test(reset): display_random is accepted and ignored - #211
Open
BitHighlander wants to merge 1 commit into
Open
Conversation
Firmware no longer renders the Internal Entropy screen -- internal entropy is seed pre-image material, and a host that supplies ext_entropy and reads that screen once can compute SHA256(shown || ext) and derive the seed. test_reset_device_pin and test_failed_pin asserted the ButtonRequest for that screen, so they failed against the new firmware. Rather than dropping display_random from the request, they keep sending it =True and now assert the NEXT message is PinMatrixRequest -- which is a direct test of the compatibility claim: the field stays decodable on the wire and changes nothing. Verified 6/6 against an emulator built from the paired firmware branch.
BitHighlander
added a commit
to BitHighlander/keepkey-firmware
that referenced
this pull request
Aug 9, 2026
Moves deps/python-keepkey to 3bbf996, which adds the first test that actually sends ZcashSignPCZT to a device. Until now every PCZT test drove a scripted transport with canned responses, so the on-device shielded path -- including the per-output confirm this branch fixes -- was never executed by anything. The new test is a real regression test for that fix, not a companion to it: run against the shipped 7.15.0 RC emulator it fails with "expected 2 ConfirmOutput screens, got 1". This pin is what lets CI run it against the fixed firmware. Also brings the report catalog changes: native firmware unit tests can now be referenced at all, the header states how much of the run the catalog covers, and the shielded confirm screens are finally requested as screenshots. PRACTICE PIN -- 3bbf996 is on an unmerged fork branch (BitHighlander/python-keepkey#30, stacked on keepkey/python-keepkey#211). Re-pin to a merged master SHA before tagging v7.15.0, along with device-protocol and trezor-firmware.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pairs with firmware BitHighlander/keepkey-firmware#336, which stops rendering the Internal Entropy screen.
Why the firmware changed
Internal entropy is seed pre-image material. A host that supplies
ext_entropyand reads that screen once computesSHA256(shown || ext_entropy)and derives the seed. Note this is unaffected by dice entropy — the displayed value is already post-mix, so dice change nothing about the leak.Why these tests failed
test_reset_device_pinandtest_failed_pinsentdisplay_random=Trueand asserted the resultingButtonRequestbefore the PIN matrix. That screen no longer exists, so both failed — this was the only red job on #336.The fix
Rather than dropping
display_randomfrom the requests, they still send it=Trueand now assert the next message isPinMatrixRequest. That turns a broken assertion into a direct test of the compatibility claim: the field stays decodable on the wire and changes nothing observable.Verification
6/6 in
test_msg_resetdevice.pyagainst an emulator built from the paired firmware branch — includingtest_reset_device_dice, confirming dice entropy and the entropy-screen removal coexist. Firmware side was 14/14 green withpython-integration-testsincluded, and #336 has since merged to alpha.