This is for people who were searching for why the SAS token issued by the TPM on their Windows 10 IoT Core device is expiring much quicker than expected or might have noticed that something isn’t quite right with the “validity” period. (as at early May 2019). If you want to “follow along at home” the code I used is available on GitHub.
I found the SAS key was expiring in roughly 5 minutes and the validity period in the configuration didn’t appear to have any effect on how long the SAS token was valid.
10:04:16 Application started ... 10:04:27 SAS token needs renewing 10:04:30 SAS token renewed 10:04:30.984 AzureIoTHubClient SendEventAsync starting 10:04:36.709 AzureIoTHubClient SendEventAsync starting The thread 0x1464 has exited with code 0 (0x0). 10:04:37.808 AzureIoTHubClient SendEventAsync finished 10:04:37.808 AzureIoTHubClient SendEventAsync finished The thread 0xb88 has exited with code 0 (0x0). The thread 0x1208 has exited with code 0 (0x0). The thread 0x448 has exited with code 0 (0x0). The thread 0x540 has exited with code 0 (0x0). 10:04:46.763 AzureIoTHubClient SendEventAsync starting 10:04:47.051 AzureIoTHubClient SendEventAsync finished The thread 0x10d8 has exited with code 0 (0x0). The thread 0x6e0 has exited with code 0 (0x0). The thread 0xf7c has exited with code 0 (0x0). 10:04:56.808 AzureIoTHubClient SendEventAsync starting 10:04:57.103 AzureIoTHubClient SendEventAsync finished The thread 0xb8c has exited with code 0 (0x0). The thread 0xc60 has exited with code 0 (0x0). 10:05:06.784 AzureIoTHubClient SendEventAsync starting 10:05:07.057 AzureIoTHubClient SendEventAsync finished ... The thread 0x4f4 has exited with code 0 (0x0). The thread 0xe10 has exited with code 0 (0x0). The thread 0x3c8 has exited with code 0 (0x0). 10:09:06.773 AzureIoTHubClient SendEventAsync starting 10:09:07.044 AzureIoTHubClient SendEventAsync finished The thread 0xf70 has exited with code 0 (0x0). The thread 0x1214 has exited with code 0 (0x0). 10:09:16.819 AzureIoTHubClient SendEventAsync starting 10:09:17.104 AzureIoTHubClient SendEventAsync finished The thread 0x1358 has exited with code 0 (0x0). The thread 0x400 has exited with code 0 (0x0). 10:09:26.802 AzureIoTHubClient SendEventAsync starting 10:09:27.064 AzureIoTHubClient SendEventAsync finished The thread 0x920 has exited with code 0 (0x0). The thread 0x1684 has exited with code 0 (0x0). The thread 0x4ec has exited with code 0 (0x0). 10:09:36.759 AzureIoTHubClient SendEventAsync starting 'backgroundTaskHost.exe' (CoreCLR: CoreCLR_UWP_Domain): Loaded 'C:\Data\Programs\WindowsApps\Microsoft.NET.CoreFramework.Debug.2.2_2.2.27505.2_arm__8wekyb3d8bbwe\System.Net.Requests.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled. 'backgroundTaskHost.exe' (CoreCLR: CoreCLR_UWP_Domain): Loaded 'C:\Data\Programs\WindowsApps\Microsoft.NET.CoreFramework.Debug.2.2_2.2.27505.2_arm__8wekyb3d8bbwe\System.Net.WebSockets.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled. Sending payload to AzureIoTHub failed:CONNECT failed: RefusedNotAuthorized
I went and looked at the NuGet package details and it seemed a bit old.
I have the RedGate Reflector plugin installed on my development box so I quickly disassembled the Microsoft.Devices.TPM assembly to see what was going on. The Reflector code is pretty readable and it wouldn’t take much “refactoring” to get it looking like “human” generated code.
public string GetSASToken(uint validity = 0xe10)
{
string deviceId = this.GetDeviceId();
string hostName = this.GetHostName();
long num = (DateTime.get_Now().ToUniversalTime().ToFileTime() / 0x98_9680L) - 0x2_b610_9100L;
string str3 = "";
if ((hostName.Length > 0) && (deviceId.Length > 0))
{
object[] objArray1 = new object[] { hostName, "/devices/", deviceId, "\n", (long) num };
byte[] bytes = new UTF8Encoding().GetBytes(string.Concat((object[]) objArray1));
byte[] buffer2 = this.SignHmac(bytes);
if (buffer2.Length != 0)
{
string str5 = this.AzureUrlEncode(Convert.ToBase64String(buffer2));
object[] objArray2 = new object[] { "SharedAccessSignature sr=", hostName, "/devices/", deviceId, "&sig=", str5, "&se=", (long) num };
str3 = string.Concat((object[]) objArray2);
}
}
return str3;
}
The validity parameter appears to not used. Below is the current code from the Azure IoT CSharp SDK on GitHub repository and they are different, the validity is used.
public string GetSASToken(uint validity = 3600)
{
const long WINDOWS_TICKS_PER_SEC = 10000000;
const long EPOCH_DIFFERNECE = 11644473600;
string deviceId = GetDeviceId();
string hostName = GetHostName();
long expirationTime = (DateTime.Now.ToUniversalTime().ToFileTime() / WINDOWS_TICKS_PER_SEC) - EPOCH_DIFFERNECE;
expirationTime += validity;
string sasToken = "";
if ((hostName.Length > 0) && (deviceId.Length > 0))
{
// Encode the message to sign with the TPM
UTF8Encoding utf8 = new UTF8Encoding();
string tokenContent = hostName + "/devices/" + deviceId + "\n" + expirationTime;
Byte[] encodedBytes = utf8.GetBytes(tokenContent);
// Sign the message
Byte[] hmac = SignHmac(encodedBytes);
// if we got a signature foramt it
if (hmac.Length > 0)
{
// Encode the output and assemble the connection string
string hmacString = AzureUrlEncode(System.Convert.ToBase64String(hmac));
sasToken = "SharedAccessSignature sr=" + hostName + "/devices/" + deviceId + "&sig=" + hmacString + "&se=" + expirationTime;
}
}
return sasToken;
}
I went back and look at the Github history and it looks like a patch was applied after the NuGet packages were released in May 2016.
If you read from the TPM and get nothing make sure you’re using the right TPM slot number and have “System Management” checked in the capabilities tab of the application manifest.
I’m still not certain the validity is being applied correctly and will dig into in a future post.
