esphome / esphome/backlog

Remove deprecated plaintext encryption key provisioning in 2027.2.0

Open
#157 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

esphome/esphome#17482 added zero PSK noise provisioning so the api encryption key no longer crosses the wire in plaintext; the old plaintext path was kept for older clients with a deprecation warning in send_noise_encryption_set_key_response_ in esphome/components/api/api_connection.cpp.

After the six month window (target 2027.2.0) remove the plaintext acceptance for keyless encryption devices: drop the plaintext helper from dual builds, reject NoiseEncryptionSetKeyRequest on unencrypted connections, and update the Home Assistant fallback accordingly.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading send_noise_encryption_set_key_response_ in esphome/components/api/api_connection.cpp, then trace the plaintext acceptance path and the Home Assistant fallback mentioned in the issue. Done means removing the plaintext helper from dual builds, rejecting NoiseEncryptionSetKeyRequest on unencrypted connections, and updating that fallback for the 2027.2.0 target.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
api, security
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.