COLDCARD firmware

This commit changes what the COLDCARD wallet displays on its 'View Seed Words' screen when a BIP-39 passphrase is active. Previously it showed the original 24 seed words plus a masked passphrase and the derived extended private key. Now it shows only the effective extended private key (and a note that a passphrase is in effect), hiding the underlying seed words. This is a deliberate UX/security hardening change, not a fix for an exploitable vulnerability.

This commit fixes a bug in the COLDCARD hardware wallet where, when the device is in 'Delta Mode' (a special temporary operating mode), opening the list of saved BIP-39 passphrases would reveal the passphrases and wallet fingerprints instead of securely wiping the seed first. The fix adds a call to wipe the seed if Delta Mode is active before displaying the saved passphrase menu. This prevents sensitive secret material from being exposed on screen in a mode meant to limit what an attacker can see.

This commit removes unused parameters from an internal function called fetch() in the COLDCARD firmware. There is no evidence this change fixes or introduces a security issue; it is purely a code cleanup that simplifies the function signature and removes dead code paths.

This commit only adds a thank-you credit to an upcoming release changelog. It does not change any code, so it cannot by itself fix or introduce a security issue. The actual BIP-322 validation bugfix must have been made in a different, earlier commit.

This update fixes how the COLDCARD hardware wallet's random-number generator (RNG) handles rare hardware faults. Previously, the device could silently continue using weak or repeated random numbers if the RNG reported a seed error. Now it detects those error flags, tries a safe recovery a few times, and if the problem persists it stops with an error instead of producing bad randomness. Two keyboard drivers were also updated so a temporary RNG failure does not lock the user out before login.

This commit fixes a buffer-validation bug in the COLDCARD Mk4 bootloader's secure callgate. The old code checked memory ranges using simple addition (address + length), which can overflow and trick the device into treating an attacker-controlled buffer as safe. The patch replaces those checks with subtraction-based math that cannot overflow, and also rejects negative input lengths. A security review by Karma-X is credited with the finding.

This update fixes a bug in the COLDCARD hardware wallet where signing a text message with the special 'Delta Mode' PIN would produce a signature that looked valid to anyone checking it. Delta Mode is a hidden feature that silently corrupts transaction signatures so attackers who force you to unlock your wallet cannot steal funds. The same protection was missing for message signatures, so an attacker could have tricked a victim into producing a seemingly valid signed message under duress. The fix makes message signatures produced in Delta Mode invalid, matching the existing behavior for transactions.

This commit changes how COLDCARD creates two special types of secrets: temporary seeds and the 'CCC' co-signing key. Previously these were generated purely from the device's own random number generator. Now the user must add their own randomness (for example by mashing buttons, rolling dice, or flipping coins) before the secret is created. This makes it harder for an attacker who has somehow compromised the device's random generator to predict or control those secrets. It is a defensive hardening change, not a fix for a known active attack.

This commit adds a warning screen before users create a Bitcoin wallet seed using only dice rolls. It tells users that no hardware randomness is added, and that the on-screen hash must be kept secret because anyone who sees it could recreate the wallet and steal funds. This is a user-experience and safety improvement, not a fix for a software vulnerability.

This commit adds build-time checks to ensure the firmware's random-number generator actually chains all the way down to the hardware chip. It does not fix a known exploit, but it prevents a future build misconfiguration from silently causing the wallet to use weaker random numbers, which could eventually make private keys guessable. Think of it as adding an assembly-line inspection that verifies a critical safety wire is connected end-to-end.

This commit changes how new COLDCARD wallets are created: instead of relying only on the device's internal random-number generators, users must now add their own physical randomness by either mashing keys, rolling dice, or flipping coins. The internal random sources are still used, but the user's extra randomness is mixed in. This is a security improvement meant to reduce the risk that a hidden flaw in the device's random-number hardware could produce a predictable wallet. The change also adds checks to catch obviously biased dice or coin results.

This commit fixes a security weakness in how the COLDCARD MK4 hardware wallet seeds its random number generator (RNG). Previously, the firmware took a 256-bit hash of entropy from two secure elements, but only used the first 32 bits (4 bytes) of that hash to reseed the RNG. The change now uses the full 256-bit (32-byte) digest. More entropy bits means the RNG's initial state is much harder to predict, which matters when the device is generating cryptographic secrets like Bitcoin seed phrases. The commit also adds length checks to make sure the expected amount of entropy is actually received from each secure element.

This commit changes how the COLDCARD hardware wallet's random-number generator (RNG) recovers from a rare 'seed error' condition. The manufacturer is now following an STMicroelectronics guideline to throw away the first 12 random numbers after clearing the error, because those values could be left over from before the error and might be predictable. Random numbers are critical for creating private keys and transaction signatures, so using weak or stale randomness could in theory weaken security. The patch is defensive and does not by itself prove an attack exists.

This commit only adds explanatory comments to two source files about why the COLDCARD firmware ignores certain hardware random-number-generator clock-error flags. It does not change any code behavior. The comments cite ST documentation saying these clock errors do not affect the quality of random numbers and that a dead clock is still caught by a data-ready timeout. There is no security-relevant code change.

This commit strengthens how the COLDCARD wallet creates the master secret (seed) by blending randomness from the main microcontroller's true random number generator with additional randomness from two separate secure-element chips. Previously the seed relied only on the microcontroller's TRNG. The change is a defensive hardening measure: even if the TRNG were biased or partially compromised, the secure elements' independent entropy would still contribute unpredictability. The commit also documents a separate bugfix for detecting random-number-generator fault flags and failing safely.

This fix closes a serious bug in the COLDCARD Mk4 and Q1 bootloader. Previously, when installing a firmware update from a microSD card in recovery mode, the bootloader verified only the portion of the file that the firmware header said was signed. Any extra bytes appended after that signed portion were still written to the device's flash memory, even though they were not signed. An attacker who could get a victim to install a legitimate-looking signed firmware file with malicious data tacked onto the end could overwrite parts of the device's internal storage without needing COLDCARD's signing key. The patch now rejects any update whose total length does not exactly match the signed length, and adds a hard upper-size limit as a backup safeguard.

This commit fixes a bug in the COLDCARD Mk4 bootloader where the same encryption counter value (nonce) was reused for both a verification check value and the real secret data. The fix changes the last byte of the nonce to a distinct value (0x80) when encrypting/decrypting the check value, so it no longer overlaps with the counter range used for actual secrets. Reusing a counter with AES-CTR-style encryption can weaken confidentiality guarantees and, in some cryptographic designs, allow an attacker who sees two encrypted blocks with the same nonce to learn information or tamper with data. The change is small and defensive, and the changelog credits an external reporter.

This commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because the fallback generator had very little real randomness, attackers who captured a public transaction or signature could potentially figure out the wallet's private keys and steal funds. The patch forces the build to use the hardware random source and adds a build-time check to make sure the weak fallback is never linked in again. Coinkite issued an emergency hotfix and warned users to move funds from wallets created with affected firmware.

This update fixes a bug in the COLDCARD hardware wallet where short PSBT (Partially Signed Bitcoin Transaction) files could be mistaken for partial firmware uploads when their size landed near a specific firmware-probe boundary. The fix adds a length check so the device only treats a chunk as a firmware header probe when the incoming data block is exactly 256 bytes long. If the bug were triggered, a legitimate PSBT upload might be misclassified, potentially causing the upload to fail or behave unexpectedly. There is no evidence in the commit of malicious exploitation or a security bypass.

This commit only updates the COLDCARD firmware's internal test suite to remain compatible with Bitcoin Core version 32. It adds helper methods to read and set locktime in a way that works for both old PSBT version 0/1 and new PSBT version 2, and changes test calls to Bitcoin Core so they request PSBT version 0 when the newer Core would otherwise default to version 2. There is no change to the actual firmware code that runs on the device, and no security vulnerability is fixed or introduced.

This commit tightens the rules for messages that COLDCARD will sign using the BIP-322 proof-of-reserves feature. Previously, non-ASCII characters were allowed with only a warning; now the message must be plain printable ASCII (with limited exceptions), must be 2-330 characters long, and cannot have tricky spacing. This reduces the chance that a crafted message could mislead the user into signing something they did not intend.

This commit adds a 330-character limit to BIP-322 proof-of-reserve messages on the COLDCARD hardware wallet. Without the limit, an attacker could craft a very long message that might be used to mislead the user, overflow display buffers, or cause other unexpected behavior during signing. The change rejects oversized or empty messages before the user is asked to sign.

This commit adds a new feature to the COLDCARD firmware: encrypted backups for Secure Notes & Passwords. Previously, exporting notes and passwords to a microSD card produced an unencrypted JSON file. Now the device can encrypt that export using the same 7z/AES backup encryption used for full wallet backups. The change also refactors the existing backup password code so it can be reused for both full-device and notes-only backups. A small, unrelated fix in message signing changes a logical AND to an OR when deciding whether tab/newline characters are allowed in signed text. There is no vendor disclosure of a security vulnerability, and the commit is framed as a feature addition.

This commit reverts a previous security fix. The original fix prevented a 'bypass PIN' (a special trick PIN that hides the wallet) from being used a second time to finish logging in without ever entering the real main PIN. After this revert, entering the bypass PIN again at the second prompt will complete login into an empty, no-secret session, just as it did before the fix. The change also removes the bugfix note from the changelog and updates tests to expect the old, less restrictive behavior again.

This commit adds a new feature to the COLDCARD hardware wallet that lets users apply the text of a Secure Note or the value of a Secure Note password as their BIP-39 wallet passphrase. It also tightens how printable ASCII is checked in a few places. The change is user-facing and requires physical interaction, so it does not look like a remote exploit. However, because passphrases control which wallet is derived, any bug in how note text is sanitized or applied could cause a user to load an unexpected wallet or expose a note's contents as a passphrase.