kleidos/test/web/test_admin_auth_runpolicy/ at main · jmrp.io/kleidos

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

Fork 0

kleidos / test / web / test_admin_auth_runpolicy /

at main 1 file

José M. Requena Plens security(web): per-session rotating OTA password + surface it in UI 5w ago

439df6ba

test_admin_auth_runpolicy.cpp

security(web): per-session rotating OTA password + surface it in UI Fold the per-session random nonce into the OTA Basic-Auth password derivation: HMAC-SHA256(masterKey, "kleidos-ota-v1" || sessionToken). The OTA password now rotates every admin session so a captured credential cannot be replayed in the next session (WEB-02/D7). Widen the password from 16-char hex (8 bytes) to 24-char hex (12 HMAC bytes, ≥96-bit entropy). Resize AdminPortalState::otaPassword from InplaceString<16> to InplaceString<24>; secureZeroize() on teardown remains unchanged. Surface the OTA Basic-Auth credential on the device screen in the ADMIN_MODE status band (replaces the "Open URL in browser" hint) as: admin:<first 12 hex> (InplaceString<18>) <last 12 hex> (InplaceString<12>) Both at SMALL font in theme::kLockout565, secureZeroize() after drawing. The AP password continues to occupy row 1 of the body area. SECURITY: displayed on-device only; never logged. Swap the call order in AdminPortal::begin(): generateSessionToken() runs first so the nonce is present when generateOtaPassword() folds it. Add test_ota_password_rotates_per_session_and_is_24_chars to test_admin_auth_runpolicy: two AdminAuth instances with distinct session tokens must produce different 24-char OTA passwords. Add kleidos-ota-v1 domain label to .gitleaks.toml allowlist (regex false-positive on Doxygen comment literal). Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

1 month ago

Configure Feed

Configure Feed