ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory.
There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example:
{credstore myusername}
{TAB}
{credstore mypassword}
{ENTER}
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrity™.
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.
Because the title and name are undescriptive af:
ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
Thanks for saving me the click, here I was thinking it will be recipe for DIY toothpaste.
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory. There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example: {credstore myusername} {TAB} {credstore mypassword} {ENTER}
https://github.com/akoerner/kprox
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrity™.
Nice work! Hardware password managers are great! While yours does a little more, perhaps, these might also be interesting:
Mooltipass: https://www.themooltipass.com/
OnlyKey: https://onlykey.io/
The closest is actually InputStick: https://www.inputstick.com/
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
How do you know that shady computer won't pwn your usb device?
Are USB keyboard devices frequently pwnable?
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.