【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

xiaolongba — Sun, 23 May 2021 15:49:06 GMT

My comments as below:

[quote userid="15475" url="~/f/nordic-q-a/75215/mesh-security-materials-generation-is-it-possible-to-generate-mesh-security-materials-by-users/311126#311126"]e don't have any PC tools for that. Our developer don't think it is possible to pre-flash security materials as there are flash headers that need to be stored as well. They also need to be dumped, otherwise stack won't be able to restore configuration.[/quote]

OK, Got it.

[quote userid="15475" url="~/f/nordic-q-a/75215/mesh-security-materials-generation-is-it-possible-to-generate-mesh-security-materials-by-users/311126#311126"]The mesh specification doesn't allow pre-flashing configuration. This may lead to security vulnerabilities. E.g. DevKey generated during provisioning and can't be changed until device is reset and re-provisioned.[/quote]

Yes, I got it. But I don't think this a security vulnerability as this approach is only used in mass production and it just speeded up the process of provisioning, In other words, these material security materials are stored into the flash in advance and bypass the process of provisioning. Such as these security materials can be obtained from a customer's server, and others is impossible to get unless the information in the server is disclosed

why? I cannot get your point, as I said above, these mesh security materials are stored into the internal flash in mass production. they can communicate with each other after power on if the customer purchased these products from the store.

[quote userid="15475" url="~/f/nordic-q-a/75215/mesh-security-materials-generation-is-it-possible-to-generate-mesh-security-materials-by-users/311126#311126"]If you still wants to do this, there is mesh_stack_provisioning_data_store() function that is called when device is provisioned. The customer may use it to pre-configure device. It can use provisioner example to see how provisioner preconfigures itself.[/quote]

OK, let me check and feedback to you soon.

Anyway, many thanks for your detailed replies.

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

Mttrinh — Fri, 21 May 2021 16:41:44 GMT

Hi,

We don't have any PC tools for that. Our developer don't think it is possible to pre-flash security materials as there are flash headers that need to be stored as well. They also need to be dumped, otherwise stack won't be able to restore configuration.

The mesh specification doesn't allow pre-flashing configuration. This may lead to security vulnerabilities. E.g. DevKey generated during provisioning and can't be changed until device is reset and re-provisioned. Thus, with pre-flashed configuration, the devices will anyway need to be reprovisioned for the security reasons.

If you still wants to do this, there is mesh_stack_provisioning_data_store() function that is called when device is provisioned. The customer may use it to pre-configure device. It can use provisioner example to see how provisioner preconfigures itself.

Regarding flash entries allocations. Here is the order of files stored in flash: https://github.com/NordicSemiconductor/nRF5-SDK-for-Mesh/blob/master/mesh/core/include/mesh_opt.h#L61-L68 and for example these are entries stored in DSM: https://github.com/NordicSemiconductor/nRF5-SDK-for-Mesh/blob/master/mesh/access/include/mesh_opt_dsm.h#L57-L66.

So, in front of NetKey, customer might see addresses' allocation. MESH_OPT_NET_STATE_FILE_ID holds IV Index and SeqNum and they should be first entries stored in flash. Their order is shown here: https://github.com/NordicSemiconductor/nRF5-SDK-for-Mesh/blob/master/mesh/core/include/mesh_opt_net_state.h#L56-L59

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

xiaolongba — Wed, 19 May 2021 16:09:16 GMT

also, I found the corresponding mesh security materials after calling the function mesh_stack_persistence_flash_usage() , the details as below:

the first red highlighted is Netkey, the second one is devkey, the third one is appkey, But I dont know what do the others mean? could you explain to me what are they? and where is the iv index & unicast address etc?

thanks in advance.

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

xiaolongba — Wed, 19 May 2021 15:35:04 GMT

Hi Bro,

what do the mesh security materials mean is netkey,appkey,unicast address, iv index, etc. and I would like to generate these parameters with the PC tool and store them into the internal flash through UART, so I don't need to provision unprovisioned devices one by one at this moment. so they can communicate with each other after power on.

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

Mttrinh — Wed, 19 May 2021 15:31:06 GMT

Hi,

I might have mistunderstood your question, by "generating the mesh security materials" do you mean provisioning the device?

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

xiaolongba — Wed, 19 May 2021 12:32:27 GMT

Hi Mttrinh

Big thanks for your detailed replies, regarding the ways to generate mesh security materials you mentioned above is not what I expected. Actually, I would like to generate this info with one specified pc tool or lib that can be used for my own pc tool for mass production. Is it possible?

RE: 【Mesh Security Materials Generation】Is it possible to generate mesh security materials by users?

Mttrinh — Wed, 19 May 2021 11:36:00 GMT

Hi,

1. We do have our nRF Mesh app for iOS and Android, assuming that you have support for PB-GATT and Proxy feature. The sample app is for development/protoyping purposes targeting developers to make debugging easier, so it is recommeded that you create your own app. The nRF Mesh app is open-source and can be used as a reference. It can be found on our Github, see here and here.

2. You can use this function mesh_stack_persistence_flash_usage() to get which flash areas used by the mesh stack to store the provisioning data.