Coinkite, the corporate behind Coldcard, has shipped a firmware replace that won’t generate a brand new pockets seed till the proprietor provides randomness by hand.
Which means a minimum of 50 cube rolls, 128 coin flips, or 65 timed key presses, three weeks after a defect in its random quantity generator opened buyer funds to attackers.
Coldcard’s two system traces run separate firmware tracks, so the discharge carries two numbers, 5.6.1 for the Mk4 and Mk5, and 1.5.1Q for the Q, the bigger mannequin with a keyboard and QR scanning.
Boot Examine Targets the Defect
Coinkite acknowledged that the enter is added on high of system randomness from the STM32 TRNG and each safe parts.
Coldcard was constructed to attract seed entropy solely from its {hardware} generator, however Coinkite traced the failure to a construct and hyperlink error that left the setting meant to disable the software program path with out impact, sending the random-number name to MicroPython’s Yasmarang PRNG, which entered the seed path in March 2021.
Affected seeds carry about 72 bits of entropy as a substitute of the anticipated 128 bits after 594.5 BTC was swept from 500 addresses on July 30.
Firmware 5.6.1 now verifies at boot that the random-number name reaches the supposed {hardware} path, halting the system if it fails. Coinkite changed Yasmarang with a SHA-256 Hash_DRBG, laid out in NIST SP 800-90A, and seeds it at startup with a full 256-bit digest from each safe parts, which earlier firmware truncated to 32 bits.
Key mashing follows Peter Todd’s push-button RNG design, hashing keypad press timing at CPU-cycle decision. The primary press units a reference, and every of the 64 gaps that observe is credited with two bits of entropy.
Outdated Seeds Nonetheless Want Migrating
“Putting in this replace doesn’t make an current weak seed protected,” Coinkite wrote, directing anybody whose seed might have been generated on affected firmware between 2021 and July 2026 to create a substitute and transfer their Bitcoin (BTC). Mk2 and Mk3 fall exterior this launch, and their minimal fastened model stays at 4.2.0.
A compromised USB host may rewrite a staged transaction after the proprietor authorised it, so the signature lined completely different outputs. The system now rechecks these bytes earlier than signing and stops with a “Transaction modified” warning.
Coinkite’s new Safety Standing web page lists 4 unbiased evaluations, amongst them a real-device take a look at that noticed eight {hardware} RNG reads for a 32-byte seed request and a rebuild matching each byte of the signed firmware.
The corporate famous that the checks are “not a whole audit of each firmware binary.” As CryptoPotato reported, confirmed losses handed $100 million, with Galaxy Analysis counting 1,596 BTC from roughly 7,300 addresses, and a suspected fourth wave sweeping almost 449 BTC on August 3.
The publish Coldcard Firmware 5.6.1 Forces Consumer Entropy Into Each New Seed After $100M Exploit appeared first on CryptoPotato.