ArnieO
commented
2 years ago Did you try the pre compiled code available here? https://github.com/gskjold/AmsToMqttBridge/releases
Closed tyler123durden closed 2 years ago
ArnieO
commented
2 years ago Did you try the pre compiled code available here? https://github.com/gskjold/AmsToMqttBridge/releases
tyler123durden
commented
2 years ago Yes, I'm using compiled release version 2.0.11 and also 2.0.5 I think. Then I tried to setup the dev environment but got to strange xtense compile not found error.
tyler123durden
commented
2 years ago I've got a development setup now up an running and as far as I understand mbetls_gcm_auth_decrypt will return an MBEDTLS_ERR_GCM_BAD_INPUT error when no authentication data is provided. Intern in mbedtls_gcm_finish this will trigger:
if( tag_len > 16 || tag_len < 4 )
return( MBEDTLS_ERR_GCM_BAD_INPUT );because tag_len is 0, which is authkeylen from our input.
So we could either ignore authentication related errors or use dedicated decryption calls without authentication stuff. The below version works for me on ESP32
#elif defined(ESP32)
uint8_t cipher_text[len - authkeylen - 5];
memcpy(cipher_text, ptr, len - authkeylen - 5);
mbedtls_gcm_context m_ctx;
mbedtls_gcm_init(&m_ctx);
int success = mbedtls_gcm_setkey(&m_ctx, MBEDTLS_CIPHER_ID_AES, config->encryption_key, 128);
if (0 != success) {
return HDLC_ENCRYPTION_KEY_FAILED;
}
if (0<authkeylen) {
success = mbedtls_gcm_auth_decrypt(&m_ctx, sizeof(cipher_text), config->initialization_vector, sizeof(config->initialization_vector),
config->additional_authenticated_data, aadlen, config->authentication_tag, authkeylen,
cipher_text, (unsigned char*)(ptr));
if (authkeylen > 0 && success == MBEDTLS_ERR_GCM_AUTH_FAILED) {
return HDLC_ENCRYPTION_AUTH_FAILED;
} else if(success == MBEDTLS_ERR_GCM_BAD_INPUT) {
return HDLC_ENCRYPTION_DECRYPT_FAILED;
}
}
else {
mbedtls_gcm_starts(&m_ctx, MBEDTLS_GCM_DECRYPT, config->initialization_vector, sizeof(config->initialization_vector),NULL, 0);
if (0 != success) {
return HDLC_SOME_ERROR_TBD1;
}
success = mbedtls_gcm_update(&m_ctx, sizeof(cipher_text), cipher_text, (unsigned char*)(ptr));
if (0 != success) {
return HDLC_SOME_ERROR_TBD2;
}
}
mbedtls_gcm_free(&m_ctx);
#endif@gskjold : Help me remember; I had the impression decryption has been verified some time ago on ESP32-based hardware?
gskjold
commented
2 years ago @ArnieO Yes, but only for encryption with both keys.
@tyler123durden Thank you for providing input to a solution, I will try to include this in the upcoming 2.1 release if possible.
tyler123durden
commented
2 years ago great. Also great work and project!
I've seen that I forgot to check error from mbedtls_gcm_starts. Another minor drawback in the above code ist that in error cases mbedtls_gcm_free will not get called, which may lead to a memory leak.
Describe the bug Decryption of payload fails on ESP32 devices with error HDLC_ENCRYPTION_DECRYPT_FAILED. Same release with ESP8266 works but of course ESP doesn't use mbed enryption library. Decrypted payload looks perfectly fine one both platforms.
Unfortunately I'm not able to set up the development environment to fix this issue, I get errors compiling code but maybe my platformIO setup is screwed up because it complains about not finding xtensa compiler.
Erroneous ESP32 log:
Working ESP8266 log:
Hardware information:
Relevant firmware information:
Additional context Add any other context about the problem here.