refactor(core, crypto): extract `consteq` for general use
What the developer wrote
Authored by M1nd3r
refactor(core, crypto): extract `consteq` for general use
[no changelog]
What changed, and why it matters
This commit adds a new utility function called `consteq` that compares two chunks of memory in a way that takes the same amount of time regardless of how similar the chunks are. It is intended to help prevent timing-based attacks in the future, but the commit itself only extracts and compiles the helper; it does not change any existing security-sensitive comparison or fix a known vulnerability.
No immediate action required. Treat as a routine refactoring. When reviewing future commits, verify that `consteq` is actually adopted at security-sensitive comparison sites (e.g., PIN, passphrase, or authentication checks) and that the implementation is used correctly with equal-length secrets.
Security signals we found
New constant-time comparison helper added
Build scripts updated to compile the new helper
No existing comparison logic was replaced in this commit
Evidence from the diff
The change introduces crypto/consteq.c and crypto/consteq.h, implementing a constant-time bool consteq(const void *s1, const void *s2, size_t n). It accumulates byte differences with diff |= p1[i] ^ p2[i] and returns diff == 0, avoiding the early-exit behavior of memcmp. The new source file is added to both firmware and unix build scripts. No call sites are modified or added in this commit, so there is no direct security fix or behavior change in shipped code.
Changed components
crypto/consteq.ccrypto/consteq.hcore/SConscript.firmwarecore/SConscript.unixInspect captured patch +31 / −0
diff --git a/core/SConscript.firmware b/core/SConscript.firmware
index bb0ba872..acf7b884 100644
--- a/core/SConscript.firmware
+++ b/core/SConscript.firmware
@@ -172,6 +172,7 @@ SOURCE_MOD_CRYPTO += [
'vendor/trezor-crypto/chacha20poly1305/poly1305-donna.c',
'vendor/trezor-crypto/chacha20poly1305/rfc7539.c',
'vendor/trezor-crypto/chacha_drbg.c',
+ 'vendor/trezor-crypto/consteq.c',
'vendor/trezor-crypto/curves.c',
'vendor/trezor-crypto/der.c',
'vendor/trezor-crypto/ecdsa.c',
diff --git a/core/SConscript.unix b/core/SConscript.unix
index d23406d3..38defe3e 100644
--- a/core/SConscript.unix
+++ b/core/SConscript.unix
@@ -153,6 +153,7 @@ SOURCE_MOD_CRYPTO += [
'vendor/trezor-crypto/chacha20poly1305/poly1305-donna.c',
'vendor/trezor-crypto/chacha20poly1305/rfc7539.c',
'vendor/trezor-crypto/chacha_drbg.c',
+ 'vendor/trezor-crypto/consteq.c',
'vendor/trezor-crypto/curves.c',
'vendor/trezor-crypto/der.c',
'vendor/trezor-crypto/ecdsa.c',
diff --git a/crypto/consteq.c b/crypto/consteq.c
new file mode 100644
index 00000000..d9287780
--- /dev/null
+++ b/crypto/consteq.c
@@ -0,0 +1,14 @@
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+bool consteq(const void *s1, const void *s2, size_t n) {
+ const unsigned char *p1 = s1;
+ const unsigned char *p2 = s2;
+ int diff = 0;
+ for (size_t i = 0; i < n; i++) {
+ // Accumulate differences using OR to prevent early termination
+ diff |= p1[i] ^ p2[i];
+ }
+ return diff == 0;
+}
diff --git a/crypto/consteq.h b/crypto/consteq.h
new file mode 100644
index 00000000..d2abdfd6
--- /dev/null
+++ b/crypto/consteq.h
@@ -0,0 +1,15 @@
+#ifndef __CONSTEQ_H__
+#define __CONSTEQ_H__
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+/**
+ * @brief Constant-time memory comparison.
+ * Compares 'n' bytes, but unlike memcmp, it does not short-circuit,
+ * thus preventing timing attacks.
+ * @return `true` if the memory areas are equal, `false` otherwise.
+ */
+bool consteq(const void *s1, const void *s2, size_t n);
+#endif
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.