wesandClaude Fable 5
840cfaf5fc
The CAN write gate (page-42/43 challenge/response) is a 32-round TEA/XTEA-family Feistel keyed by a per-session 32-bit key; REMOTE_CONTROL = 0xB16B00B5. Verified 51/51 against captured challenge/response pairs across nodes 2A/61/75/F8 (one global key, not per-node), so the CAN path can now actuate, not just sense. - ids_can_auth.py Python reference + self-test (51/51) - esphome/ids_can_auth.h C++ port for the ESP32 node (host-tested 8/8) - sniff/analyze_auth.py structural analysis (rules out affine; confirms keyed cipher) - sniff/auth-pairs-multinode-2026-06-11.txt +9 pairs across 4 nodes - README document the cipher, session keys, unlock sequence Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
35 lines
1.5 KiB
Plaintext
35 lines
1.5 KiB
Plaintext
# Lippert IDS-CAN command-auth challenge/response pairs — MULTI-NODE
|
|
# Captured 2026-06-11, app-driven (phone app issued on/off/move commands).
|
|
# Source log: app-commands-2026-06-11_230059.log (node 2A bulk set lives in 2A-auth-pairs.txt).
|
|
#
|
|
# Exchange (controller node 01 <-> module node), all 29-bit extended frames:
|
|
# id = (src<<18) | (dir<<16) | (dest<<8) | page dir: 0 = 01->node, 1 = node->01
|
|
# arm 01->node page42 DLC2 "00 04"
|
|
# challenge node->01 page42 DLC6 "00 04 <CC CC CC CC>"
|
|
# response 01->node page43 DLC6 "00 04 <RR RR RR RR>"
|
|
# ack node->01 page43 DLC2 "00 04"
|
|
# format below: <challenge_hex> <response_hex> (the 4-byte payload tails)
|
|
#
|
|
# Confirmed: the SAME handshake gates every node tested — switched loads AND the
|
|
# awning (movement class). 51 pairs total across 4 nodes; response = f(challenge)
|
|
# is nonlinear (not GF(2)-affine, not Z/2^32-affine, full byte diffusion).
|
|
|
|
# node 61 — water pump (type 0x1E switched load)
|
|
61 FE06BF48 58AEA9BE
|
|
61 D57BE45A A1FB45E1
|
|
|
|
# node 75 — awning (type 0x21 H-bridge/movement) — full nonce gate, same as loads
|
|
75 A009E94C 5ADC2B0D
|
|
75 5F8A7647 4CA89152
|
|
75 6A873757 02592CF2
|
|
|
|
# node F8 — interior lights (type 0x1E switched load)
|
|
F8 F7740A20 BDB16954
|
|
F8 EDC9281A 87EFB3EF
|
|
|
|
# node 2A — exterior lights (type 0x1E) — 2 extra pairs from this session;
|
|
# 42 more in 2A-auth-pairs.txt (extlight-authpairs-*.log). 21CA0C06 is the pair
|
|
# the README used to rule out the BLE TEA key.
|
|
2A 21CA0C06 CC18366B
|
|
2A 4FC2C0FF 2B47861E
|