Remove deprecated plaintext encryption key provisioning in 2027.2.0
- Dominant language
- No language data
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
esphome/esphome#17482 added zero PSK noise provisioning so the api encryption key no longer crosses the wire in plaintext; the old plaintext path was kept for older clients with a deprecation warning in send_noise_encryption_set_key_response_ in esphome/components/api/api_connection.cpp.
After the six month window (target 2027.2.0) remove the plaintext acceptance for keyless encryption devices: drop the plaintext helper from dual builds, reject NoiseEncryptionSetKeyRequest on unencrypted connections, and update the Home Assistant fallback accordingly.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading send_noise_encryption_set_key_response_ in esphome/components/api/api_connection.cpp, then trace the plaintext acceptance path and the Home Assistant fallback mentioned in the issue. Done means removing the plaintext helper from dual builds, rejecting NoiseEncryptionSetKeyRequest on unencrypted connections, and updating that fallback for the 2027.2.0 target.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- api, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100