kleidos/variants/m5stack_gray/ at main · jmrp.io/kleidos

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

Fork 0

kleidos / variants / m5stack_gray /

at main 3 files

José M. Requena Plens Add native font atlases for the hero PIN digit and TOTP; refresh the set 5d ago

694a3b13

m5stack_gray.ini

Add native font atlases for the hero PIN digit and TOTP; refresh the set The v2 type ladder resolves the hero PIN digit and the TOTP data role to sizes with no native atlas, so they were magnified from a smaller rung (blurry). Add native sans48 / mono20 / mono48 atlases gated to the Roomy 320x240 boards (gray, cores3_se, core2_v13) and link the existing sans32 on the Compact Stick boards, so those scaled draws resample from a near-native rung instead of upscaling. The role->atlas mapping is unchanged, so every native-scale glyph stays byte-identical. Regenerate the whole atlas set against the current i18n glyph subset (the committed atlases had drifted to a stale subset) and add a pre-commit font-atlas freshness guard so i18n or pipeline changes can no longer silently diverge from the generated output. No partition overflows; the tightest board (4 MB Plus1) sits at ~54%. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

5 days ago

sdkconfig.gray

Advertise a rotating RPA for device privacy (E1) The peripheral advertised a static identity address (base-MAC+2), which is linkable and lets anyone track the device over time — a real privacy leak for a password manager. Enable NimBLE LE privacy so it advertises a Resolvable Private Address that rotates on the CONFIG_BT_NIMBLE_RPA_TIMEOUT (900 s) cadence, while a bonded host still resolves the RPA and reconnects. The IRK is already distributed at pairing (BLE_SM_PAIR_KEY_DIST_ID was in sm_our_key_dist) and the local IRK is generated once and persisted by NimBLE itself in the NVS-backed ble_store (ble_hs_pvcy_set_default_irk at host startup), so resolution survives reboots with no custom storage. Two controller paths, selected at build time in onSync(): - ESP32-S3 / LL-Privacy controllers: controller-based privacy via ble_hs_id_infer_auto(privacy=1) -> BLE_OWN_ADDR_RPA_PUBLIC_DEFAULT; the controller rotates the RPA and resolves bonded peers from its resolving list (auto-populated from the bond store). - Classic ESP32: host-based privacy (CONFIG_BT_NIMBLE_HOST_BASED_PRIVACY, which Kconfig gates to IDF_TARGET_ESP32) via ble_hs_pvcy_rpa_config(NIMBLE_HOST_ENABLE_RPA) + own_addr_type BLE_OWN_ADDR_RANDOM. Enabled per classic variant sdkconfig because a shared assignment would warn as unmet on the S3 boards. Falls back to the static identity address (still functional) if a controller refuses privacy, so first-pairing and reconnect never break. SC-only + numeric-comparison + 16-byte key posture (E3) is unchanged. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

3 weeks ago

variant.h

security(crypto): raise KDF work factors to the new backends' 2 s budget Unlock PBKDF2 iterations: 175,000 on ESP32-S3 (raw-SHA-peripheral backend, measured 1.54 s at 240 MHz) and 40,000 on classic ESP32 (IRAM raw-transform software core, measured 1.57 s) — 5x / 1.6x more offline brute-force resistance at the same ~2 s unlock. Export envelope KDF raised from 200,000 to the OWASP floor of 600,000 (measured 5.3 s S3 / 23.6 s classic under boost, paid once per export/import); envelopes written with older counts remain importable via the authenticated header count. No vault-format change: existing dev vaults are re-provisioned by full-erase (owner decision). Promote the duplicated pin_state/onboarding CpuBoostGuard to a shared platform facade (platform/cpu_boost.h, native no-op) and apply it to the export-envelope KDF, which previously ran unboosted at whatever clock the FSM left. Refresh the per-variant iteration rationale comments and the PBKDF2BENCH doc row with the measured 6.0.2 numbers. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

Configure Feed

Configure Feed