Ernie Secure: Difference between revisions
Jump to navigation
Jump to search
| Line 5: | Line 5: | ||
=== Part 1 === | === Part 1 === | ||
# Generate an empty buffer <code>30 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</code> and send it to Syscon. | # Generate an empty buffer <code>30 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</code> and send it to Syscon. | ||
# Syscon returns header + 8 byte challenge. | # Syscon returns header <code>30 01 00 0F 00 00 00 00</code> + 8 byte challenge. | ||
=== Part 2 === | === Part 2 === | ||
| Line 13: | Line 13: | ||
=== Part 3 === | === Part 3 === | ||
# Gets a 0x28 byte response from Syscon with a 0x20 buffer. | # Gets a 0x28 byte response from Syscon with a header <code>30 03 00 0F 00 00 00 00</code> and 0x20 buffer. | ||
# Decrypt with AES-128-CBC with IV from part 2 (it is the last ciphertext generated, or the last 16 bytes of the ciphertext sent from F00D) and a shared key. On 1.69 it is <code>9E34087C48985B4B351A63572D9B481B</code> | # Decrypt with AES-128-CBC with IV from part 2 (it is the last ciphertext generated, or the last 16 bytes of the ciphertext sent from F00D) and a shared key. On 1.69 it is <code>9E34087C48985B4B351A63572D9B481B</code> | ||
# Check that first 8 byte matches unknown and next 8 byte matches the F00D nonce generated in part 1. | # Check that first 8 byte matches unknown and next 8 byte matches the F00D nonce generated in part 1. | ||
| Line 22: | Line 22: | ||
# Using the session key, encrypt a known value. On 1.69 it is <code>457798C6D9B8390DDCA49745746F65A000000000000000000000000000000000</code> | # Using the session key, encrypt a known value. On 1.69 it is <code>457798C6D9B8390DDCA49745746F65A000000000000000000000000000000000</code> | ||
# Append the header <code>30 04 00 0F 00 00 00 00</code> and send to Syscon | # Append the header <code>30 04 00 0F 00 00 00 00</code> and send to Syscon | ||
# Get a response back from Syscon, decrypt the buffer with the session, and check that it matches the known value. Both the plaintext and ciphertext should match. | # Get a response back from Syscon (header <code>30 05 00 0F 00 00 00 00</code>), decrypt the buffer with the session, and check that it matches the known value. Both the plaintext and ciphertext should match. | ||
# Keyslot 0x511 is programmed with the session key. | # Keyslot 0x511 is programmed with the session key. | ||
# Keyslot 0x512 is programmed with a 32 bit random number from Bigmac. | # Keyslot 0x512 is programmed with a 32 bit random number from Bigmac. | ||
Revision as of 17:44, 20 March 2018
Syscon 0xD0 four part key exchange
The 0F here appears to be a context id. Only 0F and 0B has been seen but only 0F seems to be supported by the update sm.
Part 1
- Generate an empty buffer
30 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00and send it to Syscon. - Syscon returns header
30 01 00 0F 00 00 00 00+ 8 byte challenge.
Part 2
- F00D composes a data buffer that is 8 bytes of RNG value, 8 bytes copied from challenge, and 16 bytes of shared data. On 1.69, the shared data is
C86B51FB019A207F32118E55462D5008 - This data is encrypted using AES-128-CBC with all zero IV and a shared key. On 1.69, it is
50E4C3A77264167C409C72A9B57A8609 - A header is prepended
30 02 00 0F 01 00 00 00to the data and sent to Syscon
Part 3
- Gets a 0x28 byte response from Syscon with a header
30 03 00 0F 00 00 00 00and 0x20 buffer. - Decrypt with AES-128-CBC with IV from part 2 (it is the last ciphertext generated, or the last 16 bytes of the ciphertext sent from F00D) and a shared key. On 1.69 it is
9E34087C48985B4B351A63572D9B481B - Check that first 8 byte matches unknown and next 8 byte matches the F00D nonce generated in part 1.
- Encrypt the same buffer back using a shared key for 16 bytes. On 1.69 it is
EBE3460D84A41754AC441368CF0200D8and the IV will be the last 16 bytes from the encrypted input buffer. - This is now the session key!
Part 4
- Using the session key, encrypt a known value. On 1.69 it is
457798C6D9B8390DDCA49745746F65A000000000000000000000000000000000 - Append the header
30 04 00 0F 00 00 00 00and send to Syscon - Get a response back from Syscon (header
30 05 00 0F 00 00 00 00), decrypt the buffer with the session, and check that it matches the known value. Both the plaintext and ciphertext should match. - Keyslot 0x511 is programmed with the session key.
- Keyslot 0x512 is programmed with a 32 bit random number from Bigmac.