diff --git a/core/embed/projects/kernel/main.c b/core/embed/projects/kernel/main.c index dd61b0f108..1cbc46385d 100644 --- a/core/embed/projects/kernel/main.c +++ b/core/embed/projects/kernel/main.c @@ -55,10 +55,6 @@ #include #endif -#ifdef USE_TROPIC -#include -#endif - #ifdef USE_POWERCTL #include #endif @@ -159,11 +155,6 @@ void drivers_init() { secbool optiga_secret_ok = secret_optiga_get(optiga_secret); #endif -#ifdef USE_TROPIC - uint8_t tropic_secret[SECRET_TROPIC_KEY_LEN] = {0}; - secbool tropic_secret_ok = secret_tropic_get(tropic_secret); -#endif - entropy_init(); #if PRODUCTION || BOOTLOADER_QA @@ -218,26 +209,6 @@ void drivers_init() { #endif -#ifdef USE_TROPIC - - if (sectrue != tropic_secret_ok) { - memzero(tropic_secret, sizeof(tropic_secret)); - ensure(false, "secret_tropic_get failed"); - } - - if (tropic_init() != TROPIC_SUCCESS) { - memzero(tropic_secret, sizeof(tropic_secret)); - ensure(false, "tropic_init failed"); - } - - if (tropic_handshake(tropic_secret) != TROPIC_SUCCESS) { - memzero(tropic_secret, sizeof(tropic_secret)); - ensure(false, "tropic_handshake failed"); - } - - memzero(tropic_secret, sizeof(tropic_secret)); - -#endif } // defined in linker script diff --git a/core/embed/projects/unix/main.c b/core/embed/projects/unix/main.c index 7d34f558b9..e789d03053 100644 --- a/core/embed/projects/unix/main.c +++ b/core/embed/projects/unix/main.c @@ -506,25 +506,34 @@ static int sdl_event_filter(void *userdata, SDL_Event *event) { void drivers_init() { #ifdef USE_TROPIC - uint8_t tropic_secret[SECRET_TROPIC_KEY_LEN] = {0}; - secbool tropic_secret_ok = secret_tropic_get(tropic_secret); + uint8_t tropic_secret_trezor_privkey[SECRET_TROPIC_KEY_LEN] = {0}; + uint8_t tropic_secret_tropic_pubkey[SECRET_TROPIC_KEY_LEN] = {0}; - if (sectrue != tropic_secret_ok) { - memzero(tropic_secret, sizeof(tropic_secret)); - ensure(false, "secret_tropic_get failed"); + if (sectrue != secret_tropic_get_trezor_privkey(tropic_secret_trezor_privkey)) { + memzero(tropic_secret_trezor_privkey, sizeof(tropic_secret_trezor_privkey)); + ensure(false, "secret_tropic_get_trezor_privkey failed"); + } + + if (sectrue != secret_tropic_get_tropic_pubkey(tropic_secret_tropic_pubkey)) { + memzero(tropic_secret_trezor_privkey, sizeof(tropic_secret_trezor_privkey)); + memzero(tropic_secret_tropic_pubkey, sizeof(tropic_secret_tropic_pubkey)); + ensure(false, "secret_tropic_get_tropic_pubkey failed"); } if (tropic_init() != TROPIC_SUCCESS) { - memzero(tropic_secret, sizeof(tropic_secret)); + memzero(tropic_secret_trezor_privkey, sizeof(tropic_secret_trezor_privkey)); + memzero(tropic_secret_tropic_pubkey, sizeof(tropic_secret_tropic_pubkey)); ensure(false, "tropic_init failed"); } - if (tropic_handshake(tropic_secret) != TROPIC_SUCCESS) { - memzero(tropic_secret, sizeof(tropic_secret)); + if (tropic_handshake(tropic_secret_trezor_privkey, tropic_secret_tropic_pubkey) != TROPIC_SUCCESS) { + memzero(tropic_secret_trezor_privkey, sizeof(tropic_secret_trezor_privkey)); + memzero(tropic_secret_tropic_pubkey, sizeof(tropic_secret_tropic_pubkey)); ensure(false, "tropic_handshake failed"); } - memzero(tropic_secret, sizeof(tropic_secret)); + memzero(tropic_secret_trezor_privkey, sizeof(tropic_secret_trezor_privkey)); + memzero(tropic_secret_tropic_pubkey, sizeof(tropic_secret_tropic_pubkey)); #endif } diff --git a/core/embed/sec/secret/inc/sec/secret.h b/core/embed/sec/secret/inc/sec/secret.h index 984bb21450..8e466b6d73 100644 --- a/core/embed/sec/secret/inc/sec/secret.h +++ b/core/embed/sec/secret/inc/sec/secret.h @@ -58,7 +58,9 @@ secbool secret_optiga_writable(void); // Erases optiga pairing secret from the secret storage void secret_optiga_erase(void); -secbool secret_tropic_get(uint8_t dest[SECRET_TROPIC_KEY_LEN]); +secbool secret_tropic_get_trezor_privkey(uint8_t dest[SECRET_TROPIC_KEY_LEN]); + +secbool secret_tropic_get_tropic_pubkey(uint8_t dest[SECRET_TROPIC_KEY_LEN]); // Regenerates the BHK and writes it to the secret storage void secret_bhk_regenerate(void); diff --git a/core/embed/sec/secret/unix/secret.c b/core/embed/sec/secret/unix/secret.c index 8460811f9c..29251036cc 100644 --- a/core/embed/sec/secret/unix/secret.c +++ b/core/embed/sec/secret/unix/secret.c @@ -7,11 +7,16 @@ #ifdef KERNEL_MODE -static uint8_t SECRET_TROPIC_PRIVKEY_BYTES[] = \ +static uint8_t SECRET_TROPIC_TREZOR_PRIVKEY_BYTES[] = \ {0xf0, 0xc4, 0xaa, 0x04, 0x8f, 0x00, 0x13, 0xa0, 0x96, 0x84, 0xdf, \ 0x05, 0xe8, 0xa2, 0x2e, 0xf7, 0x21, 0x38, 0x98, 0x28, 0x2b, 0xa9, \ 0x43, 0x12, 0xf3, 0x13, 0xdf, 0x2d, 0xce, 0x8d, 0x41, 0x64}; +static uint8_t SECRET_TROPIC_PUBKEY_BYTES[] = + {0x31, 0xE9, 0x0A, 0xF1, 0x50, 0x45, 0x10, 0xEE, 0x4E, 0xFD, 0x79, \ + 0x13, 0x33, 0x41, 0x48, 0x15, 0x89, 0xA2, 0x89, 0x5C, 0xC5, 0xFB, \ + 0xB1, 0x3E, 0xD5, 0x71, 0x1C, 0x1E, 0x9B, 0x81, 0x98, 0x72}; + static secbool bootloader_locked_set = secfalse; static secbool bootloader_locked = secfalse; @@ -128,8 +133,13 @@ secbool secret_optiga_writable(void) { return secret_wiped(); } void secret_optiga_erase(void) { secret_erase(); } -secbool secret_tropic_get(uint8_t dest[SECRET_TROPIC_KEY_LEN]) { - memcpy(dest, &SECRET_TROPIC_PRIVKEY_BYTES, SECRET_TROPIC_KEY_LEN); +secbool secret_tropic_get_trezor_privkey(uint8_t dest[SECRET_TROPIC_KEY_LEN]) { + memcpy(dest, &SECRET_TROPIC_TREZOR_PRIVKEY_BYTES, SECRET_TROPIC_KEY_LEN); + return sectrue; +} + +secbool secret_tropic_get_tropic_pubkey(uint8_t dest[SECRET_TROPIC_KEY_LEN]) { + memcpy(dest, &SECRET_TROPIC_PUBKEY_BYTES, SECRET_TROPIC_KEY_LEN); return sectrue; } diff --git a/core/embed/sec/tropic/inc/sec/tropic_common.h b/core/embed/sec/tropic/inc/sec/tropic_common.h index de6cf4f856..dc6eb968dd 100644 --- a/core/embed/sec/tropic/inc/sec/tropic_common.h +++ b/core/embed/sec/tropic/inc/sec/tropic_common.h @@ -23,8 +23,6 @@ typedef enum _tropic_result { TROPIC_SUCCESS = 0, // Operation completed successfully. TROPIC_ERR_INIT, - TROPIC_ERR_GET_INFO_CERT, - TROPIC_ERR_CERT_VERIFY_AND_PARSE, TROPIC_ERR_SESSION_START, } tropic_result; diff --git a/core/embed/sec/tropic/inc/sec/tropic_transport.h b/core/embed/sec/tropic/inc/sec/tropic_transport.h index eb00595f4d..7df77b78df 100644 --- a/core/embed/sec/tropic/inc/sec/tropic_transport.h +++ b/core/embed/sec/tropic/inc/sec/tropic_transport.h @@ -25,6 +25,6 @@ #include "libtropic.h" tropic_result tropic_init(void); -tropic_result tropic_handshake(const uint8_t *trezor_privkey); +tropic_result tropic_handshake(const uint8_t *trezor_privkey, const uint8_t *tropic_pubkey); #endif diff --git a/core/embed/sec/tropic/tropic_transport.c b/core/embed/sec/tropic/tropic_transport.c index ea68c14754..204cec885c 100644 --- a/core/embed/sec/tropic/tropic_transport.c +++ b/core/embed/sec/tropic/tropic_transport.c @@ -35,25 +35,13 @@ tropic_result tropic_init(void) { return TROPIC_SUCCESS; } -tropic_result tropic_handshake(const uint8_t *trezor_privkey) { +tropic_result tropic_handshake(const uint8_t *trezor_privkey, const uint8_t *tropic_pubkey) { lt_ret_t ret = LT_FAIL; - uint8_t X509_cert[LT_L2_GET_INFO_REQ_CERT_SIZE] = {0}; - ret = lt_get_info_cert(<_handle, X509_cert, LT_L2_GET_INFO_REQ_CERT_SIZE); - if (ret != LT_OK) { - return TROPIC_ERR_GET_INFO_CERT; - } + uint8_t trezor_pubkey[SECRET_TROPIC_KEY_LEN] = {}; + curve25519_scalarmult_basepoint(trezor_pubkey, trezor_privkey); - uint8_t stpub[32] = {0}; - ret = lt_cert_verify_and_parse(X509_cert, 512, stpub); - if (ret != LT_OK) { - return TROPIC_ERR_CERT_VERIFY_AND_PARSE; - } - - uint8_t shipub[SECRET_TROPIC_KEY_LEN] = {}; - curve25519_scalarmult_basepoint(shipub, trezor_privkey); - - ret = lt_session_start(<_handle, stpub, PKEY_INDEX_BYTE, trezor_privkey, shipub); + ret = lt_session_start(<_handle, tropic_pubkey, PKEY_INDEX_BYTE, trezor_privkey, trezor_pubkey); if (ret != LT_OK) { return TROPIC_ERR_SESSION_START; }