security: Fix bug and gate it properly via asserts and warnings. Reported by @mkj, re-reviewed by @ramrunner, thanks and kudos to both

Author: brainstorm

ssh-stamp-esp32/src/bin/ssh-stamp-esp32.rs

@@ -87,14 +87,31 @@ async fn main(spawner: Spawner) -> ! {
     cfg_if::cfg_if! {
         if #[cfg(any(feature = "esp32c5", feature = "esp32c61"))] {
             // ESP32-C5/C61 have no TRNG peripheral — use the basic Rng directly.
+            // Until the TODO above is resolved, key material on these chips is
+            // only as good as the bare RNG register, so say so out loud.
+            warn!("No TRNG on this chip: RNG is not cryptographically secure until the radio is up");
             let rng = esp_hal::rng::Rng::new();
             register_custom_rng(rng);
         } else {
-            let trng_source = TrngSource::new(peripherals.RNG, peripherals.ADC1);
-            let trng = Trng::try_new().unwrap();
+            // The TrngSource must outlive every consumer of randomness, not
+            // just this block. `Trng::downgrade` hands back `Rng`, a
+            // zero-sized handle that simply reads the RNG register, and
+            // dropping the TrngSource calls `revert_trng()` which switches the
+            // ADC entropy source back off. Anything drawn afterwards is no
+            // longer cryptographically secure.
+            //
+            // That matters because none of the key material is generated here:
+            // the SSH host key, WiFi SSID/PSK and MAC are all minted further
+            // down in `store::load_or_create`, and sunset draws fresh session
+            // and key-exchange material for every connection later still.
+            //
+            // `main` never returns, so binding it here keeps the entropy
+            // source enabled for the lifetime of the program.
+            let _trng_source = TrngSource::new(peripherals.RNG, peripherals.ADC1);
+            let trng = Trng::try_new()
+                .expect("TrngSource was just created, so the TRNG must be available");
             let rng = trng.downgrade();
             register_custom_rng(rng);
-            drop(trng_source);
         }
     }
 
@@ -125,6 +142,18 @@ async fn main(spawner: Spawner) -> ! {
         tx: tx_num,
     };
 
+    // On first boot this mints the SSH host key and the WiFi PSK, so the
+    // entropy source enabled above has to still be running. Guard the
+    // invariant rather than trusting a comment: `debug-assertions` are on
+    // even in release for this workspace, so reintroducing an early drop of
+    // the `TrngSource` fails loudly on the bench instead of silently
+    // producing predictable keys.
+    #[cfg(not(any(feature = "esp32c5", feature = "esp32c61")))]
+    debug_assert!(
+        TrngSource::is_enabled(),
+        "entropy source was disabled before host key generation"
+    );
+
     debug!("Loading config");
     let flash_config = {
         let Some(flash_storage_guard) = flash::get_flash_n_buffer() else {