-
-
Notifications
You must be signed in to change notification settings - Fork 523
Collaboration document for PSK Identity 02
Colin Kuebler edited this page Aug 14, 2020
·
279 revisions
Here we will share and organize our findings and data from #483
- firmware OS SDK version did not change, but the hash and build time did
OS SDK ver: 2.0.0(e8c5810) compiled @ Jan 25 2019 14:26:04-
OS SDK ver: 2.0.0(29f7e05) compiled @ Sep 30 2019 11:19:12- interesting that this build date corresponds with the release of tuya-convert 2.0, coincidence?
- psk begins with
02rather than01- guessing this will tell us the psk algorithm version
- disabled most of the serial debugging output
- unfortunate as this was a useful reverse engineering resource
- did not respond to our
smartconfigprocedure- it may use a new mechanism or additional restrictions have been imposed
- MAC address in flash appears to be compared with actual device MAC
- likely to foil reverse engineering attempts by running firmware on a dev board
- new factory written key found in flash,
"pskKey"- this may mean the encryption key will no longer be derived deterministically, big bummer
- only found in @rsbob's backup, looks like @Farfar's was updated to this firmware and thus lacks this factory written key
- this may mean there is still hope for devices that came with a lower firmware, since updating to this firmware would require fetching the key
- this is a very interesting new endpoint:
tuya.device.uuid.pskkey.get
It appears a unique preshared key is programmed into each device at the factory. Unlike before where the key could be derived from the TLS identity, now the identity is a hash of the device's id and MAC address. For those following along, the new identity derivation is:
'\x02' + 'BAohbmd6aG91IFR1' + sha256(prod_idx + mac_addr)
where prod_idx is the ASCII of the 8 digit product ID, and mac_addr is the MAC address of the device in hex, all lowercase, no punctuation. These parameters are all stored in the flash in a JSON blob at 0xfb000.