mirror of
https://github.com/liquidraver/ZephCore.git
synced 2026-09-02 02:08:25 +00:00
liquidraver
8d138c41b3
Tracks upstream meshcore-dev/MeshCore#2556 — passwords sent as plaintext over encrypted links are vulnerable to evil-twin/phishing attacks (attacker advertises a repeater with the same name but a different pubkey; user picks the wrong one and types the password). The structural fix is a protocol change (PAKE adoption — SPAKE2, OPAQUE, or HMAC-with-both-pubkeys) and must land synchronously across all implementations. Diverging unilaterally would break interop with Arduino-based companions and repeaters, so we wait for upstream. Two within-protocol mitigations applied server-side: 1. Constant-time password comparison. Replaced strcmp() in RepeaterMesh::handleLoginReq with a local ct_memeq() helper. Pads the received password to the full 16-byte storage size, XOR-accumulates byte differences with no early exit. Compares both admin and guest passwords unconditionally so timing is identical regardless of which (if any) the attempt resembled. Eliminates the timing oracle that lets an already-MITM attacker recover the stored password byte-by-byte. 2. Failed-login rate limit. New login_fail_limiter(4, 180) RateLimiter — 4 wrong-password attempts per 180s, matching the existing anon_limiter pattern. Hitting the cap trips a distinct LOG_WRN so operators see active brute-force attempts in logs. Global rate (not per-sender) — simpler, no ACL state bloat; trade-off documented in CRYPTO_AUDIT_INDEX.md. What's NOT fixed: the wire protocol still carries plaintext passwords. The evil-twin attack itself remains possible; these mitigations raise the attacker's cost (no timing leak, no brute-force at line rate) but don't replace the structural fix. UI-side defenses (TOFU warnings on duplicate names, pubkey fingerprint display) are valuable companion-side mitigations but out of scope for this audit's server-side commit.