From b44f1b367e7b8ce98d88a49b3457443335365d8f Mon Sep 17 00:00:00 2001 From: highlander Date: Tue, 4 Aug 2026 23:11:45 -0300 Subject: [PATCH] test(reset): display_random is accepted and ignored Firmware no longer renders the Internal Entropy screen -- internal entropy is seed pre-image material, and a host that supplies ext_entropy and reads that screen once can compute SHA256(shown || ext) and derive the seed. test_reset_device_pin and test_failed_pin asserted the ButtonRequest for that screen, so they failed against the new firmware. Rather than dropping display_random from the request, they keep sending it =True and now assert the NEXT message is PinMatrixRequest -- which is a direct test of the compatibility claim: the field stays decodable on the wire and changes nothing. Verified 6/6 against an emulator built from the paired firmware branch. --- tests/test_msg_resetdevice.py | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/tests/test_msg_resetdevice.py b/tests/test_msg_resetdevice.py index 28c5475f..e1d3c4cd 100644 --- a/tests/test_msg_resetdevice.py +++ b/tests/test_msg_resetdevice.py @@ -245,10 +245,11 @@ def test_reset_device_pin(self): language='english', label='test')) - self.assertIsInstance(ret, proto.ButtonRequest) - self.client.debug.press_yes() - ret = self.client.call_raw(proto.ButtonAck()) - + # display_random=True above is deliberate: the field stays in the wire + # schema for host compatibility but production firmware ignores it, + # because internal entropy is seed pre-image material. A host that + # sets it must get a NORMAL reset -- no Internal Entropy screen -- so + # the very next message is the PIN request, not a ButtonRequest. self.assertIsInstance(ret, proto.PinMatrixRequest) # Enter PIN for first time @@ -318,10 +319,11 @@ def test_failed_pin(self): language='english', label='test')) - self.assertIsInstance(ret, proto.ButtonRequest) - self.client.debug.press_yes() - ret = self.client.call_raw(proto.ButtonAck()) - + # display_random=True above is deliberate: the field stays in the wire + # schema for host compatibility but production firmware ignores it, + # because internal entropy is seed pre-image material. A host that + # sets it must get a NORMAL reset -- no Internal Entropy screen -- so + # the very next message is the PIN request, not a ButtonRequest. self.assertIsInstance(ret, proto.PinMatrixRequest) # Enter PIN for first time