by evgpbfhnr | 2025-09-23 22:14:17+00:00
"How it works" https://realtimelogic.com/ba/doc/en/SoftTPM.html

I couldn't find "actual sources", but one of their github repo has this: https://github.com/RealTimeLogic/BAS/blob/main/examples/Mako...

Which extracts to this .config file (looks like lua code, that creates a secret from PBKDF2 of... what? I couldn't find where secrets would come from here, but that repo obviously misses the interesting bindings; from the how it works link it looks like they're just hashing the SN to generate a pseudorandom key but I don't see why you couldn't just generate a key for neighboring devices by just faking the SN then...)

local maxHash=pcall(function() ba.crypto.hash("sha512") end) and "sha512" or "sha256" local sfmt,jencode,jdecode,symmetric,PBKDF2,keyparams,sign,jwtsign,createkey,createcsr,sharkcert= string.format,ba.json.encode,ba.json.decode,ba.crypto.symmetric,ba.crypto.PBKDF2,ba.crypto.keyparams, ba.crypto.sign,require"jwt".sign,ba.create.key,ba.create.csr,ba.create.sharkcert local function setuser(ju,db,name,pwd) if pwd then if type(pwd) == "string" then pwd={pwd=pwd,roles={}} end db[name]=pwd else db[name]=nil end local ok,err=ju:set(db) if not ok then error(err,3) end end local function tpm(gpkey,upkey) local keys={} local function tpmGetKey(kname) local key=keys[kname] if not key then error(sfmt("ECC key %s not found",tostring(kname)),3) end return key end local function tpmSign(h,kname,op) return sign(h,tpmGetKey(kname),op) end local function tpmJwtsign(p,kname,op) return jwtsign(p,function(h) return sign(h,tpmGetKey(kname)) end,op) end local function tpmKeyparams(kname) return keyparams(tpmGetKey(kname)) end local function tpmCreatecsr(kname,...) return createcsr(tpmGetKey(kname),...) end local function tpmCreatekey(kname,op) if keys[kname] then error(sfmt("ECC key %s exists",kname),2) end op = op or {} if op.key and op.key ~= "ecc" then error("TPM can only create ECC keys",2) end local newOp={} for k,v in pairs(op) do newOp[k]=v end newOp.rnd=PBKDF2(maxHash,"@#"..kname,upkey,5,1024) local key=createkey(newOp) keys[kname]=key return true end local function tpmHaskey(kname) return keys[kname] and true or false end local function tpmSharkcert(kname,certdata) return sharkcert(certdata,tpmGetKey(kname)) end require"acme/engine".setTPM{jwtsign=tpmJwtsign,keyparams=tpmKeyparams,createcsr=tpmCreatecsr,createkey=tpmCreatekey,haskey=tpmHaskey} local t={} function t.haskey(k) return tpmHaskey(k) end function t.createkey(k,...) return tpmCreatekey(k,...) end function t.createcsr(k,...) return tpmCreatecsr(k,...) end function t.sign(h,k,o) return tpmSign(h,k,o) end function t.jwtsign(k,...) return tpmJwtsign(k,...) end function t.keyparams(k,...) return tpmKeyparams(k,...) end function t.sharkcert(k,...) return tpmSharkcert(k,...) end function t.globalkey(n,l) return PBKDF2(maxHash,n,gpkey,5,l) end function t.uniquekey(n,l) return PBKDF2(maxHash,n,upkey,5,l) end function t.jsonuser(k,global) k=PBKDF2("sha256","@#"..k,global and gpkey or upkey,6,1) local function enc(db) local iv=ba.rndbs(12) local gcmEnc=symmetric("GCM",k,iv) local cipher,tag=gcmEnc:encrypt(jencode(db),"PKCS7") return iv..tag..cipher end local function dec(encdb) if encdb and #encdb > 30 then local iv=encdb:sub(1,12) local tag=encdb:sub(13,28) local gcmDec=symmetric("GCM",k,iv) local db pcall(function() db=jdecode(gcmDec:decrypt(encdb:sub(29,-1),tag,"PKCS7")) end) if db then return db end end return nil,"Data corrupt" end local ju,db=ba.create.jsonuser(),{} return { users=function() local x={} for u in pairs(db) do table.insert(x,u) end return x end, setuser=function(name,pwd) setuser(ju,db,name,pwd) return enc(db) end, setdb=function(encdb) local d,err,ok=dec(encdb) if d then ok,err=ju:set(d) if ok then db=d return ok end end return nil,err end, getauth=function() return ju end } end ba.tpm=t end local klist={} return function(x) if true == x then local hf=ba.crypto.hash(maxHash) for _,k in ipairs(klist) do hf(k) end tpm(ba.crypto.hash(maxHash)(klist[1])(true),hf(true)) klist=nil return end table.insert(klist,x) end