commit 85aa43b1e9e06a1604c8df8e0e41ea86d8dbf4c1
parent 211cce207a638cde337567bb6faa624f375b4c9c
Author: Daniel Barlow <dan@telent.net>
Date: Wed, 11 Feb 2026 19:27:16 +0000
notes
Diffstat:
| M | notes.md | | | 49 | ++++++++++++++++++++++++++++++++++++++++++++++++- |
1 file changed, 48 insertions(+), 1 deletion(-)
diff --git a/notes.md b/notes.md
@@ -61,7 +61,7 @@ https://www.1000rr.net/threads/k-line-ecu-logging.247922/
- 2016 forum thread "Whipped up a simple circuit to interface with
the K-Line interface found on that red adapter under the seat. "
-
+
https://www.carlsalter.com/mcpdf/Honda%20-%20cbr125rw-service-manual.pdf
- wirig diagram, yay. !Caution: this is 2007 model!
pin 1 Bl/W IGP "ignition power" (also seen on DLC)
@@ -169,3 +169,50 @@ O wifi provisioning over ble
- add an IMU to get lean angles
- stop hardcoding BLE address
```
+
+---
+
+We don't think impersonation is a big threat, because it requires
+having physical access and the ignition key in order to power on the
+device
+
+However, there is the problem that the wifi password is transmitted plaintext
+so an attacker could use this to get access to the wifi.
+
+In the current hardware confiudation, BLE pairing won't help, as it is
+susceptible to MITM without a display and an input device. While it
+is conceivable that there is some input to the ECU we could could
+co-opt for saying "yes" or "no" to a displayed PIN, there is nowhere
+to display it.
+
+If we add an NFC transceiver we could use OOB pairing. the nfc chip
+could be stuck to the inside of the rear tail fairing just next to the
+ecu. The need for physical access makes it more secure but also a bit
+less convenient for pairing with a bluetooth in the shed when the bike
+is parked (e.g. to do ota updates)
+
+how about using the ed25519 key we have for ota/sessionm auth?
+
+1) the device generates a random 32 byte token, then encrypts it using the
+client's private ed25519 key and publishes the ciphertext using GATT
+
+2) the client decrypts it and uses it as a key for aes-ccm encrypting the
+wifi password
+
+3) the device decrypts that and, if successful, stores the secret
+
+
+
+https://docs.espressif.com/projects/rust/esp-hal/1.0.0-beta.0/esp32c3/esp_hal/aes/struct.Aes256.html
+
+this does not seem to expose any aes mode that has both encryption and
+message authenticity
+
+https://docs.rs/aes-ccm/latest/aes_ccm/
+
+this is software, but that's ok for what's probably quite a rare operation
+
+
+
+
+without a secon
