Support extendable backup flag in SLIP-39

[andrewkozlik]

Related to:

• SLIP-39 spec update: satoshilabs/slips@8d06070
• Reference implementation update: trezor/python-shamir-mnemonic@1525df1
• Feature: Implement repeated backup #3640
• Feature implementation: feat(core): implement repeated backup. #3743

TODO:

• Update shamir-mnemonic package once version 0.3.0 is released.
• Update screens.
• Maybe add some device/upgrade tests based on the QA list below.

Notes to @trezor/qa:

• Thoroughly test Shamir backup.
• Test case 1:
  1. Install old firmware (2.7.0 or earlier).
  2. Reset device and choose Shamir backup, but do not back up.
  3. Write down some address or XPUB from passphrase-less wallet.
  4. Write down some address or XPUB from passphrased wallet.
  5. Install new firmware.
  6. Ensure that the addresses of the wallets remain the same.
  7. Create a backup and reboot.
  8. Ensure that the addresses of the wallets remain the same.
  9. Wipe the device and recover using the backup.
  10. Ensure that the addresses of the wallets remain the same.
• Test case 2:
  1. Install old firmware.
  2. Reset device and choose Shamir backup and create a backup.
  3. Write down some address or XPUB from passphrase-less wallet.
  4. Write down some address or XPUB from passphrased wallet.
  5. Install new firmware.
  6. Ensure that the addresses of the wallets remain the same.
  7. Wipe the device and recover using the backup.
  8. Ensure that the addresses of the wallets remain the same.
• TC3: Ensure that Shamir backups created with new firmware can be successfully recovered on new firmware, i.e. check that addresses remain the same.
• TC4: Ensure that Shamir backups created with new firmware are not accepted by old firmware.

[github-actions]

core UI changes	device test	click test	persistence test
T2T1 Model T	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T2B1 Safe 3	3280	test(screens) main(screens)	2724
T3T1	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
All	main(screens)

[andrewkozlik]

One would expect the UI tests to differ in only the second word and last three checksum words. The reason why they also differ in the share values is that the PRNG is called by the storage when writing the extendable flag, which desynchronizes the PRNG between the old and new UI tests before the shares are generated. The actual encrypted master secret is probably the same.

Maybe we will store the information about extendability in _BACKUP_TYPE instead of a separate storage entry. See https://www.notion.so/satoshilabs/Shamirization-and-the-random-identifier-09a8b1af23bc45809915c4a74df903d5?pvs=4#a786472062e1484fb9ff2b5d95a3c04f.

[MiroslavProchazka]

QA test task here

[matejcik]

we talked about dropping the stored identifier for extendable backups, do you still intend to do that?

[andrewkozlik]

we talked about dropping the stored identifier for extendable backups, do you still intend to do that?

I do, and I was also hoping to write some upgrade test(s). Maybe I can make some time tomorrow afternoon.

[matejcik]

implementation LGTM

i have caught a mistake in docs, and I believe we need to add a couple checks to the upgrade-test

[github-actions]

legacy UI changes	device test(screens) main(screens)