chore(core): make CPace implementation more explanatory [no changelog]
What the developer wrote
Authored by M1nd3r
chore(core): make CPace implementation more explanatory
[no changelog]
What changed, and why it matters
This commit only adds explanatory comments and a small constant to the CPace cryptographic code. It does not change what the code actually does, and there is no indication of a security bug being fixed.
No security action needed; treat as a routine code-clarity refactor.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff refactors the SHA-512 input construction in core/src/trezor/wire/thp/cpace.py by splitting one chained update block into commented steps, adding a _SID_STR constant for the empty sid length byte, and adding a debug-only length assertion. The actual byte sequence fed to sha512 is unchanged, so this is a non-functional documentation/comment-only cleanup.
Changed components
core/src/trezor/wire/thp/cpace.pyInspect captured patch +25 / −5
diff --git a/core/src/trezor/wire/thp/cpace.py b/core/src/trezor/wire/thp/cpace.py
index 76344e65e..1b75f690f 100644
--- a/core/src/trezor/wire/thp/cpace.py
+++ b/core/src/trezor/wire/thp/cpace.py
@@ -4,6 +4,10 @@ from trezor.crypto.hashlib import sha512
_PREFIX = b"\x08\x43\x50\x61\x63\x65\x32\x35\x35\x06"
_PADDING = b"\x6f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20"
+_SID_STR = b"\x00"
+
+if __debug__:
+ _LEN_PRS = 6
class Cpace:
@@ -21,11 +25,27 @@ class Cpace:
"""
Generate an ephemeral key pair using Elligator2 with X25519.
"""
- sha_ctx = sha512(_PREFIX)
- sha_ctx.update(code_code_entry)
- sha_ctx.update(_PADDING)
- sha_ctx.update(self.handshake_hash)
- sha_ctx.update(b"\x00")
+ assert len(code_code_entry) == _LEN_PRS
+
+ # See https://datatracker.ietf.org/doc/draft-irtf-cfrg-cpace/
+ # len(DSI) = 8 (b"\x08")
+ # DSI = CPace255
+ # len(PRS) = 6 (b"\x06")
+ # PRS = 'code_code_entry'
+ # len_zpad = 111 (b"\x6f")
+ # len(CI) = 32 (b"\x20")
+ # CI = 'self.handshake_hash'
+ # len(sid) = 0 (b"\x00)
+ # sid = b""
+
+ # fmt: off
+ sha_ctx = sha512(_PREFIX) # len(DSI) | DSI | len(PRS)
+ sha_ctx.update(code_code_entry) # PRS
+ sha_ctx.update(_PADDING) # len_zpad | zpad | len(CI)
+ sha_ctx.update(self.handshake_hash) # CI
+ sha_ctx.update(_SID_STR) # len(sid) | sid
+ # fmt:on
+
pregenerator = sha_ctx.digest()[:32]
generator = elligator2.map_to_curve25519(pregenerator)
self.trezor_private_key = random.bytes(32)
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.