refactor(core/build): remove storage_hw_key build feature

Trezor/Trezor firmware

c0e99eb2 View source ↗

Public commit record

What the developer wrote

Authored by tychovrahe

62/100 · Adequate

refactor(core/build): remove storage_hw_key build feature

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit removes an optional build feature called `storage_hw_key` and instead turns on hardware-derived storage key support automatically for one specific chip family (STM32U5) and never for the software emulator. It is a cleanup/refactoring change with no direct security fix or vulnerability visible in the diff.

Recommended action

No immediate action required. Treat as routine build cleanup. If auditing, verify that STM32U5 builds still define USE_STORAGE_HWKEY and that STM32F4/emulator builds correctly omit it, matching the previous behavior.

Security signals we found

Build-system refactoring of a hardware-key feature

Feature removal reduces configuration surface

No cryptographic code changes in the diff

No changelog entry (routine refactor)

Technical analysis

Evidence from the diff

The patch deletes the storage_hw_key Cargo feature from model TOMLs and project Cargo.toml/target.toml files. The only functional code change is in core/embed/sys/build.rs, where the previous cfg(feature = "storage_hw_key") guard is replaced by cfg(feature = "mcu_stm32u5") && cfg(not(feature = "emulator")). A similar feature check in core/embed/sec/storage/build.rs is removed because the STM32F4 path no longer needs to reject the now-removed feature. The change hardcodes the prior feature selection logic rather than altering cryptographic behavior.

Changed components

core/embed/sys/build.rscore/embed/sec/storage/build.rscore/embed/models/D002/model.tomlcore/embed/models/T3B1/model.tomlcore/embed/models/T3T1/model.tomlcore/embed/models/T3W1/model.tomlcore/embed/projects/*/Cargo.tomlcore/embed/projects/*/target.toml

Inspect captured patch +3 / −21

diff --git a/core/embed/models/D002/model.toml b/core/embed/models/D002/model.toml
index 225e6d39..bd7925c1 100644
--- a/core/embed/models/D002/model.toml
+++ b/core/embed/models/D002/model.toml
@@ -13,7 +13,6 @@ features = [
     "secmon_verification",
     "secret",
     "secure_aes",
-    "storage_hw_key",
     "tamper",
     "framebuffer",
     "layout_bolt_d002",
diff --git a/core/embed/models/T3B1/model.toml b/core/embed/models/T3B1/model.toml
index abd3e280..d1c38414 100644
--- a/core/embed/models/T3B1/model.toml
+++ b/core/embed/models/T3B1/model.toml
@@ -12,7 +12,6 @@ features = [
     "secure_aes",
     "framebuffer",
     "secure_mode",
-    "storage_hw_key",
     "tamper",
     "layout_caesar",
 ]
diff --git a/core/embed/models/T3T1/model.toml b/core/embed/models/T3T1/model.toml
index 5655d4f0..d53cad71 100644
--- a/core/embed/models/T3T1/model.toml
+++ b/core/embed/models/T3T1/model.toml
@@ -12,7 +12,6 @@ features = [
     "secure_aes",
     "framebuffer",
     "secure_mode",
-    "storage_hw_key",
     "tamper",
     "layout_delizia",
 ]
diff --git a/core/embed/models/T3W1/model.toml b/core/embed/models/T3W1/model.toml
index d6493162..9d9dc7c8 100644
--- a/core/embed/models/T3W1/model.toml
+++ b/core/embed/models/T3W1/model.toml
@@ -22,7 +22,6 @@ features = [
     "secure_aes",
     "serial_number",
     "smp",
-    "storage_hw_key",
     "framebuffer",
     "suspend",
     "tamper",
diff --git a/core/embed/projects/bootloader/Cargo.toml b/core/embed/projects/bootloader/Cargo.toml
index db728d13..54c56d89 100644
--- a/core/embed/projects/bootloader/Cargo.toml
+++ b/core/embed/projects/bootloader/Cargo.toml
@@ -89,7 +89,6 @@ sdram = ["sys/sdram"]
 secmon_verification = ["sec/secmon_verification"]
 secret = ["sec/secret"]
 secure_aes = ["sec/secure_aes"]
-storage_hw_key = ["sec/storage_hw_key"]
 suspend = ["io/suspend"]
 tamper = ["sec/tamper"]
 telemetry = ["sec/telemetry", "trezor_lib/telemetry"]
diff --git a/core/embed/projects/bootloader/target.toml b/core/embed/projects/bootloader/target.toml
index b4828fba..cde69adb 100644
--- a/core/embed/projects/bootloader/target.toml
+++ b/core/embed/projects/bootloader/target.toml
@@ -29,7 +29,6 @@ uses = [
     "secmon_verification",
     "secret",
     "secure_aes",
-    "storage_hw_key",
     "suspend",
     "tamper",
     "telemetry",
diff --git a/core/embed/projects/firmware/Cargo.toml b/core/embed/projects/firmware/Cargo.toml
index ea7b4b82..caeb6ac7 100644
--- a/core/embed/projects/firmware/Cargo.toml
+++ b/core/embed/projects/firmware/Cargo.toml
@@ -109,7 +109,6 @@ secret = ["sec/secret"]
 secure_aes = ["sec/secure_aes"]
 serial_number = ["upymod/serial_number", "trezor_lib/serial_number"]
 suspend = ["io/suspend"]
-storage_hw_key = ["sec/storage_hw_key"]
 thp = ["upymod/thp", "rtl/aes_gcm"]
 tamper = ["sec/tamper"]
 telemetry = ["sec/telemetry", "upymod/telemetry", "trezor_lib/telemetry"]
diff --git a/core/embed/projects/firmware/target.toml b/core/embed/projects/firmware/target.toml
index 0136a817..514ddc47 100644
--- a/core/embed/projects/firmware/target.toml
+++ b/core/embed/projects/firmware/target.toml
@@ -28,7 +28,6 @@ uses = [
     "secret",
     "secure_aes",
     "serial_number",
-    "storage_hw_key",
     "suspend",
     "tamper",
     "telemetry",
diff --git a/core/embed/projects/kernel/Cargo.toml b/core/embed/projects/kernel/Cargo.toml
index a21a2c15..a00d6c24 100644
--- a/core/embed/projects/kernel/Cargo.toml
+++ b/core/embed/projects/kernel/Cargo.toml
@@ -91,7 +91,6 @@ secmon_layout = ["models/secmon_layout"]
 secret = ["sec/secret"]
 secure_aes = ["sec/secure_aes"]
 smp = ["io/smp", "trezor_lib/smp", "trezor_lib/nrf"]
-storage_hw_key = ["sec/storage_hw_key"]
 suspend = ["io/suspend"]
 tamper = ["sec/tamper"]
 telemetry = ["sec/telemetry"]
diff --git a/core/embed/projects/kernel/target.toml b/core/embed/projects/kernel/target.toml
index 8416d5e1..8ca32e85 100644
--- a/core/embed/projects/kernel/target.toml
+++ b/core/embed/projects/kernel/target.toml
@@ -27,7 +27,6 @@ uses = [
     "secret",
     "secure_aes",
     "smp",
-    "storage_hw_key",
     "suspend",
     "tamper",
     "telemetry",
diff --git a/core/embed/projects/prodtest/Cargo.toml b/core/embed/projects/prodtest/Cargo.toml
index 054806e6..d8e4b72b 100644
--- a/core/embed/projects/prodtest/Cargo.toml
+++ b/core/embed/projects/prodtest/Cargo.toml
@@ -103,7 +103,6 @@ secmon_header = []
 secret = ["sec/secret"]
 secure_aes = ["sec/secure_aes"]
 smp = ["io/smp", "trezor_lib/smp"]
-storage_hw_key = ["sys/storage_hw_key"]
 suspend = ["io/suspend"]
 tamper = ["sec/tamper"]
 telemetry = ["sec/telemetry", "trezor_lib/telemetry"]
diff --git a/core/embed/projects/prodtest/target.toml b/core/embed/projects/prodtest/target.toml
index e6368070..9c3277b7 100644
--- a/core/embed/projects/prodtest/target.toml
+++ b/core/embed/projects/prodtest/target.toml
@@ -34,7 +34,6 @@ uses = [
     "secmon_header",
     "secure_aes",
     "smp",
-    "storage_hw_key",
     "suspend",
     "tamper",
     "telemetry",
diff --git a/core/embed/projects/secmon/Cargo.toml b/core/embed/projects/secmon/Cargo.toml
index eb4ec917..a1f686ee 100644
--- a/core/embed/projects/secmon/Cargo.toml
+++ b/core/embed/projects/secmon/Cargo.toml
@@ -68,7 +68,6 @@ optiga = ["sec/optiga"]
 secmon_layout = ["models/secmon_layout"]
 secret = ["sec/secret"]
 secure_aes = ["sec/secure_aes"]
-storage_hw_key = ["sec/storage_hw_key"]
 suspend = ["sec/suspend"]
 tamper = ["sec/tamper"]
 telemetry = ["sec/telemetry"]
diff --git a/core/embed/projects/secmon/target.toml b/core/embed/projects/secmon/target.toml
index b3f84e15..f40cc2ff 100644
--- a/core/embed/projects/secmon/target.toml
+++ b/core/embed/projects/secmon/target.toml
@@ -9,7 +9,6 @@ uses = [
     "optiga",
     "secret",
     "secure_aes",
-    "storage_hw_key",
     "suspend",
     "tamper",
     "telemetry",
diff --git a/core/embed/projects/unix/Cargo.toml b/core/embed/projects/unix/Cargo.toml
index c64e41ad..30bdbd14 100644
--- a/core/embed/projects/unix/Cargo.toml
+++ b/core/embed/projects/unix/Cargo.toml
@@ -106,7 +106,6 @@ secret = ["sec/secret"]
 secure_aes = ["sec/secure_aes"]
 serial_number = ["upymod/serial_number", "trezor_lib/serial_number"]
 suspend = ["io/suspend"]
-storage_hw_key = ["sec/storage_hw_key"]
 tamper = ["sec/tamper"]
 telemetry = ["sec/telemetry", "upymod/telemetry", "trezor_lib/telemetry"]
 thp = ["upymod/thp", "rtl/aes_gcm"]
diff --git a/core/embed/sec/Cargo.toml b/core/embed/sec/Cargo.toml
index b0c2b2de..1d16ed1b 100644
--- a/core/embed/sec/Cargo.toml
+++ b/core/embed/sec/Cargo.toml
@@ -54,7 +54,6 @@ secmon_verification = []
 secret = []
 secure_aes = []
 storage = ["time_estimate"]
-storage_hw_key = ["sys/storage_hw_key"]
 storage_insecure_testing_mode = []
 suspend = []
 tamper = []
diff --git a/core/embed/sec/storage/build.rs b/core/embed/sec/storage/build.rs
index 3402a446..52d48aaa 100644
--- a/core/embed/sec/storage/build.rs
+++ b/core/embed/sec/storage/build.rs
@@ -27,9 +27,6 @@ pub fn def_module(lib: &mut CLibrary) -> Result<()> {
         lib.add_source("storage/unix/storage_salt.c");
     } else if cfg!(feature = "mcu_stm32f4") {
         lib.add_source("storage/stm32f4/storage_salt.c");
-        if cfg!(feature = "storage_hw_key") {
-            bail_unsupported!();
-        }
     } else if cfg!(feature = "mcu_stm32u5") {
         lib.add_source("storage/stm32u5/storage_salt.c");
     } else {
diff --git a/core/embed/sys/Cargo.toml b/core/embed/sys/Cargo.toml
index 60029463..673746ce 100644
--- a/core/embed/sys/Cargo.toml
+++ b/core/embed/sys/Cargo.toml
@@ -51,7 +51,6 @@ dbg_console_vcp = ["dbg_console"]
 dbg_console_system_view = ["dbg_console", "system_view"]
 sdram = []
 sdram_stm32f429i_disc1 = []
-storage_hw_key = []
 system_view = []
 production = ["rtl/production"]
 
diff --git a/core/embed/sys/build.rs b/core/embed/sys/build.rs
index a60ad252..7febdf2d 100644
--- a/core/embed/sys/build.rs
+++ b/core/embed/sys/build.rs
@@ -49,7 +49,9 @@ fn main() -> Result<()> {
             lib.add_define("USE_BOOT_UCB", Some("1"));
         }
 
-        if cfg!(feature = "storage_hw_key") {
+        // Hardware-derived storage key (BHK) is an stm32u5 feature only,
+        // and the emulator has no BHK regardless of which MCU it emulates.
+        if cfg!(feature = "mcu_stm32u5") && cfg!(not(feature = "emulator")) {
             lib.add_define("USE_STORAGE_HWKEY", Some("1"));
         }

Risk score

Why this scored 29/100

Our methodology →

Potential impact 5/30

Exploitability 5/25

Stealth signal 5/15

Affected reach 5/15

Confidence 6/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 29/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters