fix(core/prodtest): fix conditional usage of tropic testing keys
What the developer wrote
Authored by tychovrahe
fix(core/prodtest): fix conditional usage of tropic testing keys
[no changelog]
What changed, and why it matters
This is a one-line fix in Trezor's factory production-test code for the Tropic secure chip. It changes a preprocessor condition from an apparently wrong/placeholder macro name 'ABAB' to the intended 'TROPIC_TESTING_KEYS'. The effect is to ensure that testing-only cryptographic keys are compiled in only when the proper configuration flag is set, rather than under an unrelated or accidental flag. This reduces the risk that production devices could be built with test keys instead of real factory keys.
Verify that no production builds define TROPIC_TESTING_KEYS, confirm that factory release builds use only the real factory keys, and audit other preprocessor conditions in prodtest_tropic.c for similar stale/wrong macro names. No end-user action is needed.
Security signals we found
Hardcoded/testing cryptographic keys in source code
Preprocessor conditional controlling key material selection
Mismatch between configuration macro and intended key set
Production-test tooling code (not shipped to end users)
Evidence from the diff
In core/embed/projects/prodtest/cmd/prodtest_tropic.c, the conditional guarding a set of curve25519 testing keys was ‘#ifdef ABAB’. The patch changes it to ‘#ifdef TROPIC_TESTING_KEYS’. The surrounding code already uses TROPIC_TESTING_KEYS elsewhere to select testing keys, so ABAB appears to have been a typo or stale placeholder. The file is part of the prodtest (manufacturing test) firmware, not the end-user wallet firmware, and the keys are used for pairing with the TROPIC01 chip during production testing.
Changed components
core/embed/projects/prodtest/cmd/prodtest_tropic.cTropic production-test pairing commandInspect captured patch +1 / −1
diff --git a/core/embed/projects/prodtest/cmd/prodtest_tropic.c b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
index 2a37c073f..888f5620d 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_tropic.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
@@ -861,7 +861,7 @@ static void prodtest_tropic_pair(cli_t* cli) {
0x05, 0xe8, 0xa2, 0x2e, 0xf7, 0x21, 0x38, 0x98, 0x28, 0x2b, 0xa9,
0x43, 0x12, 0xf3, 0x13, 0xdf, 0x2d, 0xce, 0x8d, 0x41, 0x64};
#else
-#ifdef ABAB
+#ifdef TROPIC_TESTING_KEYS
// Testing keys (used in TROPIC01-P2S-P001)
curve25519_key factory_private = {
0xd0, 0x99, 0x92, 0xb1, 0xf1, 0x7a, 0xbc, 0x4d, 0xb9, 0x37, 0x17,
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.