fix(core): invalidate THP credential authentication key on `Forget all`
What the developer wrote
Authored by Roman Zeyde
fix(core): invalidate THP credential authentication key on `Forget all`
[no changelog]
What changed, and why it matters
This commit fixes a security bug in the Trezor hardware wallet's Bluetooth handling. When a user chose 'Forget all' Bluetooth pairings, the device was not clearing a special key used for a feature called THP (Trezor Host Protocol) credential authentication. As a result, after reconnecting, the device might trust the other side without asking the user to confirm again. The fix adds a call to invalidate that key whenever all Bluetooth pairings are erased.
Treat as a security bugfix. Users should update firmware to a version containing this commit. If a device was previously unpaired via 'Forget all' while running vulnerable firmware, users should re-pair only with trusted hosts and consider rotating any THP-related credentials if the vendor provides guidance. Trezor should document whether this is exploitable in practice and whether a CVE is warranted.
Security signals we found
Missing invalidation of cryptographic/authentication state on user-initiated reset
Cached credential authentication key could allow reconnection without fresh confirmation
Fix is narrowly scoped to the 'Forget all' Bluetooth unpair code path
No changelog entry suggests low-profile bugfix rather than public security announcement
Evidence from the diff
The patch modifies core/src/apps/management/ble/unpair.py. In the branch that handles msg.all (forget all BLE pairings), it now imports invalidate_cred_auth_key from apps.thp.credential_manager and calls it before ble.erase_bonds(). The comment states that without this invalidation the device will not ask for THP confirmation after reconnecting. This indicates a state-management flaw where THP credential authentication state persisted across a full unpair operation, potentially allowing a paired host to reconnect and authenticate via cached credentials without fresh user confirmation.
Changed components
core/src/apps/management/ble/unpair.pyapps.thp.credential_managerBluetooth pairing / unpairing flowTHP credential authenticationInspect captured patch +5 / −0
diff --git a/core/src/apps/management/ble/unpair.py b/core/src/apps/management/ble/unpair.py
index 5a3a4fe6..7371acbc 100644
--- a/core/src/apps/management/ble/unpair.py
+++ b/core/src/apps/management/ble/unpair.py
@@ -36,6 +36,11 @@ async def unpair(msg: BleUnpair) -> None:
await ctx.write(Success(message="Erasing..."))
if msg.all:
+ from apps.thp.credential_manager import invalidate_cred_auth_key
+
+ # THP credentials should be invalidated when "Forget all" is handled.
+ # Otherwise, the device will not ask for THP confirmation after reconnecting.
+ invalidate_cred_auth_key()
ble.erase_bonds()
else:
ble.unpair(msg.addr)
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.