Skip to content

Commit cd5c243

Browse files
fallbergfallberg
committed
Handle inbound and outbound nonces simultaneously
Two separate buffers are used for nonce storage. One for the nonce used for signing a message and one for the nonce used for verifying a message.
1 parent a0615b5 commit cd5c243

File tree

2 files changed

+62
-57
lines changed

2 files changed

+62
-57
lines changed

‎libraries/MySensors/core/MySigningAtsha204.cpp

Lines changed: 45 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -33,17 +33,18 @@
3333

3434
unsigned long _signing_timestamp;
3535
bool _signing_verification_ongoing = false;
36-
uint8_t _signing_current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1];
36+
uint8_t _signing_verifying_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1];
37+
uint8_t _signing_signing_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH+SHA204_SERIAL_SZ+1];
3738
uint8_t _signing_temp_message[SHA_MSG_SIZE];
38-
uint8_t _singning_rx_buffer[SHA204_RSP_SIZE_MAX];
39-
uint8_t _singning_tx_buffer[SHA204_CMD_SIZE_MAX];
39+
uint8_t _signing_rx_buffer[SHA204_RSP_SIZE_MAX];
40+
uint8_t _signing_tx_buffer[SHA204_CMD_SIZE_MAX];
4041
extern uint8_t _doWhitelist[32];
4142

4243
#ifdef MY_SIGNING_NODE_WHITELISTING
4344
const whitelist_entry_t _signing_whitelist[] = MY_SIGNING_NODE_WHITELISTING;
4445
#endif
4546

46-
static void signerCalculateSignature(MyMessage &msg);
47+
static void signerCalculateSignature(MyMessage &msg, bool signing);
4748
static uint8_t* signerSha256(const uint8_t* data, size_t sz);
4849

4950

@@ -94,7 +95,8 @@ bool signerAtsha204CheckTimer(void) {
9495
if (hwMillis() < _signing_timestamp || hwMillis() > _signing_timestamp + MY_VERIFICATION_TIMEOUT_MS) {
9596
DEBUG_SIGNING_PRINTBUF(F("Verification timeout"), NULL, 0);
9697
// Purge nonce
97-
memset(_signing_current_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
98+
memset(_signing_signing_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
99+
memset(_signing_verifying_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
98100
_signing_verification_ongoing = false;
99101
return false;
100102
}
@@ -109,22 +111,22 @@ bool signerAtsha204GetNonce(MyMessage &msg) {
109111
// This 32-byte random value is then hashed (SHA256) to produce the resulting nonce
110112
(void)atsha204_wakeup(_signing_temp_message);
111113
if (atsha204_execute(SHA204_RANDOM, RANDOM_SEED_UPDATE, 0, 0, NULL,
112-
RANDOM_COUNT, _singning_tx_buffer, RANDOM_RSP_SIZE, _singning_rx_buffer) != SHA204_SUCCESS) {
114+
RANDOM_COUNT, _signing_tx_buffer, RANDOM_RSP_SIZE, _signing_rx_buffer) != SHA204_SUCCESS) {
113115
DEBUG_SIGNING_PRINTBUF(F("Failed to generate nonce"), NULL, 0);
114116
return false;
115117
}
116118
for (int i = 0; i < 32; i++) {
117-
_signing_current_nonce[i] = _singning_rx_buffer[SHA204_BUFFER_POS_DATA+i] ^ (hwMillis()&0xFF);
119+
_signing_verifying_nonce[i] = _signing_rx_buffer[SHA204_BUFFER_POS_DATA+i] ^ (hwMillis()&0xFF);
118120
}
119-
memcpy(_signing_current_nonce, signerSha256(_signing_current_nonce, 32), MAX_PAYLOAD);
121+
memcpy(_signing_verifying_nonce, signerSha256(_signing_verifying_nonce, 32), MAX_PAYLOAD);
120122

121123
atsha204_idle(); // We just idle the chip now since we expect to use it soon when the signed message arrives
122124

123125
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
124-
memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD);
126+
memset(&_signing_verifying_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_verifying_nonce)-MAX_PAYLOAD);
125127

126128
// Transfer the first part of the nonce to the message
127-
msg.set(_signing_current_nonce, MAX_PAYLOAD);
129+
msg.set(_signing_verifying_nonce, MAX_PAYLOAD);
128130
_signing_verification_ongoing = true;
129131
_signing_timestamp = hwMillis(); // Set timestamp to determine when to purge nonce
130132
// Be a little fancy to handle turnover (prolong the time allowed to timeout after turnover)
@@ -137,9 +139,9 @@ bool signerAtsha204GetNonce(MyMessage &msg) {
137139
void signerAtsha204PutNonce(MyMessage &msg) {
138140
DEBUG_SIGNING_PRINTBUF(F("Signing backend: ATSHA204"), NULL, 0);
139141

140-
memcpy(_signing_current_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
142+
memcpy(_signing_signing_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
141143
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
142-
memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD);
144+
memset(&_signing_signing_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_signing_nonce)-MAX_PAYLOAD);
143145
}
144146

145147
bool signerAtsha204SignMsg(MyMessage &msg) {
@@ -151,25 +153,25 @@ bool signerAtsha204SignMsg(MyMessage &msg) {
151153

152154
// Calculate signature of message
153155
mSetSigned(msg, 1); // make sure signing flag is set before signature is calculated
154-
signerCalculateSignature(msg);
156+
signerCalculateSignature(msg, true);
155157

156158
if (DO_WHITELIST(msg.destination)) {
157159
// Salt the signature with the senders nodeId and the unique serial of the ATSHA device
158-
memcpy(_signing_current_nonce, &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
159-
_signing_current_nonce[32] = msg.sender;
160-
atsha204_getSerialNumber(&_signing_current_nonce[33]);
161-
(void)signerSha256(_signing_current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
160+
memcpy(_signing_signing_nonce, &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
161+
_signing_signing_nonce[32] = msg.sender;
162+
atsha204_getSerialNumber(&_signing_signing_nonce[33]);
163+
(void)signerSha256(_signing_signing_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
162164
DEBUG_SIGNING_PRINTBUF(F("Signature salted with serial"), NULL, 0);
163165
}
164166

165167
// Put device back to sleep
166168
atsha204_sleep();
167169

168170
// Overwrite the first byte in the signature with the signing identifier
169-
_singning_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
171+
_signing_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
170172

171173
// Transfer as much signature data as the remaining space in the message permits
172-
memcpy(&msg.data[mGetLength(msg)], &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
174+
memcpy(&msg.data[mGetLength(msg)], &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
173175
DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg));
174176

175177
return true;
@@ -193,18 +195,18 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) {
193195
}
194196

195197
DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg));
196-
signerCalculateSignature(msg); // Get signature of message
198+
signerCalculateSignature(msg, false); // Get signature of message
197199

198200
#ifdef MY_SIGNING_NODE_WHITELISTING
199201
// Look up the senders nodeId in our whitelist and salt the signature with that data
200202
size_t j;
201203
for (j=0; j < NUM_OF(_signing_whitelist); j++) {
202204
if (_signing_whitelist[j].nodeId == msg.sender) {
203205
DEBUG_SIGNING_PRINTBUF(F("Sender found in whitelist"), NULL, 0);
204-
memcpy(_signing_current_nonce, &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
205-
_signing_current_nonce[32] = msg.sender;
206-
memcpy(&_signing_current_nonce[33], _signing_whitelist[j].serial, SHA204_SERIAL_SZ);
207-
(void)signerSha256(_signing_current_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
206+
memcpy(_signing_verifying_nonce, &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32); // We can reuse the nonce buffer now since it is no longer needed
207+
_signing_verifying_nonce[32] = msg.sender;
208+
memcpy(&_signing_verifying_nonce[33], _signing_whitelist[j].serial, SHA204_SERIAL_SZ);
209+
(void)signerSha256(_signing_verifying_nonce, 32+1+SHA204_SERIAL_SZ); // we can 'void' sha256 because the hash is already put in the correct place
208210
break;
209211
}
210212
}
@@ -220,11 +222,11 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) {
220222
atsha204_sleep();
221223

222224
// Overwrite the first byte in the signature with the signing identifier
223-
_singning_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
225+
_signing_rx_buffer[SHA204_BUFFER_POS_DATA] = SIGNING_IDENTIFIER;
224226

225227
// Compare the caluclated signature with the provided signature
226-
if (signerMemcmp(&msg.data[mGetLength(msg)], &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) {
227-
DEBUG_SIGNING_PRINTBUF(F("Signature bad: "), &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
228+
if (signerMemcmp(&msg.data[mGetLength(msg)], &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg))) {
229+
DEBUG_SIGNING_PRINTBUF(F("Signature bad: "), &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], MAX_PAYLOAD-mGetLength(msg));
228230
#ifdef MY_SIGNING_NODE_WHITELISTING
229231
DEBUG_SIGNING_PRINTBUF(F("Is the sender whitelisted and serial correct?"), NULL, 0);
230232
#endif
@@ -236,42 +238,43 @@ bool signerAtsha204VerifyMsg(MyMessage &msg) {
236238
}
237239
}
238240

239-
// Helper to calculate signature of msg (returned in _singning_rx_buffer[SHA204_BUFFER_POS_DATA])
240-
static void signerCalculateSignature(MyMessage &msg) {
241+
// Helper to calculate signature of msg (returned in _signing_rx_buffer[SHA204_BUFFER_POS_DATA])
242+
static void signerCalculateSignature(MyMessage &msg, bool signing) {
241243
(void)atsha204_wakeup(_signing_temp_message);
242244
memset(_signing_temp_message, 0, 32);
243245
memcpy(_signing_temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
244246

245247
// Program the data to sign into the ATSHA204
246248
DEBUG_SIGNING_PRINTBUF(F("Message to process: "), (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
247-
DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), _signing_current_nonce, 32);
249+
DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), signing ? _signing_signing_nonce : _signing_verifying_nonce, 32);
248250
(void)atsha204_execute(SHA204_WRITE, SHA204_ZONE_DATA | SHA204_ZONE_COUNT_FLAG, 8 << 3, 32, _signing_temp_message,
249-
WRITE_COUNT_LONG, _singning_tx_buffer, WRITE_RSP_SIZE, _singning_rx_buffer);
251+
WRITE_COUNT_LONG, _signing_tx_buffer, WRITE_RSP_SIZE, _signing_rx_buffer);
250252

251253
// Program the nonce to use for the signature (has to be done just before GENDIG due to chip limitations)
252-
(void)atsha204_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH, _signing_current_nonce,
253-
NONCE_COUNT_LONG, _singning_tx_buffer, NONCE_RSP_SIZE_SHORT, _singning_rx_buffer);
254+
(void)atsha204_execute(SHA204_NONCE, NONCE_MODE_PASSTHROUGH, 0, NONCE_NUMIN_SIZE_PASSTHROUGH,
255+
signing ? _signing_signing_nonce : _signing_verifying_nonce,
256+
NONCE_COUNT_LONG, _signing_tx_buffer, NONCE_RSP_SIZE_SHORT, _signing_rx_buffer);
254257

255258
// Purge nonce when used
256-
memset(_signing_current_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
259+
memset(signing ? _signing_signing_nonce : _signing_verifying_nonce, 0x00, NONCE_NUMIN_SIZE_PASSTHROUGH);
257260

258261
// Generate digest of data and nonce
259262
(void)atsha204_execute(SHA204_GENDIG, GENDIG_ZONE_DATA, 8, 0, NULL,
260-
GENDIG_COUNT_DATA, _singning_tx_buffer, GENDIG_RSP_SIZE, _singning_rx_buffer);
263+
GENDIG_COUNT_DATA, _signing_tx_buffer, GENDIG_RSP_SIZE, _signing_rx_buffer);
261264

262265
// Calculate HMAC of message+nonce digest and secret key
263266
(void)atsha204_execute(SHA204_HMAC, HMAC_MODE_SOURCE_FLAG_MATCH, 0, 0, NULL,
264-
HMAC_COUNT, _singning_tx_buffer, HMAC_RSP_SIZE, _singning_rx_buffer);
267+
HMAC_COUNT, _signing_tx_buffer, HMAC_RSP_SIZE, _signing_rx_buffer);
265268

266-
DEBUG_SIGNING_PRINTBUF(F("HMAC: "), &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32);
269+
DEBUG_SIGNING_PRINTBUF(F("HMAC: "), &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32);
267270
}
268271

269272
// Helper to calculate a generic SHA256 digest of provided buffer (only supports one block)
270-
// The pointer to the hash is returned, but the hash is also stored in _singning_rx_buffer[SHA204_BUFFER_POS_DATA])
273+
// The pointer to the hash is returned, but the hash is also stored in _signing_rx_buffer[SHA204_BUFFER_POS_DATA])
271274
static uint8_t* signerSha256(const uint8_t* data, size_t sz) {
272275
// Initiate SHA256 calculator
273276
(void)atsha204_execute(SHA204_SHA, SHA_INIT, 0, 0, NULL,
274-
SHA_COUNT_SHORT, _singning_tx_buffer, SHA_RSP_SIZE_SHORT, _singning_rx_buffer);
277+
SHA_COUNT_SHORT, _signing_tx_buffer, SHA_RSP_SIZE_SHORT, _signing_rx_buffer);
275278

276279
// Calculate a hash
277280
memset(_signing_temp_message, 0x00, SHA_MSG_SIZE);
@@ -281,8 +284,8 @@ static uint8_t* signerSha256(const uint8_t* data, size_t sz) {
281284
_signing_temp_message[SHA_MSG_SIZE-2] = (sz >> 5);
282285
_signing_temp_message[SHA_MSG_SIZE-1] = (sz << 3);
283286
(void)atsha204_execute(SHA204_SHA, SHA_CALC, 0, SHA_MSG_SIZE, _signing_temp_message,
284-
SHA_COUNT_LONG, _singning_tx_buffer, SHA_RSP_SIZE_LONG, _singning_rx_buffer);
287+
SHA_COUNT_LONG, _signing_tx_buffer, SHA_RSP_SIZE_LONG, _signing_rx_buffer);
285288

286-
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), &_singning_rx_buffer[SHA204_BUFFER_POS_DATA], 32);
287-
return &_singning_rx_buffer[SHA204_BUFFER_POS_DATA];
289+
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), &_signing_rx_buffer[SHA204_BUFFER_POS_DATA], 32);
290+
return &_signing_rx_buffer[SHA204_BUFFER_POS_DATA];
288291
}

‎libraries/MySensors/core/MySigningAtsha204Soft.cpp

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@
3838
Sha256Class _signing_sha256;
3939
unsigned long _signing_timestamp;
4040
bool _signing_verification_ongoing = false;
41-
uint8_t _signing_current_nonce[NONCE_NUMIN_SIZE_PASSTHROUGH];
41+
uint8_t _signing_verifying_nonce[32];
42+
uint8_t _signing_signing_nonce[32];
4243
uint8_t _signing_temp_message[32];
4344
static uint8_t _signing_hmac_key[32];
4445
uint8_t _signing_hmac[32];
@@ -49,7 +50,7 @@ static uint8_t _signing_node_serial_info[9];
4950
const whitelist_entry_t _signing_whitelist[] = MY_SIGNING_NODE_WHITELISTING;
5051
#endif
5152

52-
static void signerCalculateSignature(MyMessage &msg);
53+
static void signerCalculateSignature(MyMessage &msg, bool signing);
5354

5455
#ifdef MY_DEBUG_VERBOSE_SIGNING
5556
static char i2h(uint8_t i)
@@ -102,7 +103,8 @@ bool signerAtsha204SoftCheckTimer(void) {
102103
if (hwMillis() < _signing_timestamp || hwMillis() > _signing_timestamp + MY_VERIFICATION_TIMEOUT_MS) {
103104
DEBUG_SIGNING_PRINTBUF(F("Verification timeout"), NULL, 0);
104105
// Purge nonce
105-
memset(_signing_current_nonce, 0xAA, 32);
106+
memset(_signing_signing_nonce, 0xAA, 32);
107+
memset(_signing_verifying_nonce, 0xAA, 32);
106108
_signing_verification_ongoing = false;
107109
return false;
108110
}
@@ -119,14 +121,14 @@ bool signerAtsha204SoftGetNonce(MyMessage &msg) {
119121
for (int i = 0; i < 32; i++) {
120122
_signing_sha256.write(random(256) ^ (hwMillis()&0xFF));
121123
}
122-
memcpy(_signing_current_nonce, _signing_sha256.result(), MAX_PAYLOAD);
123-
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_current_nonce, 32);
124+
memcpy(_signing_verifying_nonce, _signing_sha256.result(), MAX_PAYLOAD);
125+
DEBUG_SIGNING_PRINTBUF(F("SHA256: "), _signing_verifying_nonce, 32);
124126

125127
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
126-
memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD);
128+
memset(&_signing_verifying_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_verifying_nonce)-MAX_PAYLOAD);
127129

128130
// Transfer the first part of the nonce to the message
129-
msg.set(_signing_current_nonce, MAX_PAYLOAD);
131+
msg.set(_signing_verifying_nonce, MAX_PAYLOAD);
130132
_signing_verification_ongoing = true;
131133
_signing_timestamp = hwMillis(); // Set timestamp to determine when to purge nonce
132134
// Be a little fancy to handle turnover (prolong the time allowed to timeout after turnover)
@@ -139,9 +141,9 @@ bool signerAtsha204SoftGetNonce(MyMessage &msg) {
139141
void signerAtsha204SoftPutNonce(MyMessage &msg) {
140142
DEBUG_SIGNING_PRINTBUF(F("Signing backend: ATSHA204Soft"), NULL, 0);
141143

142-
memcpy(_signing_current_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
144+
memcpy(_signing_signing_nonce, (uint8_t*)msg.getCustom(), MAX_PAYLOAD);
143145
// We set the part of the 32-byte nonce that does not fit into a message to 0xAA
144-
memset(&_signing_current_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_current_nonce)-MAX_PAYLOAD);
146+
memset(&_signing_signing_nonce[MAX_PAYLOAD], 0xAA, sizeof(_signing_signing_nonce)-MAX_PAYLOAD);
145147
}
146148

147149
bool signerAtsha204SoftSignMsg(MyMessage &msg) {
@@ -153,7 +155,7 @@ bool signerAtsha204SoftSignMsg(MyMessage &msg) {
153155

154156
// Calculate signature of message
155157
mSetSigned(msg, 1); // make sure signing flag is set before signature is calculated
156-
signerCalculateSignature(msg);
158+
signerCalculateSignature(msg, true);
157159

158160
if (DO_WHITELIST(msg.destination)) {
159161
// Salt the signature with the senders nodeId and the (hopefully) unique serial The Creator has provided
@@ -195,7 +197,7 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg) {
195197

196198
// Get signature of message
197199
DEBUG_SIGNING_PRINTBUF(F("Signature in message: "), (uint8_t*)&msg.data[mGetLength(msg)], MAX_PAYLOAD-mGetLength(msg));
198-
signerCalculateSignature(msg);
200+
signerCalculateSignature(msg, false);
199201

200202
#ifdef MY_SIGNING_NODE_WHITELISTING
201203
// Look up the senders nodeId in our whitelist and salt the signature with that data
@@ -236,11 +238,11 @@ bool signerAtsha204SoftVerifyMsg(MyMessage &msg) {
236238
}
237239

238240
// Helper to calculate signature of msg (returned in hmac)
239-
static void signerCalculateSignature(MyMessage &msg) {
241+
static void signerCalculateSignature(MyMessage &msg, bool signing) {
240242
memset(_signing_temp_message, 0, 32);
241243
memcpy(_signing_temp_message, (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
242244
DEBUG_SIGNING_PRINTBUF(F("Message to process: "), (uint8_t*)&msg.data[1-HEADER_SIZE], MAX_MESSAGE_LENGTH-1-(MAX_PAYLOAD-mGetLength(msg)));
243-
DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), _signing_current_nonce, 32);
245+
DEBUG_SIGNING_PRINTBUF(F("Current nonce: "), signing ? _signing_signing_nonce : _signing_verifying_nonce, 32);
244246

245247
// ATSHA204 calculates the HMAC with a PSK and a SHA256 digest of the following data:
246248
// 32 bytes zeroes
@@ -275,9 +277,9 @@ static void signerCalculateSignature(MyMessage &msg) {
275277
_signing_sha256.write(0x01); // SN[0]
276278
_signing_sha256.write(0x23); // SN[1]
277279
for (int i=0; i<25; i++) _signing_sha256.write(0x00);
278-
for (int i=0; i<32; i++) _signing_sha256.write(_signing_current_nonce[i]);
280+
for (int i=0; i<32; i++) _signing_sha256.write(signing ? _signing_signing_nonce[i] : _signing_verifying_nonce[i]);
279281
// Purge nonce when used
280-
memset(_signing_current_nonce, 0xAA, 32);
282+
memset(signing ? _signing_signing_nonce : _signing_verifying_nonce, 0xAA, 32);
281283
memcpy(_signing_temp_message, _signing_sha256.result(), 32);
282284

283285
// Feed "message" to HMAC calculator

0 commit comments

Comments
 (0)