What the developer wrote
Authored by Marko Bencun
optiga: rename KDF_NUM_ITERATIONS
To make it clear it's only used in V0.
What changed, and why it matters
This commit is a simple code cleanup: it renames a constant from KDF_NUM_ITERATIONS to KDF_NUM_ITERATIONS_V0 and updates the comment to clarify that the low number of iterations (2) applies only to an older password-stretching algorithm (V0). No behavior changes, no security fix, no vulnerability patch.
No security action needed; treat as normal refactoring/documentation commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change is purely cosmetic/commentary. The macro value remains 2, and the only call site in _stretch_password_v0() uses the renamed constant identically. The added ‘V0’ in the comment and name documents that this iteration count is specific to the legacy v0 stretching routine, not to any newer algorithm. There is no functional diff.
Changed components
src/optiga/optiga.cInspect captured patch +3 / −3
diff --git a/src/optiga/optiga.c b/src/optiga/optiga.c
index 7da7f71..8f3999b 100644
--- a/src/optiga/optiga.c
+++ b/src/optiga/optiga.c
@@ -47,8 +47,8 @@
#define ARBITRARY_DATA_OBJECT_TYPE_3_MAX_SIZE 140
// This number of KDF iterations on the external kdf slot when stretching the device
-// password.
-#define KDF_NUM_ITERATIONS (2)
+// password using the V0 algorithm.
+#define KDF_NUM_ITERATIONS_V0 (2)
// Struct stored in the arbitrary data object.
#pragma GCC diagnostic push
@@ -1567,7 +1567,7 @@ static int _stretch_password_v0(const char* password, uint8_t* stretched_out)
return securechip_result;
}
// Second KDF does not use the counter and we call it multiple times.
- for (int i = 0; i < KDF_NUM_ITERATIONS; i++) {
+ for (int i = 0; i < KDF_NUM_ITERATIONS_V0; i++) {
memcpy(kdf_in, stretched_out, 32);
securechip_result = optiga_kdf_external(kdf_in, 32, stretched_out);
if (securechip_result) {
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.