Robot-Market/mqtt-security-test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use only plain characters inside sequence diagram messages

Browse Source 
GoLand's Mermaid preview renders the flowchart and state diagrams but not
two of the sequence diagrams. Remove "|", "||", "+" and braces from message
text, the only characters those diagrams had that the others lack.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Ryan
2026-10-25 11:06:51 +03:30
co-authored by Claude Sonnet 5.5
parent 5b7a2c5584
commit 914e156b62
2 changed files with 23 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sn-as-username-process.md
+13 -13
View File
@@ -118,14 +118,14 @@ sequenceDiagram
participant G as Go backend
B->>B: random Client ID, X25519 pair (b, B), nonce n1
B->>M: CONNECT anonymous, clientId=random (TLS)
B->>M: SUBSCRIBE enroll/response/{cid} (own topic only)
B->>G: enroll/request/{cid} {B, n1, mac}
G->>G: reserve {cid}, assign FN, ephemeral (s, S)
G->>G: shared = X25519(s, B), pw = HKDF(shared, salt=n1, info=label|FN)
B->>M: SUBSCRIBE enroll/response/[cid] (own topic only)
B->>G: enroll/request/[cid] [B, n1, mac]
G->>G: reserve [cid], assign FN, ephemeral (s, S)
G->>G: shared = X25519(s, B), pw = HKDF(shared, salt=n1, info = label, FN)
G->>M: dynsec createClient FN, pw, clientid=FN, role board-bootstrap
G->>B: enroll/response/{cid} {FN, S, sig} (not retained)
G->>B: enroll/response/[cid] [FN, S, sig] (not retained)
B->>B: verify sig, shared = X25519(b, S), same pw
B->>B: persist FN + pw to flash, then reconnect as FN
B->>B: persist FN and pw to flash, then reconnect as FN
```
- `sig` = Ed25519 over `S || B || n1 || clientid || FN`. Binding the FN and the Client ID means a reply for another request, board or identity does not verify.
@@ -161,17 +161,17 @@ sequenceDiagram
participant G as Go backend
participant M as Mosquitto
participant B as Board (FN session)
B->>B: fresh X25519 pair (b2, B2), nonce n2, SAS = digits(hash(B2 || n2 || FN))
B->>G: board/{FN}/activation/request {B2, n2}
B->>B: fresh X25519 pair (b2, B2), nonce n2, SAS = digits(hash(B2, n2, FN))
B->>G: board/[FN]/activation/request [B2, n2]
G->>O: pending request FN, MAC label, SAS, time
O->>G: choose SN, enter activation code, confirm SAS matches the board
G->>G: DB: ACTIVATING (FN, SN, generation g+1), unique constraint
G->>G: ephemeral (s2, S2), shared2, pw_sn = HKDF(shared2, salt=n2, info=label|SN|g+1)
G->>G: DB: ACTIVATING (FN, SN, next generation), unique constraint
G->>G: ephemeral (s2, S2), shared2, pw_sn = HKDF(shared2, salt=n2, info = label, SN, generation)
G->>M: dynsec create or update client SN: pw_sn, role vending-device, clientid = FN
G->>B: board/{FN}/activation/response {SN, g+1, S2, sig}
B->>B: verify sig, derive pw_sn, persist SN + pw_sn + generation, reconnect
G->>B: board/[FN]/activation/response [SN, next generation, S2, sig]
B->>B: verify sig, derive pw_sn, persist SN, pw_sn and generation, reconnect
B->>M: CONNECT username=SN, clientId=FN, password=pw_sn
M-->>G: first message on device/{SN}/... (or presence)
M-->>G: first message on device/[SN]/... (or presence)
G->>G: DB: ACTIVE, disable the FN client, audit
```