bionicbone / 433mhz_Rolling_Code

quichip Add Rolling Code Protection
GNU General Public License v3.0
12 stars 3 forks source link

Potential Nano Random Number Hack (untested) #22

Open bionicbone opened 8 months ago

bionicbone commented 8 months ago

Potentially, although this is a long shot, it would be possible if a hacker was to collect enough codes on the first run through the loop (before an init-Value had been applied) to use a Nano to create a list of random numbers starting with seed 0, then seed 1,2,3 etc. until they found a list that matched the numbers captured. This is because the way in which Arduino creates a random number, if fact, based on a seed it is a (Pseudo)Random number. Thus the same seed creates the same numbers each time.

To remove this vulnerability, is would be better to:

  1. Instead of 2 different value resistors on Pin A0 to create a simple voltage divider circuit it would be better to have a mono-stable circuit by adding a couple of etc. cheap components, thus the value on A0 would be constantly changing (thus changing the seed) while the (Pseudo)Random numbers were being created. Also in the loop there should be a delay() based on the last number generated, i.e. delay(15), this will ensure A0 has time to update enough and not be in a position whereby the seed is always at a particular number when the seed is set.
  2. Direct users to use a file (any file) and use that to create the list of numbers. A .exe could be written to allow a file to be selected and min / max numbers required etc. Consider ESP32 migration whereby numbers 1-255 will be possible to increase security.