Home
JAQForum Ver 24.01
Log In or Join  
Active Topics
Local Time 14:15 07 Jan 2025 Privacy Policy
Jump to

Notice. New forum software under development. It's going to miss a few functions and look a bit ugly for a while, but I'm working on it full time now as the old forum was too unstable. Couple days, all good. If you notice any issues, please contact me.

Forum Index : Microcontroller and PC projects : Draft PicoMite 6.00.01 User Manual

     Page 9 of 10    
Author Message
thwill

Guru

Joined: 16/09/2019
Location: United Kingdom
Posts: 4071
Posted: 09:11am 18 Dec 2024
Copy link to clipboard 
Print this post

By no means my area of expertise, but for anything other than ECB don't you need a way of specifying an Initialisation Vector ?

... also ECB is not secure.

Best wishes,

Tom
Edited 2024-12-18 19:13 by thwill
Game*Mite, CMM2 Welcome Tape, Creaky old text adventures
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 09:19am 18 Dec 2024
Copy link to clipboard 
Print this post

  thwill said  ... also ECB is not secure.

That's what I read too.
Michael
causality ≠ correlation ≠ coincidence
 
matherp
Guru

Joined: 11/12/2012
Location: United Kingdom
Posts: 9326
Posted: 09:24am 18 Dec 2024
Copy link to clipboard 
Print this post

There is an initialisation vector for CBC and CTR built into the firmware. I could expose this as an extra parameter but haven't thus far unless someone specifically has a requirement.
 
thwill

Guru

Joined: 16/09/2019
Location: United Kingdom
Posts: 4071
Posted: 09:27am 18 Dec 2024
Copy link to clipboard 
Print this post

  matherp said  There is an initialisation vector for CBC and CTR built into the firmware. I could expose this as an extra parameter but haven't thus far unless someone specifically has a requirement.


That's insecure, read the "Properties" section of https://en.wikipedia.org/wiki/Initialization_vector

Edit: ... trivially insecure given the IV is in public source code.

Best wishes,

Tom
Edited 2024-12-18 19:31 by thwill
Game*Mite, CMM2 Welcome Tape, Creaky old text adventures
 
matherp
Guru

Joined: 11/12/2012
Location: United Kingdom
Posts: 9326
Posted: 09:43am 18 Dec 2024
Copy link to clipboard 
Print this post

OK

Updated manual entry

  Quote  MATH AES128 ENCRYPT/DECRYPT CBC/ECB/CTR key$/key(), in$/in(), out$/out() [,iv$/iv()]
This command encrypts or decrypts the data in 'in' and puts the answer in 'out' using the AES128 encryption method specified
The parameters can each be either a string, integer array, or float array with any mix possible
The key must be 16 elements long (16*8=128bits)
in and out must be a multiple of 16 elements long.
In the case of out being specified as a string (e.g. out$). The string variable must exist and should be set to empty (DIM out$="")
The maximum number of elements in 'in' and 'out' is 256 when defined as arrays or 128 if one or other is defined as a string
For CBC and CTR encryption/decryption you can optionally specify an initialisation vector 'iv'. 'iv' must be 16 elements long (16*8=128bits)
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 09:51am 18 Dec 2024
Copy link to clipboard 
Print this post

  matherp said  
  Quote  ...For CBC and CTR encryption/decryption you can optionally specify an initialisation vector 'iv'. 'iv' must be 16 elements long (16*8=128bits)

Sounds good to me. Interesting topic, although I won't actually use it, I guess?
Regards
Michael
causality ≠ correlation ≠ coincidence
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 05:53pm 22 Dec 2024
Copy link to clipboard 
Print this post

Hi Geoff,
On page 80 of the manual I read:
DIM INTEGER Str1(MaxLen/8), Str2(MaxLen/8), Str3(MaxLen/8)

These will contain empty strings when created (ie, their length will be zero). When these variables are passed to the long string functions they should be entered as the variable name followed by empty brackets. For example:

LONGSTRING COPY Str1(), Str2()

Long string variables can be passed as arguments to user defined subroutines and functions. For example:

Sub MySub lstr() AS INTEGER
PRINT "Long string length is" LLEN(lstr())
END SUB


And it could be called like this:

MySub str1()

Wouldn't it make more sense if you wrote
Sub MySub str1() AS INTEGER
PRINT "Long string length is" LLEN(str1())
END SUB
?
Regards
Michael
causality ≠ correlation ≠ coincidence
 
Geoffg

Guru

Joined: 06/06/2011
Location: Australia
Posts: 3246
Posted: 11:07pm 22 Dec 2024
Copy link to clipboard 
Print this post

Thanks Michael.  Actually, the problem is that I made the variable in MySub too similar to the variables used in the call to that sub and that could cause confusion (and probably did for you).  
A better version is this:

Sub MySub longarg() AS INTEGER
 PRINT  "Long string length is" LLEN(longarg())
END SUB

It is then obvious that longarg() in the subroutine is different from str1() which was used in the call.

Geoff
Geoff Graham - http://geoffg.net
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 11:12pm 22 Dec 2024
Copy link to clipboard 
Print this post

Thanks, Geoff!
You are right!
Best regards
MIchael
causality ≠ correlation ≠ coincidence
 
homa

Guru

Joined: 05/11/2021
Location: Germany
Posts: 394
Posted: 01:12pm 26 Dec 2024
Copy link to clipboard 
Print this post

PicoMite User Manual, MMBasic BASIC Interpreter Ver 6.00.01
Revision 1 (10 December 2024)


Hi Geoff,

I am currently playing around with the WebMite Pi Pico 2 W.
I noticed that the JSON$ function is used in the example, but it is not described anywhere in the manual. It is referred to in two places.

page 77:
The JSON() function is used to extract the value that we want from the JSON (JavaScript Object Notation)
formatted response.

paged 153:
If the received data is a JSON string
then the JSON$ function can be used to parse it.

Matthias
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 01:30pm 26 Dec 2024
Copy link to clipboard 
Print this post

Hi Matthias,
The problem has already been reported by Gerry and confirmed by Geoff.
You can find a description in the CMM2 manual.
A board search for "api.openweathermap.org" yields more results.

Kind regards
MIchael
causality ≠ correlation ≠ coincidence
 
homa

Guru

Joined: 05/11/2021
Location: Germany
Posts: 394
Posted: 02:04pm 26 Dec 2024
Copy link to clipboard 
Print this post

Hi Michael,

Thanks for the info!

However, I am also missing a description of the web server output on the console, such as Warning: LWIP send data timeout.
Are these the OPTION WEB MESSAGES that can be turned on or off?

What others are there?

Matthias
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 03:29am 29 Dec 2024
Copy link to clipboard 
Print this post

@Geoff
If the manual isn't closed yet, please add that ERASE doesn't work for local variables. Thanks!

Regarding "OPTION WEB MESSAGES" I'm also hoping for more explanations.

Kind regards
Michael
causality ≠ correlation ≠ coincidence
 
Geoffg

Guru

Joined: 06/06/2011
Location: Australia
Posts: 3246
Posted: 05:57am 29 Dec 2024
Copy link to clipboard 
Print this post

  twofingers said  please add that ERASE doesn't work for local variables.

Will do that.

  twofingers said  Regarding "OPTION WEB MESSAGES" I'm also hoping for more explanations.

Not sure about that.

Geoff
Geoff Graham - http://geoffg.net
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 11:18am 29 Dec 2024
Copy link to clipboard 
Print this post

@Geoff
Thanks a lot anyway!
Kind regards
Michael
causality ≠ correlation ≠ coincidence
 
matherp
Guru

Joined: 11/12/2012
Location: United Kingdom
Posts: 9326
Posted: 12:40pm 29 Dec 2024
Copy link to clipboard 
Print this post

Geoff

The manual is missing some of the later functionality I sent you

  Quote  LONGSTRING AES128 ENCRYPT/DECRYPT CBC/ECB/CTR key$/key[!/%](), in%(), out%() [,iv$/iv[!/%]()]
Encrypts or decrypts the longstring in in%() putting the answer in out%()
For CBC and CTR modes the encryption will generate a random initialisation vector and prepend out%() with the IV. If an explicit IV is specified this will be used instead of the random vector and this will be prepended to out%()
For CBC and CTR decryption the firmware assumes that the first 16 bytes of in%() are the initialisation vector.
In the case where you want to transmit a message without IV you can use LONGSTRING RIGHT to remove the IV before sending the message. In this case the recipient must know the IV as well as the key and create a complete longstring before using DECRYPT. This can be done by using LONGSTRING CONCAT to add the incoming message to a longstring containing the IV.

LONGSTRING BASE64 ENCODE/DECODE in%(), out%()
This BASE64 encodes or decodes the longstring in in%() placing the answer in out%(). The array used as the output must be big enough relative to the input and the direction. Encoding increases length by 4/3 and decoding decreases it by 3/4

Function
MATH(BASE64 ENCODE/DECODE in$/in(), out$/out())
Returns the length of out$/out(). This base64 encodes or decodes the data in 'in' and puts the result in 'out'. Where arrays are used as the output they must be big enough relative to the input and the direction. Encryption increases length by 4/3 and decryption decreases it by 3/4



and the MATH AES128 text should be updated

  Quote  MATH AES128 ENCRYPT/DECRYPT CBC/ECB/CTR key$/key(), in$/in(), out$/out() [,iv$/iv()]
This command encrypts or decrypts the data in 'in' and puts the answer in 'out' using the AES128 encryption method specified
The parameters can each be either a string, integer array, or float array with any mix possible
The key must be 16 elements long (16*8=128bits)
in and out must be a multiple of 16 elements long.
In the case of out being specified as a string (e.g. out$), the string variable must exist and should be set to empty (DIM out$="")
The maximum number of elements in 'in' and 'out' is limited by memory when defined as arrays. Strings for encrypting are limited to 240bytes (EBR) and 224bytes (CTR and CBC).
For CBC and CTR encryption you can optionally specify an initialisation vector 'iv'. 'iv' must be 16 elements long (16*8=128bits). If an initialisation vector is not specified encryption will generate a random initialisation vector.
In both cases the output is prepended with the IV.
For CBC and CTR, decryption requires that the first 16 elements of the input are the initialisation vector.
In the case where you want to transmit a message without IV you should remove the IV before sending the message using standard MMBasic manipulations. In this case the recipient must know the IV as well as the key and create a complete message before using DECRYPT by prepending the IV to the incoming message.
- page
The LONGSTRING commands are also missing in the LONGSTRING summary - page 81
Edited 2024-12-29 22:42 by matherp
 
Geoffg

Guru

Joined: 06/06/2011
Location: Australia
Posts: 3246
Posted: 01:09pm 29 Dec 2024
Copy link to clipboard 
Print this post

I don't remember receiving these but no matter, the manual has been updated to Revision 3.
Same comment re clearing the cache,

Geoff
Geoff Graham - http://geoffg.net
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 01:14pm 29 Dec 2024
Copy link to clipboard 
Print this post

@Peter
Doesn't it also apply to long strings that in() and out() have to be 16 elements long?

[60] LongString AES128 ENCRYPT CTR key$,inp%(),out%(),iv$
Error : input must be multiple of 16 elements long

Regards
Michael
causality ≠ correlation ≠ coincidence
 
twofingers
Guru

Joined: 02/06/2014
Location: Germany
Posts: 1338
Posted: 02:19pm 01 Jan 2025
Copy link to clipboard 
Print this post

PicoMiteHDMI MMBasic RP2350A Edition V6.00.01
OPTION FLASH SIZE 4194304
OPTION KEYBOARD GR
OPTION CPUSPEED (KHz) 315000
OPTION SDCARD GP5, GP2, GP3, GP4
OPTION F9 *"B:FM113d"


I don't know if this is the right thread for me. The manual does not (in every case) correspond to the firmware. Maybe not all Picomites are affected?  This is suggested by the fact that Vadim's file manager uses the Alt key.

PicoMite User Manual Page 200 (Revision 3, 29 December 2024) Page 200:
  Quote  If the shift key is simultaneously pressed with the function keys F1 to F12 then 40 (hex) is added to the code (this is the equivalent of setting bit 6). For example Shift-F10 will generate DA (hex).
The shift modifier works with the function keys F1 to F12;


A short test shows that is not correct (PicoMiteHDMI/Console):
Dim key$
Do
  Do :Loop While Inkey$<>""
  Do :Key$=Inkey$:Loop While Key$=""
  Print Asc(key$)
Loop
End

I get for <shift+F1> or <shift+F2> just nothing, an empty string,
for <shift+F3> = ASCII 179 (<F3> = ASCII 147)
and for <shift+F4> to <shift+F8> = ASCII 27
for <shift+F9> to <shift+F12> again a empty string ("")
<Alt> again a empty string ("")
SHIFT_DOWN_ARROW, SHIFT_RIGHT_ARROW, PrtScr/SysRq and PAUSE/BREAK the same.
SHIFT_TAB = ASCII 27
SHIFT_DEL = Clipboard?

I would prefer if the firmware was updated to match what the manual says.
This could be useful for the file manager, for example.

Kind regards
Michael
causality ≠ correlation ≠ coincidence
 
matherp
Guru

Joined: 11/12/2012
Location: United Kingdom
Posts: 9326
Posted: 02:30pm 01 Jan 2025
Copy link to clipboard 
Print this post

What keyboard? Connected USB, Connected PS2, or Computer console?
 
     Page 9 of 10    
Print this page
© JAQ Software 2025