Aerohive Keygen

A key generation tool for Aerohive access points that calculates secret keys based on device serial numbers and firmware versions.

Algorithm Overview

The key generation algorithm uses a multi-step MD5 hashing process with platform-specific secrets and magic strings. The algorithm differs slightly between AP130 and AP230/305 device types.

Core Components

1. Magic String Mixing: Combines platform secrets with device-specific magic strings (stored as little-endian uint32 values) and performs byte swapping operations.

2. MD5 Digest to String Conversion: Maps MD5 digest bytes (0-255) to ASCII characters using modulo 59:

   • Values 0-8: Maps to '0'-'8' (ASCII 48-56)
   • Values 9-33 (0x22-1): Maps to 'A'-'Y' (ASCII 65-89)
   • Values 34-58: Maps to special characters (ASCII 97-121)

3. Multi-Step Hashing: Chains multiple MD5 operations, converting digests to strings between each step.

AP230/305 Algorithm

For AP230 and AP305 devices, the algorithm requires both serial number and firmware version:

1. Initialize with platform secret: TIUt8Kk5A7d4WirH
2. Mix magic strings with platform secret using specific swap locations
3. Find the first null byte in the mixed result to determine length
4. Convert platform secret to string (this step is performed but immediately overwritten)
5. MD5 hash the mixed result (up to first null byte) → convert to string
6. Append converted digest to serial number → MD5 hash → convert to string
7. Append converted digest to firmware version → MD5 hash → convert to string
8. Return final converted digest as the key

AP130 Algorithm

For AP130 devices, the algorithm only requires the serial number:

1. Initialize with platform secret: JPEiX5cjsbcRTP3X
2. Mix magic strings with platform secret using specific swap locations
3. Find the first null byte in the mixed result to determine length
4. MD5 hash the mixed result (up to first null byte) → convert to string
5. Append converted digest to serial number → MD5 hash → convert to string
6. Return final converted digest as the key

Magic String Mixing

The mixing process:

1. Convert magic strings from uint32 (little-endian) to bytes
2. Copy platform secret to output buffer
3. Append magic string bytes to output buffer
4. Perform byte swaps at specific locations: positions [3, 1, 4, 5, 0, 7, 2, 6] are swapped with corresponding positions in the first 16 bytes

Device Type Detection

The device type is determined by examining characters at positions 1-3 of the serial number:

• 230 or 305: AP230/305 devices (require version parameter)
• 130: AP130 devices (version not required)

Usage

JavaScript Version

node aerohive-keygen.js --serial=SERIAL [--version=VERSION]

Python Version

python3 aerohive-keygen.py --serial=SERIAL [--version=VERSION]

Examples

# AP230/305 device
node aerohive-keygen.js --serial=02301601202422 --version=10.3

# AP130 device
node aerohive-keygen.js --serial=01301601202422

Options

• --serial=SERIAL: Device serial number (required)
• --version=VERSION: Firmware version (required for AP230/305, e.g., 10.3)
• -h, --help: Display help message