From 5a102bb511d8776a4f74f60813e990f91bb11124 Mon Sep 17 00:00:00 2001 From: portersky Date: Mon, 17 Aug 2026 15:05:08 +0200 Subject: [PATCH] docs: mark crypto checklist items resolved Update the AES-CCMP investigation checklist and quick reference to reflect the completed crypto backend choice, on-chip CCMP, and validated P-256 ECDH. Co-Authored-By: deepseek (deepseek/deepseek-v4-pro-0813): updated crypto docs --- README.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index ecf5b2a..1514583 100644 --- a/README.md +++ b/README.md @@ -62,12 +62,14 @@ Strike through or check off as each is resolved. ### 5. AES-CCMP Encryption -- [ ] **Crypto backend choice** — Decide between: - - **CommonCrypto** (system, zero deps) — `CCryptorCreate()` for AES-CTR/CBC - - **Security.framework** (system) — `SecKeyRef` for ECDH key exchange - - **libcrypto/OpenSSL** (Homebrew) — `EVP_*` APIs, more familiar but external dep -- [ ] **CCMP mode implementation** — AES-CCMP = AES-CTR encryption + AES-CBC-MAC authentication. Neither CommonCrypto nor OpenSSL has a direct CCMP API. Need to implement the mode manually (encrypt then MIC, or verify MIC then decrypt). -- [ ] **ECDH key exchange** — The authentication handshake uses ECDH (P-256 curve). Test `SecKeyCreateWithData()` + `SecKeyCopyKeyExchangeResult()` on macOS for key agreement. +- [x] **Crypto backend choice** — CommonCrypto (SHA-256/HMAC), Security.framework + (RSA PKCS#1), and a self-contained P-256 ECDH (no public macOS C API for EC + key agreement). Implemented in `src/auth/crypto.cpp`. +- [x] **CCMP mode implementation** — Not needed on the host: AES-CCMP runs on the + MT76 chip; the host only installs keys via WCID registers + (`xone_mt76_set_client_key`). +- [x] **ECDH key exchange** — P-256 implemented and validated against + OpenSSL-derived test vectors (`tests/test_crypto.cpp`). ### 6. Virtual HID Gamepad @@ -112,7 +114,7 @@ Strike through or check off as each is resolved. | `kzalloc` / `kfree` | `malloc` / `free` | ✅ Straightforward | | `spin_lock_irqsave` | `pthread_mutex_t` or lock-free | ☐ Design | | `msleep` / `mdelay` | `usleep()` / `clock_nanosleep()` | ☐ Test timing | -| `crypto_shash_*` | CommonCrypto / Security.framework | ☐ Choose backend | +| `crypto_shash_*` | CommonCrypto / Security.framework | ✅ Done (`auth/crypto.cpp`) | | `input_register_device()` | HID Proxy Driver / IOHIDSystem | ☐ Investigate | | `snd_pcm_*` | Core Audio (Audio Units) | ☐ Investigate | | `request_firmware()` | File I/O (`fopen`/`fread`) | ✅ Straightforward |