fix(prodtest): establish session when reading fido key
What the developer wrote
Authored by Ondřej Vejpustek
fix(prodtest): establish session when reading fido key
What changed, and why it matters
This commit fixes a production-test command used inside Trezor's factory tooling. The command for reading a FIDO security key was failing because it tried to read the key without first starting a secure session with the Tropic chip. The patch adds the missing session-start step before reading the key. It is a bug fix in internal manufacturing diagnostics, not a user-facing wallet security flaw.
Treat as a routine manufacturing-tooling bug fix. No end-user action is required. If reviewing supply-chain security, verify that prodtest commands require appropriate physical/factory authorization and are not reachable in retail firmware.
Security signals we found
Missing privileged session establishment before sensitive cryptographic read
Fixes failing manufacturing diagnostic command only
No privilege escalation or bypass introduced by the patch
No user funds or device PIN/seed paths involved
Evidence from the diff
In core/embed/projects/prodtest/cmd/prodtest_tropic.c, the pubkey_read() helper (used by the tropic-keyfido-read CLI command) now calls tropic_custom_session_start(TROPIC_PRIVILEGED_PAIRING_KEY_SLOT) before invoking lt_ecc_key_read(). Previously the read was attempted without an established privileged session, causing the command to fail. The change is localized to prodtest firmware and does not alter end-user application behavior.
Changed components
core/embed/projects/prodtest/cmd/prodtest_tropic.cTropic secure-element prodtest CLI command `tropic-keyfido-read`Inspect captured patch +14 / −2
diff --git a/core/embed/projects/prodtest/.changelog.d/6081.fixed b/core/embed/projects/prodtest/.changelog.d/6081.fixed
new file mode 100644
index 000000000..6fa15c09c
--- /dev/null
+++ b/core/embed/projects/prodtest/.changelog.d/6081.fixed
@@ -0,0 +1 @@
+Fix the failing `tropic-keyfido-read` command.
diff --git a/core/embed/projects/prodtest/cmd/prodtest_tropic.c b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
index 2f48bfcbe..b2bb79e29 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_tropic.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
@@ -1474,11 +1474,22 @@ static void pubkey_read(cli_t* cli, ecc_slot_t slot,
return;
}
+ lt_ret_t ret = LT_FAIL;
+
+ ret = tropic_custom_session_start(TROPIC_PRIVILEGED_PAIRING_KEY_SLOT);
+ if (ret != LT_OK) {
+ cli_error(cli, CLI_ERROR,
+ "`tropic_custom_session_start()` for privileged key failed with "
+ "error %d",
+ ret);
+ return;
+ }
+
uint8_t public_key[ECDSA_PUBLIC_KEY_SIZE] = {0x04};
lt_ecc_curve_type_t curve_type = 0;
ecc_key_origin_t origin = 0;
- lt_ret_t ret = lt_ecc_key_read(tropic_get_handle(), slot, &public_key[1],
- &curve_type, &origin);
+ ret = lt_ecc_key_read(tropic_get_handle(), slot, &public_key[1], &curve_type,
+ &origin);
if (ret != LT_OK || curve_type != CURVE_P256) {
cli_error(cli, CLI_ERROR, "lt_ecc_key_read error %d.", ret);
return;
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.