What the developer wrote
Authored by M1nd3r
chore(core): disable BIP39 cache
[no changelog]
What changed, and why it matters
This commit turns off an internal performance cache for BIP39, the system that converts a recovery seed phrase into cryptographic keys on Trezor hardware wallets. Disabling a cache is usually a defensive change: it can prevent sensitive seed-derived data from lingering in device memory longer than necessary. However, the commit gives no explanation, changelog entry, or linked security report, so we cannot tell whether this fixes a known vulnerability or is just a precautionary hardening measure.
Treat as a hardening change rather than a confirmed vulnerability fix unless additional vendor context is published. Users should ensure they are running firmware that includes this change and follow Trezor's official security advisories. Developers should document the rationale for disabling the cache and assess performance impact on seed derivation operations.
Security signals we found
Disables a cryptographic cache that may retain sensitive key-derived material
No changelog entry or security explanation provided
Single-line build configuration change with no accompanying code patch
Evidence from the diff
The change adds one compile-time flag in core/embed/crypto/build.rs: USE_BIP39_CACHE is set to “0”. This disables the BIP39 derivation cache in the embedded cryptographic library used by Trezor firmware. Caches for BIP32/BIP39 can store recently derived keys or intermediate values to speed up repeated operations. Turning the cache off reduces the attack surface where sensitive key material might be recoverable from RAM, but it may also increase CPU usage and derivation time. The patch is one line and contains no functional code changes, tests, or documentation beyond the flag toggle.
Changed components
core/embed/crypto/build.rsTrezor embedded crypto library BIP39 cacheInspect captured patch +1 / −0
### core/embed/crypto/build.rs
@@ -49,6 +49,7 @@ fn add_crypto_base(lib: &mut CLibrary, common_attrs: &CompileAttrs) -> Result<()
("AES_192", None),
("USE_KECCAK", Some("1")),
("USE_BIP32_CACHE", Some("0")),
+ ("USE_BIP39_CACHE", Some("0")),
]);
if cfg!(feature = "ed25519_no_precomp") {Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.