What the developer wrote
Authored by ww3512687
use explicit_bzero
What changed, and why it matters
This commit replaces a custom secure-wipe function with a standard one in code that handles secret key material during password-based key derivation. The change is likely a defensive hardening fix, but the diff alone does not prove an exploitable vulnerability existed.
Treat as a low-risk hardening commit. Verify that memzero is implemented with explicit_bzero or a volatile memory barrier on the target platform, and audit other occurrences of memset_s in the firmware for consistency.
Security signals we found
Sensitive buffer clearing in PBKDF2/HMAC key preparation
Switch from project-specific memset_s to Trezor memzero/explicit_bzero wrapper
Removal of user_memory.h dependency in cryptographic code
Defensive secret-zeroing hardening
Evidence from the diff
In src/crypto/slip39/trezor-crypto/pbkdf2.c, the commit removes the include of user_memory.h and changes memset_s(key_pad, sizeof(key_pad), 0, sizeof(key_pad)) to memzero(key_pad, sizeof(key_pad)). The memzero helper is the Trezor-crypto explicit_bzero-style wrapper that prevents compiler optimization from eliding the wipe. The previous memset_s was presumably provided by user_memory.h and may have been a project-specific wrapper. This change makes the sensitive key_pad buffer clearing rely on a well-known, portable anti-optimization primitive rather than a local abstraction, reducing the risk that a future build or compiler change silently removes the wipe.
Changed components
src/crypto/slip39/trezor-crypto/pbkdf2.cSLIP39/Trezor PBKDF2-HMAC-SHA256 implementationKeystone 3 firmware cryptographic key derivationInspect captured patch +1 / −2
diff --git a/src/crypto/slip39/trezor-crypto/pbkdf2.c b/src/crypto/slip39/trezor-crypto/pbkdf2.c
index 49946f4..4fe8a85 100644
--- a/src/crypto/slip39/trezor-crypto/pbkdf2.c
+++ b/src/crypto/slip39/trezor-crypto/pbkdf2.c
@@ -26,7 +26,6 @@
#include "hmac.h"
#include "memzero.h"
#include "sha2.h"
-#include "user_memory.h"
void hmac_sha256_prepare_slip39(const uint8_t *key, const uint32_t keylen,
uint32_t *opad_digest, uint32_t *ipad_digest)
@@ -60,7 +59,7 @@ void hmac_sha256_prepare_slip39(const uint8_t *key, const uint32_t keylen,
key_pad[i] = key_pad[i] ^ 0x5c5c5c5c ^ 0x36363636;
}
sha256_Transform(sha256_initial_hash_value, key_pad, ipad_digest);
- memset_s(key_pad, sizeof(key_pad), 0, sizeof(key_pad));
+ memzero(key_pad, sizeof(key_pad));
}
void pbkdf2_hmac_sha256_Init(PBKDF2_HMAC_SHA256_CTX *pctx, const uint8_t *pass,
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.