espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-25 03:39:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

[key-manager] update how key guard time is determined and applied (#9871)

Browse Source 
This commit makes changes/fixes to `KeyManager` regarding key switch
guard time.

Key Rotation Time updates:
- When the Key Rotation Time changes (due to security policy updates),
  the key switch guard time (`mKeySwitchGuardTime`) is also adjusted.
  It's set to 93% of the Rotation Time (rounded down).
- Immediately checks if the new rotation time indicates a rotation is
  due and keys are rotated.

New variable `mKeySwitchGuardTimer`:
- This is reset to the current guard time whenever the key sequence is
  updated.
- It decrements hourly until reaching zero.
- Key switch guard comparison is made with this value, aligning the
  implementation with the Thread specification.

`SetCurrentKeySequence()` modification:
- Now accepts a new input parameter that determines whether to apply
  or ignore the key switch guard when updating the key sequence.
- During a key rotation check (when the rotation time has passed), the
  key switch guard is ignored and we always move to the next key
  sequence number.

Other changes:
- Variables handling guard and rotation time now use `uint16_t`
  instead of `uint32_t` to align with security policy definitions.
- API and CLI command documentation for setting the "key switch guard
  time" emphasize that they are intended for testing purposes.
This commit is contained in:
Abtin Keshavarzian
2024-03-07 21:39:52 -08:00
committed by GitHub
parent 5b88759da9
commit c66d91bdd7
10 changed files with 116 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/scripts/thread-cert/test_mle_msg_key_seq_jump.py
+6 -6
View File
@@ -221,20 +221,20 @@ class MleMsgKeySeqJump(thread_cert.TestCase):
self.assertEqual(reed.get_key_sequence_counter(), 20)
#-------------------------------------------------------------------
# Move forward the key seq counter by one on router. Wait for max
# Move forward the key seq counter by two on router. Wait for max
# time between advertisements. Validate that leader adopts the higher
# counter value.
router.set_key_sequence_counter(21)
self.assertEqual(router.get_key_sequence_counter(), 21)
router.set_key_sequence_counter(22)
self.assertEqual(router.get_key_sequence_counter(), 22)
self.simulator.go(52)
self.assertEqual(leader.get_key_sequence_counter(), 21)
self.assertEqual(reed.get_key_sequence_counter(), 21)
self.assertEqual(leader.get_key_sequence_counter(), 22)
self.assertEqual(reed.get_key_sequence_counter(), 22)
child.set_mode('r')
self.simulator.go(2)
self.assertEqual(child.get_key_sequence_counter(), 21)
self.assertEqual(child.get_key_sequence_counter(), 22)
#-------------------------------------------------------------------
# Force a reattachment from the child with a higher key seq counter,