Secure iButton

Project Secure iButton
Status	In progress
Contact	User:Bertrik Sikken
Last Update	2013-01-09

purge cache

	Project Name	Project Status	Project Contact
35c3bus	35C3Bus	Abandoned	Bas
Afkortzaag Trolley	Afkortzaag Trolley	Abandoned	Crashjuh
Bakfiets	Bakfiets	Abandoned	Hammercat
Blahaj counter	Blahaj counter	Abandoned	Noor
BBQ Dak	Dak voor de BBQ space	Abandoned	Cfw
DeCRASH	DeCRASH	Abandoned	Crashjuh
Esp32ink	ESP32Ink	Abandoned	Bas
EpsonHX20	Epson HX20	Abandoned	Bas
FrontDoorDisplay	FrontDoorDisplay	Abandoned	Bertrik Sikken
HabAlertApp	HAB alert app	Abandoned	Bertrik Sikken
HackVerbatimPowerBay	Hacking the Verbatim PowerBay Nas	Abandoned	FooBar
ISSO	ISSO	Abandoned	Bertrik Sikken Bas
IbmPosDisplay	IbmPosDisplay	Abandoned	Bertrik Sikken
Ik leg een tientje in	Ik leg een tientje in	Abandoned	Bas
ImprovedLaosLaser	Improved LaosLAser	Abandoned	FooBar
KinderSupriseChallenge	KinderSupriseChallenge	Abandoned	Crashjuh Jelly Bas
Klokkie	Klokkie	Abandoned	Pwuts
Knopje 2	Knopje 2	Abandoned	Bas
Lange lichtkrant	Lange Lichtkrant	Abandoned	Maxell Bas
Lasercutter2	Lasercutter2	Abandoned	Mux
RevSpace App	MacOS in Qemu-KVM RevSpace App	Abandoned Completed	Peetz0r
Noise cancelling megaphone	Noise Cancelling Megaphone	Abandoned	Walter
Noodlamp 2.0	Noodlamp 2.0	Abandoned	Pwuts
Norfolk	Norfolk	Abandoned	Qguv
Pico Trackers	Pico Trackers	Abandoned	Bertrik Sikken
RadarOnAStick	RadarOnAStick	Abandoned	Bertrik Sikken
Projects/RevDome	RevDome	Abandoned	Walter
Lathe	RevLathe	Abandoned	Pwuts
RevSmoker	RevSmoker	Abandoned	Gori
RevQuest	Revspace Oculus Quest	Abandoned	Bas
RevspaceMug	RevspaceMug	Abandoned	Bas
Rf24deurbel	Rf24deurbel v1.1	Abandoned	Crashjuh
Ruimteposters	Ruimteposters	Abandoned	Bas
SEM oud	SEM	Abandoned	PeterC Shiz Peterbjornx
Space-tv	Space-tv	Abandoned	Dave o
SparkShack 2	SparkShack	Abandoned	Morphje Gori Juerd Bas
SparkshackAlert	SparkshackAlert	Abandoned	Bas
SpiekerFoon	SpiekerFoon	Abandoned	Pwuts
Thuisrecepten	Thuisrecepten	Abandoned	F0x Bas
Transpotter	Transpotter	Abandoned	Bas
UMD	UMD	Abandoned	Eightdot Bas
Useless Machine	Useless Machine	Abandoned	Costyn van Dongen
Watermeter	Watermeter	Abandoned	Bas
WifiLamp	WifiLamp	Abandoned	Bertrik Sikken
Zwart	Zwart	Abandoned	Boekenwuurm Bas
RevUAV	revUAV	Abandoned	Marcel
!revbank	!revbank	Completed	Juerd
35C3 Tickets	35C3 Tickets	Completed	FooBar
36C3 Streams	36C3 Streams kijken	Completed	Bas
36C3 Tickets	36C3 Tickets	Completed	Bestuur
4G IoT	4G IoT	Completed	Juerd
A4PaperDispenser	A4PaperDispenser	Completed	Bertrik Sikken Bas
ACS Current probe	ACS730 Hall-Effect Current Probe	Completed	Kartoffel
AddiSpecificKnittingLoom	Addi compatible knitting loom	Completed	Molenaar
Analogecams	Analoge Cams	Completed	Peetz0r Bas
Another JBC	Another JBC	Completed	Bas
Arcade repair course	Arcade console repair classes	Completed	Mahjongg
Assembling RhoCoCo	Assembling a RhoCoCo home computer	Completed	Mahjongg
Augurken	Augurken	Completed
Barcodebeestje	Barcodebeestje	Completed	Bas
... further results

This project is about investigating and using the secure features of the iButton that people currently use for physical access to RevSpace.

Planned project phases are:

• phase 1: investigate possbilities of the iButton and experiment with it
• phase 2: write software for the iButton functionality and package it into a library
• phase 3: apply knowledge and software for application within RevSpace

iButton investigation

The iButton used at RevSpace is the DS1961, with the following features:

• 4 pages of 32-byte user data each
• an 8-byte write-only "secret"
• SHA-1 algorithm that can calculate a hash over a 32-byte user data page, the 8-byte secret, a 3-byte "challenge" and the unique iButton id.

Basically authentication could work like this:

• (the secret key has been installed on the iButton previously)
• user presents iButton to the reader
• reader reads the unique iButton id
• reader generates a random number and uses this as the challenge to read a 32-byte user page
• iButton sends the user page, followed by the SHA-1 hash
• reader also calculates SHA-1 hash and compares it with the iButton hash
• if the hash matches, the user data can be considered as authentic and the reader can interpret the user data as a "deelnemer id" (or something) for example.

Bus pirate experimentation

Investigation of the DS1961-specific commands can be done with a Bus Pirate. A bus pirate speaks the 1-wire protocol that any iButton-like device uses.

Examples of bus pirate commands to communicate with the DS1961:

• Initialise the bus pirate

  # (reset the bus pirate)
  M (select mode)
  2 (1-wire mode)
  W (enable power)

• Reset the iButton and get iButton unique id

  (240)

• Write scratchpad (command 0x0F) at address 0,0 with data 1 2 3 4 5 6 7 8

  0x0f 0 0 1 2 3 4 5 6 7 8 r:2

• Read scratchpad (command 0xAA)

  0xaa r:3 r:8 r:2

• Read auth page (command 0xA5), which is the secure read command

  0xa5 0 0 r:32 r r:2 &:1500 r:20 r:2

Example response:

1-WIRE>0xa5 0 0 r:32 r r:2 &:1500 r:20 r:2
WRITE: 0xA5
WRITE: 0x00
WRITE: 0x00
READ 0x20 BYTES:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
READ: 0xFF
READ 0x02 BYTES:
0x6D 0x0D
DELAY 0xDCuS
READ 0x14 BYTES:
0x45 0x31 0x40 0x42 0xAE 0xD3 0x4B 0xC5 0x18 0xCC 0x10 0x43 0x27 0x56 0x33 0xD0 0xEB 0x47 0xA7 0x81
READ 0x02 BYTES:
0xAA 0x6D

DS1961 library

This library provides an API for the DS1961 specific functions. It will be targeted at the Arduino microcontroller, to run on top of the existing 1-wire library.

Application

We could apply this to improve the security of RevSpace access for example. to be discussed.

Stuff to be considered for access control:

• an extra initialisation step to install the secret before use is needed
• how can we handle the transition of the current iButton system to a more secure system?
• how advanced do we make the authentication scheme / how is key management handled?
  • Simplest: one secret for all revspace iButtons. Disadvantage: cracking one iButton means that *all* revspace iButtons are cracked.
  • More advanced: different secret for each revspace iButton (e.g. calculated from a master secret and the iButton serial number)
  • More advanced: master secret is re-newed every X time, so we have multiple versions of the master secret (e.g. renewed each year)

External Links

Maxim iButton 1-wire public domain kit