HaloKeymind/docs/management_decoder.md

Management report decoder

Paste MGR1 management-report payloads or complete GroupData packets from a packet analyzer to read a radio's public management information. Everything, including password authentication and ACL decryption, happens locally in this browser. The report, password, and candidate public key are never uploaded.

The public portion of a report is deliberately plaintext, but it is not authenticated until a management password is supplied. A password-authenticated page proves that its public fields and encrypted ACL bytes have not been altered by someone who does not know that password.

Decode a management report

MGR1 payload or complete GroupData packet hex

Spaces, line breaks, colons, dashes, 0x, and MQTT JSON fields named raw or data are accepted. Paste all pages from one report together to view a complete multi-page ACL. Press Ctrl/Command+Enter to decode.

Management password (optional for public fields; required for ACLs)

The password remains in this page only. The decoder derives the MGR1 AES-SIV key in your browser and does not send it anywhere.

Candidate administrator public key (optional)

ACL encryption reveals per-radio 12-byte fingerprints, not recoverable public keys. Supplying a complete candidate key checks whether its fingerprint appears in this report.

Decode management report Clear local data Load authenticated example

Decode notes

Encrypted ACL entries

What the decoder accepts

• Complete PAYLOAD_TYPE_GRP_DATA (0x06) analyzer/MQTT packet hex. It checks the MeshCore route header, encoded path length, MGR1 page bounds, and required zero padding.
• A canonical MGR1 payload beginning with 4D475231 (MGR1).
• One raw packet or canonical payload per line; duplicate observations of an identical page are deduplicated.

Use the same password configured by set mgmt.password. A decoded ACL lists the report-specific fingerprints and the administrator and/or OTA-signer flags. It cannot turn a fingerprint back into a full key. Use the optional candidate field to test a specific full public key.

For the report schedule, public-field layout, cryptographic design, and the offline Python capture tool, see Management reports.