Skip GCM auth on ESP8266 when no auth key is set (align with ESP32)

[gskjold]

Summary

Aligns the ESP8266 GCM path with ESP32/native: when no authentication key is configured, decrypt without verifying the GCM tag instead of failing.

Background

The ESP8266 (BearSSL) path enforced the GCM tag whenever the frame's security byte requested authentication, regardless of whether an AK was configured — it gated the tag check on authkeylen > 0. The ESP32 and native (mbedTLS) paths instead gate on authenticate, which is true only when the AK has a non-zero byte. So a blank AK already meant "decrypt without auth" on ESP32, but failed with -51 on ESP8266.

Change

One-line alignment in GcmParser.cpp (ESP8266 branch):

-        if(authkeylen > 0 && br_gcm_check_tag_trunc(&gcmCtx, authentication_tag, authkeylen) != 1) {
+        if(authenticate && br_gcm_check_tag_trunc(&gcmCtx, authentication_tag, authkeylen) != 1) {
             return GCM_AUTH_FAILED;
         }

• Meters configured with an auth key: unchanged — the tag is still verified.
• Meters configured without an auth key: the frame is decrypted with the encryption key alone and the tag is not checked (no integrity guarantee — opt-in by leaving the AK blank), matching ESP32.

Why

Some meters use a non-standard authentication scheme that doesn't verify against the DLMS SC ‖ AK AAD, so they can only be read with the encryption key. The Polish Stoen / Elgama GAMA 350 (#1198) is one such case — the reference ESPHome component decrypts with the EK only and skips authentication. This change lets such meters be read on ESP8266 the same way they already can be on ESP32 (by leaving the auth key blank). Note the ~580 B GAMA 350 telegram still realistically needs an ESP32 for buffer reasons.

Testing

• Native decoder suite: 16/16 pass, including a new test_encrypted_decode_without_authkey that decodes an authenticated fixture (issued with an AK) using the EK only / AK omitted, locking the cross-platform "blank AK skips auth" contract.
• esp8266 builds clean.

The native test exercises the mbedTLS path; the ESP8266 br_gcm line is platform-gated and can't be unit-tested on host, but it now mirrors the covered ESP32/native logic.

Refs #1198.

[github-actions]

🔧 PR Build Artifacts

Version: 90335a3

All environments built successfully. Download the zip files:

• esp32s2: Download esp32s2.zip
• esp32s3: Download esp32s3.zip
• esp32c3: Download esp32c3.zip
• esp32: Download esp32.zip
• esp32solo: Download esp32solo.zip
• esp8266: Download esp8266.zip

Artifacts expire after 7 days. View workflow run