80 lines
3.2 KiB
Diff
80 lines
3.2 KiB
Diff
# UNDF: UNDF-2026-000000934
|
|
--- a/core/src/trezor/wire/thp/crypto.py
|
|
+++ b/core/src/trezor/wire/thp/crypto.py
|
|
@@ -28,7 +28,7 @@ def enc(buffer: AnyBuffer, key: bytes, nonce: int, auth_data: bytes = b"") -> by
|
|
Returns a 16-byte long encryption tag.
|
|
"""
|
|
if __debug__ and _TRACE:
|
|
- log.debug(__name__, "enc (key: %s, nonce: %d)", hexlify_if_bytes(key), nonce)
|
|
+ log.debug(__name__, "enc (key: <redacted>, nonce: %d)", nonce)
|
|
iv = _get_iv_from_nonce(nonce)
|
|
aes_ctx = aesgcm(key, iv)
|
|
aes_ctx.auth(auth_data)
|
|
@@ -49,7 +49,7 @@ def dec(
|
|
"""
|
|
iv = _get_iv_from_nonce(nonce)
|
|
if __debug__ and _TRACE:
|
|
- log.debug(__name__, "dec (key: %s, nonce: %d)", hexlify_if_bytes(key), nonce)
|
|
+ log.debug(__name__, "dec (key: <redacted>, nonce: %d)", nonce)
|
|
aes_ctx = aesgcm(key, iv)
|
|
aes_ctx.auth(auth_data)
|
|
aes_ctx.decrypt_in_place(buffer)
|
|
@@ -122,13 +122,7 @@ class Handshake:
|
|
trezor_masked_static_public_key = curve25519.multiply(
|
|
mask, trezor_static_public_key
|
|
)
|
|
- aes_ctx = aesgcm(self.k, IV_1)
|
|
- encrypted_trezor_static_public_key = aes_ctx.encrypt(
|
|
- trezor_masked_static_public_key
|
|
- )
|
|
- if __debug__:
|
|
- log.debug(
|
|
- __name__,
|
|
- "th1 - enc (key: %s, nonce: %d, handshake_hash %s)",
|
|
- hexlify_if_bytes(self.k),
|
|
- 0,
|
|
- hexlify_if_bytes(self.h),
|
|
- )
|
|
+ aes_ctx_th1 = aesgcm(self.k, IV_1)
|
|
+ encrypted_trezor_static_public_key = aes_ctx_th1.encrypt(
|
|
+ trezor_masked_static_public_key
|
|
+ )
|
|
|
|
- aes_ctx.auth(self.h)
|
|
- tag_to_encrypted_key = aes_ctx.finish()
|
|
+ aes_ctx_th1.auth(self.h)
|
|
+ tag_to_encrypted_key = aes_ctx_th1.finish()
|
|
encrypted_trezor_static_public_key = (
|
|
encrypted_trezor_static_public_key + tag_to_encrypted_key
|
|
@@ -165,9 +159,6 @@ class Handshake:
|
|
|
|
aes_ctx = aesgcm(self.k, IV_2)
|
|
|
|
- if __debug__:
|
|
- log.debug(
|
|
- __name__, "th2 - dec (key: %s, nonce: %d)", hexlify_if_bytes(self.k), 1
|
|
- )
|
|
# The new value of hash `h` MUST be computed before the `encrypted_host_static_public_key` is decrypted.
|
|
# However, decryption of `encrypted_host_static_public_key` MUST use the previous value of `h` for
|
|
# authentication of the gcm tag.
|
|
@@ -188,17 +179,8 @@ class Handshake:
|
|
aes_ctx = aesgcm(self.k, IV_1)
|
|
aes_ctx.auth(self.h)
|
|
self.h = _hash_of_two(self.h, memoryview(encrypted_payload))
|
|
aes_ctx.decrypt_in_place(memoryview(encrypted_payload)[:-16])
|
|
- if __debug__:
|
|
- log.debug(
|
|
- __name__, "th2 - dec (key: %s, nonce: %d)", hexlify_if_bytes(self.k), 0
|
|
- )
|
|
tag = aes_ctx.finish()
|
|
if tag != encrypted_payload[-16:]:
|
|
raise ThpDecryptionError()
|
|
|
|
self.key_receive, self.key_send = _hkdf(self.ck, b"")
|
|
- if __debug__:
|
|
- log.debug(
|
|
- __name__,
|
|
- "(key_receive: %s, key_send: %s)",
|
|
- hexlify_if_bytes(self.key_receive),
|
|
- hexlify_if_bytes(self.key_send),
|
|
- )
|