Add AES-CTR decryption support for encrypted Meshtastic packets in meshview.ino

[Copilot]

Overview

Enhances meshview.ino to fully support encrypted Meshtastic packet decryption, transforming it from a basic unencrypted packet viewer into a complete UDP packet decoder with encryption support.

Problem

The original meshview.ino only handled unencrypted packets (decoded variant). When it encountered encrypted packets, it would simply report "Packet does not contain decoded Data (maybe encrypted or other variant)" and skip them. This made it unusable for most real-world Meshtastic networks that use encryption.

Example of previous behavior:

Encrypted packet detected. Attempting decryption...
Decryption worked but protobuf decode failed for channel 0
Failed to decrypt packet with any configured key.

Solution

Implemented full AES-CTR decryption based on the Meshtastic firmware's CryptoEngine, including:

Core Features

• AES-CTR Decryption: Uses mbedtls library (standard on ESP32) to decrypt packets with AES-128 or AES-256
• Base64 Key Decoding: Converts base64-encoded PSK strings to binary keys
• Proper Nonce Generation: Creates nonces from packet ID and sender node ID, matching Meshtastic firmware
• Multi-Channel Support: Configure up to 4 channels with different keys; automatically tries all keys until successful
• Channel Hash Calculation: XOR-based hash of channel name + PSK bytes for channel identification

Special Key Handling

Supports Meshtastic's special PSK conventions:

• PSK "AQ==" (0x01) → Uses default Meshtastic key
• PSK "Ag==" (0x02) through "Cg==" (0x10) → Uses default key with last byte incremented
• Custom base64 keys → Used directly for encryption

Security

• Buffer overflow protection (256-byte limit on encrypted payloads)
• Bounds checking before decryption
• Safe handling of variable-length data
• Proper cleanup of crypto contexts

Debugging

Extensive diagnostic output to help troubleshoot configuration issues:

Nonce (hex): 05 56 55 42 00 00 00 00 EF BE AD DE 00 00 00 00
Encrypted data (hex): 55 C8 57 01 21 F1 EE 43 07 A9 14
Trying channel 0 (LongFast, hash=0x8C)...
Decrypted data (hex): 08 01 12 05 68 65 6C 6C 6F
Successfully decrypted with channel 0 (LongFast)
Decoded text message: hello

Configuration Example

// Configure your channels
ChannelConfig channels[MAX_CHANNELS] = {
  {"LongFast", "AQ==", {0}, 0, 0},  // Default channel
  {"MyTeam", "1PG7OiApB1nwvP+rz05pAQ==", {0}, 0, 0},  // Custom channel
};
int num_channels = 2;

Documentation

• Comprehensive inline comments with setup instructions and encryption details
• MESHVIEW_USAGE.md: Complete usage guide with examples and troubleshooting
• IMPLEMENTATION_SUMMARY.md: Technical documentation with encryption algorithm details
• README.md: Updated with meshview.ino features section

Technical Details

Encryption Algorithm

• Mode: AES-CTR (Counter Mode)
• Key Sizes: 128-bit (16 bytes) or 256-bit (32 bytes)
• Library: mbedtls (included with ESP32 Arduino core)

Nonce Format (16 bytes)

Bytes 0-3:   Packet ID (little-endian, 32-bit)
Bytes 4-7:   Zero padding
Bytes 8-11:  From Node ID (little-endian, 32-bit)
Bytes 12-15: Zero padding

Testing

Ready for testing with real encrypted Meshtastic packets. Users should:

1. Configure WiFi credentials
2. Add Meshtastic channel names and PSK keys
3. Upload to ESP32
4. Monitor Serial output for decrypted packets

References

• Meshtastic Encryption Documentation
• Meshtastic Firmware CryptoEngine
• Meshtastic Protocol Buffers

Fixes #[issue_number]

Original prompt

---

This section details on the original issue you should resolve

<issue_title>.ino file enhance with ability to decode packets and change channel and key </issue_title>
<issue_description>Complete this as fully working example to display data from UDP.

https://github.com/SpudGunMan/node-slurper/blob/main/meshview.ino

Currently decodes outer wrapper but has no decryption of encrypted packets.

Haven't tested but assume licensed mode will decrypt as it's clear text.</issue_description>

Comments on the Issue (you are @copilot in this section)

@SpudGunMan Some details on encryption

https://meshtastic.org/docs/overview/encryption/

https://meshtastic.org/docs/about/overview/encryption/limitations/

If any improvements otherwise are seen to handling packets.

https://meshtastic.org/docs/overview/mesh-algo/

@SpudGunMan Encryption in the Meshtastic firmware is handled primarily through the `CryptoEngine` class and its platform-specific implementations (such as `ESP32CryptoEngine`). Here’s where encryption is managed in the codebase

https://github.com/meshtastic/firmware

---

1. src/mesh/CryptoEngine.h & src/mesh/CryptoEngine.cpp

• The CryptoEngine class provides the main interfaces for encryption and decryption, such as:
  • encryptPacket(...)
  • decrypt(...)
  • encryptAESCtr(...) (AES in counter mode)
  • encryptCurve25519(...) and decryptCurve25519(...) (for PKI/Curve25519 encryption)
• Example implementation:

  void CryptoEngine::encryptPacket(uint32_t fromNode, uint64_t packetId, size_t numBytes, uint8_t *bytes) {
      if (key.length > 0) {
          initNonce(fromNode, packetId);
          if (numBytes <= MAX_BLOCKSIZE) {
              encryptAESCtr(key, nonce, numBytes, bytes);
          } else {
              LOG_ERROR("Packet too large for crypto engine: %d. noop encryption!", numBytes);
          }
      }
  }

---

2. Platform-specific implementation:

• For the ESP32, the class ESP32CryptoEngine in src/platform/esp32/ESP32CryptoEngine.cpp implements the crypto functions using mbedtls:

  virtual void encryptAESCtr(CryptoKey _key, uint8_t *_nonce, size_t numBytes, uint8_t *bytes) override {
      if (_key.length > 0) {
          mbedtls_aes_setkey_enc(&aes, _key.bytes, _key.length * 8);
          ...
          mbedtls_aes_crypt_ctr(&aes, numBytes, &nc_off, _nonce, stream_block, scratch, bytes);
      }
  }

---

3. Usage in Packet Handling (src/mesh/Router.cpp)

• When a packet is about to be sent, the function perhapsEncode() encrypts the data using the active channel key:

  crypto->encryptPacket(getFrom(p), p->id, numbytes, bytes);
  memcpy(p->encrypted.bytes, bytes, numbytes);

---

4. Curve25519/PKI Encryption

• encryptCurve25519 and decryptCurve25519 support public key encryption for secure communications using node public keys.

---

Summary:

• Encryption is abstracted by the CryptoEngine class, with actual cryptographic routines (AES, Curve25519, etc.) implemented in both platform-agnostic (src/mesh/CryptoEngine.cpp) and platform-specific files (like src/platform/esp32/ESP32CryptoEngine.cpp).
• Packet encryption is triggered in routing code before sending data over the mesh.
• The AES key and nonce generation are managed per-packet, ensuring unique encryption for each transmission.</comment_new>
  <comment_new>@SpudGunMan
  Something like this?

#include <AES.h>
#include <CTR.h>

byte key[16] = { /* your key here / };
byte nonce[16] = { / nonce for this packet / };
byte ciphertext[] = { / ciphertext bytes */ };
size_t len = sizeof(ciphertext);

void setup() {
Serial.begin(115200);

AES128 aes;
CTR ctr;
aes.setKey(key, sizeof(key));
ctr.clear();
ctr.setCipher(&aes);
ctr.setIV(nonce, sizeof(nonce));
ctr.seek(0);

byte plaintext[len];
ctr.decrypt(plaintext, ciphertext, len);

Serial.print("Decrypted: ");
for (size_t i = 0; i < len; i++) Serial.write(plaintext[i]);
Serial.println();
}

void loop() {}</comment_new>
<comment_new>@SpudGunMan
Details on some aes arduino capability

https://www.arduinolibraries.info/libraries/aes-lib

And

https://www.arduinolibraries.info/libraries/aes-utils

As well as some others

https://github.com/DavyLandman/AESLib

https://www.arduinolibraries.info/libraries/aes_cmac

Having clear direction of which module to use which is supported by the Arduino IDE

@SpudGunMan there is this branch with some ideas that look good https://github.com/SpudGunMan/node-slurper/tree/copilot/enhance-decrypt-packets @SpudGunMan One issue the last branch and PR had was no accounting for the channel name @SpudGunM...

Fixes #1

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.