[tcat] implement rate limitation for TCAT TLVs 0x10, 0x11 and 0x12 and remove TLV 0x14 (#12211)

This commit implements rate limitation for the TCAT commands Present
PSKd Hash TLV (0x10), Present PSKc Hash TLV (0x11) and Present
Install-code Hash TLV (0x12) to prevent password guessing attacks.

It also removes the TCAT command Request PSKd Hash TLV (0x14), to
prevent offline password guessing attacks with a single Hash value
retrieved from the device.

Note: The commit does not remove the Request PSKd Hash TLV
implementation in the Python commissioner such that the non-existence
of the command TLV can still be tested.

tools/tcat_ble_client/cli/base_commands.py

@@ -324,41 +324,6 @@ class GetNetworkNameCommand(BleCommand):
         return TLV(TcatTLVType.GET_NETWORK_NAME.value, bytes()).to_bytes()
 
 
-class GetPskdHash(BleCommand):
-
-    def __init__(self):
-        super().__init__()
-        self.digest = None
-
-    def get_log_string(self) -> str:
-        return 'Retrieving peer PSKd hash.'
-
-    def get_help_string(self) -> str:
-        return 'Get calculated PSKd hash.'
-
-    def prepare_data(self, args, context) -> bytes:
-        bless: BleStreamSecure = context['ble_sstream']
-        if bless.peer_public_key is None:
-            raise DataNotPrepared("Peer certificate not present.")
-
-        challenge = token_bytes(CHALLENGE_SIZE)
-        pskd = bytes(args[0], 'utf-8')
-
-        data = TLV(TcatTLVType.GET_PSKD_HASH.value, challenge).to_bytes()
-
-        hash = hmac.new(pskd, digestmod=sha256)
-        hash.update(challenge)
-        hash.update(bless.peer_public_key)
-        self.digest = hash.digest()
-        return data
-
-    def process_response(self, tlv_response, context) -> None:
-        if tlv_response.value == self.digest:
-            print('Requested hash is valid.')
-        else:
-            print('Requested hash is NOT valid.')
-
-
 class GetRandomNumberChallenge(BleCommand):
 
     def get_log_string(self) -> str:

tools/tcat_ble_client/cli/cli.py

@@ -33,7 +33,7 @@ import shlex
 from typing import Optional
 
 from cli.base_commands import (DisconnectCommand, HelpCommand, HelloCommand, CommissionCommand, DecommissionCommand,
-                               ExtractDatasetCommand, GetCommissionerCertificate, GetDeviceIdCommand, GetPskdHash,
+                               ExtractDatasetCommand, GetCommissionerCertificate, GetDeviceIdCommand,
                                GetExtPanIDCommand, GetNetworkNameCommand, GetProvisioningUrlCommand, PingCommand,
                                GetRandomNumberChallenge, ThreadStateCommand, ScanCommand, PresentHash,
                                DiagnosticTlvsCommand, GetApplicationLayersCommand, SendVendorData,
@@ -74,7 +74,6 @@ class CLI:
             'simulation': SimulationCommand(),
             'random_challenge': GetRandomNumberChallenge(),
             'present_hash': PresentHash(),
-            'peer_pskd_hash': GetPskdHash(),
             'tlv': TlvCommand(),
             'get_comm_cert': GetCommissionerCertificate(),
             'diagnostic_tlvs': DiagnosticTlvsCommand()

tools/tcat_ble_client/tlv/tcat_tlv.py

@@ -42,7 +42,6 @@ class TcatTLVType(Enum):
     PRESENT_PSKC_HASH = 0x11
     PRESENT_INSTALL_CODE_HASH = 0x12
     GET_RANDOM_NUMBER_CHALLENGE = 0x13
-    GET_PSKD_HASH = 0x14
     ACTIVE_DATASET = 0x20
     GET_COMMISSIONER_CERTIFICATE = 0x25
     GET_ACTIVE_DATASET = 0x40