Robot-Market/mqtt-security-test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Mermaid parse errors in the design docs

Browse Source 
Semicolons end a statement in Mermaid sequence diagrams and angle brackets
are treated as HTML, so messages like "shared = X25519(s, B); pw = ..." and
"enroll/request/<cid>" broke rendering. Use commas and {cid} style
placeholders instead.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Ryan
2026-10-25 10:39:12 +03:30
co-authored by Claude Sonnet 5.5
parent 6c2fd0648f
commit 5b7a2c5584
2 changed files with 23 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sn-as-username-process.md
+11 -11
View File
@@ -118,13 +118,13 @@ sequenceDiagram
participant G as Go backend
B->>B: random Client ID, X25519 pair (b, B), nonce n1
B->>M: CONNECT anonymous, clientId=random (TLS)
B->>M: SUBSCRIBE enroll/response/<cid> (own topic only)
B->>G: enroll/request/<cid> {B, n1, mac}
G->>G: reserve <cid>, assign FN, ephemeral (s, S)
G->>G: shared = X25519(s, B); pw = HKDF(shared, salt=n1, info=label|FN)
B->>M: SUBSCRIBE enroll/response/{cid} (own topic only)
B->>G: enroll/request/{cid} {B, n1, mac}
G->>G: reserve {cid}, assign FN, ephemeral (s, S)
G->>G: shared = X25519(s, B), pw = HKDF(shared, salt=n1, info=label|FN)
G->>M: dynsec createClient FN, pw, clientid=FN, role board-bootstrap
G->>B: enroll/response/<cid> {FN, S, sig} (not retained)
B->>B: verify sig; shared = X25519(b, S); same pw
G->>B: enroll/response/{cid} {FN, S, sig} (not retained)
B->>B: verify sig, shared = X25519(b, S), same pw
B->>B: persist FN + pw to flash, then reconnect as FN
```
@@ -162,17 +162,17 @@ sequenceDiagram
participant M as Mosquitto
participant B as Board (FN session)
B->>B: fresh X25519 pair (b2, B2), nonce n2, SAS = digits(hash(B2 || n2 || FN))
B->>G: board/<FN>/activation/request {B2, n2}
B->>G: board/{FN}/activation/request {B2, n2}
G->>O: pending request FN, MAC label, SAS, time
O->>G: choose SN, enter activation code, confirm SAS matches the board
G->>G: DB: ACTIVATING (FN, SN, generation g+1), unique constraint
G->>G: ephemeral (s2, S2); shared2; pw_sn = HKDF(shared2, salt=n2, info=label|SN|g+1)
G->>G: ephemeral (s2, S2), shared2, pw_sn = HKDF(shared2, salt=n2, info=label|SN|g+1)
G->>M: dynsec create or update client SN: pw_sn, role vending-device, clientid = FN
G->>B: board/<FN>/activation/response {SN, g+1, S2, sig}
G->>B: board/{FN}/activation/response {SN, g+1, S2, sig}
B->>B: verify sig, derive pw_sn, persist SN + pw_sn + generation, reconnect
B->>M: CONNECT username=SN, clientId=FN, password=pw_sn
M-->>G: first message on device/<SN>/... (or presence)
G->>G: DB: ACTIVE; disable the FN client; audit
M-->>G: first message on device/{SN}/... (or presence)
G->>G: DB: ACTIVE, disable the FN client, audit
```
### 9.3 Rules that make it safe