bitbox-secp256k1: use hex!() over hex::decode()
What the developer wrote
Authored by benma's agent
bitbox-secp256k1: use hex!() over hex::decode()
What changed, and why it matters
This commit is a small code cleanup in the BitBox02 firmware's Rust code. It replaces runtime hex decoding with a compile-time macro for test data only. There is no security vulnerability here—just a dependency swap that makes unit tests slightly more efficient and removes an unused dev-dependency.
No action required. This is a routine refactoring commit with no security implications.
Security signals we found
No security-relevant behavior change
Dependency reduction (removes hex dev-dependency)
Compile-time constant substitution in tests only
No input parsing or cryptography logic modified
Evidence from the diff
The change removes the hex crate as a dev-dependency from bitbox-secp256k1 and switches test fixtures in lib.rs to use the hex_lit::hex!() compile-time macro instead of hex::decode(). The affected data are hard-coded secp256k1 keys, nonces, and expected DLEQ proof outputs used only in unit tests. No runtime firmware behavior is changed.
Changed components
src/rust/bitbox-secp256k1/src/lib.rs (unit tests)src/rust/bitbox-secp256k1/Cargo.toml (dev-dependencies)src/rust/Cargo.lockInspect captured patch +11 / −11
diff --git a/src/rust/Cargo.lock b/src/rust/Cargo.lock
index 96b4d2f..7fd86ad 100644
--- a/src/rust/Cargo.lock
+++ b/src/rust/Cargo.lock
@@ -112,7 +112,6 @@ version = "0.1.0"
dependencies = [
"bitcoin",
"cc",
- "hex",
"hex_lit",
]
diff --git a/src/rust/bitbox-secp256k1/Cargo.toml b/src/rust/bitbox-secp256k1/Cargo.toml
index 0e0215b..9bbbc58 100644
--- a/src/rust/bitbox-secp256k1/Cargo.toml
+++ b/src/rust/bitbox-secp256k1/Cargo.toml
@@ -15,7 +15,6 @@ doctest = false
bitcoin = { workspace = true }
[dev-dependencies]
-hex = { workspace = true }
hex_lit = { workspace = true, features = ["rust_v_1_46"] }
[build-dependencies]
diff --git a/src/rust/bitbox-secp256k1/src/lib.rs b/src/rust/bitbox-secp256k1/src/lib.rs
index 2822ca6..f2a7d5a 100644
--- a/src/rust/bitbox-secp256k1/src/lib.rs
+++ b/src/rust/bitbox-secp256k1/src/lib.rs
@@ -334,23 +334,25 @@ mod tests {
#[test]
fn test_dleq() {
let secp = Secp256k1::new();
- let seckey_bytes = b"\x07\x7e\xb7\x5a\x52\xec\xa2\x4c\xde\xdf\x05\x8c\x92\xf1\xca\x8b\x9d\x48\x41\x77\x1f\xd6\xba\xa3\xd2\x78\x85\xfb\x5b\x49\xfb\xa2";
- let seckey = SecretKey::from_slice(seckey_bytes).unwrap();
+ let seckey_bytes = hex!("077eb75a52eca24cdedf058c92f1ca8b9d4841771fd6baa3d27885fb5b49fba2");
+ let seckey = SecretKey::from_slice(&seckey_bytes).unwrap();
let pubkey = seckey.public_key(&secp);
- let other_base_bytes = b"\x03\x89\x14\x0f\x7b\xb8\x52\xf0\x20\xf1\x54\xe5\x59\x08\xfe\x36\x99\xdc\x9f\x65\x15\x3e\x68\x15\x27\xf0\xd5\x5a\xab\xed\x93\x7f\x4b";
- let other_base = PublicKey::from_slice(other_base_bytes).unwrap();
+ let other_base_bytes =
+ hex!("0389140f7bb852f020f154e55908fe3699dc9f65153e681527f0d55aabed937f4b");
+ let other_base = PublicKey::from_slice(&other_base_bytes).unwrap();
let other_pubkey = other_base;
let other_pubkey = other_pubkey.mul_tweak(&secp, &seckey.into()).unwrap();
- let proof = dleq_prove(&secp, seckey_bytes, &other_base, &pubkey, &other_pubkey).unwrap();
+ let proof = dleq_prove(&secp, &seckey_bytes, &other_base, &pubkey, &other_pubkey).unwrap();
// Check against fixture so potential upstream changes in the DLEQ implementation get
// caught. Incompatible changes can break BitBox client libraries that rely on this
// specific DLEQ implementation.
assert_eq!(
- hex::encode(&proof),
- "6c885f825f6ce7565bc6d0bfda90506b11e2682dfe943f5a85badf1c8a96edc5f5e03f5ee2c58bf979646fbada920f9f1c5bd92805fb5b01534b42d26a550f79",
+ proof,
+ hex!("6c885f825f6ce7565bc6d0bfda90506b11e2682dfe943f5a85badf1c8a96edc5f5e03f5ee2c58bf979646fbada920f9f1c5bd92805fb5b01534b42d26a550f79")
+ .to_vec(),
);
dleq_verify(
&secp,
@@ -405,8 +407,8 @@ mod tests {
let client_commitment =
secp256k1_nonce_commit(&private_key, &msg, &host_commitment).unwrap();
assert_eq!(
- hex::encode(client_commitment),
- "0381e4136251c87f2947b735159c6dd644a7b58d35b437e20c878e5129f1320e5e",
+ client_commitment,
+ hex!("0381e4136251c87f2947b735159c6dd644a7b58d35b437e20c878e5129f1320e5e"),
);
}
}
Why this scored 14/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.