How does Device Authentication work ?

[thibauts]

I'm trying to understand device authentication right now and will post progress in this issue.

[thibauts]

The culprit is the VerifyCredentials function in cast_auth_util_nss.cc.

The Chromecast uses 2 certificates. The first one is used for the TLS connection, is self-signed and expires every 24 hours (let's call it the peer certificate). The second one is used to validate the first in the device authentication process (let's call it the platform certificate).

I added a few tools in the bin directory to help dumping and inspecting the various files.

The process seems to go as follows.

1. Every 24 hours the dongle generates a new self-signed TLS peer certificate.
2. A client sends a DeviceAuth challenge.
3. The dongle generates a signature of its current peer certificate using the platform certificate private key and returns both the platform certificate and the signature to the client.
4. First the client verifies that the platform certificate is signed by a trusted CA using its embedded public key (kCAPublicKeyDER)
5. The client then extracts the platform certificate public key and uses it to check that the returned signature matches the peer certificate signed with the platform certificate.

Long story short, I'm not an expert in cryptography but it seems that without the platform certificate private key used to produce the signature, not much can be done.

[luke]

I stumbled across this repo. It seems to have tools related to the certs on the chromecast. Thought it migth be of some help. https://github.com/EiNSTeiN-/chromecast-widevine-tools

[thibauts]

Looks good indeed. Thanks a lot !

[leo-labs]

Are there some updates on this? :)

[thibauts]

Nothing yet. I don't have time nor interest in searching this direction but I'll help if I can.

[leo-labs]

Am I rigth that the only way to get authentiation is work is buying a chromecast and root it?

[thibauts]

I can't say for sure. A first step would be understanding the auth scheme and looking at the chromium source code.

[emersion]

Somme guys managed to make it work in a Python project: https://github.com/dz0ny/leapcast
I will try to add this to node-castv2 soon :-)

[thibauts]

Hmm, where exactly is the code that does it ?

[emersion]

I think sign_data is very interesting here: https://github.com/dz0ny/leapcast/blob/master/leapcast/services/dial.py

[leo-labs]

I do not think, that this is related to chromecast v2 protocol;

[thibauts]

I think @leo-labs is right, it doesn't look like the same process at all. Probably only relevant to the DIAL protocol.

[Afterster]

The chromecast protocol is new to me so sorry if this is a dummy question :).
If the 24h-generated certificate is only used for Chromecast device legacy authentication, an "authentication proxy" replaying the authentication request to a real Chromecast should work isn't it?