chore(core): add PROD payment request public signing key
What the developer wrote
Authored by M1nd3r
chore(core): add PROD payment request public signing key
[no changelog]
What changed, and why it matters
This commit simply fills in a previously empty placeholder with the real production public key used to verify signed payment requests. By itself, it is a routine configuration/key-installation change, not an exploitable vulnerability. The only security-relevant observation is that before this commit, payment-request signatures using this key could not have been validated, so the feature would not have worked in production.
No immediate action required. Treat as a normal key-provisioning commit. Ensure the corresponding private key is stored securely and that key rotation procedures exist for the payment-request signing infrastructure.
Security signals we found
Hard-coded cryptographic public key added to firmware
Empty public-key placeholder replaced with production key
No changelog entry provided
Evidence from the diff
The diff replaces an empty bytes value for PaymentRequestVerifier.PUBLIC_KEY with a 33-byte compressed secp256k1 public key (starting with 0x02, indicating an even y-coordinate). This is the production key that the device uses to verify payment-request signatures. The change is a one-line data update with no accompanying logic changes.
Changed components
core/src/apps/common/payment_request.pyPaymentRequestVerifier classInspect captured patch +1 / −1
diff --git a/core/src/apps/common/payment_request.py b/core/src/apps/common/payment_request.py
index 372aeca2..7532c52f 100644
--- a/core/src/apps/common/payment_request.py
+++ b/core/src/apps/common/payment_request.py
@@ -46,7 +46,7 @@ def _is_coin_swap(payment_request: PaymentRequest) -> bool:
class PaymentRequestVerifier:
- PUBLIC_KEY = b""
+ PUBLIC_KEY = b"\x02\xaa\x9b\x94\xb3\x06\xf1\xb5\x0c\x19\xb4\xb9\x53\xb6\xac\xdf\x2d\x3a\xc0\x9e\xca\x5e\x53\x44\xa2\xbb\x2f\xbf\x19\x49\x5d\x55\x0c"
def verify_payment_request_is_supported(
self, payment_request: PaymentRequest
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.