{

if (attempts == 0)

return 0;

uint32_t delay = 5u;

for (uint8_t i = 1; i < attempts; i++) {

delay *= 2;

if (delay >= 900)

return 900;

}

return delay;

{

if (!ephemeralKekDerived)

return false;

size_t labelLen = strlen(BACKOFF_AUTH_LABEL);

meshtastic_security::ZeroizingBuffer<32 + BACKOFF_BODY_SIZE> input; // labelLen <= 32

memcpy(input.data(), BACKOFF_AUTH_LABEL, labelLen);

memcpy(input.data() + labelLen, body, BACKOFF_BODY_SIZE);

return computeHMAC(ephemeralKek, AES_KEY_SIZE, input.data(), labelLen + BACKOFF_BODY_SIZE, out);

{

// Default outputs: zero-attempts. Reassigned to "max" below if the file

// is missing OR present-but-tampered. The fresh-device (pre-provision)

// case is handled by bumpBootsSinceFailOnBoot's early-return; once

// provision has run, the file is always present and a missing file

// means something hostile deleted it.

attempts = 0;

bootsSinceFail = 0;

lastFailEpoch = 0;

#ifdef FSCom

meshtastic_security::ZeroizingBuffer<BACKOFF_SIZE> buf;

{

concurrency::LockGuard g(spiLock);

auto f = FSCom.open(BACKOFF_FILENAME, FILE_O_READ);

if (!f) {

// Fresh device (no provision yet) OR an attacker deleted the

// file. Caller resolves the ambiguity via isProvisioned() -

// see bumpBootsSinceFailOnBoot and the unlock backoff gate.

return;

}

size_t sz = f.size();

if (sz != BACKOFF_SIZE) {

f.close();

attempts = kBackoffMaxAttempts;

return;

}

size_t n = f.read(buf.data(), BACKOFF_SIZE);

f.close();

if (n != BACKOFF_SIZE) {

attempts = kBackoffMaxAttempts;

return;

}

}

// Verify HMAC under lock-free CC310 access (we hold no spiLock here).

uint8_t expected[HMAC_SIZE];

nRFCrypto.begin();

bool ok = computeBackoffHmac(buf.data(), expected);

nRFCrypto.end();

if (!ok || !constTimeEq(expected, buf.data() + BACKOFF_BODY_SIZE, HMAC_SIZE)) {

// Tampered or attacker-rewritten file. Fail closed.

attempts = kBackoffMaxAttempts;

return;

}

attempts = buf.data()[0];

bootsSinceFail = buf.data()[1];

memcpy(&lastFailEpoch, buf.data() + 2, 4);

#endif

{

#ifdef FSCom

meshtastic_security::ZeroizingBuffer<BACKOFF_SIZE> buf;

buf.data()[0] = attempts;

buf.data()[1] = bootsSinceFail;

memcpy(buf.data() + 2, &lastFailEpoch, 4);

uint8_t mac[HMAC_SIZE];

nRFCrypto.begin();

bool ok = computeBackoffHmac(buf.data(), mac);

nRFCrypto.end();

if (!ok) {

LOG_ERROR("EncryptedStorage: backoff HMAC failed");

return;

}

memcpy(buf.data() + BACKOFF_BODY_SIZE, mac, HMAC_SIZE);

SafeFile sf(BACKOFF_FILENAME, /*fullAtomic=*/true);

sf.write(buf.data(), BACKOFF_SIZE);

if (!sf.close()) {

LOG_ERROR("EncryptedStorage: backoff atomic write failed");

}

#endif

{

if (!isProvisioned())

return;

uint8_t attempts;

uint8_t bootsSinceFail;

uint32_t lastFailEpoch;

readBackoff(attempts, bootsSinceFail, lastFailEpoch);

if (attempts == 0 || attempts == kBackoffMaxAttempts)

return;

if (bootsSinceFail < 255)

bootsSinceFail++;

writeBackoff(attempts, bootsSinceFail, lastFailEpoch);

{

writeBackoff(0, 0, 0);

s_backoffSecondsRemaining = 0;

s_lastFailMillis = 0;

{

// Copy FICR registers to local vars before memcpy (registers are volatile)

uint32_t tmp;

tmp = NRF_FICR->DEVICEID[0];

memcpy(efuseData, &tmp, 4);

tmp = NRF_FICR->DEVICEID[1];

memcpy(efuseData + 4, &tmp, 4);

tmp = NRF_FICR->DEVICEADDR[0];

memcpy(efuseData + 8, &tmp, 4);

tmp = NRF_FICR->DEVICEADDR[1];

memcpy(efuseData + 12, &tmp, 4);

uint8_t *output)

{

if (inputLen == 0)

return true;

SaSiAesUserContext_t ctx;

SaSiAesUserKeyData_t keyData;

SaSiAesIv_t iv;

memset(iv, 0, sizeof(iv));

size_t copyLen = (nonceLen < sizeof(iv)) ? nonceLen : sizeof(iv);

memcpy(iv, nonce, copyLen);

SaSiError_t err = SaSi_AesInit(&ctx, SASI_AES_ENCRYPT, SASI_AES_MODE_CTR, SASI_AES_PADDING_NONE);

if (err != 0) {

LOG_ERROR("EncryptedStorage: AES init failed: 0x%x", err);

return false;

}

keyData.pKey = (uint8_t *)key;

keyData.keySize = AES_KEY_SIZE;

err = SaSi_AesSetKey(&ctx, SASI_AES_USER_KEY, &keyData, sizeof(keyData));

if (err != 0) {

LOG_ERROR("EncryptedStorage: AES setkey failed: 0x%x", err);

SaSi_AesFree(&ctx);

return false;

}

err = SaSi_AesSetIv(&ctx, iv);

if (err != 0) {

LOG_ERROR("EncryptedStorage: AES setiv failed: 0x%x", err);

SaSi_AesFree(&ctx);

return false;

}

size_t processed = 0;

size_t fullBlocks = (inputLen / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;

if (fullBlocks > 0) {

err = SaSi_AesBlock(&ctx, (uint8_t *)input, fullBlocks, output);

if (err != 0) {

LOG_ERROR("EncryptedStorage: AES block failed: 0x%x", err);

SaSi_AesFree(&ctx);

return false;

}

processed = fullBlocks;

}

size_t remaining = inputLen - processed;

size_t finishOutSize = remaining;

err = SaSi_AesFinish(&ctx, remaining, (uint8_t *)input + processed, remaining, output + processed, &finishOutSize);

if (err != 0) {

LOG_ERROR("EncryptedStorage: AES finish failed: 0x%x", err);

SaSi_AesFree(&ctx);

return false;

}

SaSi_AesFree(&ctx);

return true;

{

CRYS_HASH_Result_t hmacResult;

CRYSError_t err = CRYS_HMAC(CRYS_HASH_SHA256_mode, (uint8_t *)key, (uint16_t)keyLen, (uint8_t *)data, dataLen, hmacResult);

if (err != 0) {

LOG_ERROR("EncryptedStorage: CRYS_HMAC failed: 0x%x", err);

return false;

}

memcpy(hmacOut, hmacResult, HMAC_SIZE);

return true;

{

uint8_t diff = 0;

for (size_t i = 0; i < len; i++)

diff |= a[i] ^ b[i];

return diff == 0;

{

uint8_t efuseData[16];

readFICR(efuseData);

static const char *prefix = "device-efuse-data";

uint8_t sha256Result[32];

nRFCrypto_Hash hash;

if (!hash.begin(CRYS_HASH_SHA256_mode)) {

LOG_ERROR("EncryptedStorage: SHA-256 init failed (KEK)");

meshtastic_security::secure_zero(efuseData, sizeof(efuseData));

return false;

}

hash.update((uint8_t *)prefix, strlen(prefix));

hash.update(efuseData, sizeof(efuseData));

hash.update((uint8_t *)passphrase, passphraseLen);

hash.update((uint8_t *)KEK_DOMAIN, strlen(KEK_DOMAIN));

hash.end(sha256Result);

memcpy(kek, sha256Result, AES_KEY_SIZE);

meshtastic_security::secure_zero(sha256Result, sizeof(sha256Result));

meshtastic_security::secure_zero(efuseData, sizeof(efuseData));

kekDerived = true;

return true;

{

if (ephemeralKekDerived)

return true;

uint8_t efuseData[16];

readFICR(efuseData);

static const char *prefix = "device-efuse-data";

uint8_t sha256Result[32];

nRFCrypto_Hash hash;

if (!hash.begin(CRYS_HASH_SHA256_mode)) {

LOG_ERROR("EncryptedStorage: SHA-256 init failed (ephemeral KEK)");

meshtastic_security::secure_zero(efuseData, sizeof(efuseData));

return false;

}

hash.update((uint8_t *)prefix, strlen(prefix));

hash.update(efuseData, sizeof(efuseData));

hash.update((uint8_t *)EPHEMERAL_KEK_DOMAIN, strlen(EPHEMERAL_KEK_DOMAIN));

hash.end(sha256Result);

memcpy(ephemeralKek, sha256Result, AES_KEY_SIZE);

meshtastic_security::secure_zero(sha256Result, sizeof(sha256Result));

meshtastic_security::secure_zero(efuseData, sizeof(efuseData));

ephemeralKekDerived = true;

return true;

{

#ifdef FSCom

concurrency::LockGuard g(spiLock);

auto f = FSCom.open(DEK_FILENAME, FILE_O_READ);

if (!f)

return false;

size_t fileSize = f.size();

if (fileSize != DEK_SIZE) {

f.close();

return false;

}

uint8_t buf[DEK_SIZE];

size_t bytesRead = f.read(buf, sizeof(buf));

f.close();

if (bytesRead != DEK_SIZE) {

LOG_ERROR("EncryptedStorage: DEK short read");

return false;

}

// Check magic

uint32_t magic;

memcpy(&magic, buf, 4);

if (magic != DEK_MAGIC) {

LOG_ERROR("EncryptedStorage: DEK bad magic");

return false;

}

uint8_t *nonce = buf + 4;

uint8_t *encDek = buf + 4 + NONCE_SIZE;

// Verify HMAC-SHA256(KEK, DEK_AUTH_LABEL || nonce || encDEK)

size_t authLabelLen = strlen(DEK_AUTH_LABEL);

size_t hmacInputLen = authLabelLen + NONCE_SIZE + AES_KEY_SIZE;

auto hmacInput = meshtastic_security::make_zeroizing_array(hmacInputLen);

if (!hmacInput) {

LOG_ERROR("EncryptedStorage: OOM for DEK HMAC verify");

return false;

}

memcpy(hmacInput.get(), DEK_AUTH_LABEL, authLabelLen);

memcpy(hmacInput.get() + authLabelLen, nonce, NONCE_SIZE);

memcpy(hmacInput.get() + authLabelLen + NONCE_SIZE, encDek, AES_KEY_SIZE);

meshtastic_security::ZeroizingBuffer<HMAC_SIZE> expectedHmac;

nRFCrypto.begin();

bool hmacOk = computeHMAC(kek, AES_KEY_SIZE, hmacInput.get(), hmacInputLen, expectedHmac.data());

nRFCrypto.end();

hmacInput.reset();

if (!hmacOk) {

return false;

}

const uint8_t *storedHmac = buf + DEK_SIZE - HMAC_SIZE;

if (!constTimeEq(expectedHmac.data(), storedHmac, HMAC_SIZE)) {

LOG_ERROR("EncryptedStorage: DEK HMAC mismatch - wrong passphrase or tampered");

return false;

}

// Decrypt DEK into a local candidate - only write to global dek[] on success so that

// a wrong passphrase attempt does not destroy the live DEK in RAM.

meshtastic_security::ZeroizingBuffer<AES_KEY_SIZE> dekCandidate;

nRFCrypto.begin();

bool decOk = aesCtr128(kek, nonce, NONCE_SIZE, encDek, AES_KEY_SIZE, dekCandidate.data());

nRFCrypto.end();

if (!decOk) {

LOG_ERROR("EncryptedStorage: DEK decrypt failed");

return false;

}

memcpy(dek, dekCandidate.data(), AES_KEY_SIZE);

LOG_INFO("EncryptedStorage: DEK loaded and verified");

return true;

#else

return false;

#endif

{

#ifdef FSCom

// Generate random nonce

uint8_t nonce[NONCE_SIZE];

nRFCrypto.begin();

if (!nRFCrypto.Random.generate(nonce, NONCE_SIZE)) {

LOG_ERROR("EncryptedStorage: TRNG failed for DEK nonce");

nRFCrypto.end();

return false;

}

// Encrypt DEK with KEK

uint8_t encDek[AES_KEY_SIZE];

bool encOk = aesCtr128(kek, nonce, NONCE_SIZE, dek, AES_KEY_SIZE, encDek);

if (!encOk) {

LOG_ERROR("EncryptedStorage: DEK encrypt failed");

nRFCrypto.end();

meshtastic_security::secure_zero(encDek, sizeof(encDek));

return false;

}

// Compute HMAC-SHA256(KEK, DEK_AUTH_LABEL || nonce || encDEK)

size_t authLabelLen = strlen(DEK_AUTH_LABEL);

size_t hmacInputLen = authLabelLen + NONCE_SIZE + AES_KEY_SIZE;

auto hmacInput = meshtastic_security::make_zeroizing_array(hmacInputLen);

if (!hmacInput) {

LOG_ERROR("EncryptedStorage: OOM for DEK HMAC");

nRFCrypto.end();

return false;

}

memcpy(hmacInput.get(), DEK_AUTH_LABEL, authLabelLen);

memcpy(hmacInput.get() + authLabelLen, nonce, NONCE_SIZE);

memcpy(hmacInput.get() + authLabelLen + NONCE_SIZE, encDek, AES_KEY_SIZE);

uint8_t hmac[HMAC_SIZE];

bool hmacOk = computeHMAC(kek, AES_KEY_SIZE, hmacInput.get(), hmacInputLen, hmac);

nRFCrypto.end();

hmacInput.reset();

if (!hmacOk) {

meshtastic_security::secure_zero(encDek, sizeof(encDek));

return false;

}

// Write file: magic(4)+nonce(13)+encDEK(16)+hmac(32) = 65 bytes

// H12 (audit): atomic write via SafeFile. Power-loss between remove()

// and write() previously left a missing or partial DEK file, which

// bricked the device - the encrypted protos can't be decrypted with

// no DEK on flash. SafeFile writes a tmp file, reads it back to verify

// a content hash, then atomically renames over the target. Crash before

// rename → old DEK stays in place; crash after rename → new DEK is on

// disk and verified.

uint32_t magic = DEK_MAGIC;

SafeFile sf(DEK_FILENAME, /*fullAtomic=*/true);

sf.write((uint8_t *)&magic, 4);

sf.write(nonce, NONCE_SIZE);

sf.write(encDek, AES_KEY_SIZE);

sf.write(hmac, HMAC_SIZE);

bool ok = sf.close();

meshtastic_security::secure_zero(nonce, sizeof(nonce));

meshtastic_security::secure_zero(encDek, sizeof(encDek));

meshtastic_security::secure_zero(hmac, sizeof(hmac));

if (!ok) {

LOG_ERROR("EncryptedStorage: DEK write/verify failed");

return false;

}

LOG_INFO("EncryptedStorage: DEK saved");

return true;

#else

return false;

#endif

{

if (!ephemeralKekDerived)

return false;

size_t labelLen = strlen(MONO_AUTH_LABEL);

meshtastic_security::ZeroizingBuffer<32 + MONO_BODY_SIZE> input;

memcpy(input.data(), MONO_AUTH_LABEL, labelLen);

memcpy(input.data() + labelLen, body, MONO_BODY_SIZE);

return computeHMAC(ephemeralKek, AES_KEY_SIZE, input.data(), labelLen + MONO_BODY_SIZE, out);

{

#ifdef FSCom

meshtastic_security::ZeroizingBuffer<MONO_TOTAL_SIZE> buf;

{

concurrency::LockGuard g(spiLock);

auto f = FSCom.open(MONO_FILENAME, FILE_O_READ);

if (!f)

return 0;

size_t sz = f.size();

if (sz != MONO_TOTAL_SIZE) {

f.close();

return 0;

}

size_t n = f.read(buf.data(), MONO_TOTAL_SIZE);

f.close();

if (n != MONO_TOTAL_SIZE)

return 0;

}

uint8_t expected[HMAC_SIZE];

nRFCrypto.begin();

bool ok = computeMonoHmac(buf.data(), expected);

nRFCrypto.end();

if (!ok || !constTimeEq(expected, buf.data() + MONO_BODY_SIZE, HMAC_SIZE))

return 0;

uint32_t counter;

memcpy(&counter, buf.data(), 4);

return counter;

#else

return 0;

#endif

{

#ifdef FSCom

meshtastic_security::ZeroizingBuffer<MONO_TOTAL_SIZE> buf;

memcpy(buf.data(), &counter, 4);

uint8_t mac[HMAC_SIZE];

nRFCrypto.begin();

bool ok = computeMonoHmac(buf.data(), mac);

nRFCrypto.end();

if (!ok) {

LOG_ERROR("EncryptedStorage: mono-counter HMAC failed");

return false;

}

memcpy(buf.data() + MONO_BODY_SIZE, mac, HMAC_SIZE);

SafeFile sf(MONO_FILENAME, /*fullAtomic=*/true);

sf.write(buf.data(), MONO_TOTAL_SIZE);

if (!sf.close()) {

LOG_ERROR("EncryptedStorage: mono-counter atomic write failed");

return false;

}

return true;

#else

return false;

#endif

{

#ifdef FSCom

uint8_t nonce[NONCE_SIZE];

nRFCrypto.begin();

if (!nRFCrypto.Random.generate(nonce, NONCE_SIZE)) {

LOG_ERROR("EncryptedStorage: TRNG failed for token nonce");

nRFCrypto.end();

return false;

}

uint8_t encDek[AES_KEY_SIZE];

bool encOk = aesCtr128(ephemeralKek, nonce, NONCE_SIZE, dek, AES_KEY_SIZE, encDek);

if (!encOk) {

LOG_ERROR("EncryptedStorage: Token DEK encrypt failed");

nRFCrypto.end();

meshtastic_security::secure_zero(encDek, sizeof(encDek));

return false;

}

// M4 (audit): claim a fresh monotonic-counter slot ABOVE the highest

// value previously persisted. The new counter is MAC'd into the token

// body below; after the token write succeeds we persist this value to

// /prefs/.tokmono so the next readAndConsumeToken can reject any older

// token that gets restored to disk later.

uint32_t newMonoCounter = readMonoCounter() + 1;

// Build body for HMAC (everything before the trailing HMAC)

uint8_t body[TOKEN_BODY_SIZE];

size_t pos = 0;

uint32_t magic = TOKEN_MAGIC;

memcpy(body + pos, &magic, 4);

pos += 4;

memcpy(body + pos, nonce, NONCE_SIZE);

pos += NONCE_SIZE;

memcpy(body + pos, encDek, AES_KEY_SIZE);

pos += AES_KEY_SIZE;

body[pos++] = bootsRemaining;

memcpy(body + pos, &validUntilEpoch, 4);

pos += 4;

memcpy(body + pos, &sessionMaxSeconds, 4);

pos += 4;

memcpy(body + pos, &newMonoCounter, 4);

pos += 4;

uint8_t hmac[HMAC_SIZE];

bool hmacOk = computeHMAC(ephemeralKek, AES_KEY_SIZE, body, TOKEN_BODY_SIZE, hmac);

nRFCrypto.end();

meshtastic_security::secure_zero(encDek, sizeof(encDek));

if (!hmacOk) {

meshtastic_security::secure_zero(body, sizeof(body));

return false;

}

// H12 (audit): atomic token write via SafeFile (see saveDEK note for

// the same rationale). Power-loss between remove and write previously

// left the token in an unreadable state, forcing the operator to re-

// enter the passphrase from a client. SafeFile rolls back to the

// previous token if the new write fails verification.

SafeFile sf(TOKEN_FILENAME, /*fullAtomic=*/true);

sf.write(body, TOKEN_BODY_SIZE);

sf.write(hmac, HMAC_SIZE);

bool tokOk = sf.close();

if (!tokOk) {

LOG_ERROR("EncryptedStorage: token write/verify failed");

meshtastic_security::secure_zero(body, sizeof(body));

meshtastic_security::secure_zero(hmac, sizeof(hmac));

return false;

}

meshtastic_security::secure_zero(body, sizeof(body));

meshtastic_security::secure_zero(hmac, sizeof(hmac));

// M4: persist new max-counter-seen AFTER the token write committed.

// If this write fails the token is still valid (its counter is

// greater than the persisted value); readAndConsumeToken will

// promote .tokmono on the next read.

if (!writeMonoCounter(newMonoCounter)) {

LOG_WARN("EncryptedStorage: mono-counter persist failed (self-heals on next read)");

}

LOG_INFO("EncryptedStorage: Unlock token written (boots=%d, epoch=%u, mono=%u)", bootsRemaining, validUntilEpoch,

(unsigned)newMonoCounter);

return true;

#else

return false;

#endif

{

#ifdef FSCom

// Read the token file. M10 (audit): the 74-byte buffer holds the entire

// wrapped DEK + HMAC; using ZeroizingBuffer ensures the destructor

// wipes it on every return path (success and all the error cases

// below) without needing one secure_zero per goto-label.

meshtastic_security::ZeroizingBuffer<TOKEN_TOTAL_SIZE> buf;

{

concurrency::LockGuard g(spiLock);

auto f = FSCom.open(TOKEN_FILENAME, FILE_O_READ);

if (!f)

return false;

size_t fileSize = f.size();

if (fileSize != TOKEN_TOTAL_SIZE) {

f.close();

LOG_WARN("EncryptedStorage: Token file wrong size (%d), deleting", fileSize);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_wrong_size";

return false;

}

size_t bytesRead = f.read(buf.data(), TOKEN_TOTAL_SIZE);

f.close();

if (bytesRead != TOKEN_TOTAL_SIZE) {

LOG_ERROR("EncryptedStorage: Token short read");

FSCom.remove(TOKEN_FILENAME);

return false;

}

}

// Verify magic

uint32_t magic;

memcpy(&magic, buf.data(), 4);

if (magic != TOKEN_MAGIC) {

LOG_ERROR("EncryptedStorage: Token bad magic, deleting");

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_bad_magic";

return false;

}

// Verify HMAC-SHA256(ephemeralKek, body). M10: ZeroizingBuffer wipes on scope exit.

meshtastic_security::ZeroizingBuffer<HMAC_SIZE> computedHmac;

nRFCrypto.begin();

bool hmacOk = computeHMAC(ephemeralKek, AES_KEY_SIZE, buf.data(), TOKEN_BODY_SIZE, computedHmac.data());

nRFCrypto.end();

if (!hmacOk || !constTimeEq(computedHmac.data(), buf.data() + TOKEN_BODY_SIZE, HMAC_SIZE)) {

LOG_ERROR("EncryptedStorage: Token HMAC failed - tampered or wrong device, deleting");

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_hmac_fail";

return false;

}

// Parse fields from body

size_t pos = 4; // skip magic

const uint8_t *nonce = buf.data() + pos;

pos += NONCE_SIZE;

const uint8_t *encDek = buf.data() + pos;

pos += AES_KEY_SIZE;

uint8_t bootsRemaining = buf[pos++];

uint32_t validUntilEpoch;

memcpy(&validUntilEpoch, buf.data() + pos, 4);

pos += 4;

uint32_t sessionMaxSeconds;

memcpy(&sessionMaxSeconds, buf.data() + pos, 4);

pos += 4;

uint32_t tokenMonoCounter;

memcpy(&tokenMonoCounter, buf.data() + pos, 4);

// M4 (audit): reject any token whose monotonic counter is below the

// persisted max-seen. An attacker who once read disk could otherwise

// restore a higher-bootcount / weaker-policy token even after the

// operator unlocked again with tighter parameters; this check makes

// such a restore visible and fatal at boot.

//

// If the token's counter is GREATER than what we've persisted (e.g.

// the .tokmono file was lost via factory-erase, or the persist after

// a token write itself failed), accept and promote .tokmono to the

// current value. Equal is the normal case post-write.

uint32_t maxSeenCounter = readMonoCounter();

if (tokenMonoCounter < maxSeenCounter) {

LOG_ERROR("EncryptedStorage: Token rollback (counter=%u, max-seen=%u), deleting", (unsigned)tokenMonoCounter,

(unsigned)maxSeenCounter);

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_rollback";

return false;

}

if (tokenMonoCounter > maxSeenCounter) {

// Self-heal: this token is newer than what we knew, promote it.

writeMonoCounter(tokenMonoCounter);

}

// Check boot count

if (bootsRemaining == 0) {

LOG_WARN("EncryptedStorage: Token boot count exhausted, deleting");

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_boots_zero";

return false;

}

// Check time expiry. A wall-clock TTL (validUntilEpoch != 0) needs a

// currently valid RTC to verify. getValidTime() returns 0 unless we

// actually have an RTC source - getTime() would return a boot-relative

// count, which an attacker can reset by power-cycling with no RTC sync.

//

// If the wall-clock TTL is set but we can't verify it right now:

// - boot count still has budget -> fall back to the boot-count TTL,

// keep the token. The boot count is independently verifiable

// without an RTC, so the token is not unbounded.

// - boot count is the only thing we had and it's zero -> already

// rejected above. (validUntilEpoch is never the *sole* TTL here:

// bootsRemaining > 0 is guaranteed by the check above.)

// We only hard-reject (delete) a token whose wall-clock TTL we *can*

// evaluate and find expired.

if (validUntilEpoch != 0) {

uint32_t now = getValidTime(RTCQualityDevice);

if (now == 0) {

LOG_WARN("EncryptedStorage: Token wall-clock TTL unverifiable (no RTC), using boot count (%u left)", bootsRemaining);

} else if (now > validUntilEpoch) {

LOG_WARN("EncryptedStorage: Token expired (now=%u, until=%u), deleting", now, validUntilEpoch);

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_expired";

return false;

}

}

// Decrypt DEK from token

nRFCrypto.begin();

bool decOk = aesCtr128(ephemeralKek, nonce, NONCE_SIZE, encDek, AES_KEY_SIZE, dek);

nRFCrypto.end();

if (!decOk) {

LOG_ERROR("EncryptedStorage: Token DEK decrypt failed");

meshtastic_security::secure_zero(dek, sizeof(dek));

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

lockReason = "token_dek_fail";

return false;

}

// Decrement boot count and rewrite (or delete if now zero)

uint8_t newBoots = bootsRemaining - 1;

if (newBoots == 0) {

LOG_INFO("EncryptedStorage: Token last boot consumed, deleting");

concurrency::LockGuard g(spiLock);

FSCom.remove(TOKEN_FILENAME);

} else {

writeUnlockToken(newBoots, validUntilEpoch, sessionMaxSeconds);

}

dekLoaded = true;

s_bootsRemaining = newBoots;

s_validUntilEpoch = validUntilEpoch;

// Start the session timer if the token carries one. Token-auto-unlocked

// boots inherit the same cap that was set at passphrase-unlock time.

setSession(sessionMaxSeconds);

LOG_INFO("EncryptedStorage: Token valid, DEK loaded (%d boots remaining%s)", newBoots,

sessionMaxSeconds ? ", session timer armed" : "");

return true;

#else

return false;

#endif

{

nRFCrypto.begin();

bool ok = nRFCrypto.Random.generate(dek, AES_KEY_SIZE);

nRFCrypto.end();

if (!ok) {

LOG_ERROR("EncryptedStorage: TRNG failed generating DEK");

meshtastic_security::secure_zero(dek, sizeof(dek));

return false;

}

return true;