Finding 8: multi-source entropy with ChaCha20 KDF conditioning

[sensei-hacker]

Summary

• Replaces single-source `RandRSSI()` with `CollectEntropy()` for session key and nonce generation
• XOR-mixes RSSI analog noise and ESP32 hardware TRNG into a 32-byte accumulator
• Conditions output via ChaCha20 used as a PRF — same construction as Linux kernel CRNG (v5.17+)
• Replaces the incomplete `GetRandomBytes()` stub left in the codebase
• Fixes hardcoded `24` at call site → `sizeof(nonce_key)` to guard against future struct changes
• Adds compile-time `#warning` when no radio is defined and RSSI source is unavailable

Security

Finding 8 (MEDIUM): RNG quality — RSSI sampling alone is insufficient for cryptographic key material.

Raw XOR of entropy sources is not safe as direct key material; a conditioning step is required. ChaCha20 with entropy as the key encrypting zeros yields a keystream that is computationally indistinguishable from uniform random under PRF security — no separate SHA-256 dependency needed.

Testing

Native unit tests: `pio test -e native` with `-DUSE_ENCRYPTION` — 21/21 previously-passing tests still pass, 2 pre-existing failures (Finding #1, unrelated).

Hardware validation on ESP32-D0WDQ6 @ 240 MHz via `test_esp32_standalone/`:

Test	Result
`esp_random()` non-zero	PASS (0x43C6BC54)
`esp_random()` varies across 10 calls	PASS
`CollectEntropy()` output non-zero	PASS
Two successive calls produce different output	PASS
ChaCha20 KDF deterministic (same key → same output)	PASS
Different keys → different output	PASS
Bit distribution over 1008 bytes	PASS (50.8% ones)

ChaCha20 adds 3.52 µs per packet (0.09% CPU at 250 Hz) — negligible overhead.

Code Review

Reviewed with inav-code-review agent and security analyst. Critical findings addressed: KDF conditioning added, flawed timer jitter source removed, sizeof used at call site.