Tamper detection docs changes #490

tadeubas · 2024-12-08T04:05:47Z

What is this PR for?

Added links and changed text a little to better understand Tamper detection feature

What is the purpose of this pull request?

Bug fix
New feature
Docs update
Other

codecov · 2024-12-08T04:08:47Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 94.91%. Comparing base (831954d) to head (ac54271).
Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #490   +/-   ##
=======================================
  Coverage   94.91%   94.91%           
=======================================
  Files          74       74           
  Lines        7952     7952           
=======================================
  Hits         7548     7548           
  Misses        404      404

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

jdlcdl · 2024-12-08T22:44:14Z

docs/getting-started/features/tamper-detection.en.md


 ## Conclusion

-The *TC Flash Hash* tool significantly enhances security by making it infeasible for attackers to tamper with the firmware without detection. By combining *TC Code* hashing, filling empty memory with random entropy, and verifying flash integrity through unique images and words, Krux significantly enhances the detection of any tamper attempts.
+The *TC Flash Hash* tool significantly enhances security by making it impossible for attackers to tamper with firmware without being detected. By combining *TC Code* hashing, filling empty memory with random entropy, and verification of the the unique image and set of words, Krux allows the detection of any tamper attempts.


Not sure that "impossible" is an improvement over "infeasible".

Hi Jean, thx for reading the changes 😄. Infeasible is the opposite of feasible, if it is not feasible, following all the procedures listed on the tamper detection feature, I think it is more assertive and easy to understand to call it impossible. Like it is impossible to stole the funds from any BTC address.

Yes, better stick with more moderated terms

jdlcdl · 2024-12-08T22:46:36Z

read and approved... even though I think that "infeasible" is less of a claim than "impossible".

odudex · 2024-12-09T11:38:29Z

docs/getting-started/features/tamper-detection.en.md


 <div style="text-align: center;">
    <img src="../../../img/flash_hash.bmp" alt="TC Flash Hash" width="200"/>
 </div>

-*Example: The blue symbol and words 'tail monkey' represent the firmware region, while 'wrestle over' reflects the user region.*
+*Example: The blue symbol and words 'tail monkey' represents the firmware region, while 'wrestle over' user's region.*


"represent" refers to "words", or "words plus image", so "they represent", no trailing "s"

odudex · 2024-12-09T11:47:25Z

docs/getting-started/features/tamper-detection.en.md


-Krux performs a memory sweep while simultaneously capturing a live feed from the camera. Whenever an empty block is found in the flash memory, Krux estimates the image's entropy by evaluating its color variance. Krux waits until minimum threshold is met, then uses the data from the image to fill these empty spaces with rich, random entropy.
+Use this to enhance tamper detection. Krux performs a memory sweep while capturing a live feed from the camera. Whenever an empty block is found in the flash memory, it uses the data from the image to fill these empty spaces with rich, random entropy. It estimates the image's entropy by evaluating its color variance waiting until a minimum threshold is met. 


IMO original version text flow better reflects sequence of events. But second is OK

I think we are used to speaking programmatically, I believe that hiding this information to reveal it later makes it easier for the average user to understand. Even if this is not the correct order of events, we are detailing what was done right after.

odudex · 2024-12-09T11:48:48Z

docs/getting-started/features/tamper-detection.en.md

-`hash(TC Code,UID,Flash content)` -> Image + Words
-
-Hash properties ensure that without knowing the *TC Code*, UID, and flash content, an attacker cannot reproduce the TC Flash Hash results.
+The *TC Flash Hash* function securely hashes the combination of the *TC Code*, device's UID, and flash memory contents. The hash properties ensure that without knowing these three elements, an attacker will not be able to reproduce the *TC Flash Hash* results.


Why remove the "function"?

I've been thinking more from the user's point of view, many are scared of codes and don't even use the command line, so as we've already repeated the information several times I thought removing the function would be better.

odudex · 2024-12-09T11:49:29Z

docs/getting-started/features/tamper-detection.en.md

-If a wrong *TC Code* is typed at boot, the device will turn off. As storing code typing attempts count on flash would change its contents, there will be no consequences if wrong *TC Code* is typed multiple times.
-
-As *TC Code* verification data is stored in the user's region of memory, *TC Flash Hash* and *TC Code* requirement is disabled if the user wipes the device. Flashing an older firmware version will also disable the feature.
+By navigating to `Settings -> Security -> TC Flash Hash at Boot`, users can set Krux to always require *TC Flash Hash* verification after device is turned on. If a wrong *TC Code* is typed at boot, the device will turn off. Nothing else will happen if the wrong *TC Code* is entered multiple times. As *TC Code* verification data is stored in the user's region of memory, the requirement to type at boot is disabled if the user [erases user's data](../features/tools.md/#erase-users-data) or [wipe device](../installing/from-gui/usage.md/#wipe-device). Flashing an older firmware version will also disable this feature.


Why make it a single paragraph?

For the last statement, maybe: "Flashing an older firmware version, prior to TC Flash Hash support, will also disable this feature."

It's the same topic or idea. If I change the paragraph, it would indicate a change of emphasis or tone within a topic or it would also give the users a break in their thinking. I believe that with just one paragraph we improve the understanding of the topic.

odudex · 2024-12-09T11:52:05Z

docs/getting-started/features/tamper-detection.en.md


 - **One-Way Hash Functions:** Cryptographic hash functions like SHA-256 are one-way, making it infeasible to reverse-engineer or manipulate the hash without the original inputs.

 ### Why Tampered Firmware Cannot Bypass Verification

- **Cannot Reconstruct the Hash:** Without the original flash data, the attacker cannot generate the correct hash, even if they know the UID and *TC Code* after the user enters it.
+- **Cannot Reconstruct the Hash:** Without the original flash data, the attacker cannot generate the correct hash, even if it knows the device's UID and the *TC Code* (after the user enters it).


typo, referring to attacker as "it". Maybe "the attacker" could be replace by "attackers"

or "it knows" could become "they know"

odudex · 2024-12-09T11:53:59Z

docs/getting-started/features/tamper-detection.en.md


- **Hash Sensitivity:** Any alteration in the flash content changes the hash output, which will be evident through a different image or tamper detection words.
+- **Hash Sensitivity:** Any alteration in the flash content changes the hash output, which will be evident through a different image or the set of two words.


here it's referring to the whole flash, why mention "the set", what set?

When I read it quickly, I thought that the change in the image represented only the firmware memory space. Sorry, I'll change that.

tadeubas · 2024-12-09T14:03:47Z

Hey guys, I think I made the changes according to the conversations, the ones that were changed are marked as "outdated". To see the changes easily, take a look at the latest commit.

odudex

Thank you!

Added links and changed text a bit

876f012

jdlcdl reviewed Dec 8, 2024

View reviewed changes

jdlcdl previously approved these changes Dec 8, 2024

View reviewed changes

odudex reviewed Dec 9, 2024

View reviewed changes

Changes following PR suggestions

ac54271

tadeubas dismissed jdlcdl’s stale review via ac54271 December 9, 2024 14:00

odudex approved these changes Dec 9, 2024

View reviewed changes

odudex merged commit 19dbff1 into selfcustody:main Dec 9, 2024
7 checks passed

tadeubas deleted the tamper-detection-doc branch December 12, 2024 03:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tamper detection docs changes #490

Tamper detection docs changes #490

tadeubas commented Dec 8, 2024

codecov bot commented Dec 8, 2024 •

edited

Loading

jdlcdl Dec 8, 2024

tadeubas Dec 9, 2024

odudex Dec 9, 2024

jdlcdl commented Dec 8, 2024

odudex Dec 9, 2024

odudex Dec 9, 2024 •

edited

Loading

tadeubas Dec 9, 2024

odudex Dec 9, 2024

tadeubas Dec 9, 2024

odudex Dec 9, 2024

jdlcdl Dec 9, 2024

tadeubas Dec 9, 2024

odudex Dec 9, 2024

jdlcdl Dec 9, 2024 •

edited

Loading

odudex Dec 9, 2024

tadeubas Dec 9, 2024

tadeubas commented Dec 9, 2024

odudex left a comment


		Krux performs a memory sweep while simultaneously capturing a live feed from the camera. Whenever an empty block is found in the flash memory, Krux estimates the image's entropy by evaluating its color variance. Krux waits until minimum threshold is met, then uses the data from the image to fill these empty spaces with rich, random entropy.
		Use this to enhance tamper detection. Krux performs a memory sweep while capturing a live feed from the camera. Whenever an empty block is found in the flash memory, it uses the data from the image to fill these empty spaces with rich, random entropy. It estimates the image's entropy by evaluating its color variance waiting until a minimum threshold is met.


		- Hash Sensitivity: Any alteration in the flash content changes the hash output, which will be evident through a different image or tamper detection words.
		- Hash Sensitivity: Any alteration in the flash content changes the hash output, which will be evident through a different image or the set of two words.

Tamper detection docs changes #490

Tamper detection docs changes #490

Conversation

tadeubas commented Dec 8, 2024

What is this PR for?

What is the purpose of this pull request?

codecov bot commented Dec 8, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jdlcdl commented Dec 8, 2024

Choose a reason for hiding this comment

odudex Dec 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jdlcdl Dec 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tadeubas commented Dec 9, 2024

odudex left a comment

Choose a reason for hiding this comment

codecov bot commented Dec 8, 2024 •

edited

Loading

odudex Dec 9, 2024 •

edited

Loading

jdlcdl Dec 9, 2024 •

edited

Loading