Not clear how to generate key for Google FMDN?

[maelp]

The ESP32 folder has code for Google FMDN but it's not clear how we should generate a key for this? I thought the generate_keys.py script was generating the Apple FindMy key, but is it also suited for the Google key?

[biemster]

The Google FMDN is still a bit of a work in progress on our side, I don't think I ever tested the micropython for this. The only repo that does Google FMDN (and does it really well!) is https://github.com/leonboe1/GoogleFindMyTools

[maelp]

@biemster Thanks! I'll take a look!

Meanwhile would you mind documenting in the README the structure of the "keys" file? it's not clear to me exactly how it works:

eg I see

Private key: r8GG4nUDQbef1/...
Advertisement key: Fe8I1S1BKG...
Hashed adv key: fgkJp18ksbTIhz3...

I guess:

• Private + Hashed adv are used by the backend to query?
• Advertisment key is used by the firmware to advertise?

Is that how it works?

[biemster]

i understand that it is not clear immediately, but this repo is on purpose not beginner friendly. It does require a bit of prior research in how this all works. The private key is obvious, the advertisement key is the public key corresponding to that. The hashed advertisement key is the value needed to request the reports.

[maelp]

This could be perhaps a bit clearer (outputs json)

#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.12"
# dependencies = [
#     "cryptography==46.0.3",
# ]
# ///
"""
Apple FindMy Key Generation

Generates SECP224R1 elliptic curve key pairs for use with Apple's FindMy network.
The generated keys include:
- Private key: Used by the backend to query location reports
- Advertisement key: Public key stored on the device and broadcast
- Hashed advertisement key: Used by the backend to request location reports

Note: FindMy requires the advertisement key (public key x-coordinate) to be even.
"""
import base64
import hashlib
import json
import random

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec


def compute_sha256(data: bytes) -> bytes:
  """
  Compute SHA-256 hash of the input data.

  Args:
    data: Bytes to hash

  Returns:
    SHA-256 digest as bytes
  """
  digest = hashlib.new("sha256")
  digest.update(data)
  return digest.digest()


def encode_base64(data: bytes) -> str:
  """
  Encode bytes to base64 string.

  Args:
    data: Bytes to encode

  Returns:
    Base64-encoded string
  """
  return base64.b64encode(data).decode("ascii")


def generate_key(output_filename: str) -> None:
  """
  Generate a FindMy-compatible SECP224R1 key pair and save to JSON file.

  This function generates random keys until it finds one where the public key
  x-coordinate is even, as required by Apple's FindMy network protocol.

  The output JSON contains:
  - private_key: 224-bit private key (28 bytes, base64-encoded)
  - advertisment_key: Public key x-coordinate (28 bytes, base64-encoded)
  - hashed_advertisment_key: SHA-256 hash of advertisement key (base64-encoded)

  Args:
    output_filename: Path to output JSON file
  """
  while True:
    private_key_int = random.getrandbits(224)

    public_key_x = ec.derive_private_key(
      private_key_int,
      ec.SECP224R1(),
      default_backend()
    ).public_key().public_numbers().x

    private_key_bytes = int.to_bytes(private_key_int, 28, 'big')
    advertisement_key_bytes = int.to_bytes(public_key_x, 28, 'big')

    is_even = advertisement_key_bytes[0] % 2 == 0
    if is_even:
      break

  key_data = {
    "private_key": encode_base64(private_key_bytes),
    "advertisment_key": encode_base64(advertisement_key_bytes),
    "hashed_advertisment_key": encode_base64(compute_sha256(advertisement_key_bytes))
  }

  with open(output_filename, 'w') as f:
    json.dump(key_data, f, indent=2)


if __name__ == "__main__":
  generate_key("device_keys.json")