Skip to content

Make printDevParam() configurable to avoid printing sensitive keys #189

@zerion87

Description

@zerion87

In the file Heltec_ESP32/src/LoRaWan_APP.cpp, the function printDevParam() currently prints out all LoRaWAN configuration parameters, including sensitive information such as:

DevEui
AppEui
AppKey
NwkSKey
AppSKey
DevAddr

void printDevParam(void) { printf("+OTAA=%d\r\n", overTheAirActivation); printf("+Class=%X\r\n", loraWanClass+10); printf("+ADR=%d\r\n", loraWanAdr); printf("+IsTxConfirmed=%d\r\n", isTxConfirmed); printf("+AppPort=%d\r\n", appPort); printf("+DutyCycle=%u\r\n", appTxDutyCycle); printf("+ConfirmedNbTrials=%u\r\n", confirmedNbTrials); printf("+ChMask=%04X%04X%04X%04X%04X%04X\r\n", userChannelsMask[5], userChannelsMask[4], userChannelsMask[3], userChannelsMask[2], userChannelsMask[1], userChannelsMask[0]); printf("+DevEui="); print_Hex(devEui, 8); printf("(For OTAA Mode)\r\n"); printf("+AppEui="); print_Hex(appEui, 8); printf("(For OTAA Mode)\r\n"); printf("+AppKey="); print_Hex(appKey, 16); printf("(For OTAA Mode)\r\n"); printf("+NwkSKey="); print_Hex(nwkSKey, 16); printf("(For ABP Mode)\r\n"); printf("+AppSKey="); print_Hex(appSKey, 16); printf("(For ABP Mode)\r\n"); printf("+DevAddr=%08X(For ABP Mode)\r\n\r\n", devAddr); }

While this function is helpful for debugging, it creates a significant security risk: anyone connecting the device to a serial interface can immediately access all LoRaWAN keys.

Feature request:

Please make this debug output configurable via a compile-time flag or a runtime setting, such as:
#ifndef DISABLE_PRINT_DEV_PARAM void printDevParam(void) { ... } #endif

Or at least provide an option in the configuration header to disable printing the keys.
Why this matters:

Protects sensitive credentials (especially AppKey and AppSKey)
Enables secure device provisioning
Prevents accidental leaks during development or deployment

Thank you for considering this important security improvement.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions