Allow temporarily disabling device protection

[sergeuz]

Description

Implement a challenge-response protocol between the device and the cloud to temporarily disable device protection. An external tool like the CLI transfers the information from the device to the API and back.

Changes

Behavior of protected mode

• All the USB USART functions return a neutral result when called when device protection is currently active.
• LogHandler changes for protected mode are reversed.
  • The consequence is that SerialLogHandler does not output anything in protected mode, but starts outputing when protection is temporarily disabled, and other LogHandlers (including custom ones) still output in protected mode.

Control requests

• GetProtectedStateReply
  • state returns true when the device is currently protected
  • overriden returns true when the device would have been protected but protection is temporarily disabled
• SetProtectedStateRequest. New request (see below for use)

Unprotect algorithm

• SetProtectedStateRequest has 3 steps: prepare, confirm and reset.
• Prepare generates a random device nonce, and responds with a signature of the device id, the server nonce, and the device nonce. The response also include the fingerprint of the device key used for the signature. It also saves the time when prepare was done.
• Confirm checks that prepare was started less than a minute ago. It first checks that the server that generated the signature is the one we have a key for (KEY_MISMATCH error). It then verifies the signature sent by the server (INVALID_SIGNATURE error).
  • If everything checks out, device protection is disabled for 20 reboots and 24 hours.
• Reset clears the temporary unlock.
• The counter of remaining resets and remaining seconds for the temporary unlock is stored in system flags.
• In the bootloader system tick, a 1 second counter is decremented. When that gets to 0, the remaining seconds for the temporary unlock is decremented and the system flags are saved.
• Outside the bootloader, a 1 second OS timer is used to decrement the remaining seconds for the temporary unlock and save the system flags.

References

• sc-127946

[sergeuz]

I'm marking this PR as ready for review even though it currently overflows on some of the platforms – we'll investigate that separately. The test steps can be found in sc-127946.

[avtolstoy]

Nit: define a constant for this?