chore: guard against insecure PRNG in production build
What the developer wrote
Authored by Andrew Kozlik
chore: guard against insecure PRNG in production build
[no changelog]
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
What changed, and why it matters
This commit adds safety guards to prevent a deliberately weak random-number generator from being included in production firmware builds, and stops emulator builds from being labeled as production builds. It does not by itself fix a vulnerability in shipped code; it is a build-time hardening measure against accidental misconfiguration.
Treat as a defensive hardening commit. Verify that CI and release pipelines fail when PRODUCTION=1 and USE_INSECURE_PRNG are both set, and audit whether any prior production artifacts were accidentally built with the insecure PRNG enabled.
Security signals we found
Compile-time guard against insecure PRNG in production builds
Prevention of emulator builds being marked as production builds
Explicit labeling of rand_insecure.c as insecure and test-only
No runtime cryptographic weakness patched; build-hardening only
Evidence from the diff
The change sets PRODUCTION=1 instead of an empty define, then uses #if defined(PRODUCTION) && PRODUCTION in crypto/rand_insecure.c to trigger a compile-time #error if the insecure PRNG is included in a production build. It also prevents EMULATOR=1 from being combined with PRODUCTION=1 in legacy Makefile builds. The insecure PRNG remains intended for testing/emulator use only.
Changed components
core/embed/models/build.rscrypto/rand_insecure.clegacy/Makefile.includeInspect captured patch +13 / −1
### core/embed/models/build.rs
@@ -134,7 +134,7 @@ fn main() -> Result<()> {
}
if cfg!(feature = "production") {
- lib.add_define("PRODUCTION", None);
+ lib.add_define("PRODUCTION", Some("1"));
}
if cfg!(feature = "boardloader") {
### crypto/rand_insecure.c
@@ -21,6 +21,11 @@
* OTHER DEALINGS IN THE SOFTWARE.
*/
+// Guard against this file ever being compiled into a production build.
+#if defined(PRODUCTION) && PRODUCTION
+#error "Insecure PRNG must not be compiled into a production build"
+#endif
+
#include "rand.h"
#ifdef USE_INSECURE_PRNG
### legacy/Makefile.include
@@ -155,6 +155,13 @@ CFLAGS += -DBITCOIN_ONLY=0
CFLAGS += -DU2F_ENABLED=1
endif
+ifeq ($(EMULATOR), 1)
+ifeq ($(PRODUCTION), 1)
+$(error EMULATOR=1 cannot be combined with PRODUCTION=1)
+endif
+PRODUCTION := 0
+endif
+
ifeq ($(PRODUCTION), 0)
CFLAGS += -DPRODUCTION=0
CPUFLAGS += -DPRODUCTION=0Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.