Adds support for LibHydrogen-based digital signatures and MQTT publishing

[simonarnell]

As part of our funded contribution to the UK's Digital Security by Design project, we have developed an integration of the digital signing of JSON models produced by the Configured Things platform to securely supply configuration updates to IoT devices running on the CHERIoT platform. The wider application here includes the hardware-assured secure distribution of configuration across software compartments, if interested there are more details shared in a CHERIoT blog article.

To remove the tight coupling between the Configured Things platform and CHERIoT, we have developed a set of CyberChef plugins that allow JSON models to be signed and published from CyberChef to a CHERIoT board via any third party MQTT broker.

CHERIoT boards are microcontrollers and therefore cryptography needs to have limited computational requirements. We therefore selected the C-based LibHydrogen crypt library. Having successfully ported LibHydrogen to CHERIoT and upstreamed the changes jedisct1/libhydrogen#156, we have created a LibHydrogen Web Assembly to enable binding of this C library with non-C applications such as our own Node.js-based platform. The LibHydrogen Sign CyberChef operation uses this WASM to sign an ArrayBuffer and exposes the signature as a JSON-encoded object.

The MQTT Publish CyberChef operation utilises the MQTT.js library to publish MQTT messages over a web socket to a given MQTT broker.

We wish to upstream these operations to enable wider use of MQTT and LibHydrogen within the CyberChef user base. This contribution also includes two glue operations that allows arbitrary JSON to be serialised to an ArrayBuffer and for a digitally signed object to be serialised into a format consistent with how our platform does so to enable compatibility between CyberChef's output and our own.

The following is a screenshot of the operations working together locally:

We will be demonstrating this end-to-end capability working on Sonata CHERIoT boards at the UK’s Secure by Design Showcase 2025 event in February.

[simonarnell]

Ok this seems good on my end, checks now seem to be failing due to a dependency issue on the UI tests stage of the "main" GitHub action.

[a3957273]

Hey @simonarnell, thanks so much for the contribution to the project. The MQTT processor seems exciting, and if it were converted into a separate PR we would happily merge that in. Unfortunately, we generally don't favour importing unknown npm dependencies into this project, which means we're unlikly to merge in other PR with the LibHydrogen dependency.

Sorry, we understand this makes a lot of new and exciting crypto hard to contribute, as it's often too large to contribute in-line to the project.