💬 Security & Signing

[sineverba]

@pepson You use RFM69(H/W/HW). So I. My hint is remain with 2.2.0. I got so many issues with 2.3.0 and RFM that I reverted to 2.2.0 in 1 minute.

HMAC is not LAN MAC, is HMAC got from MYsensors gateway. Same for other 2 keyes.

I think that in long explain on my guide you have all info to get your keyes. I follow my same guide everytime I need to reinstall mysensors / domoticz / an entire PI. It is fully tested :)

[pepson]

@sineverba
Hi
Yes i use radio RFM69HW. I also on 2.3.0 have big problem... and back to 2.2.0. What you have problem on 2.3.0 with radio RFM69 ?

I read all your guide and it is ok. But i dont know what i must put in place:
#define MY_SIGNING_NODE_WHITELISTING {{.nodeId = GATEWAY_ADDRESS,.serial = {0Xaa,0Xbb,0Xcc,0XF9,0X82,0XB2,0X50,0XF2,0XAB}}} // got from gateway setup

Put serial from this:
sudo mysgw --gen-soft-serial-key

We will get:

SOFT_SERIAL | 7850987FA6601F6538

The next line is intended to be used in SecurityPersonalizer.ino:
#define MY_SOFT_SERIAL 0X78,0X50,0X98,0X7F,0XA6,0X60,0X1F,0X65,0X38

To use this key, run mysgw with:
--set-soft-serial-key=7850987FA6601F6538

And i must put my keys to mysensors.conf when i use version 2.2.0 ? Or only when use 2.3.0 ?

Software signing settings
Note: The gateway must have been built with signing
support to use the options below.
To generate a HMAC key run mysgw with: --gen-soft-hmac-key
copy the new key in the line below and uncomment it.
#soft_hmac_key=

To generate a serial key run mysgw with: --gen-soft-serial-key
copy the new key in the line below and uncomment it.
#soft_serial_key=

Encryption settings
Note: The gateway must have been built with encryption
support to use the options below.
To generate a AES key run mysgw with: --gen-aes-key
copy the new key in the line below and uncomment it.
#aes_key=

or only send command

sudo mysgw --set-soft-serial-key=7850987FA6601F6538 && sudo mysgw --set-aes-key=768859210B4A75FACC78B757ADAFE75B && sudo mysgw --set-soft-hmac-key=0298FF121DD3194BCC33DC8185055B9D981EBE0A90D847A4777A9E65CCE4F524 ?

[sineverba]

@pepson

Too many ack lost and slow communication. And other that I don't remember.

That line on the sketches means that you need add on the node that you want whitelist the serial of gateway.

You got serial gateway on the steps for 2.2.0.

You have it.

You don't need to put anything in no file with 2.2.0. In my guide is NOT mentioned. In my guide, at the bottom, there is the final "set keyes" with only a line OR you can set them everytime you get them.

Please, take your time to read 1, 2, 3 times before type anything. I think it is very clear, and every step is write down for you.

;) Enjoy :)

PS Don't offend, I want help you, 'cause I used a bit of times before getting security working. And I used so many time write down a guide. But you need to read and follow carefully

[pepson]

@sineverba I also have the same problem with communication. But tell me you send issue to developer ? I send but nothing done.

Ok in point 4 in your guide in sketch for node i must put serial key from gateway ? Yes ?

And tell me how remove setup serial, HMAC and AES when i dont want to use it ? How remove it from gateway ?
Thanks

[pepson]

Any help ?

[sineverba]

@pepson no need to remove. Simply, in your sketches, don't use signing at all.

[pepson]

@sineverba said in 💬 Security & Signing:

no need to remove. Simply, in your sketches, don't use signing at all.

ok but if on gateway it was generate and setup keys and when in skethces i dont use keys will nody connect? and what the purpose of the signature is then ?
I thought that if the gate has a set of keys and will try to connect noda without a key that it will not connect ....

[sineverba]

@pepson you can use a special flag define to "downgrade/reduce" security MY_WEAK_SECURITY

[pepson]

@sineverba

Ok summary
When i have setup on Raspberry Gateway , generate keys.

When i write in node all keys with sketches.... Node connect ok.

But when write to node only sketches without keys.,... node connect to gateway or not connect to gateway ?

[sineverba]

@pepson you need to setup gateway with weak security.

You need generate keyes and set in gateway.

You need to personalize nodes with the sketch and set keyes on Arduino EEPROM.

From now, you have two ways: Your node need security? Set use security bla-bla on top with other define(s).

Don't Need security? Don't define use security.

Simpler than ever.

[Anticimex]

@pepson if you find the security setup to be too complicated, I highly recommend sticking with the simple password flags. The documentation has it all.

[pepson]

@sineverba said in 💬 Security & Signing:

setup gateway with weak security.

But when configure my gateway without flag setup gateway with weak security i can only use nodes with setup in sketches keys. yes ?

[pepson]

@anticimex

Can you share me this document when is describe how define only pass ? I want also read this.

[sineverba]

@pepson

Let's summarize. Last time.

1. compile gateway with weak security (make your research, also in my github guide, there is ;) )
2. create the 3 keyes for gateway
3. set the 3 keyes for gateway.
4. clean your EEPROM arduinos with the sketch present in my guide and in examples of library
5. set the keyes in EEPROM arduinos.

Stop. End. Fin. Fine. These steps are MANDATARY. You NEED to do.

You will have in EEPROM the keyes (arduino) and in gateway.

From now, you select:

a) Do I need security? Perfect, in sketch arduino add #define bla bla bla on top with security and other stuff.
b) Do I NOT need security? Perfect, in sketch arduino DON'T ADD #define bla bla related to security.

[sineverba]

@pepson And, last all, you can use the mysensors debug options. Try. Try. Try! This is the best option offered to you to learn. Try!
At max, nothing works ;)

[pepson]

@sineverba
ok all is very good.

But what give me this if i can connect nodes also with defines bla bla bla in skethc and also without define bla bla bla in sketch?
But Do I think right ? In each of these accidents in the eeprom I need to have the keys loaded?

[sineverba]

@pepson only one word. Try. Really, you are lost in 1 cm of water. Try. And if it doesn't work, open your topic, showing exactly your sketches and what have you done.

[pepson]

ok thanks

[pepson]

Ok i build my gateway on RPI on MySensors 2.2.0 with this configuration:

./configure --my-transport=rfm69 --my-rfm69-frequency=868 --my-is-rfm69hw --my-gateway=ethernet --my-port=5003 --my-signing=software --my-signing-request-signatures

Then generate 3 key and setup it on gateway.

Then clear_epprom on Arduino MIni Pro, and then send sketch security with add serial, HMAC, and AES. Then put sketch with add this on top sketch with my SERIAL generated on gateway RPI.

#define MY_SIGNING_SOFT
#define MY_SIGNING_SOFT_RANDOMSEED_PIN 7
#define MY_SIGNING_REQUEST_SIGNATURES
#define MY_SIGNING_NODE_WHITELISTING {{.nodeId = GATEWAY_ADDRESS,.serial = {0X2C,0X61,0X17,0X2E,0XEE,0XDD,0XCC,0XBB,0XAA}}} // got from gateway setup

After that i run HA and he not found my nodes...
WHat is wrondg ?

[Anticimex]

@pepson well for starters, don't start out with whitelisting unless you know exactly what you are doing. First you have to verify that your network is stable enough to handle the security protocol. The simplest option is to only enable encryption, or use the simple password flag options. Once you have established that your gw and nodes are capable of communicating securely you can move on to personalization and whitelisting.