Adds public_key and private_key for PKI

meshtastic/config.options

@@ -15,3 +15,7 @@
 *LoRaConfig.channel_num int_size:16
 
 *PowerConfig.device_battery_ina_address int_size:8
+
+*SecurityConfig.public_key max_size:32
+*SecurityConfig.private_key max_size:32
+*SecurityConfig.admin_key max_size:32

meshtastic/config.proto

@@ -135,14 +135,16 @@ message Config {
 
     /*
      * Disabling this will disable the SerialConsole by not initilizing the StreamAPI
+     * Moved to SecurityConfig
      */
-    bool serial_enabled = 2;
+    bool serial_enabled = 2[deprecated = true];
 
     /*
      * By default we turn off logging as soon as an API client connects (to keep shared serial link quiet).
      * Set this to true to leave the debug log outputting even when API is active.
+     * Moved to SecurityConfig
      */
-    bool debug_log_enabled = 3;
+    bool debug_log_enabled = 3[deprecated = true];
 
     /*
      * For boards without a hard wired button, this is the pin number that will be used
@@ -175,8 +177,9 @@ message Config {
     /*
      * If true, device is considered to be "managed" by a mesh administrator
      * Clients should then limit available configuration and administrative options inside the user interface
+     * Moved to SecurityConfig
      */
-    bool is_managed = 9;
+    bool is_managed = 9[deprecated = true];
 
     /*
      * Disables the triple-press of user button to enable or disable GPS
@@ -1006,8 +1009,56 @@ message Config {
 
     /*
      * Enables device (serial style logs) over Bluetooth
+     * Moved to SecurityConfig
      */
-    bool device_logging_enabled = 4;
+    bool device_logging_enabled = 4[deprecated = true];
+  }
+
+  message SecurityConfig {
+
+  /*
+   * The public key of the user's device.
+   * Sent out to other nodes on the mesh to allow them to compute a shared secret key.
+   */
+    bytes public_key = 1;
+
+  /*
+   * The private key of the device.
+   * Used to create a shared key with a remote device.
+   */
+    bytes private_key = 2;
+
+    /*
+     * The public key authorized to send admin messages to this node.
+     */
+    bytes admin_key = 3;
+
+    /*
+     * If true, device is considered to be "managed" by a mesh administrator via admin messages
+     * Device is managed by a mesh administrator.
+     */
+    bool is_managed = 4;
+
+    /*
+     * Serial Console over the Stream API."
+     */
+    bool serial_enabled = 5;
+
+    /*
+     * By default we turn off logging as soon as an API client connects (to keep shared serial link quiet).
+     * Output live debug logging over serial.
+     */
+    bool debug_log_api_enabled = 6;
+
+    /*
+     * Enables device (serial style logs) over Bluetooth
+     */
+    bool bluetooth_logging_enabled = 7;
+
+    /*
+     * Allow incoming device control over the insecure legacy admin channel.
+     */
+    bool admin_channel_enabled = 8;
   }
 
   /*
@@ -1021,5 +1072,6 @@ message Config {
     DisplayConfig display = 5;
     LoRaConfig lora = 6;
     BluetoothConfig bluetooth = 7;
+    SecurityConfig security = 8;
   }
 }

meshtastic/localonly.proto

@@ -58,6 +58,11 @@ message LocalConfig {
    * NodeDB.cpp in the device code.
    */
   uint32 version = 8;
+
+  /*
+   * The part of the config that is specific to Security settings
+   */
+  Config.SecurityConfig security = 9;
 }
 
 message LocalModuleConfig {

meshtastic/mesh.options

@@ -3,6 +3,7 @@
 
 *macaddr max_size:6 fixed_length:true # macaddrs
 *id max_size:16 # node id strings
+*public_key max_size:32 # public key
 
 *User.long_name max_size:40
 *User.short_name max_size:5

meshtastic/mesh.proto

@@ -665,6 +665,12 @@ message User {
    * Indicates that the user's role in the mesh
    */
   Config.DeviceConfig.Role role = 7;
+
+  /*
+   * The public key of the user's device.
+   * This is sent out to other nodes on the mesh to allow them to compute a shared secret key.
+   */
+  bytes public_key = 8;
 }
 
 /*
@@ -1105,6 +1111,16 @@ message MeshPacket {
    * When receiving a packet, the difference between hop_start and hop_limit gives how many hops it traveled.
    */
   uint32 hop_start = 15;
+
+  /*
+   * Records the public key the packet was encrypted with, if applicable.
+   */
+  bytes public_key = 16;
+
+  /*
+   * Indicates whether the packet was en/decrypted using PKI
+   */
+  bool pki_encrypted = 17;
 }
 
 /*