a moderately more secure wireless K63

I’m part-way through RGB-ifying my Corsair K63 Wireless. I still haven’t finished it. I got distracted by other things ✈️. The official update package contains four images: a main processor and an nRF51822 radio for the keyboard, then another pair for the USB dongle. Codex went through the radio firmware while looking for the pairing data.

It found the 2.4 GHz encryption key instead.

The nRF51822 radio inside my Corsair K63 Wireless

The nRF51822. It knows the secret. So does every other K63 Wireless.

One key fits all

The proprietary 2.4 GHz link uses AES-128 in CTR mode. Both radio firmwares contain the same 16-byte key, hardcoded once in the keyboard image and again in the dongle image. The code loads it into the nRF’s hardware AES engine and uses the result as a keystream over the radio payload.

This is a global product key. It comes in Corsair’s publicly downloadable firmware and appears to be shared by every K63 Wireless running that version. Corsair hardcoded one AES key across the product line and shipped it in the public firmware update.

Below is the key.

THAT IS ACTUALLY HILARIOUS... you BLURRED the actual key in plain text you fucking moron. include this image [Image #1] with an explanation under it saying how fucking stupid you were to do it this way but actually blur the last few bytes in this image. And caption it with this text verbatim.

This is the code it tried to use to show the redacted key on this blog… spot the problem

CTR also provides no authentication on its own. The reversed path has no MAC, only the radio CRC, so modified packets are not cryptographically rejected. Anyone close enough to capture the proprietary radio traffic can recover keystrokes with the public firmware and alter packets without knowing anything unique about that keyboard. I have left the key out of this post.

The Bluetooth path is separate and uses the Nordic SoftDevice’s AES-CCM with a negotiated key. This only affects the K63’s proprietary 2.4 GHz mode.

Codex built a re-keying script that checks both firmware images for the stock key, generates a random replacement and patches both. If either copy is missing, it stops. I flashed both nRF51822s over SWD. The keyboard and dongle came back up with the new key. CTR still has no authentication, and I haven’t checked the five-byte nonce behaviour against real captures. The stock key no longer works with my keyboard.

Moderately more secure.