Firmware over the air#

use pamoja_lorawan::packages::fragment::{
    data_block_int_key, BlockMicKey, Defragmenter, Fragmenter,
};
use pamoja_lorawan::packages::multicast::{
    mc_app_s_key, mc_ke_key, mc_key, mc_root_key, wrap_mc_key,
};
use pamoja_security::DeviceIdentity;
use pamoja_update::block::{frame, split, DESCRIPTOR};
use pamoja_update::{
    image_digest, Device, Manifest, MemoryStore, PayloadFormat, SlotState, SlotStore, Updater,
    ENVELOPE_MAX, STRUCTURE_VERSION,
};

// The publisher signs releases; the devices in the field are anchored to its public half
// and will take firmware from nobody else, however it reaches them.
let publisher = DeviceIdentity::from_seed(&[7u8; 32]);
const VENDOR: [u8; 16] = [10; 16];
const FLOW_METER: [u8; 16] = [11; 16];

let image = b"firmware for a flow meter, version two, long enough to need fragmenting";
let manifest = Manifest {
    structure_version: STRUCTURE_VERSION,
    sequence: 2,
    vendor_id: VENDOR,
    class_id: FLOW_METER,
    format: PayloadFormat::Raw,
    storage: 1,
    digest: image_digest(image),
    size: image.len() as u32,
    expires: 0,
};
let mut envelope = [0u8; ENVELOPE_MAX];
let signed = manifest.sign(&publisher, &mut envelope)?;

// One block carries the release: the signed manifest and the image behind a header that
// says where each begins. The transport moves bytes and vouches for none of them.
let mut block = [0u8; 512];
let block_len = frame(&envelope[..signed], image, &mut block)?;
let block = &block[..block_len];
println!(
    "release   {block_len} bytes: a signed manifest and {} of image",
    image.len()
);

// The group every device in the field belongs to. Its key travels wrapped under a key
// each device derives from its own root key, so the broadcast key is never in the clear.
let device_root_key = [0x2B; 16];
let group_key = [0x77; 16];
let group_addr = 0x2601_0042;
let wrapped = wrap_mc_key(&mc_ke_key(&mc_root_key(&device_root_key)), &group_key);
let unwrapped = mc_key(&mc_ke_key(&mc_root_key(&device_root_key)), &wrapped);
let keyed = if unwrapped == group_key {
    "keyed by the key the server wrapped and the device unwrapped"
} else {
    "with a key the device could not unwrap"
};
println!("group     {group_addr:#010x}, {keyed}");
let _payload_key = mc_app_s_key(&group_key, group_addr);

// The server cuts the block into fragments and sends more than there are, so a device
// that misses some can still finish. Each coded fragment is the exclusive-or of a
// pseudo-random half of the originals.
let sender = Fragmenter::new(block, 32)?;
println!(
    "session   {} fragments of {} bytes, {} of padding",
    sender.nb_frag(),
    sender.frag_size(),
    sender.padding()
);

// The device puts it back together in storage it set aside once: the block itself, and
// room to solve for a handful of losses.
let mut store = [0u8; 512];
let mut matrix = [0u8; 256];
let mut receiver = Defragmenter::new(
    sender.nb_frag(),
    sender.frag_size(),
    &mut store,
    &mut matrix,
)?;

// The link drops every fourth fragment. The session keeps going until the block is whole.
let mut piece = [0u8; 32];
let (mut sent, mut coded) = (0, 0);
for n in 1..=sender.nb_frag() * 2 {
    if n % 4 == 0 {
        continue;
    }
    sender.fragment(n, &mut piece)?;
    sent += 1;
    coded += usize::from(n > sender.nb_frag());
    if receiver.fragment(n, &piece)? {
        break;
    }
}
println!("received  {sent} fragments, {coded} of them coded, and the block is whole");

// What the device built is checked against the code the server took over the block with
// this device's own key, and sent in the session setup. It is taken a piece at a time, so
// the image is never held twice.
let signer = BlockMicKey::new(&data_block_int_key(&device_root_key));
let mut expected = signer.start(1, 0, DESCRIPTOR, block_len as u32);
expected.update(block);
let expected = expected.finish();
let mut built = signer.start(1, 0, DESCRIPTOR, block_len as u32);
built.update(&receiver.block()[..block_len]);
let intact = built.finish() == expected;
let verdict = if intact {
    "carries the code the server took over it"
} else {
    "does not carry the code the server took over it"
};
println!("checked   the block the device built {verdict}");

// Only now does the update itself get a say. The header says where the manifest ends;
// everything after that is the manifest's decision, exactly as for a wired update.
let (carried_envelope, carried_image) = split(&receiver.block()[..block_len])?;
let mut updater = Updater::new(
    Device {
        vendor_id: VENDOR,
        class_id: FLOW_METER,
        anchor: publisher.public(),
    },
    MemoryStore::new(2, 4096),
);
updater.provision(0, 1).expect("the shipped image");
let slot = updater.stage(carried_envelope, carried_image)?;
println!("staged    into slot {slot}, leaving the running image alone");

// A release broadcast to everyone is still refused by anyone it is not for. This one is
// signed by another key.
let impostor = DeviceIdentity::from_seed(&[90u8; 32]);
let mut forged = [0u8; ENVELOPE_MAX];
let forged_len = manifest.sign(&impostor, &mut forged)?;
match updater.stage(&forged[..forged_len], image) {
    Ok(_) => println!("a forged release was accepted, which should never happen"),
    Err(error) => println!("forged    refused: {error}"),
}

// A device further out hears every other fragment of the session's first pass, eight
// uncoded and four coded. It solves for what it can and says how many it still lacks,
// so the server keeps sending coded fragments until it has none left to ask for.
let mut far_store = [0u8; 512];
let mut far_matrix = [0u8; 256];
let mut far = Defragmenter::new(
    sender.nb_frag(),
    sender.frag_size(),
    &mut far_store,
    &mut far_matrix,
)?;
let first_pass = sender.nb_frag() + sender.nb_frag() / 2;
for n in (1..=first_pass).step_by(2) {
    sender.fragment(n, &mut piece)?;
    far.fragment(n, &piece)?;
}
println!(
    "short     heard {} of {first_pass} fragments, and {} are still missing",
    far.received(),
    far.missing()
);
let mut more = 0;
for n in first_pass + 1.. {
    sender.fragment(n, &mut piece)?;
    more += 1;
    if far.fragment(n, &piece)? {
        break;
    }
}
println!("more      {more} more coded fragments finish the block");

// A fragment changed on the way, by a fault or by another member of the group, who holds
// the same group key, still completes the block. The code the server took with this
// device's own key is what catches it, so the updater never sees the block.
let mut odd_store = [0u8; 512];
let mut odd_matrix = [0u8; 256];
let mut odd = Defragmenter::new(
    sender.nb_frag(),
    sender.frag_size(),
    &mut odd_store,
    &mut odd_matrix,
)?;
for n in 1..=sender.nb_frag() {
    sender.fragment(n, &mut piece)?;
    if n == 3 {
        piece[0] ^= 0x01;
    }
    odd.fragment(n, &piece)?;
}
let mut taken = signer.start(1, 0, DESCRIPTOR, block_len as u32);
taken.update(&odd.block()[..block_len]);
let caught = taken.finish() != expected;
if odd.done() && caught {
    println!("tampered  the block completes, its code does not match, and nothing is staged");
}

import { DeviceIdentity } from '@pamoja/security'
import { fragment, multicast } from '@pamoja/lorawan'
import {
  BLOCK_DESCRIPTOR,
  frameBlock,
  imageDigest,
  signManifest,
  splitBlock,
  Updater,
} from '@pamoja/update'

// The publisher signs releases; the devices in the field are anchored to its public half
// and will take firmware from nobody else, however it reaches them.
const publisher = DeviceIdentity.fromSeed(Buffer.alloc(32, 7))
const vendor = Buffer.alloc(16, 10)
const flowMeter = Buffer.alloc(16, 11)

const image = Buffer.from('firmware for a flow meter, version two, long enough to need fragmenting')
const manifest = {
  sequence: 2,
  vendorId: vendor,
  classId: flowMeter,
  storage: 1,
  digest: imageDigest(image),
  size: image.length,
}
const envelope = signManifest(manifest, publisher)

// One block carries the release: the signed manifest and the image behind a header that
// says where each begins. The transport moves bytes and vouches for none of them.
const block = frameBlock(envelope, image)
console.log(`release   ${block.length} bytes: a signed manifest and ${image.length} of image`)

// The group every device in the field belongs to. Its key travels wrapped under a key each
// device derives from its own root key, so the broadcast key is never in the clear.
const deviceRootKey = Buffer.alloc(16, 0x2b)
const groupKey = Buffer.alloc(16, 0x77)
const groupAddr = 0x26010042
const keKey = multicast.keKey(multicast.rootKey(deviceRootKey))
const wrapped = multicast.wrapKey(keKey, groupKey)
const unwrapped = multicast.key(keKey, wrapped)
const keyed = unwrapped.equals(groupKey)
  ? 'keyed by the key the server wrapped and the device unwrapped'
  : 'with a key the device could not unwrap'
console.log(`group     0x${groupAddr.toString(16).padStart(8, '0')}, ${keyed}`)
multicast.appSKey(groupKey, groupAddr)

// The server cuts the block into fragments and sends more than there are, so a device that
// misses some can still finish. Each coded fragment is the exclusive-or of a pseudo-random
// half of the originals.
const fragSize = 32
const { nbFrag, padding } = fragment.session(block.length, fragSize)
console.log(`session   ${nbFrag} fragments of ${fragSize} bytes, ${padding} of padding`)

// The device puts it back together in storage it set aside once: the block itself, and room
// to solve for a handful of losses.
const receiver = new fragment.Defragmenter(nbFrag, fragSize, 8)

// The link drops every fourth fragment. The session keeps going until the block is whole.
let sent = 0
let coded = 0
for (let n = 1; n <= nbFrag * 2; n++) {
  if (n % 4 === 0) {
    continue
  }
  sent += 1
  if (n > nbFrag) {
    coded += 1
  }
  if (receiver.fragment(n, fragment.fragment(block, fragSize, n))) {
    break
  }
}
console.log(`received  ${sent} fragments, ${coded} of them coded, and the block is whole`)

// What the device built is checked against the code the server took over the block with this
// device's own key, and sent in the session setup. It is taken a piece at a time, so the
// image is never held twice.
const blockKey = fragment.dataBlockIntKey(deviceRootKey)
const descriptor = Buffer.from(BLOCK_DESCRIPTOR)
const taking = new fragment.BlockMic(blockKey, 1, 0, descriptor, block.length)
taking.update(block)
const expected = taking.finish()
const built = new fragment.BlockMic(blockKey, 1, 0, descriptor, block.length)
built.update(receiver.block.subarray(0, block.length))
const intact = built.finish().equals(expected)
const verdict = intact
  ? 'carries the code the server took over it'
  : 'does not carry the code the server took over it'
console.log(`checked   the block the device built ${verdict}`)

// Only now does the update itself get a say. The header says where the manifest ends;
// everything after that is the manifest's decision, exactly as for a wired update.
const carried = splitBlock(receiver.block.subarray(0, block.length))
const updater = new Updater(vendor, flowMeter, publisher.publicKey(), 2, 4096)
updater.provision(0, 1)
const slot = updater.stage(carried.envelope, carried.image)
console.log(`staged    into slot ${slot}, leaving the running image alone`)

// A release broadcast to everyone is still refused by anyone it is not for. This one is
// signed by another key.
const impostor = DeviceIdentity.fromSeed(Buffer.alloc(32, 90))
try {
  updater.stage(signManifest(manifest, impostor), image)
  console.log('a forged release was accepted, which should never happen')
} catch (error) {
  console.log(`forged    refused: ${(error as Error).message}`)
}

// A device further out hears every other fragment of the session's first pass, eight
// uncoded and four coded. It solves for what it can and says how many it still lacks, so
// the server keeps sending coded fragments until it has none left to ask for.
const far = new fragment.Defragmenter(nbFrag, fragSize, 8)
const firstPass = nbFrag + nbFrag / 2
for (let n = 1; n <= firstPass; n += 2) {
  far.fragment(n, fragment.fragment(block, fragSize, n))
}
console.log(`short     heard ${far.received} of ${firstPass} fragments, and ${far.missing} are still missing`)
let more = 0
for (let n = firstPass + 1; ; n++) {
  more += 1
  if (far.fragment(n, fragment.fragment(block, fragSize, n))) {
    break
  }
}
console.log(`more      ${more} more coded fragments finish the block`)

// A fragment changed on the way, by a fault or by another member of the group, who holds the
// same group key, still completes the block. The code the server took with this device's own
// key is what catches it, so the updater never sees the block.
const odd = new fragment.Defragmenter(nbFrag, fragSize, 8)
for (let n = 1; n <= nbFrag; n++) {
  const piece = fragment.fragment(block, fragSize, n)
  if (n === 3) {
    piece[0] ^= 0x01
  }
  odd.fragment(n, piece)
}
const taken = new fragment.BlockMic(blockKey, 1, 0, descriptor, block.length)
taken.update(odd.block.subarray(0, block.length))
const caught = !taken.finish().equals(expected)
if (odd.done && caught) {
  console.log('tampered  the block completes, its code does not match, and nothing is staged')
}

from pamoja.core import PamojaError
from pamoja.lorawan import fragment, multicast
from pamoja.security import DeviceIdentity
from pamoja.update import (
    BLOCK_DESCRIPTOR,
    Manifest,
    Updater,
    frame_block,
    image_digest,
    sign_manifest,
    split_block,
)

# The publisher signs releases; the devices in the field are anchored to its public half
# and will take firmware from nobody else, however it reaches them.
publisher = DeviceIdentity.from_seed(bytes([7]) * 32)
vendor = bytes([0x0A]) * 16
flow_meter = bytes([0x0B]) * 16

image = b"firmware for a flow meter, version two, long enough to need fragmenting"
manifest = Manifest(
    sequence=2,
    vendor_id=vendor,
    class_id=flow_meter,
    storage=1,
    digest=image_digest(image),
    size=len(image),
)
envelope = sign_manifest(manifest, publisher)

# One block carries the release: the signed manifest and the image behind a header that
# says where each begins. The transport moves bytes and vouches for none of them.
block = frame_block(envelope, image)
print(f"release   {len(block)} bytes: a signed manifest and {len(image)} of image")

# The group every device in the field belongs to. Its key travels wrapped under a key each
# device derives from its own root key, so the broadcast key is never in the clear.
device_root_key = bytes([0x2B]) * 16
group_key = bytes([0x77]) * 16
group_addr = 0x26010042
ke_key = multicast.ke_key(multicast.root_key(device_root_key))
wrapped = multicast.wrap_key(ke_key, group_key)
unwrapped = multicast.key(ke_key, wrapped)
keyed = (
    "keyed by the key the server wrapped and the device unwrapped"
    if unwrapped == group_key
    else "with a key the device could not unwrap"
)
print(f"group     {group_addr:#010x}, {keyed}")
payload_key = multicast.app_s_key(group_key, group_addr)

# The server cuts the block into fragments and sends more than there are, so a device that
# misses some can still finish. Each coded fragment is the exclusive-or of a pseudo-random
# half of the originals.
frag_size = 32
session = fragment.session(len(block), frag_size)
print(
    f"session   {session.nb_frag} fragments of {frag_size} bytes, "
    f"{session.padding} of padding"
)

# The device puts it back together in storage it set aside once: the block itself, and room
# to solve for a handful of losses.
receiver = fragment.Defragmenter(session.nb_frag, frag_size, 8)

# The link drops every fourth fragment. The session keeps going until the block is whole.
sent = 0
coded = 0
for n in range(1, session.nb_frag * 2 + 1):
    if n % 4 == 0:
        continue
    sent += 1
    if n > session.nb_frag:
        coded += 1
    if receiver.fragment(n, fragment.fragment(block, frag_size, n)):
        break
print(f"received  {sent} fragments, {coded} of them coded, and the block is whole")

# What the device built is checked against the code the server took over the block with this
# device's own key, and sent in the session setup. It is taken a piece at a time, so the
# image is never held twice.
block_key = fragment.data_block_int_key(device_root_key)
descriptor = BLOCK_DESCRIPTOR.encode()
taking = fragment.BlockMic(block_key, 1, 0, descriptor, len(block))
taking.update(block)
expected = taking.finish()
built = fragment.BlockMic(block_key, 1, 0, descriptor, len(block))
built.update(receiver.block[: len(block)])
intact = built.finish() == expected
verdict = (
    "carries the code the server took over it"
    if intact
    else "does not carry the code the server took over it"
)
print(f"checked   the block the device built {verdict}")

# Only now does the update itself get a say. The header says where the manifest ends;
# everything after that is the manifest's decision, exactly as for a wired update.
carried_envelope, carried_image = split_block(receiver.block[: len(block)])
updater = Updater(vendor, flow_meter, publisher.public_key, 2, 4096)
updater.provision(0, 1)
slot = updater.stage(carried_envelope, carried_image)
print(f"staged    into slot {slot}, leaving the running image alone")

# A release broadcast to everyone is still refused by anyone it is not for. This one is
# signed by another key.
impostor = DeviceIdentity.from_seed(bytes([90]) * 32)
try:
    updater.stage(sign_manifest(manifest, impostor), image)
    print("a forged release was accepted, which should never happen")
except PamojaError as error:
    print(f"forged    refused: {error}")

# A device further out hears every other fragment of the session's first pass, eight uncoded
# and four coded. It solves for what it can and says how many it still lacks, so the server
# keeps sending coded fragments until it has none left to ask for.
far = fragment.Defragmenter(session.nb_frag, frag_size, 8)
first_pass = session.nb_frag + session.nb_frag // 2
for n in range(1, first_pass + 1, 2):
    far.fragment(n, fragment.fragment(block, frag_size, n))
print(f"short     heard {far.received} of {first_pass} fragments, and {far.missing} are still missing")
more = 0
n = first_pass
while True:
    n += 1
    more += 1
    if far.fragment(n, fragment.fragment(block, frag_size, n)):
        break
print(f"more      {more} more coded fragments finish the block")

# A fragment changed on the way, by a fault or by another member of the group, who holds the
# same group key, still completes the block. The code the server took with this device's own
# key is what catches it, so the updater never sees the block.
odd = fragment.Defragmenter(session.nb_frag, frag_size, 8)
for n in range(1, session.nb_frag + 1):
    piece = bytearray(fragment.fragment(block, frag_size, n))
    if n == 3:
        piece[0] ^= 0x01
    odd.fragment(n, bytes(piece))
taken = fragment.BlockMic(block_key, 1, 0, descriptor, len(block))
taken.update(odd.block[: len(block)])
caught = taken.finish() != expected
if odd.done and caught:
    print("tampered  the block completes, its code does not match, and nothing is staged")

// The publisher signs releases; the devices in the field are anchored to its public
// half and will take firmware from nobody else, however it reaches them.
byte[] seed = new byte[32];
Array.Fill(seed, (byte)7);
using var publisher = new DeviceIdentity(seed);
byte[] vendor = Enumerable.Repeat((byte)0x0A, 16).ToArray();
byte[] flowMeter = Enumerable.Repeat((byte)0x0B, 16).ToArray();

byte[] image = Encoding.ASCII.GetBytes(
    "firmware for a flow meter, version two, long enough to need fragmenting");
var manifest = new Manifest(
    Sequence: 2,
    VendorId: vendor,
    ClassId: flowMeter,
    Storage: 1,
    Digest: Update.ImageDigest(image),
    Size: (uint)image.Length);
byte[] envelope = Update.SignManifest(manifest, publisher);

// One block carries the release: the signed manifest and the image behind a header
// that says where each begins. The transport moves bytes and vouches for none of them.
byte[] block = Update.FrameBlock(envelope, image);
Console.WriteLine(
    $"release   {block.Length} bytes: a signed manifest and {image.Length} of image");

// The group every device in the field belongs to. Its key travels wrapped under a key
// each device derives from its own root key, so the broadcast key is never in the clear.
byte[] deviceRootKey = Enumerable.Repeat((byte)0x2B, 16).ToArray();
byte[] groupKey = Enumerable.Repeat((byte)0x77, 16).ToArray();
const uint groupAddr = 0x2601_0042;
byte[] keKey = LorawanPackages.McKeKey(LorawanPackages.McRootKey(deviceRootKey));
byte[] wrapped = LorawanPackages.WrapMcKey(keKey, groupKey);
byte[] unwrapped = LorawanPackages.McKey(keKey, wrapped);
string keyed = unwrapped.SequenceEqual(groupKey)
    ? "keyed by the key the server wrapped and the device unwrapped"
    : "with a key the device could not unwrap";
Console.WriteLine($"group     0x{groupAddr:x8}, {keyed}");
byte[] payloadKey = LorawanPackages.McAppSKey(groupKey, groupAddr);

// The server cuts the block into fragments and sends more than there are, so a device
// that misses some can still finish. Each coded fragment is the exclusive-or of a
// pseudo-random half of the originals.
const byte fragSize = 32;
LorawanFragSession session = LorawanPackages.FragSession(block.Length, fragSize);
Console.WriteLine(
    $"session   {session.NbFrag} fragments of {fragSize} bytes, " +
    $"{session.Padding} of padding");

// The device puts it back together in storage it set aside once: the block itself,
// and room to solve for a handful of losses.
using var receiver = new LorawanDefragmenter(session.NbFrag, fragSize, 8);

// The link drops every fourth fragment. The session keeps going until the block is whole.
int sent = 0;
int coded = 0;
for (ushort n = 1; n <= session.NbFrag * 2; n++)
{
    if (n % 4 == 0)
    {
        continue;
    }

    sent++;
    if (n > session.NbFrag)
    {
        coded++;
    }

    if (receiver.Fragment(n, LorawanPackages.FragFragment(block, fragSize, n)))
    {
        break;
    }
}

Console.WriteLine(
    $"received  {sent} fragments, {coded} of them coded, and the block is whole");

// What the device built is checked against the code the server took over the block
// with this device's own key, and sent in the session setup. It is taken a piece at a
// time, so the image is never held twice.
byte[] blockKey = LorawanPackages.DataBlockIntKey(deviceRootKey);
byte[] descriptor = Encoding.ASCII.GetBytes(Update.BlockDescriptor);
byte[] expected;
using (var taking = new LorawanBlockMic(blockKey, 1, 0, descriptor, (uint)block.Length))
{
    taking.Update(block);
    expected = taking.Finish();
}

byte[] built = receiver.Block().AsSpan(0, block.Length).ToArray();
using var check = new LorawanBlockMic(blockKey, 1, 0, descriptor, (uint)block.Length);
check.Update(built);
bool intact = check.Finish().SequenceEqual(expected);
string verdict = intact
    ? "carries the code the server took over it"
    : "does not carry the code the server took over it";
Console.WriteLine($"checked   the block the device built {verdict}");

// Only now does the update itself get a say. The header says where the manifest ends;
// everything after that is the manifest's decision, exactly as for a wired update.
(byte[] carriedEnvelope, byte[] carriedImage) = Update.SplitBlock(built);
using var updater = new Updater(vendor, flowMeter, publisher.PublicKey, 2, 4096);
updater.Provision(0, 1);
byte slot = updater.Stage(carriedEnvelope, carriedImage);
Console.WriteLine($"staged    into slot {slot}, leaving the running image alone");

// A release broadcast to everyone is still refused by anyone it is not for. This one
// is signed by another key.
byte[] impostorSeed = new byte[32];
Array.Fill(impostorSeed, (byte)90);
using var impostor = new DeviceIdentity(impostorSeed);
try
{
    updater.Stage(Update.SignManifest(manifest, impostor), image);
    Console.WriteLine("a forged release was accepted, which should never happen");
}
catch (PamojaException error)
{
    Console.WriteLine($"forged    refused: {error.Message}");
}

// A device further out hears every other fragment of the session's first pass, eight
// uncoded and four coded. It solves for what it can and says how many it still lacks,
// so the server keeps sending coded fragments until it has none left to ask for.
using var far = new LorawanDefragmenter(session.NbFrag, fragSize, 8);
ushort firstPass = (ushort)(session.NbFrag + (session.NbFrag / 2));
for (ushort n = 1; n <= firstPass; n += 2)
{
    far.Fragment(n, LorawanPackages.FragFragment(block, fragSize, n));
}

Console.WriteLine(
    $"short     heard {far.Received} of {firstPass} fragments, and {far.Missing} are still missing");
int more = 0;
for (ushort n = (ushort)(firstPass + 1); ; n++)
{
    more++;
    if (far.Fragment(n, LorawanPackages.FragFragment(block, fragSize, n)))
    {
        break;
    }
}

Console.WriteLine($"more      {more} more coded fragments finish the block");

// A fragment changed on the way, by a fault or by another member of the group, who
// holds the same group key, still completes the block. The code the server took with
// this device's own key is what catches it, so the updater never sees the block.
using var odd = new LorawanDefragmenter(session.NbFrag, fragSize, 8);
for (ushort n = 1; n <= session.NbFrag; n++)
{
    byte[] piece = LorawanPackages.FragFragment(block, fragSize, n);
    if (n == 3)
    {
        piece[0] ^= 0x01;
    }

    odd.Fragment(n, piece);
}

using var taken = new LorawanBlockMic(blockKey, 1, 0, descriptor, (uint)block.Length);
taken.Update(odd.Block().AsSpan(0, block.Length));
bool caught = !taken.Finish().SequenceEqual(expected);
if (odd.Done && caught)
{
    Console.WriteLine("tampered  the block completes, its code does not match, and nothing is staged");
}