fix(prodtest): enable MCU TRNG in prodtest
What the developer wrote
Authored by cepetr
fix(prodtest): enable MCU TRNG in prodtest
[no changelog]
What changed, and why it matters
This commit removes a flag called USE_INSECURE_PRNG from the production-test firmware build. That flag previously told the device to use a weak or insecure random number generator during factory testing. Removing it means the production-test firmware will now use the microcontroller's true hardware random number generator (TRNG) instead. Using a weak random source in a test environment could, in theory, affect security if any test keys, identifiers, or calibration data generated there were later reused or leaked, but this change is in a specialized factory-only firmware image, not the main wallet firmware users run.
Verify that the prodtest image no longer compiles in insecure-PRNG fallback code anywhere else, that the MCU TRNG driver is actually enabled and seeded correctly in this build, and that no factory-generated secrets or identifiers are ever carried over into retail devices or user-facing operations. Treat this as a hardening improvement rather than an active vulnerability unless additional evidence shows insecure randomness affected shipped devices.
Security signals we found
Removal of USE_INSECURE_PRNG compile flag
Commit title explicitly frames change as enabling hardware TRNG in production-test firmware
Change is limited to the prodtest build (core/SConscript.prodtest), not the main firmware
No changelog entry provided, reducing transparency
Evidence from the diff
The single-line change deletes the CPP define USE_INSECURE_PRNG from core/SConscript.prodtest. The commit title says this is to ‘enable MCU TRNG in prodtest.’ The prodtest image is a factory/production-test firmware used on the assembly line; it is not the regular user firmware. The diff itself only shows removal of the insecure-PRNG opt-in; it does not show the TRNG enablement code, so we cannot verify from the diff alone whether the TRNG is now correctly initialized or whether any other insecure paths remain.
Changed components
core/SConscript.prodtestTrezor production-test firmware build configurationInspect captured patch +0 / −1
diff --git a/core/SConscript.prodtest b/core/SConscript.prodtest
index 55587429..fdf7b868 100644
--- a/core/SConscript.prodtest
+++ b/core/SConscript.prodtest
@@ -51,7 +51,6 @@ CCFLAGS_MOD = ''
CPPPATH_MOD = []
CPPDEFINES_MOD = [
'AES_128',
- 'USE_INSECURE_PRNG',
]
SOURCE_MOD = []
SOURCE_MOD_CRYPTO = []
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.