fix: feed full SE digest to PRNG reseed (drop 32-bit truncation) - #691
Draft
ballance wants to merge 1 commit into
Draft
fix: feed full SE digest to PRNG reseed (drop 32-bit truncation)#691ballance wants to merge 1 commit into
ballance wants to merge 1 commit into
Conversation
rng_seeding() hashed the secure-element entropy with SHA256d but then
kept only n[0:4], handing ngu.random.reseed() a single 32-bit word. That
throttled the secure-element contribution to 2**32 and, combined with
reseed()'s old behaviour, left most of the generator state at fixed
constants. Pass the whole 32-byte digest instead.
Bumps external/libngu to a512174, which reworks random.reseed() to
absorb a full-width seed into all generator state words.
Ref: Block engineering disclosure, "Predictable RNG fallback and 32-bit
reseed in COLDCARD firmware".
Thirty-two silent bytes,
all but four were cast aside —
now the seed stays whole.
scgbckbone
reviewed
Aug 1, 2026
scgbckbone
left a comment
scgbckbone
left a comment
Collaborator
There was a problem hiding this comment.
Can you please open libngu changes as separate PR against libngu repo? thanks
Author
|
ballance
marked this pull request as draft
August 1, 2026 16:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mk4.rng_seeding()hashes the secure-element entropy with SHA256d but then keepsonly the first four bytes —
n, = ustruct.unpack('I', n[0:4])— before handing itto
ngu.random.reseed(). That throttled the secure-element contribution to thesoftware RNG to 2**32, discarding 28 of the 32 digest bytes.
This change passes the full 32-byte digest to
reseed().Change
shared/mk4.py: drop the 4-byte truncation; feed the whole SHA256d digest.external/libnguto the companion RNG fix.Dependency / CI note
Draft — depends on switck/libngu#61; will re-pin on merge. #61 replaces the
generator with a SHA-256 Hash-DRBG and makes
reseed()require a ≥32-byte seed(it now rejects the old 4-byte
intcall), so thismk4.pychange is required for#61 to boot on-device. Until #61 merges, the pinned submodule commit lives only on
the fork and firmware CI cannot fetch it from upstream; the pin will move to the
merged #61 SHA.
Context
Public disclosure: Block engineering, "Predictable RNG fallback and 32-bit reseed in
COLDCARD firmware." This addresses the 32-bit-reseed half. (The predictable-fallback
half is already mitigated in this tree:
stm32/COLDCARD*/rng.cbindsrng_get()tothe hardware TRNG with
#if MICROPY_HW_ENABLE_RNG -> #errorguarding, and thempconfigboard.mkfiles poisonpyb_rng_yasmarang.)