* Test commit for XEdDSA support
* Update to Crypto lib in Meshtatic org
* Generate a new node identity on key generation (#7628)
* Generate a new node identity on key generation
* Fixes
* Fixes
* Fixes
* Messed up
* Fixes
* Update src/modules/AdminModule.cpp
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update src/mesh/NodeDB.cpp
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Figured it out!
* Cleanup
* Update src/mesh/NodeDB.h
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update src/mesh/NodeDB.cpp
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update src/modules/AdminModule.cpp
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update crypto commit hash
* Some fixes for xeddsa pr (#9610)
* fix: add null check for getMeshNode() in NodeInfoModule
getMeshNode() can return nullptr for unknown nodes. Dereferencing
without a check crashes the firmware when receiving NodeInfo from
a node not yet in the database.
* fix: enforce XEdDSA signature verification and prevent stripping
Previously, failed signature verification still allowed the packet
through, making signatures purely cosmetic. Now:
- Failed verification drops the packet (DECODE_FAILURE)
- Successfully verified nodes get HAS_XEDDSA_SIGNED bitfield set
- Unsigned packets from previously-signing nodes are rejected
- Log levels reduced from WARN/ERROR to DEBUG/WARN as appropriate
* fix: include packet metadata in XEdDSA signature
The signature now covers [fromNode | packetId | portnum | payload]
instead of just the payload bytes. This prevents:
- Replay attacks (different packetId fails verification)
- Reattribution (different fromNode fails verification)
- Portnum redirection (different portnum fails verification)
Also adds a key initialization check to xeddsa_sign (returns false
if XEdDSA keys are all zeros) and checks the return value in the
encode path.
* fix: handle existing key pair in AdminModule security config
When a user provides both a valid private key and public key via
admin config, the crypto engine's DH private key and owner public
key were never loaded. DMs and XEdDSA signing would silently break.
Add an else branch to load both keys into the crypto engine.
* perf: cache Ed25519 public key conversion in xeddsa_verify
curve_to_ed_pub() performs field element parsing, inversion, and
multiplication on every call. Since packets from the same node
tend to arrive in bursts, a single-entry cache avoids repeating
this expensive conversion for consecutive packets from one sender.
* fix: skip identity cleanup when node number is unchanged
createNewIdentity() was called on every generateCryptoKeyPair(),
including normal boots where the same key is regenerated. This
caused unnecessary NodeDB writes and old-node cleanup logic to
run when the node number hadn't actually changed.
Also fixes only zeroing byte[0] of the old node's public key
instead of clearing the entire array.
* fix: replace hardcoded 120 with derived XEDDSA_SIGNATURE_SIZE constant
The payload size check for XEdDSA signing used a magic number (120).
Replace with a derivation from DATA_PAYLOAD_LEN and XEDDSA_SIGNATURE_SIZE
so the limit adjusts automatically if constants change. This also
increases the max signable payload from 120 to 169 bytes, which is
still safe since the actual encoded size is checked after pb_encode.
* fix: add const qualifiers to XEdDSA verify and curve_to_ed_pub inputs
pubKey, payload, and signature parameters in xeddsa_verify are
input-only and should not be modified. Same for curve_pubkey in
curve_to_ed_pub.
* chore: remove commented-out old Crypto dependency in portduino.ini
* Leave out the admin module change for now
---------
Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz>
* trunk
* protobuf re-update
* Protobufs
* Merge resolution fix
* Put XEDDSA on the right bit
* NodeDB update to new nodeInfoLite accessors, etc
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Refine unsigned packet rejection logic in Router (#10534)
* use hardware random to fill the first 32 signature bytes with entropy prior to signing.
* Add XEdDSA packet-signing policy tests and update dependencies for macos
* Minor fixes
* integrate XEdDSA support and update dependencies across multiple modules
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Wessel <github@weebl.me>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com>
* Delete unused code
CryptoEngine::clearKeys() is not used in the code base, therefore this
cleanup removes the code. It might give casual reviewers the impression,
that keys are wiped.
Since the code uses memset() which might be optimized away by the
compiler, using the code might not even cause the memory
to be wiped.
* Update CryptoEngine.cpp
Fix stray newline, this is the only thing that I can come up with that might confuse the linter.
---------
Co-authored-by: Jason P <applewiz@mac.com>
I thought git would be smart enough to understand all the whitespace changes but even with all the flags I know to make it ignore theses it still blows up if there are identical changes on both sides.
I have a solution but it require creating a new commit at the merge base for each conflicting PR and merging it into develop.
I don't think blowing up all PRs is worth for now, maybe if we can coordinate this for V3 let's say.
This reverts commit 0d11331d18.
you're leaking the nonce to stdout, if your logs are routed to a folder, this logs the nonce every time, leading to replay attack surface area being higher. Changed to debug.
* Remove unnecessary memcpy for PKI crypto
* Update comment s/packet_id/id/
* Create a copy of bytes for each channel decrypt
---------
Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz>
remove newline from logging statements in code. The LOG_* functions will now magically add it at the end.
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
* * Adding the -Wcast-align compilation flag for
the rp2040.
* * Some rework to use a struct to access radio data
* Buffer will not be accessed by arithmetic pointer anymore
* * Remplace arithmetic pointer to avoid Warning
* * Avoid 2 little artitmetic pointer
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
* Replace multiple potentially non aligned pointer dereference (#4855)
First step to fix some Crypto crashes or strange behaviors
* Makes the two Crypto byte buffers aligned (#4855)
Fix#4855, and probably multiple Crypto problems depending on hardware
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
Co-authored-by: GUVWAF <78759985+GUVWAF@users.noreply.github.com>
* Re-implement PKI from #1509
co-authored-by: edinnen <ethanjdinnen@protonmail.com>
* Set the key lengnth to actually make PKI work.
* Remove unused variable and initialize keys to null
* move printBytes() to meshUtils
* Don't reset PKI key son reboot unless needed.
* Remove double encryption for PKI messages
* Cleanup encrypt logic
* Add the MESHTASTIC_EXCLUDE_PKI option, and set it for minimal builds. Required for STM32 targets for now.
* Use SHA-256 for PKI key hashing, and add MESHTASTIC_EXCLUDE_PKI_KEYGEN for STM32
* Fix a crash when node is null
* Don't send PKI encrypted packets while licensed
* use chIndex 8 for PKI
* Don't be so clever, that you corrupt incoming packets
* Pass on channel 8 for now
* Typo
* Lock keys once non-zero
* We in fact need 2 scratch buffers, to store the encrypted bytes, unencrypted bytes, and decoded protobuf.
* Lighter approach to retaining known key
* Attach the public key to PKI decrypted packets in device memory
* Turn PKI back off for STM32 :(
* Don't just memcp over a protobuf
* Don't PKI encrypt nodeinfo packets
* Add a bit more memory logging around nodeDB
* Use the proper macro to refer to NODENUM_BROADCAST
* Typo fix
* Don't PKI encrypt ROUTING (naks and acks)
* Adds SecurityConfig protobuf
* Add admin messages over PKI
* Disable PKI for the WIO-e5
* Add MINIMUM_SAFE_FREE_HEAP macro and set to safe 1.5k
* Add missed "has_security"
* Add the admin_channel_enabled option
* STM32 again
* add missed configuration.h at the top of files
* Add EXCLUDE_TZ and RTC
* Enable PKI build on STM32 once again
* Attempt 1 at moving PKI to aes-ccm
* Fix buffers for encrypt/decrypt
* Eliminate unused aes variable
* Add debugging lines
* Set hash to 0 for PKI
* Fix debug lines so they don't print pointers.
* logic fix and more debug
* Rather important typo
* Check for short packets before attempting decrypt
* Don't forget to give cryptoEngine the keys!
* Use the right scratch buffer
* Cleanup
* moar cleanups
* Minor hardening
* Remove some in-progress stuff
* Turn PKI back off on STM32
* Return false
* 2.5 protos
* Sync up protos
* Add initial cryptography test vector tests
* re-add MINIMUM_SAFE_FREE_HEAP
* Housekeeping and comment fixes
* Add explanatory comment about weak dh25519 keys
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
JorropoandGitHub
Tom FifieldandGitHub
lizthedeveloperandGitHub
Sacha Weatherstone
Kevin Hester