Coinkite, the corporate behind Coldcard, has shipped a firmware replace that won’t generate a brand new pockets seed till the proprietor provides randomness by hand.
Which means at the very least 50 cube rolls, 128 coin flips, or 65 timed key presses, three weeks after a defect in its random quantity generator opened buyer funds to attackers.
Coldcard’s two gadget traces run separate firmware tracks, so the discharge carries two numbers, 5.6.1 for the Mk4 and Mk5, and 1.5.1Q for the Q, the bigger mannequin with a keyboard and QR scanning.
Boot Test Targets the Defect
Coinkite said that the enter is added on prime of gadget randomness from the STM32 TRNG and each safe components.
Coldcard was constructed to attract seed entropy solely from its {hardware} generator, however Coinkite traced the failure to a construct and hyperlink error that left the setting meant to disable the software program path with out impact, sending the random-number name to MicroPython’s Yasmarang PRNG, which entered the seed path in March 2021.
Affected seeds carry about 72 bits of entropy as a substitute of the anticipated 128 bits after 594.5 BTC was swept from 500 addresses on July 30.
Firmware 5.6.1 now verifies at boot that the random-number name reaches the meant {hardware} path, halting the gadget if it fails. Coinkite changed Yasmarang with a SHA-256 Hash_DRBG, laid out in NIST SP 800-90A, and seeds it at startup with a full 256-bit digest from each safe components, which earlier firmware truncated to 32 bits.
Key mashing follows Peter Todd’s push-button RNG design, hashing keypad press timing at CPU-cycle decision. The primary press units a reference, and every of the 64 gaps that comply with is credited with two bits of entropy.
Previous Seeds Nonetheless Want Migrating
“Putting in this replace doesn’t make an current susceptible seed protected,” Coinkite wrote, directing anybody whose seed might have been generated on affected firmware between 2021 and July 2026 to create a alternative and transfer their Bitcoin (BTC). Mk2 and Mk3 fall outdoors this launch, and their minimal mounted model stays at 4.2.0.
A compromised USB host may rewrite a staged transaction after the proprietor authorized it, so the signature coated completely different outputs. The gadget now rechecks these bytes earlier than signing and stops with a “Transaction modified” warning.
Coinkite’s new Safety Standing web page lists 4 unbiased opinions, amongst them a real-device take a look at that noticed eight {hardware} RNG reads for a 32-byte seed request and a rebuild matching each byte of the signed firmware.
The corporate famous that the checks are “not an entire audit of each firmware binary.” As CryptoPotato reported, confirmed losses handed $100 million, with Galaxy Analysis counting 1,596 BTC from roughly 7,300 addresses, and a suspected fourth wave sweeping almost 449 BTC on August 3.
The submit Coldcard Firmware 5.6.1 Forces Consumer Entropy Into Each New Seed After $100M Exploit appeared first on CryptoPotato.