chore: guard against insecure PRNG in bare-metal build
What the developer wrote
Authored by Andrew Kozlik
chore: guard against insecure PRNG in bare-metal build
[no changelog]
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
What changed, and why it matters
This commit adds compile-time guards to prevent an intentionally insecure random-number generator from being accidentally included in firmware that runs directly on Trezor hardware. It does not fix an active bug, but it adds safety rails so a future build misconfiguration cannot silently ship weak randomness to real devices.
Treat as a hardening commit. Verify CI still builds test/simulator targets correctly and that no bare-metal or production configuration accidentally selects USE_INSECURE_PRNG. No immediate incident response is indicated by the diff alone.
Security signals we found
Compile-time guard around insecure PRNG
Explicit block of bare-metal / freestanding targets
Existing production-build guard already present
File named rand_insecure.c signals intentionally weak randomness
Evidence from the diff
The change modifies crypto/rand_insecure.c to add three compile-time checks: a static assertion that the target pointer size is 64-bit, an #error directive blocking bare-metal targets (anything not Linux/macOS/Windows), and an #error directive blocking freestanding environments (STDC_HOSTED == 0). The file already had a guard against production builds; this patch extends those guards to catch device/bare-metal builds more explicitly. The insecure PRNG is intended only for testing/simulation on hosted 64-bit operating systems.
Changed components
crypto/rand_insecure.cTrezor firmware build system / target selectionInspect captured patch +11 / −0
### crypto/rand_insecure.c
@@ -26,6 +26,17 @@
#error "Insecure PRNG must not be compiled into a production build"
#endif
+// Guard against this file ever being compiled into a bare-metal build.
+_Static_assert(
+ sizeof(void *) == 8,
+ "Insecure PRNG compiled for a non 64-bit target, a device build?");
+#if !defined(__linux__) && !defined(__APPLE__) && !defined(_WIN32)
+#error "Insecure PRNG must not be compiled for a bare-metal target"
+#endif
+#if __STDC_HOSTED__ == 0
+#error "Insecure PRNG must not be compiled for a freestanding target"
+#endif
+
#include "rand.h"
#ifdef USE_INSECURE_PRNGWhy this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.