espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-27 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[tcat] implement rate limitation for TCAT TLVs 0x10, 0x11 and 0x12 and remove TLV 0x14 (#12211)

Browse Source 
This commit implements rate limitation for the TCAT commands Present
PSKd Hash TLV (0x10), Present PSKc Hash TLV (0x11) and Present
Install-code Hash TLV (0x12) to prevent password guessing attacks.

It also removes the TCAT command Request PSKd Hash TLV (0x14), to
prevent offline password guessing attacks with a single Hash value
retrieved from the device.

Note: The commit does not remove the Request PSKd Hash TLV
implementation in the Python commissioner such that the non-existence
of the command TLV can still be tested.
This commit is contained in:
arnulfrupp
2026-05-04 07:10:19 -07:00
committed by GitHub
parent d27c618ccb
commit 928c78a01b
6 changed files with 58 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/scripts/expect/cli-tcat-hashes.exp
+24 -5
View File
@@ -31,6 +31,9 @@ source "tests/scripts/expect/_common.exp"
spawn_node 1 "cli"
# Sleep > 50 seconds to ensure the maximum number of unsuccessful hash verification attempts (10) are permitted
sleep 51
spawn_tcat_client_for_node 1 tools/tcat_ble_client/auth-cert/CommCert2
send "commission\n"
@@ -41,11 +44,6 @@ send "random_challenge\n"
expect_line "\tTYPE:\tRESPONSE_W_PAYLOAD"
expect_line "\tLEN:\t8"
send "peer_pskd_hash JJJJJJ\n"
expect_line "Requested hash is valid."
expect_line "\tTYPE:\tRESPONSE_W_PAYLOAD"
expect_line "\tLEN:\t32"
send "present_hash pskd AAAA\n"
expect_line "\tTYPE:\tRESPONSE_W_STATUS"
expect_line "\tVALUE:\t0x07"
@@ -74,6 +72,27 @@ send "present_hash pskc aaaa\n"
expect_line "\tTYPE:\tRESPONSE_W_STATUS"
expect_line "\tVALUE:\t0x07"
# Sleep >> 5 seconds to ensure a few more hash verification attempts are allowed
sleep 20
# Try hash verification >10 times to enforce rate limitation
for {set i 0} {$i < 11} {incr i} {
send "present_hash pskd AAAA\n"
expect_line "\tTYPE:\tRESPONSE_W_STATUS"
}
send "present_hash pskd AAAA\n"
expect_line "\tTYPE:\tRESPONSE_W_STATUS"
expect_line "\tVALUE:\t0x05"
# Sleep >5 seconds to ensure one more hash verification attempt is allowed
sleep 5.5
send "present_hash pskd AAAA\n"
expect_line "\tTYPE:\tRESPONSE_W_STATUS"
expect_line "\tVALUE:\t0x07"
dispose_tcat_client 1
switch_node 1