From 096b5a4d17c85fa5f87db3e72364e9c3506d1e64 Mon Sep 17 00:00:00 2001 From: cirakg Date: Sun, 25 Oct 2026 12:46:42 +0100 Subject: feat(pin): exactly 4 digits, entered on the 4th digit The keypad has no OK key; the 4th digit submits, so a tap that also arrives as START can no longer submit a partial PIN (the likely cause of "Wrong PIN" before the code opened). PINs set by earlier versions still unlock and are then replaced by a 4-digit one. Opening an entry ignores a second request from the same tap. A Require PIN sent from the phone while the watch is locked now applies at the next PIN instead of waiting for Confirm all. The linter skips .claude. Co-Authored-By: Claude Opus 5.5 --- tools/gen_fixture_wrap.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'tools/gen_fixture_wrap.py') diff --git a/tools/gen_fixture_wrap.py b/tools/gen_fixture_wrap.py index c389fea..6eb207a 100644 --- a/tools/gen_fixture_wrap.py +++ b/tools/gen_fixture_wrap.py @@ -1,16 +1,19 @@ #!/usr/bin/env python3 # Author: cirakg & claude ai -# Summary: Compute the UI-test fixture's PIN wrap (fake PIN 123456) so the watch needn't run PBKDF2 at start-up. +# Summary: Compute the UI-test fixture's PIN wrap (fake PIN 1234) so the watch needn't run PBKDF2 at start-up. """Print the fake PIN wrap that source/app/Fixtures.mc stores in the UI-test build. The wrap follows docs/SECURITY.md ("PIN wrap, version 1") with fixed, fake -inputs: PIN 123456, salt 10..1f, IV 20..2f, master key 40..5f, 2000 +inputs: PIN 1234, salt 10..1f, IV 20..2f, master key 40..5f, 2000 PBKDF2 iterations. Deriving the PIN key on the watch in one event trips the watchdog, and the UI tests need the store ready before the first screen, so the fixture stores this precomputed value instead. The app's own unlock code then checks it like any other wrap, which also cross-checks the format. +The fixture also stores the 4-digit PIN marker (KeyManager.PIN_LENGTH_KEY = +PIN_DIGITS), so the PIN isn't treated as a legacy 4-to-10-digit one. -Usage: gen_fixture_wrap.py (prints FIXTURE_WRAP and FIXTURE_MASTER_KEY in hex) +Usage: gen_fixture_wrap.py (prints FIXTURE_PIN, FIXTURE_WRAP and FIXTURE_MASTER_KEY in hex, + and the marker the fixture stores) """ from __future__ import annotations @@ -20,7 +23,9 @@ import hmac import struct import subprocess -PIN = b"123456" +PIN = b"1234" +PIN_DIGITS = 4 # source/storage/KeyManager.mc: every new PIN, and the marker value +PIN_LENGTH_KEY = "wl" # source/storage/KeyManager.mc ITERATIONS = 2000 SALT = bytes(range(0x10, 0x20)) IV = bytes(range(0x20, 0x30)) @@ -65,8 +70,11 @@ def fixture_wrap() -> bytes: def main() -> None: + assert len(PIN) == PIN_DIGITS + print("FIXTURE_PIN =", PIN.decode()) print("FIXTURE_WRAP =", fixture_wrap().hex()) print("FIXTURE_MASTER_KEY =", MASTER_KEY.hex()) + print(f"marker: {PIN_LENGTH_KEY} = {PIN_DIGITS}") if __name__ == "__main__": -- cgit v1.2.3