README

Encryption Algorithm

Password transmission exists in various scenarios. For example, when formatting the hard disk, enter the current password for secondary authentication, set user password, set email password, etc.

(1) The procedure for the client to use the PBKDF2_SHA256 encrypted password for secondary authentication is: salt = base64_decode(key); outlen = 32; enc = PBKDF2(salt, pwd, iter, outlen); --------> openssl PKCS5_PBKDF2_HMAC , and EVP_sha256() cipher = base64_encode(enc);

(2) The client adopts X25519 to encrypt and transmit the password process as follows: Encryption Algorithm: aes_256_gcm The source of Key and iv: the secret is calculated through X25519, and then the key and iv are obtained through hkdf expand; "0" is a parameter in our encryption library, which represents a certain algorithm and needs to participate in key negotiation transmission along with the encryption and decryption

    evp_pkey = (my_pri, my_pub) = generate_X25519_key;
    key_1 = remove "0" from key;
    device_peer_key = base64_decode(key_1);
    secret = X25519_derive(device_peer_key, evp_pkey);
    aes_256_gcm_key = hkdf_expand(secret, label = "expand key", out_len = 32);
    aes_256_gcm_iv = hkdf_expand(secret, label = "expand iv", out_len = 12);

Output:

peer_key = "0" + base64(EVP_PKEY_get_raw_public_key (evp_pkey))  //Here is passing your own public key to the device.
cipher = base64( aes_256_gcm(password, key, iv) + aes_256_gcm_iv + tag )
// tag_len = 16, key_len = 32, iv_len = 12

Assistance Tools

Below are the web pages we provide for calculating ciphers, which will assist you in determining whether the calculated values of the cipher are correct.

1. Calculate the cipher for the secondary authentication pbkdf2.html
2. Calculate the cipher of the password encrypted field x25519.html

Instructions:

1. pbkdf2.html: Open the widget webpage, input word, salt, and iter values in sequence, and click commit to start running. Among them, word is the password to be encrypted, salt is the random string used to disturb the real password, and iter is the number of iterations. The final result of the operation will be printed in result, and the encrypted value is the calculated ciphertext.
2. x25519.html: Open the widget webpage, input the values of word and peer public in turn, and click commit to start running. Among them, word is the password to be encrypted, and peer public is the public key obtained from nvr. The final result of the run will be printed in result. In encrypted, the value of public is the public key generated by the client, which will be sent to nvr for decryption, and the value of encrypted is the calculated ciphertext.

Specific Scenarios of Secondary Authentication

Below, we use device reboot as an example.

Specific Scenarios of Password Encryption

Below, we use setting up an email account as an example.