CAN Triple Device Manager 1.1.15 — firmware licensing and secure packages (device firmware 1.0.5)

Two releases' worth since 1.1.13. Ships device firmware 1.0.5, up from 1.0.4 — and this one changes what the device is.

⚠ Read before updating

Firmware 1.0.5 is required. Every feature below talks to commands that did not exist before it; the Device Manager says so, rather than failing quietly, but update the firmware first.

Secure packages built before this release no longer open. The .ct3s container is at format 2. Rebuild them from their .ct3 with the new Secure Configuration Builder — a package now carries an install policy, and a file without one is refused by name.

A plain Send no longer stamps a configuration version. The version a unit reports now comes from the package that installed it. Bench work leaves the number alone.

The device now has a licence

Online → Firmware License Manager… writes five values into the unit: manufacturer, model, version, a Firmware Key and an FW Updater Password. They live in their own flash pages, survive a Send, a Clear and a firmware update, and the two secrets are never read back — not by this application, not by any command.

The two are deliberately different things. The password is the gate: blank means anyone who connects can rewrite the licence; set means the device demands it first. The key is the claim: it is what a unit proves to show which licence it holds, and it is what a secure package checks. It is also a master key over the access passwords, so a package proving it can re-provision a unit whose customer has locked it — stated plainly in the manual, because it is a real elevation.

The record is written to two pages, ping-ponged: a power cut mid-Apply leaves the old licence intact rather than a blank, licensable unit.

This replaces the fleet identity, which was compiled into the firmware and could only change with a rebuild — fine for an identity, useless for a licence.

The device knows what it physically is

Online → Get Device Info… reads the manufacturing record burned into the STM32's OTP: manufacturer, product, hardware version, serial number and date. Burned once, unchangeable by anything. An unburned part reads as Unknown throughout, and a read that faults is reported the same way rather than resetting the unit.

Secure packages carry their own rules

File → Secure Configuration Builder… replaces Save Secure Config. It takes a .ct3, attaches a policy, and writes a .ct3s: optional matches on the licence's manufacturer, model and version; a Firmware Key the device must prove — not optional, and not a string compare — the access passwords the package sets as it installs, and the package version it stamps on the unit.

Send Secure Configuration enforces all of it before the device is touched, before the Send password is asked for, and before a single record goes out. A refusal names the field and both values. An unlicensed unit takes no packages at all — issue a licence first.

Passwords a package sets land atomically with the configuration, which closes a documented trap: access keys live in a write-once header, so passwords set through Set Access Passwords on an already-configured unit only ever lasted until the next power cycle. A package install re-commits that header anyway.

Removed

Fleet Identity, Upload Configuration, Lock Configuration to Device, Verify Configuration and Save Secure Config, each for the same reason: what it did is now done better elsewhere, or was three clicks from irrelevant. The .ct3s password-protected mode went with them — it was the one mode that withheld anything from a reader of this source, and it is gone by decision; what stops a package being used where it should not be is the licence match, which is a different guarantee and is not presented as the same one.

Found in review before this shipped

The pre-release build's device would sign its own challenge — a cable and no secret was enough for master-key authority on any licensed unit. Fixed with domain-separated labels on the two directions the key is used in, pinned by a test that performs the attack, and mutation-checked from all three sites. It never reached a release; it is listed here because the fix is visible in the wire format.

---

Install: download CANTripleDeviceManager-1.1.15-Setup_Windows_x64.exe below and run it. Windows x64; the installer carries the Qt runtime, device firmware 1.0.5 and the ST-Link drivers.