ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory.
There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example:
{credstore myusername}
{TAB}
{credstore mypassword}
{ENTER}
I like the idea of a remote keyboard, but everything else is unimportant to everyone but you. Do Apple products advertise their security algorithm details? They just say âsecureâ, and maybe details are fine print later. I am almost exactly the target demographic for a product like this, and I havenât really pictured how it would improve my life at all, because all I remember from reading the page is the encryption is over engineered because it seems like a fun project a guy did.
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrityâ˘.
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.
Because the title and name are undescriptive af:
ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
Thanks. We live in an era where a lot are trying to bait-click and have the maximum dramatic effect to milk as much as engagement as possible.
Thanks for saving me the click, here I was thinking it will be recipe for DIY toothpaste.
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory. There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example: {credstore myusername} {TAB} {credstore mypassword} {ENTER}
https://github.com/akoerner/kprox
I like the idea of a remote keyboard, but everything else is unimportant to everyone but you. Do Apple products advertise their security algorithm details? They just say âsecureâ, and maybe details are fine print later. I am almost exactly the target demographic for a product like this, and I havenât really pictured how it would improve my life at all, because all I remember from reading the page is the encryption is over engineered because it seems like a fun project a guy did.
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
Further, âjust worksâ Bluetooth encryption is not vulnerable most of the time. Itâs only vulnerable at the instance of pairing.
It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.
So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, itâs an excellent system.
But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrityâ˘.
Nice work! Hardware password managers are great! While yours does a little more, perhaps, these might also be interesting:
Mooltipass: https://www.themooltipass.com/
OnlyKey: https://onlykey.io/
The closest is actually InputStick: https://www.inputstick.com/
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
How do you know that shady computer won't pwn your usb device?
Are USB keyboard devices frequently pwnable?
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.