What changed, and why it matters
This commit flips a build-time option in the blake2 Rust library from 'fast and large' to 'smaller and less inlined.' It is a pure code-size optimization that does not change the hashing algorithm, inputs, outputs, or how the firmware calls it. There is no security-relevant change visible in the diff.
No security action required. Treat as a normal firmware size optimization during routine review.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change adds the ‘size_opt’ feature to the optional blake2 dependency in src/rust/bitbox02-rust/Cargo.toml. The blake2 crate’s size_opt feature disables aggressive inlining of the compression function, reducing code size at the cost of some runtime performance. The commit message states this saves 11576 bytes in firmware.bin and explicitly notes that the algorithm, test vectors, and call sites remain unchanged. No cryptographic logic, API usage, or data flow is modified.
Changed components
src/rust/bitbox02-rust/Cargo.tomlInspect captured patch +1 / −1
diff --git a/src/rust/bitbox02-rust/Cargo.toml b/src/rust/bitbox02-rust/Cargo.toml
index 73e9225..e844e05 100644
--- a/src/rust/bitbox02-rust/Cargo.toml
+++ b/src/rust/bitbox02-rust/Cargo.toml
@@ -41,7 +41,7 @@ num-bigint = { workspace = true, optional = true }
num-traits = { version = "0.2", default-features = false }
# If you change this, also change src/rust/.cargo/config.toml.
bip32-ed25519 = { git = "https://github.com/BitBoxSwiss/rust-bip32-ed25519", tag = "v0.2.1", optional = true }
-blake2 = { version = "0.10.6", default-features = false, optional = true }
+blake2 = { version = "0.10.6", default-features = false, features = ["size_opt"], optional = true }
minicbor = { version = "0.24.0", default-features = false, features = ["alloc"], optional = true }
crc = { workspace = true, optional = true }
ed25519-dalek = { version = "2.1.1", default-features = false, features = ["hazmat", "digest"], optional = true }
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.