide? If so, could you give me the link? Thank you for your collaboration.

[Anticimex]

@Proyectos-Integrasoft I assume you use an official release first of all. That personalization is more complicated than the one used on beta/development branch.
Then you are first expected to generate the keys (like you say). These keys are printed on the serial console. You then copy those into the personalizer sketch and reconfigure the personalizer to store the keys you have set. And then you run the personalizer to use those keys.
You can of course skip the generation step and set the hmac key manually using the personalizer. The only requirement is the size of the key (32 bytes) and that it is identical on all nodes.

[Proyectos Integrasoft]

@Anticimex
Could you please give me the link of the last official release? to verify that is the one that I have. When you say "copy" the keys in the sketch personalizer, are you referring to PERSONALIZE_SOFT? And what do you mean by configuring the sketch personalizer? Could you additionally tell me how it would be done manually? (example of sketch)

[Anticimex]

@Proyectos-Integrasoft I am not sure where to start. I assume you are familiar with c code? The signing solution available in the latest official release (which you find on github, I believe is 2.1.1) require at least fundamental understanding of how to adjust sketch code.
The documentation gives the exact lines to change.
There is, like I said, a step by step guide, and if you follow it you should end up with a properly personalized device. In this case, that is of less importance since you currently do not have a stable enough radio link to use security since you get NACKs for full size payloads (so neither signing nor encryption will work).
So you will have to make that work and get rid of the NACKs, before we should start worrying about personalization.
And like I said before, that is not a signing related issue. You will get the same problem if you try to send full size payloads of any kind. Just try to disable signing and send full size payloads.

[Proyectos Integrasoft]

@Anticimex
Okay, so I'll start by tackling things step by step ... How can I avoid getting NACKs in my log?

[Anticimex]

@Proyectos-Integrasoft as I said; ensuring good decoupling, a stable power supply (measure that to confirm). Also, counterfeit RF24 chips are all over the place that perform under par. There are quite a few threads here on this topic. So please post such questions in those, it is somewhat off topic here :)
Also, setting proper power levels can have a huge impact on the performance.

[ahmedadelhosni]

Hi @Anticimex Actually there is something that I can not understand regarding cryptograhpy. I want to know how other products like Fibaro, Smartthings, etc handles the security ?

Here in our library the SW is not a good idea, why ? I thought beacuse someone can dump the memory .. but is it that easy ? Can't we lock the code and memory ? Also in the hardware ATSHA solution, someone can easily take the chip and intercept our network and sniff it or even send commands as it is explained in the documentation and that's why we don't use security for public nodes as it usualy reports states. But can't we lock the chip ? and by some way only the atmega can communicate with it to get the key by some way ?

I read online that some people are using private and public keys .. if this is the case, then the private key is offcourse saved in the memory. How do they handle this problem ?

Do they use AES , SHA ? which encyption way ?

Also the nRF52, I tried to read a lot and they use private and public keys i guess.

lots of questions and I am confused but I want to know how do they handle protection for public nodes.

Can you please explain this to me ?

Thanks.

[Anticimex]

@ahmedadelhosni some devices, like the atmega, doss not support locking the memory, so the software based signing is inherently insecure in terms of hw theft.
Atsha204a based signing protection specifically against this because the personalizer locks the chip from readout. It is not possible to extract the hmac key from the atsha204a memory and the key is never transmitted OTA (unless you deploy the personalizer OTA).

[Anticimex]

@ahmedadelhosni and regarding reusing a node/atsha204a for attack purpose, we have whitelisting to protect against that. The serials used for whitelisting are also never send OTA (again, unless you send the personalizer OTA).

[ahmedadelhosni]

@Anticimex

1- So if we have a microcontroller that supports locking the memory then the problem is solved ? I know that SAM is being introduced now, Does it support this ?

2- what is then the purpose of locking the ATSHA if we can't extract the HMAC which we depend on it ?

Thanks.

[Anticimex]

@ahmedadelhosni
We lock the atsha to make sure it can't be readable.
It does not matter that samd supports locking or not. The atmega328p does not. For now, we have a security scheme that supports any target, so we have to have a system that works for all.
For MySensors v3, an entirely new security scheme is under consideration. But it will mean dropping support for the atmga328p as it is not powerful enough.
As for what others do, I suggest you ask them :)
Security can be implemented in many ways. Each with drawbacks and benefits. The one currently in use is a scheme that can work on basically any target with reasonable security and performance. It has drawbacks, yes, but at the time of implementation, these were considered acceptable.
For the future, more sophisticated schemes can be used which are easier to use, arguably more secure but more complex in terms of computational power and protocol. The core team is investigating various solutions.

[ahmedadelhosni]

@Anticimex Sorry but I didn't understand the benefit of locking the ATSHA to be unreadable ? :expressionless:
I know we do not lock it so that we can read the HMAC and use it during verification, but what is the usage of a locked ATSHA ?

[Anticimex]

@ahmedadelhosni what do you mean? All cryptography is performed inside the chip. The hmac key never leaves the chip after it has been programmed and locked. Thats the whole point with the atsha204a.

[ahmedadelhosni]

@Anticimex aha okay I understand a bit now. So we put s special hmac that does all cryptography jobs then it gives us something that is used for transmision?

Looks like i have to read the datasheet also :D

[Anticimex]

@ahmedadelhosni I'd suggest you start by reading the documentation on signing linked at the very top of this post. It explains in detail how the signing security is implemented.

[ahmedadelhosni]

@Anticimex yeah I read it several times before but maybe didnt pay attention to tge technical stuff 😂