RED_CRYPTO ver 0.5.0

Description

Password manager for (almost) any QMK-compatible keyboards.

There are two versions:

• hard-coded passwords in keymap.c, change branch to hard_coded_storage or releases (YOU ARE HERE)
• storing passwords in EEPROM with adding and editing via RED_MENU, change branch to eeprom_storage or releases

Supports cryptographic algorithms

• Kuznechik (Russian GOST cipher)
• SHA256 (for hashing key)
• Streebog (for hashing key, Russian GOST hash algorithm)
• AES256

Features and plans

• add read all ASCII-printable symbols for key
• add Kuznechik lib for non 128 bit MCU
• use SHA256 for hashing key to set key length to 32 bytes
• expand stored passwords length from 16 byte to 64
• expand number of stored passwords (manual adding new keys)
• add CBC mode for Kuznechik, it will increase security

Installation

1. Clone this repo to your keymap folder.

2. Copy this string to rules.mk. Don't forget to insert your names. This is make rules for including all needed file to firmwire.

include keyboards/<your keyboard>/<path to your keymap folder>/red_crypto/red_crypto.mk 

3. Import library in keymap.c.

#include "red_crypto/red_crypto.h"

4. Define chosen algorithms and parameters in config.h. Now you can use only Kuznechik.

#define USE_KUZNECHIK_8

If you want use SHA256 of your key to encrypt passwords, define this in config.h.

#define USE_SHA256_KEY

Change storage size (default 4) and maximum password length (default 64).

#define STORAGE_SIZE 4
#define STORAGE_PASS_LEN 64 // use a multiple of 16, e.g. 16, 32, 64... but don't forget about available memory! 

5. Encrypt your passwords with chosen algorithm (AES, Kuznechik). Now available only Kuznechik. You can use CyberChef.

Don't use web version! We are here for security, right?

If you've enabled SHA256 for key, choose SHA2, then SHA256 mode and 64 rounds. Hash your key, then copy it to next step.

Choose GOST Encrypt, then choose type GOST R 34.12 (Kuznechik, 2015), not Magma. Choose mode ECB. Now there is no other modes for Kuznechik.

Don't forget IV for GOST

94208510C2C001FB01C0C21085209401

6. Add your encrypted passwords in keymap.c. Now you can encrypt 4 passwords with any length (16, 32, 64, more not tested).

Keep this information in secret. Even if there are no plaintext.

Chosen parameter STORAGE_PASS_LEN must be the same as the number of zeros in this array.

Chosen parameter STORAGE_SIZE must be the same as the number of passwords in this array.

const uint8_t encrypted_passwords[STORAGE_SIZE][STORAGE_PASS_LEN] = {
    {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
    };

If you want more passwords in storage, you should:

• add keys RED_PASSX into enum red_crypto_keys in red_crypto.h
• add into crypto_proccess_record_user handling new keys

7. Add new layer or set new keyes everywhere you want.

• RED_TEST - execute test functions of every algorithm with. Available only with #define TEST_FUNCTIONS_ENABLED and COMMAND_ENABLE=yes. You can see output via hid_listen.
• RED_CRY_M - execute reading password for encrypted passwords. After entering password, tap this key again. Now, you can use RED_PASSX keys.
• RED_PASSX - where X is number of your password in database. After tapping, keyboard send decrypted password.
• RED_RNG - use 32 times function named tap_random_base64 from QMK. It's for generating random strings. But now random seed is not unique for every keyboard's power on.

8. Copy this string to function process_record_user in keymap.c before all your code. It uses "switch case" construction inside.

    uint8_t crypto_return = crypto_process_record_user(keycode, event, encrypted_passwords);
    if (crypto_return == 1){
        return false;
    }

9. Compile and flash your keyboard.

Usage

Tap RED_CRY_M. Enter password. Tap RED_CRY_M again to confirm. Now you can use RED_PASSX to send decrypted passwords.

If you have missed while entering password, just tap RED_CRY_M and tap RED_CRY_M.

Related projects

Thanks to the authors of these repositories:

• https://github.com/mjosaarinen/kuznechik - kuznechik implementation for 8bit and 128bit
• https://github.com/B-Con/crypto-algorithms - other crypto algorithms