| 25 | } |
| 26 | |
| 27 | void CredentialManager::initializeEncryptionKey() { |
| 28 | #if defined(ESP32) |
| 29 | esp_err_t err = esp_efuse_read_block(EFUSE_BLK_KEY0, m_encryption_key, 0, |
| 30 | ENCRYPTION_KEY_SIZE * 8); |
| 31 | |
| 32 | if (err == ESP_OK) { |
| 33 | // Check if truly programmed (not all 0xFF) |
| 34 | bool all_ff = true; |
| 35 | for (int i = 0; i < ENCRYPTION_KEY_SIZE; i++) { |
| 36 | if (m_encryption_key[i] != 0xFF) { |
| 37 | all_ff = false; |
| 38 | break; |
| 39 | } |
| 40 | } |
| 41 | |
| 42 | if (!all_ff) { |
| 43 | m_efuse_initialized = true; |
| 44 | log_info("BLOCK_KEY0 initialized from eFuse - SECURE mode"); |
| 45 | } else { |
| 46 | log_info("BLOCK_KEY0 not programmed - using fallback (NOT SECURE)"); |
| 47 | m_efuse_initialized = false; |
| 48 | // Use fallback key (derived from MAC address or constant) |
| 49 | // This obfuscates but is not real security |
| 50 | memset(m_encryption_key, 0xAA, ENCRYPTION_KEY_SIZE); |
| 51 | } |
| 52 | } else { |
| 53 | log_error("Failed to read BLOCK_KEY0: %s", esp_err_to_name(err)); |
| 54 | // Fallback to predefined key |
| 55 | memset(m_encryption_key, 0xAA, ENCRYPTION_KEY_SIZE); |
| 56 | } |
| 57 | #else |
| 58 | // For ESP8266 or other chips, use fallback |
| 59 | memset(m_encryption_key, 0xAA, ENCRYPTION_KEY_SIZE); |
| 60 | #endif |
| 61 | } |
| 62 | |
| 63 | String CredentialManager::getStatus() const { |
| 64 | if (m_efuse_initialized) { |
nothing calls this directly
no outgoing calls
no test coverage detected