fix syntax for qmk

unified dec_pass array, update readme
update readme
2025-01-22 07:11:18 +00:00 · 2025-01-22 07:02:14 +00:00 · 2025-01-21 17:43:33 +00:00 · 2025-01-21 17:40:40 +00:00 · 2025-01-21 10:11:23 +00:00 · 2025-01-21 07:52:06 +00:00
7 changed files with 230 additions and 77 deletions
@@ -1,65 +1,123 @@
-# RED_CRYPTO ver 0.2.0
+# RED_CRYPTO ver 0.5.0

 ## Description

 Password manager for (almost) any QMK keyboards. 
 Supports cryptographic algorithms:
- [ ] AES256,
- [x] Kuznechik (Russian GOST cipher),
- [ ] SHA256. 
+- [x] Kuznechik (Russian GOST cipher)
+- [x] SHA256 (for hashing key)
+- [ ] Streebog (for hashing key, Russian GOST hash algorithm)
+- [ ] AES256
+
+## Features and plans
+
+- [x] add read all ASCII-printable symbols for key
+- [x] add Kuznechik lib for non 128 bit MCU
+- [x] use SHA256 for hashing key to set key length to 32 bytes
+- [x] expand stored passwords length from 16 byte to 64
+- [x] expand number of stored passwords (manual adding new keys)
+- [ ] write new passwords to EEPROM without flashing firmware
+- [ ] add CBC mode for Kuznechik, it will increase security

 ## Installation

 1. Clone this repo to your keymap folder.

-2. Copy this string to *rules.mk*. Don't forget to insert your names. This is make rules for including all needed file to firmwire.
+2. Copy this string to **rules.mk**. Don't forget to insert your names. This is make rules for including all needed file to firmwire.

 ```make
-include keyboards/<keyboard>/<path to your keymap folder>/red_crypto/red_crypto.mk 
+include keyboards/<your keyboard>/<path to your keymap folder>/red_crypto/red_crypto.mk 
 ```

-3. Import library in *keymap.c*.
+3. Import library in **keymap.c**.

 ```c
 #include "red_crypto/red_crypto.h"
 ```

-4. Enable chosen algorithms. Now you can use only `Kuznechik`. 
+4. Define chosen algorithms and parameters in `config.h`. Now you can use only `Kuznechik`. 

 ```c
 #define USE_KUZNECHIK_8
 ```

-5. Encrypt your passwords with chosen algorithm (AES, Kuznechik). Now available only Kuznechik. You can use `CyberChef`. Don't use web version! We are here for security, right? Choose `GOST Cipher`, then choose type `Kuznechik 34.12-2014`, not Magma. Choose mode ECB. Now, there is no CBC or CTR. 
-
-> Don't forget IV for GOST
-> ```94208510C2C001FB01C0C21085209401```
-
-6. Add your encrypted passwords in "keymap.c". Now you can encrypt 2 passwords with length <=16 byte. Keep this information in secret. Even if there are no plaintext. 
+If you want use SHA256 of your key to encrypt passwords, define this in `config.h`.

 ```c
-const uint8_t encrypted_passwords[2][16] = { {0,0,0,...,0,0,0}, {0,0,0,...,0,0,0} };
+#define USE_SHA256_KEY
 ```

+Change storage size (default `4`) and maximum password length (default `64`). 
+
+```c
+#define STORAGE_SIZE 4
+#define STORAGE_PASS_LEN 64 // use a multiple of 16, e.g. 16, 32, 64... but don't forget about available memory! 
+```
+
+5. Encrypt your passwords with chosen algorithm (AES, Kuznechik). Now available only Kuznechik. You can use `CyberChef`. 
+
+> Don't use web version! We are here for security, right?
+
+If you've enabled SHA256 for key, choose `SHA2`, then `SHA256` mode and `64` rounds. Hash your key, then copy it to next step.
+
+Choose `GOST Encrypt`, then choose type `GOST R 34.12 (Kuznechik, 2015)`, not `Magma`. Choose mode `ECB`. Now there is no other modes for `Kuznechik`.
+
+> Don't forget IV for GOST
+ ```
+ 94208510C2C001FB01C0C21085209401
+ ```
+
+6. Add your encrypted passwords in **keymap.c**. Now you can encrypt 4 passwords with any length (16, 32, 64, more not tested). 
+
+> Keep this information in secret. Even if there are no plaintext. 
+
+Chosen parameter `STORAGE_PASS_LEN` must be the same as the number of zeros in this array.
+
+Chosen parameter `STORAGE_SIZE` must be the same as the number of passwords in this array.
+
+```c
+const uint8_t encrypted_passwords[STORAGE_SIZE][STORAGE_PASS_LEN] = {
+    {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
+    };
+```
+
+If you want more passwords in storage, you should:
+- add keys `RED_PASSX` into `enum red_crypto_keys` in `red_crypto.h`
+- add into `crypto_proccess_record_user` handling new keys
+
 7. Add new layer or set new keyes everywhere you want.

 - `RED_TEST` - execute test functions of every algorithm with. Available only with `#define TEST_FUNCTIONS_ENABLED` and `COMMAND_ENABLE=yes`. You can see output via `hid_listen`.
- `GET_PASS` - execute reading password for encrypted passwords. After entering password, tap this key again. Now, you can use `RED_PASSX` keys.
+- `RED_CRY_M` - execute reading password for encrypted passwords. After entering password, tap this key again. Now, you can use `RED_PASSX` keys.
 - `RED_PASSX` - where `X` is number of your password in database. After tapping, keyboard send decrypted password.
 - `RED_RNG` - use 32 times function named `tap_random_base64` from QMK. It's for generating random strings. But now random seed is not unique for every keyboard's power on.  

-8. Copy this string to function *process_record_user* in *keymap.c* before all your code. It uses "switch case" construction inside. 
+8. Copy this string to function **process_record_user** in **keymap.c** before all your code. It uses "switch case" construction inside. 

 ```c
-    crypto_process_record_user(keycode,event,encrypted_passwords);
+    uint8_t crypto_return = crypto_process_record_user(keycode, event, encrypted_passwords);
+    if (crypto_return == 1){
+        return false;
+    }
 ```

-9. Flash your keyboard.
+9. Compile and flash your keyboard.


 ## Usage

-Tap `GET_PASS`. Enter password. Tap `GET_PASS` again to confirm.
+Tap `RED_CRY_M`. Enter password. Tap `RED_CRY_M` again to confirm.
 Now you can use `RED_PASSX` to send decrypted passwords.

-If you have missed while entering password, just tap `GET_PASS` and tap `GET_PASS`. 
+If you have missed while entering password, just tap `RED_CRY_M` and tap `RED_CRY_M`. 
+
+
+## Related projects
+
+Thanks to the authors of these repositories:
+
+- https://github.com/mjosaarinen/kuznechik - kuznechik implementation for 8bit and 128bit
+- https://github.com/B-Con/crypto-algorithms - other crypto algorithms
@@ -12,7 +12,9 @@ void write_keycode(uint8_t up_key, uint8_t low_key, keyrecord_t *record, uint8_t
        } else {
            readed_key[*count_char_key] = low_key;
        }
+#ifdef USE_RED_CRY_DEBUG
        dprintf("%d", readed_key[*count_char_key]);
+#endif
        *count_char_key = *count_char_key + 1;
    }
 };
@@ -205,8 +207,8 @@ uint8_t kc_to_ascii(uint16_t keycode, keyrecord_t *record, uint8_t readed_key[],
            write_keycode(ASCII_UP_QUOTE, ASCII_LOW_QUOTE, record, readed_key, count_char_key);
            return 1;
            break;
-        //i am not sure about KC_GRAVE and KC_NONUS_HASH
-        //need to test
+        // i am not sure about KC_GRAVE and KC_NONUS_HASH
+        // need to test
        case KC_GRAVE:
            write_keycode(ASCII_NON_PRINTABLE, ASCII_GRAVE, record, readed_key, count_char_key);
            return 1;
@@ -4,7 +4,7 @@
 #include "quantum.h"

 #ifndef KC_TO_ASCII_H
-#define KC_TO_ASCII_H
+#    define KC_TO_ASCII_H

 uint8_t kc_to_ascii(uint16_t keycode, keyrecord_t *record, uint8_t readed_key[], uint8_t *count_char_key);

@@ -2,9 +2,23 @@

 #include "red_crypto.h"

-uint8_t dec_pass[2][16] = {{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}};
+uint8_t dec_pass[STORAGE_SIZE][STORAGE_PASS_LEN];

+void init_dec_pass(void) {
+    for (uint8_t i = 0; i < STORAGE_SIZE; i++) {
+        for (uint8_t j = 0; j < STORAGE_PASS_LEN; j++) {
+            dec_pass[i][j] = 0x00;
+        }
+    }
+}
+
+// you can use key any length with SHA256, kuznechik use only 32byte
+#ifdef USE_SHA256_KEY
+uint8_t readed_key[128] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+#endif
+#ifndef USE_SHA256_KEY
 uint8_t readed_key[32] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+#endif

 uint8_t count_char_key = 0;

@@ -13,7 +27,7 @@ uint8_t crypto_mode = 0;
 void print_chars_w128(w128_t *x) {
    for (uint8_t i = 0; i < 16; i++) {
        if (x->b[i] == 0x00) break;
-        printf("%c", x->b[i]);
+        dprintf("%c", x->b[i]);
    }
    dprintf("\n");
 };
@@ -21,76 +35,116 @@ void print_chars_w128(w128_t *x) {
 void print_chars(uint8_t *c) {
    for (uint8_t i = 0; i < 32; i++) {
        if (c[i] == 0x00) break;
-        printf("%c", c[i]);
+        dprintf("%c", c[i]);
    }
    dprintf("\n");
 };

 void print_int(uint8_t *c) {
    for (uint8_t i = 0; i < 32; i++) {
-        printf("%d", c[i]);
+        dprintf("%d", c[i]);
    }
    dprintf("\n");
 };

-void decrypt_pass_kuzn(const uint8_t encrypted_passwords[2][16]) {
+void print_hex(uint8_t *h) {
+    for (uint8_t i = 0; i < 32; i++) {
+        dprintf("%x ", h[i]);
+    }
+    dprintf("\n");
+};
+
+size_t min_len(size_t a, size_t b) {
+    if (a < b)
+        return a;
+    else
+        return b;
+}
+
+void decrypt_pass_kuzn(const uint8_t encrypted_passwords[STORAGE_SIZE][STORAGE_PASS_LEN]) {
    kuz_key_t key;
    w128_t    x;

+    init_dec_pass();
+
+#ifdef USE_SHA256_KEY
+    SHA256_CTX ctx;
+    sha256_init(&ctx);
+    sha256_update(&ctx, readed_key, min_len(u_strlen(readed_key), MAX_KEY_LEN));
+    BYTE result_key[SHA256_BLOCK_SIZE];
+    sha256_final(&ctx, result_key);
+    print_hex(result_key);
+    kuz_set_decrypt_key(&key, result_key);
+#endif
+#ifndef USE_SHA256_KEY
    kuz_set_decrypt_key(&key, readed_key);
-    for (uint8_t j = 0; j < 2; j++) {
-        for (uint8_t i = 0; i < 16; i++) {
-            x.b[i] = encrypted_passwords[j][i];
-        }
-        kuz_decrypt_block(&key, &x);
-
+#endif
+    for (uint8_t j = 0; j < STORAGE_SIZE; j++) {
+#ifdef USE_RED_CRY_DEBUG
        dprintf("decrypted\t=");
-        print_w128(&x);
-        print_chars_w128(&x);
+#endif
+        for (uint8_t k = 0; k < STORAGE_PASS_LEN / 16; k++) {
+            uint8_t cnt_zeros = 0;
+            for (uint8_t z = 0 + k * 16; z < 16 + k * 16; z++) {
+                if (encrypted_passwords[j][z] == 0x00) {
+                    cnt_zeros++;
+                } else {
+                    cnt_zeros = 0;
+                    break;
+                }
+            }
+            if (cnt_zeros != 0) break; // if there is zero 8 byte block in password, e.g. password length <32 or <64

-        for (uint8_t i = 0; i < 16; i++) {
-            dec_pass[j][i] = x.b[i];
+            for (uint8_t i = 0 + k * 16; i < 16 + k * 16; i++) {
+                x.b[i % 16] = encrypted_passwords[j][i];
+            }
+
+            kuz_decrypt_block(&key, &x);
+
+            for (uint8_t i = 0 + k * 16; i < 16 + k * 16; i++) {
+                dec_pass[j][i] = x.b[i % 16];
+            }
+
+#ifdef USE_RED_CRY_DEBUG
+            print_w128(&x);
+            print_chars_w128(&x);
+#endif
        }
    }
-
 };

 // TODO: add encrypt new passwords with binding on new keys
 // and storing all these to EEPROM
 // void encrypt_pass_kuzn(){
-    // kuz_set_encrypt_key(&key,readed_key);
-    // for (uint8_t i=0; i<16; i++) {
-    //     x.b[i] = pass[i];
-    // }
-    // kuz_encrypt_block(&key,&x);
-    // printf("encrypted\t="); print_w128(&x);
-    // print_chars_w128(&x);
+// kuz_set_encrypt_key(&key,readed_key);
+// for (uint8_t i=0; i<16; i++) {
+//     x.b[i] = pass[i];
+// }
+// kuz_encrypt_block(&key,&x);
+// printf("encrypted\t="); print_w128(&x);
+// print_chars_w128(&x);
 // }

 void send_chars_pass(uint8_t *out) {
-    for (uint8_t i = 0; i < 16 && out[i] != 0; i++) {
+    for (uint8_t i = 0; i < STORAGE_PASS_LEN && out[i] != 0; i++) {
        send_char((char)out[i]);
    }
 };

-uint8_t crypto_process_record_user(uint16_t keycode, keyrecord_t *record, const uint8_t encrypted_passwords[2][16]) {
+uint8_t crypto_process_record_user(uint16_t keycode, keyrecord_t *record, const uint8_t encrypted_passwords[STORAGE_SIZE][STORAGE_PASS_LEN]) {
    if (crypto_mode) {
        switch (keycode) {
-            // case KC_1:
-            //     if (record->event.pressed) {
-            //         readed_key[count_char_key] = ASCII_LOW_1;
-            //         count_char_key++;
-            //     }
-            //     return 1;
-            //     break;
            case RED_CRY_M:
                if (record->event.pressed) {
+#ifdef USE_RED_CRY_DEBUG
                    print_int(readed_key);
+#endif
                    crypto_mode    = 0;
                    count_char_key = 0;
                    decrypt_pass_kuzn(encrypted_passwords);
                }
            default:
+                // reading key
                return kc_to_ascii(keycode, record, readed_key, &count_char_key);
                break;
        }
@@ -106,6 +160,22 @@ uint8_t crypto_process_record_user(uint16_t keycode, keyrecord_t *record, const
                    send_chars_pass(dec_pass[1]);
                }
                break;
+            case RED_PASS3:
+                if (record->event.pressed) {
+                    send_chars_pass(dec_pass[2]);
+                }
+                break;
+            case RED_PASS4:
+                if (record->event.pressed) {
+                    send_chars_pass(dec_pass[3]);
+                }
+                break;
+            // if you want to add more keys for passwords, copy this `case`
+            // case RED_PASSX: //change X here
+            //     if (record->event.pressed) {
+            //         send_chars_pass(dec_pass[X]); //change X here
+            //     }
+            //     break;
            case RED_RNG:
                if (record->event.pressed) {
                    // TODO: change seed
@@ -3,37 +3,58 @@
 #include QMK_KEYBOARD_H
 #include "quantum.h"

-
 #ifndef RED_CRYPTO_H
-#define RED_CRYPTO_H
+#    define RED_CRYPTO_H

-#include "kc_to_ascii.h"
+#    include "kc_to_ascii.h"

 // #ifdef USE_RED_KUZNECHIK_128
 // #include "kuznechik_128bit.h"
 // #endif
-#ifdef USE_RED_KUZNECHIK_8
-#include "kuznechik_8bit.h"
-#include "sha256.h"
-#endif

-#ifdef USE_RED_AES_256
-#include "aes.h"
-#endif
+#    ifdef USE_RED_KUZNECHIK_8
+#        include "kuznechik_8bit.h"
+#        ifdef USE_SHA256_KEY
+#            include "sha256.h"
+#        endif
+#    endif
+
+#    ifdef USE_RED_AES_256
+#        include "aes.h"
+#    endif
+
+#    define MAX_KEY_LEN 128
+
+#    ifndef STORAGE_SIZE
+#        define STORAGE_SIZE 4
+#    endif
+
+#    ifdef STORAGE_PASS_LEN
+#        if STORAGE_PASS_LEN % 16 != 0
+#            error Storage password length must be a multiple of 16
+#        endif
+#    endif
+
+#    ifndef STORAGE_PASS_LEN
+#        define STORAGE_PASS_LEN 64
+#    endif


+//example for encrypted 64 byte password
+// const uint8_t red_enc_pass[STORAGE_SIZE][STORAGE_PASS_LEN] = {
+//     {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+//      0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+//      0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 
+//      0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
+// };

 enum red_crypto_keys {
-    RED_CRY_M = SAFE_RANGE+0x80,     // added safe range offset
-    RED_PASS1,
-    RED_PASS2,
+    RED_CRY_M = SAFE_RANGE + 0x80, // added safe range offset
    RED_RNG,
-    RED_TEST
+    RED_TEST,
+    RED_PASS1, RED_PASS2, RED_PASS3, RED_PASS4, RED_PASS5, RED_PASS6, RED_PASS7, RED_PASS8, RED_PASS9, RED_PASS10, RED_PASS11, RED_PASS12
 };

-uint8_t crypto_process_record_user(uint16_t keycode, keyrecord_t *record, const uint8_t encrypted_passwords[2][16]);
-
+uint8_t crypto_process_record_user(uint16_t keycode, keyrecord_t *record, const uint8_t encrypted_passwords[STORAGE_SIZE][STORAGE_PASS_LEN]);

 #endif
-
-
@@ -158,13 +158,14 @@ void sha256_final(SHA256_CTX *ctx, BYTE hash[])
 	}
 }

-/*********************** TEST FUNCTION DEFINITIONS ***********************/
-#ifdef TEST_FUNCTIONS_ENABLED
-inline size_t u_strlen(const unsigned char * array)
+size_t u_strlen(const unsigned char * array)
 {
    return strlen((const char*)array);
 }

+/*********************** TEST FUNCTION DEFINITIONS ***********************/
+#ifdef TEST_FUNCTIONS_ENABLED
+
 void exec_sha256_test(void)
 {
 	BYTE text1[] = {"abc"};
@@ -31,6 +31,7 @@ typedef struct {
 void sha256_init(SHA256_CTX *ctx);
 void sha256_update(SHA256_CTX *ctx, const BYTE data[], size_t len);
 void sha256_final(SHA256_CTX *ctx, BYTE hash[]);
+size_t u_strlen(const unsigned char * array);

 // test
 #ifdef TEST_FUNCTIONS_ENABLED
Author	SHA1	Message	Date
redlineo	c890ad0c33	fix syntax for qmk	2025-01-22 07:11:18 +00:00
redlineo	aaa6f71708	unified dec_pass array, update readme	2025-01-22 07:02:14 +00:00
redlineo	90399dc61b	update readme	2025-01-21 17:43:33 +00:00
redlineo	1e18045a38	update readme	2025-01-21 17:40:40 +00:00
redlineo	6d8cbd1277	expanded storage size and password length	2025-01-21 10:11:23 +00:00
redlineo	c615c136b1	update readme	2025-01-21 07:52:06 +00:00
redlineo	6b2605d270	add hashing key with SHA256, update readme	2025-01-21 07:47:11 +00:00
redlineo	842beb2716	expand key lenght, add key hashing	2025-01-20 14:55:18 +00:00
redlineo	4630460b88	update readme	2025-01-20 14:41:53 +00:00
redlineo	9e653cab69	merged kc_to_ascii with main, add debug define, update readme	2025-01-20 14:06:45 +00:00