-
Notifications
You must be signed in to change notification settings - Fork 266
Description
In the file Heltec_ESP32/src/LoRaWan_APP.cpp, the function printDevParam() currently prints out all LoRaWAN configuration parameters, including sensitive information such as:
DevEui
AppEui
AppKey
NwkSKey
AppSKey
DevAddr
void printDevParam(void) { printf("+OTAA=%d\r\n", overTheAirActivation); printf("+Class=%X\r\n", loraWanClass+10); printf("+ADR=%d\r\n", loraWanAdr); printf("+IsTxConfirmed=%d\r\n", isTxConfirmed); printf("+AppPort=%d\r\n", appPort); printf("+DutyCycle=%u\r\n", appTxDutyCycle); printf("+ConfirmedNbTrials=%u\r\n", confirmedNbTrials); printf("+ChMask=%04X%04X%04X%04X%04X%04X\r\n", userChannelsMask[5], userChannelsMask[4], userChannelsMask[3], userChannelsMask[2], userChannelsMask[1], userChannelsMask[0]); printf("+DevEui="); print_Hex(devEui, 8); printf("(For OTAA Mode)\r\n"); printf("+AppEui="); print_Hex(appEui, 8); printf("(For OTAA Mode)\r\n"); printf("+AppKey="); print_Hex(appKey, 16); printf("(For OTAA Mode)\r\n"); printf("+NwkSKey="); print_Hex(nwkSKey, 16); printf("(For ABP Mode)\r\n"); printf("+AppSKey="); print_Hex(appSKey, 16); printf("(For ABP Mode)\r\n"); printf("+DevAddr=%08X(For ABP Mode)\r\n\r\n", devAddr); }
While this function is helpful for debugging, it creates a significant security risk: anyone connecting the device to a serial interface can immediately access all LoRaWAN keys.
Feature request:
Please make this debug output configurable via a compile-time flag or a runtime setting, such as:
#ifndef DISABLE_PRINT_DEV_PARAM void printDevParam(void) { ... } #endif
Or at least provide an option in the configuration header to disable printing the keys.
Why this matters:
Protects sensitive credentials (especially AppKey and AppSKey)
Enables secure device provisioning
Prevents accidental leaks during development or deployment
Thank you for considering this important security improvement.