Reject registering wallet policies with pubkeys not on the curve
What the developer wrote
Authored by Salvatore Ingala
Reject registering wallet policies with pubkeys not on the curve
While this would be detected and fail at the first attempt at
deriving addresses from it, checking it early consts little.
What changed, and why it matters
This commit adds an early safety check in the Ledger Bitcoin app. Before registering a new wallet policy, the app now verifies that each public key is a valid point on the Bitcoin elliptic curve. Previously, an invalid public key would only be caught later when trying to derive addresses. Catching it earlier prevents the device from storing a broken or potentially manipulated wallet policy.
Treat as a defensive hardening fix. Review whether other public-key entry points (e.g., signing, address display, key import) perform equivalent on-curve validation, and consider adding tests with deliberately invalid secp256k1 points to ensure the check is reached.
Security signals we found
Input validation added for cryptographic public key points
Invalid curve points now rejected at wallet registration time rather than deferred to address derivation
Use of standard status word SW_INCORRECT_DATA for malformed input
Evidence from the diff
In src/handler/register_wallet.c, inside confirm_and_register_wallet(), the patch calls crypto_get_uncompressed_pubkey() on each extended public key’s compressed public key during wallet policy registration. If the function returns a negative value (indicating the point is not on the secp256k1 curve), the handler aborts with SW_INCORRECT_DATA. Previously, registration would succeed and the invalid key would only surface at address-derivation time.
Changed components
src/handler/register_wallet.cWallet policy registration handlerInspect captured patch +9 / −0
### src/handler/register_wallet.c
@@ -109,6 +109,15 @@ __attribute__((noinline)) static void confirm_and_register_wallet(
return;
}
+ // Reject invalid pubkeys (not on the curve)
+ uint8_t uncompressed_pubkey[65];
+ if (0 > crypto_get_uncompressed_pubkey(key_info.ext_pubkey.compressed_pubkey,
+ uncompressed_pubkey)) {
+ PRINTF("The pubkey is not a valid point of the curve\n");
+ SEND_SW(dc, SW_INCORRECT_DATA);
+ return;
+ }
+
// We refuse to register wallets without key origin information, or whose keys don't end
// with the wildcard ('/**'). The key origin information is necessary when signing to
// identify which one is our key. Using addresses without a wildcard could potentially beWhy this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.