COLDCARD firmware

This commit is a changelog-only update that publicly discloses a severe, long-running security flaw in COLDCARD hardware wallets: for roughly five years, the devices generated cryptographic seeds with far less randomness than intended. On older Mk3 devices, seed entropy may have been as low as about 40 bits, and on Mk4/Mk5/Q devices as low as about 72 bits. That makes generated private keys much easier for an attacker to guess or reproduce, putting any funds secured by those keys at risk. The changelog also lists many other security fixes, including protections against a compromised USB host altering transactions before signing, restrictions on reading sensitive staged data over USB, and hardening of the random-number generator. Users are advised to upgrade immediately and regenerate any seeds created with affected firmware.

This commit only changes test scripts for the COLDCARD hardware wallet firmware. It adds small timing delays, adjusts the order of test assertions, and fills in missing steps in automated UI tests. There are no changes to the actual firmware or wallet code that users rely on, so this cannot affect real device security.

This commit only rewords an on-screen user warning about keeping dice-roll hashes secret. It does not change any code behavior, cryptography, or security logic. The change makes the warning more precise: it clarifies that seeing any intermediate hash (not just the final one) could let someone recreate the wallet from the dice rolls entered up to that point. There is no vulnerability or security fix here.

This commit simply increments an automatically-generated Bitcoin block height constant by one. It is a routine data update with no code changes and no security implications.

This commit simply updates a stored Bitcoin blockchain height number from 963,074 to 963,190, along with its timestamp. It is a routine data refresh with no code logic changes and no apparent security relevance.

This commit only updates a linked external code submodule (ckcc-protocol) to a newer version. The actual code changes are not shown in this diff, only the submodule pointer was moved. There is no information in the commit itself about what changed in the submodule or whether it has any security relevance.

This commit adds a new, more secure USB encryption mode (ncry v3) to the COLDCARD hardware wallet firmware. It does not remove the older v1/v2 mode. The new mode adds message authentication tags and separate keys for each direction, which protects against tampering, replay, and reflection attacks on the USB cable. The commit also fixes a timing side-channel in user authentication by replacing direct HMAC comparisons with a constant-time comparison. The change is defensive and improves security, but the old unauthenticated modes remain available for compatibility, so users must actively choose v3 to get the stronger protection.

This commit changes how COLDCARD handles multisig wallet names. Previously, re-importing a wallet file or descriptor with a different name would silently rename the existing wallet. Now, renaming must be done through an explicit 'Rename' menu action, and re-importing a duplicate with a different name is rejected. This is a security-hardening UX change that prevents accidental or malicious wallet renaming during import, which could confuse users about which wallet they are signing for.

This commit only edits the project's 'Next-ChangeLog.md' file. It rewrites upcoming release notes, adds details, fixes wording, and updates release dates. No actual firmware code, build scripts, or security behavior changed in this commit. The changelog text does describe many security fixes, but those fixes are already present in other commits; this commit merely documents them.

This commit simply updates a stored Bitcoin blockchain height number from 960,398 to 963,074, along with its timestamp. It is a routine data refresh with no code logic changes and no apparent security relevance.

This commit only changes test code for the COLDCARD firmware. It makes the test suite more stable by letting developers specify a custom Bitcoin daemon path, adding a PSBT2 test flag, fixing a test that checks upload-during-approval behavior, and importing an extra constant for user-interface tests. None of these changes affect the actual firmware that runs on the device, so there is no security risk to users.

This commit only edits the wording of an upcoming release changelog. It does not change any firmware code, cryptographic algorithms, or security behavior. The edits clarify and reorganize descriptions of previously planned entropy-generation improvements, but they do not themselves introduce or fix any vulnerability.

This commit fixes a bug in the COLDCARD firmware update process. Previously, the maximum file size allowed for a firmware update file (.dfu) was set too small because it was based on the firmware's own size limit, not accounting for extra data that comes with 'factory' update images (which include a bootloader and a DFU wrapper). As a result, legitimate factory firmware files could not be selected from the MicroSD card picker. The fix separates the two limits: one for the actual firmware size, and a larger one for the .dfu container shown in the file picker. There is no direct evidence in the commit that this was a security vulnerability, but overly restrictive size checks can sometimes hide or complicate downgrade or supply-chain issues.

This change makes the COLDCARD wallet require the user to scroll down before showing a BIP-39 passphrase on screen. The goal is to reduce the chance that someone nearby (a shoulder-surfer) or a camera can read the secret passphrase when it appears automatically. It is a small user-interface hardening improvement, not a fix for a remote hack.

This commit changes how the COLDCARD hardware wallet generates random numbers used to protect backups, encrypted files, and two-factor authentication secrets. Previously these sensitive values were produced using only the STM32 chip's built-in random number generator (TRNG). Now they are produced through a stronger combined method: a Hash-DRBG (a NIST-style deterministic random-bit generator) that is seeded from both secure elements and the TRNG. The change is defensive hardening rather than a fix for a known exploitable bug, but it reduces the risk that a weakness in the STM32 TRNG alone could weaken user secrets.

This commit tightens security for temporary Bitcoin wallet seeds created by rolling dice on a COLDCARD hardware wallet. Previously, temporary dice-generated seeds skipped the same mandatory entropy checks and warnings used for permanent dice-generated seeds. The change makes temporary dice seeds follow the same rules, so users cannot accidentally create a weak wallet from too few dice rolls. This is a defensive hardening fix, not an active bug that steals funds, but weak entropy could let an attacker guess a wallet's private keys.

This update fixes a bug in the COLDCARD MK4 hardware wallet where sensitive temporary data stored in extra memory (PSRAM) was not fully erased when the device performed a 'fast wipe' or self-destruct sequence. After wiping the seed, leftover application data could remain in that memory through a reset, potentially allowing someone with physical access to recover secrets. The patch now explicitly clears that memory during both wipe paths.

This update fixes a bug where the COLDCARD Q1 wallet could accidentally let a previously authorized USB file download remain valid while it reused a special memory area (PSRAM) to prepare new data for display or signing. If a backup download lease was still active, an attacker or malicious host connected over USB might have been able to read sensitive material that was later loaded into that same memory area. The patch now clears the download lease before staging PSBT files, BBQr data, or note exports in PSRAM.

This commit fixes a security bug in the COLDCARD hardware wallet where sensitive BIP39 seed-derivation data was not being securely erased from memory after use. The patch wraps the master-secret generation in a try/finally block and uses blank_object() to wipe the mnemonic words and derived master secret even if an error occurs. Without this fix, an attacker who could read the device's RAM might recover these secrets, though such access is normally difficult on a hardened hardware wallet.

This commit fixes a small but meaningful bug in the COLDCARD bootloader. Two separate code paths that check firmware update data were missing the word 'else', so after rejecting bad data they would also run a second check. That second check could trigger an internal assertion (a hard crash/reboot) when given an invalid 'highwater' timestamp value, instead of cleanly rejecting the bad update. The fix makes the bootloader properly reject invalid values without crashing.

This commit fixes a bug in the COLDCARD firmware signing tools and headers. Previously, the maximum allowed firmware size for Mk4/Q1 devices was set too large: it did not account for a 512 KB filesystem region and a small DFU wrapper block at the end of flash. As a result, a firmware image could be signed and accepted even though part of it would extend beyond the region protected by the device's 'world checksum' integrity check. The patch shrinks the official maximum firmware length so that the entire image stays within the integrity-checked region. The changelog explicitly calls this a bugfix that 'reject[s] firmware images that extend past the world-checksum-covered flash region.'

This commit fixes a bug in the COLDCARD hardware wallet where using the BIP-85 feature while in Delta Mode could expose or operate on the real master seed instead of the expected temporary/delta seed. The fix forces the wallet to wipe the seed before performing BIP-85 derivation in Delta Mode, matching how other sensitive operations are already blocked. This is a security bugfix for a local, post-authentication edge case.

This commit fixes two ways a Coldcard in 'Delta Mode' (a restricted mode that hides the wallet seed) could still let a user pick or import secret seed phrases. One path was through 'Key Teleport' secret selection, and another was through importing a 'CCC key C' from the Seed Vault. The patch blocks both so Delta Mode cannot be bypassed to reveal or use stored secrets.

This update changes the Coldcard wallet cloning process so that the receiving device now displays the restored seed's master fingerprint and asks the user to confirm it before installing. Previously, the clone process skipped this confirmation step. The change helps prevent a user from accidentally accepting a different seed than intended during a clone, which could lead to backing up or using the wrong wallet.

This commit fixes a bug in the COLDCARD hardware wallet where a transaction could be signed over USB even if the data shown on the device screen did not match the data actually being signed. Before the fix, an attacker or buggy software could upload one PSBT (a Bitcoin transaction file) but then ask the device to sign a different one, or sign data that was not fully/correctly uploaded. The fix makes the USB signing command strictly verify the staged PSBT's length and SHA-256 hash against what is stored in memory, and resets upload state on errors so stale data cannot be reused.