eculocate

commit 1a5314d2a390e84d0a817dbe2068b3a0fa659ef7
parent 4be552150423c5eb45335f73a1ef392eb23c1aa7
Author: Daniel Barlow <dan@telent.net>
Date:   Sun, 15 Feb 2026 17:57:07 +0000

make keypairs for secure ble

Diffstat:
M
Makefile
 | 
12
+++++++++++-
A
genkeys.py
 | 
17
+++++++++++++++++

2 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/Makefile b/Makefile
@@ -1,6 +1,6 @@
 IMAGE=./target/riscv32imc-unknown-none-elf/release/ecu-esp32
 
-$(IMAGE): $(wildcard ecu-esp32/src/*.rs) Makefile pubkey.bin ecu-esp32/Cargo.toml Cargo.toml
+$(IMAGE): $(wildcard ecu-esp32/src/*.rs) Makefile pubkey.bin ecu-esp32/Cargo.toml Cargo.toml keys/device.key keys/client.pub
 	echo $<
 	cargo build --release
 
@@ -16,8 +16,18 @@ ota: ota.bin
 install: $(IMAGE)
 	espflash flash  --erase-parts otadata --partition-table ./partitions.csv --monitor --chip esp32c3  $<
 
+# these keys are used during normal operation for signing session requests and
+# OTA updates
 privkey.pem:
 	openssl genpkey -algorithm ed25519 -out privkey.pem
 
 pubkey.bin: privkey.pem
 	openssl pkey -in $< -pubout  -text_pub | awk '/^ / {print}' | xxd -r -p > $@
+
+# these keys are used during wifi provisioning so we can authenticate
+# the peer
+keys/client.key keys/client.pub:
+	python genkeys.py keys/client.key
+
+keys/device.key keys/device.pub:
+	python genkeys.py keys/device.key
diff --git a/genkeys.py b/genkeys.py
@@ -0,0 +1,17 @@
+import nacl
+from pathlib import Path
+from nacl.public import PrivateKey, Box
+import sys
+
+secret = PrivateKey.generate()
+public = secret.public_key
+
+sk_filename = Path(sys.argv[1])
+sk_filename.parent.mkdir(exist_ok=True)
+
+with open(sk_filename, "w") as f:
+    f.buffer.write(secret.encode(encoder=nacl.encoding.RawEncoder))
+
+pk_filename = sk_filename.with_suffix(".pub")
+with open(pk_filename, "w") as f:
+    f.buffer.write(public.encode(encoder=nacl.encoding.RawEncoder))