COLDCARD firmware

This commit changes how COLDCARD creates two special types of secrets: temporary seeds and the 'CCC' co-signing key. Previously these were generated purely from the device's own random number generator. Now the user must add their own randomness (for example by mashing buttons, rolling dice, or flipping coins) before the secret is created. This makes it harder for an attacker who has somehow compromised the device's random generator to predict or control those secrets. It is a defensive hardening change, not a fix for a known active attack.

This commit adds a warning screen before users create a Bitcoin wallet seed using only dice rolls. It tells users that no hardware randomness is added, and that the on-screen hash must be kept secret because anyone who sees it could recreate the wallet and steal funds. This is a user-experience and safety improvement, not a fix for a software vulnerability.

This commit adds build-time checks to ensure the firmware's random-number generator actually chains all the way down to the hardware chip. It does not fix a known exploit, but it prevents a future build misconfiguration from silently causing the wallet to use weaker random numbers, which could eventually make private keys guessable. Think of it as adding an assembly-line inspection that verifies a critical safety wire is connected end-to-end.

This commit changes how new COLDCARD wallets are created: instead of relying only on the device's internal random-number generators, users must now add their own physical randomness by either mashing keys, rolling dice, or flipping coins. The internal random sources are still used, but the user's extra randomness is mixed in. This is a security improvement meant to reduce the risk that a hidden flaw in the device's random-number hardware could produce a predictable wallet. The change also adds checks to catch obviously biased dice or coin results.

This commit fixes a security weakness in how the COLDCARD MK4 hardware wallet seeds its random number generator (RNG). Previously, the firmware took a 256-bit hash of entropy from two secure elements, but only used the first 32 bits (4 bytes) of that hash to reseed the RNG. The change now uses the full 256-bit (32-byte) digest. More entropy bits means the RNG's initial state is much harder to predict, which matters when the device is generating cryptographic secrets like Bitcoin seed phrases. The commit also adds length checks to make sure the expected amount of entropy is actually received from each secure element.

This commit changes how the COLDCARD hardware wallet's random-number generator (RNG) recovers from a rare 'seed error' condition. The manufacturer is now following an STMicroelectronics guideline to throw away the first 12 random numbers after clearing the error, because those values could be left over from before the error and might be predictable. Random numbers are critical for creating private keys and transaction signatures, so using weak or stale randomness could in theory weaken security. The patch is defensive and does not by itself prove an attack exists.

This commit only adds explanatory comments to two source files about why the COLDCARD firmware ignores certain hardware random-number-generator clock-error flags. It does not change any code behavior. The comments cite ST documentation saying these clock errors do not affect the quality of random numbers and that a dead clock is still caught by a data-ready timeout. There is no security-relevant code change.

This commit strengthens how the COLDCARD wallet creates the master secret (seed) by blending randomness from the main microcontroller's true random number generator with additional randomness from two separate secure-element chips. Previously the seed relied only on the microcontroller's TRNG. The change is a defensive hardening measure: even if the TRNG were biased or partially compromised, the secure elements' independent entropy would still contribute unpredictability. The commit also documents a separate bugfix for detecting random-number-generator fault flags and failing safely.

This fix closes a serious bug in the COLDCARD Mk4 and Q1 bootloader. Previously, when installing a firmware update from a microSD card in recovery mode, the bootloader verified only the portion of the file that the firmware header said was signed. Any extra bytes appended after that signed portion were still written to the device's flash memory, even though they were not signed. An attacker who could get a victim to install a legitimate-looking signed firmware file with malicious data tacked onto the end could overwrite parts of the device's internal storage without needing COLDCARD's signing key. The patch now rejects any update whose total length does not exactly match the signed length, and adds a hard upper-size limit as a backup safeguard.

This commit is a minor formatting edit to the README.md file. It changes a 'Security Advisory' heading from being displayed as a code block (with diff-style coloring) to a normal Markdown heading, and adds a horizontal rule. There are no code changes, no new security claims beyond what was already present, and no functional impact on the COLDCARD firmware.

This commit adds a security advisory to the COLDCARD firmware README. Coinkite states that firmware releases from 2021 through July 2026 contained a bug that produced weak randomness (poor entropy) when generating secrets such as wallet seed phrases. Because weak randomness can make private keys guessable by attackers, any Bitcoin or other cryptocurrency funds protected by seeds created on affected COLDCARD devices during that period may be at risk of theft. The advisory recommends regenerating seeds and moving funds immediately, and lists specific firmware versions where the issue is fixed. The commit itself only changes documentation; it does not contain the actual code fix.

This commit fixes a bug in the COLDCARD Mk4 bootloader where the same encryption counter value (nonce) was reused for both a verification check value and the real secret data. The fix changes the last byte of the nonce to a distinct value (0x80) when encrypting/decrypting the check value, so it no longer overlaps with the counter range used for actual secrets. Reusing a counter with AES-CTR-style encryption can weaken confidentiality guarantees and, in some cryptographic designs, allow an attacker who sees two encrypted blocks with the same nonce to learn information or tamper with data. The change is small and defensive, and the changelog credits an external reporter.

This update changes the COLDCARD hardware wallet so that it refuses to sign Bitcoin transactions using the SIGHASH_SINGLE signature mode unless the user has explicitly enabled a 'Warn' setting. SIGHASH_SINGLE lets a signer lock in only one output while leaving other outputs changeable later. That could allow someone to alter where remaining funds go after the COLDCARD has already signed. The change adds SIGHASH_SINGLE to the existing safety check that already blocked SIGHASH_NONE, and it includes a test to confirm the block works.

This commit only updates the release signature file. It adds two new firmware file hashes for recently built releases and refreshes the PGP signature that covers the file. There is no code change and no indication of a security fix or vulnerability.

This commit only updates a signed release manifest file (signatures.txt). It refreshes cryptographic hashes for release notes and adds a new firmware file entry, then re-signs the file with PGP. There is no code change and no security vulnerability is present in the diff.

This commit updates Coldcard's release notes to announce that a previously disclosed limited-entropy bug in seed generation now also affects Mk3 hardware, and that a new Mk3 firmware version 4.2.0 has been released as a hotfix. The earlier notes told Mk3 users to stop generating seeds and move funds; the revised notes say Mk3 users can safely generate seeds again after installing 4.2.0. Seeds created before this fix may have only about 40 bits of randomness, making them far weaker than intended and potentially guessable by attackers.

This commit simply updates a hardcoded Bitcoin blockchain height number in a file that is automatically generated. There is no security issue here.

This commit only updates the release signature file. It adds two new file hashes for a COLDCARD Mk firmware release and refreshes the PGP signature that covers the file. There is no code change, no bug fix, and no security patch in the diff itself.

This commit only updates an auto-generated timestamp and version number in a firmware build file. It does not change any executable code, logic, or security behavior. There is no security issue here.

This commit simply updates a hardcoded Bitcoin block height number in a single file by one block, along with its timestamp. There is no code logic change and no apparent security relevance.

This commit only updates a signed release manifest file (signatures.txt). It records new cryptographic hashes for firmware release files and their PGP signature. There is no code change, no bug fix, and no security patch in the commit itself.

This commit only updates an auto-generated timestamp and version string used by the COLDCARD Q1 hardware wallet's FAT filesystem driver. The change is cosmetic/build-metadata only and does not alter any executable logic, security boundary, or user-facing behavior.

This commit simply updates a recorded Bitcoin block height number in a generated file, moving it from block 960,344 to 960,347. There is no code logic change, no user-facing behavior change, and no security relevance.

This commit only removes a period at the end of one changelog sentence. It is a trivial punctuation/typography fix with no code or security behavior change.

This commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because the fallback generator had very little real randomness, attackers who captured a public transaction or signature could potentially figure out the wallet's private keys and steal funds. The patch forces the build to use the hardware random source and adds a build-time check to make sure the weak fallback is never linked in again. Coinkite issued an emergency hotfix and warned users to move funds from wallets created with affected firmware.