Implement encryption of event / command payloads.

This implements the encryption of event and command payloads, to avoid
the exposure of possible sensitive data (e.g. configuration parameters).

This also adds a new root_key configuration, which will be used to derrive
the keys for mic calculation and encryption. In case the signing_key
configuration is present, then this key will be used for mic calculation
(for backwards compatibility).

Author: brocaar

src/aes128.rs

@@ -1,6 +1,10 @@
 use std::fmt;
 use std::str::FromStr;
 
+use aes::{
+    cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit},
+    Aes128, Block,
+};
 use anyhow::{Error, Result};
 use serde::{
     de::{self, Visitor},
@@ -95,3 +99,26 @@ impl Visitor<'_> for Aes128KeyVisitor {
         Aes128Key::from_str(value).map_err(|e| E::custom(format!("{}", e)))
     }
 }
+
+pub fn get_signing_key(key: Aes128Key) -> Aes128Key {
+    let b: [u8; 16] = [0; 16];
+    get_key(key, b)
+}
+
+pub fn get_encryption_key(key: Aes128Key) -> Aes128Key {
+    let mut b: [u8; 16] = [0; 16];
+    b[0] = 0x01;
+    get_key(key, b)
+}
+
+fn get_key(key: Aes128Key, b: [u8; 16]) -> Aes128Key {
+    let key_bytes = key.to_bytes();
+    let key = GenericArray::from_slice(&key_bytes);
+    let cipher = Aes128::new(key);
+
+    let mut b = b;
+    let block = Block::from_mut_slice(&mut b);
+    cipher.encrypt_block(block);
+
+    Aes128Key(b)
+}

src/cmd/configfile.rs

@@ -24,10 +24,19 @@ pub fn run() {
 
 # Mesh configuration.
 [mesh]
-  # Signing key (AES128, HEX encoded).
+  # Mesh root key (AES128, HEX encoded).
+  #
+  # This key is used to derive the signing and encryption keys. The same key
+  # must be configured on every Border and Relay gateway.
+  root_key="{{ mesh.root_key }}"
+
+  # Signing key (AES128, HEX encoded) (deprecated).
   #
   # This key is used to sign and validate each mesh packet. This key must be
   # configured on every Border / Relay gateway equally.
+  #
+  # Deprecation note: If set, the signing key will not be derrived from the
+  # above root_key, but this key will be used.
   signing_key="{{ mesh.signing_key }}"
 
   # Border Gateway.

src/commands.rs

@@ -52,6 +52,7 @@ pub async fn execute_commands(pl: &packets::CommandPayload) -> Result<Vec<packet
     for cmd in &pl.commands {
         let resp = match cmd {
             packets::Command::Proprietary((t, v)) => execute_proprietary(*t, v).await,
+            packets::Command::Encrypted(_) => panic!("Commands must be decrypted first"),
         };
 
         match resp {

src/config.rs

@@ -58,6 +58,7 @@ impl Default for Logging {
 #[derive(Serialize, Deserialize)]
 #[serde(default)]
 pub struct Mesh {
+    pub root_key: Aes128Key,
     pub signing_key: Aes128Key,
     pub frequencies: Vec<u32>,
     pub data_rate: DataRate,
@@ -72,6 +73,7 @@ pub struct Mesh {
 impl Default for Mesh {
     fn default() -> Self {
         Mesh {
+            root_key: Aes128Key::null(),
             signing_key: Aes128Key::null(),
             frequencies: vec![868100000, 868300000, 868500000],
             data_rate: DataRate {

src/events.rs

@@ -9,6 +9,7 @@ use tokio::process::Command;
 use tokio::sync::OnceCell;
 use tokio::time::sleep;
 
+use crate::aes128::{get_encryption_key, get_signing_key, Aes128Key};
 use crate::backend;
 use crate::config::{self, Configuration};
 use crate::helpers;
@@ -133,7 +134,8 @@ pub async fn send_events(events: Vec<packets::Event>) -> Result<()> {
         }),
         mic: None,
     };
-    packet.set_mic(conf.mesh.signing_key)?;
+    packet.encrypt(get_encryption_key(Aes128Key::null()))?;
+    packet.set_mic(get_signing_key(conf.mesh.signing_key))?;
 
     let pl = gw::DownlinkFrame {
         downlink_id: random(),

src/mesh.rs

@@ -8,6 +8,7 @@ use log::{info, trace, warn};
 use rand::random;
 
 use crate::{
+    aes128::{get_encryption_key, get_signing_key, Aes128Key},
     backend,
     cache::{Cache, PayloadCache},
     commands,
@@ -39,8 +40,12 @@ pub async fn handle_uplink(border_gateway: bool, pl: &gw::UplinkFrame) -> Result
 // Handle Proprietary LoRaWAN payload (mesh encapsulated).
 pub async fn handle_mesh(border_gateway: bool, pl: &gw::UplinkFrame) -> Result<()> {
     let conf = config::get();
-    let packet = MeshPacket::from_slice(&pl.phy_payload)?;
-    if !packet.validate_mic(conf.mesh.signing_key)? {
+    let mut packet = MeshPacket::from_slice(&pl.phy_payload)?;
+    if !packet.validate_mic(if conf.mesh.signing_key != Aes128Key::null() {
+        conf.mesh.signing_key
+    } else {
+        get_signing_key(conf.mesh.root_key)
+    })? {
         warn!("Dropping packet, invalid MIC, mesh_packet: {}", packet);
         return Ok(());
     }
@@ -55,6 +60,9 @@ pub async fn handle_mesh(border_gateway: bool, pl: &gw::UplinkFrame) -> Result<(
         return Ok(());
     };
 
+    // Decrypt the packet (in case it contains an encrypted payload).
+    packet.decrypt(get_encryption_key(conf.mesh.root_key))?;
+
     match border_gateway {
         // Proxy relayed uplink
         true => match packet.mhdr.payload_type {
@@ -113,7 +121,12 @@ pub async fn send_mesh_command(pl: gw::MeshCommand) -> Result<()> {
         }),
         mic: None,
     };
-    packet.set_mic(conf.mesh.signing_key)?;
+    packet.encrypt(get_encryption_key(conf.mesh.root_key))?;
+    packet.set_mic(if conf.mesh.signing_key != Aes128Key::null() {
+        conf.mesh.signing_key
+    } else {
+        get_signing_key(conf.mesh.root_key)
+    })?;
 
     let pl = gw::DownlinkFrame {
         downlink_id: random(),
@@ -267,6 +280,7 @@ async fn proxy_event_mesh_packet(pl: &gw::UplinkFrame, packet: MeshPacket) -> Re
                                 payload: v.1.clone(),
                             })
                         }
+                        Event::Encrypted(_) => panic!("Events must be decrypted first"),
                     }),
                 })
                 .collect(),
@@ -375,9 +389,16 @@ async fn relay_mesh_packet(pl: &gw::UplinkFrame, mut packet: MeshPacket) -> Resu
     // Increment hop count.
     packet.mhdr.hop_count += 1;
 
+    // Encrypt.
+    packet.encrypt(get_encryption_key(conf.mesh.root_key))?;
+
     // We need to re-set the MIC as we have changed the payload by incrementing
     // the hop count (and in casee of heartbeat, we have modified the Relay path).
-    packet.set_mic(conf.mesh.signing_key)?;
+    packet.set_mic(if conf.mesh.signing_key != Aes128Key::null() {
+        conf.mesh.signing_key
+    } else {
+        get_signing_key(conf.mesh.root_key)
+    })?;
 
     if packet.mhdr.hop_count > conf.mesh.max_hop_count {
         return Err(anyhow!("Max hop count exceeded"));
@@ -447,7 +468,11 @@ async fn relay_uplink_lora_packet(pl: &gw::UplinkFrame) -> Result<()> {
         }),
         mic: None,
     };
-    packet.set_mic(conf.mesh.signing_key)?;
+    packet.set_mic(if conf.mesh.signing_key != Aes128Key::null() {
+        conf.mesh.signing_key
+    } else {
+        get_signing_key(conf.mesh.root_key)
+    })?;
 
     let pl = gw::DownlinkFrame {
         downlink_id: random(),
@@ -546,7 +571,11 @@ async fn relay_downlink_lora_packet(pl: &gw::DownlinkFrame) -> Result<gw::Downli
             }),
             mic: None,
         };
-        packet.set_mic(conf.mesh.signing_key)?;
+        packet.set_mic(if conf.mesh.signing_key != Aes128Key::null() {
+            conf.mesh.signing_key
+        } else {
+            get_signing_key(conf.mesh.root_key)
+        })?;
 
         let pl = gw::DownlinkFrame {
             downlink_id: pl.downlink_id,