Phase 1: nonce/replay correctness + unauthenticated-command guard - #126

Closed

davelee98 wants to merge 12 commits into

OpenDisplay:mainfrom

davelee98:debug/freeze-fix-phase1

Commits on Jul 26, 2026

docs: freeze-proofing plan, plan review, and timer/watchdog inventory
davelee98
committed
ee43e19
docs: Phase 1 implementation plan — nonce/replay correctness
davelee98
committed
edc93f0
docs: Phase 1 adversarial review + corrections; wire-protocol constraint
davelee98
committed
02bdd5c
fix(nonce): replace 512 B replay value ring with a 32 B sliding bitmap
davelee98
committed
0a60712
fix(nonce): split check from commit; stop counting packet loss as tampering
davelee98
committed
9b827f3
fix(pipe): do not answer a nonce-dropped 0x0081 frame with a fatal NACK
davelee98
committed
eeadbe0
ci: separate host-tests job for the nonce-window state machine
davelee98
committed
44df35a
test: host test for the nonce sliding-window state machine
davelee98
committed
23a586a
fix(nonce): review follow-ups - split log budgets, readable replay log, honest comments
davelee98
committed
c87ff60
fix(nonce): answer session-id mismatch with AUTH_REQUIRED, not a fatal NACK
davelee98
committed
55a2478
feat(auth): drop the BLE link after 10 consecutive unauthenticated commands
davelee98
committed
77ebdcd
fix(auth): drop the BLE link inline on nRF; loop() is starved mid-transfer
davelee98
committed
23ecaed