tari-project / tari / 37828815456

77%

Build Type

push

github

Committed by web-flow

Commit Message

fix(ledger): keep alpha out of reach of the legacy host-indexed nonce instruction (#8098)

## Summary

The Ledger app's legacy host-indexed nonce instruction
(`GetRawSchnorrSignatureLegacyNonce`) accepted `OneSidedSenderOffset`
private keys at any index, and the `GetScriptOffset` reply hands the
host the index of the sender-offset key that blinds a reply containing
`alpha`. Two legacy signatures under that key and one nonce index
therefore recovered the root spend key, with nothing shown on the
device.

This PR closes that path, and the related ways a host could difference
device replies with no prompt, without adding any state on the device.

### What changes

- **Legacy whitelist.** `check_legacy_nonce_branches` (shared crate,
checked on host and device) admits only a `PreMine` private key with a
`Random` nonce. Nothing the legacy instruction can sign is a term of a
reply that contains `alpha`.
- **Pre-mine mode in `GetScriptOffset`.** When no alpha-derived script
key was folded into the sum, the device derives the sender offsets on
the `PreMine` branch at a base index with bit 63 set and 62 random bits,
and returns the index as before. Marked indexes are refused as script
keys on both sides. Normal spends keep `OneSidedSenderOffset`.
- **Review on every legacy signature.** Purpose line ("Pre-mine script
signature" / "Pre-mine metadata signature"), key branch and index, nonce
branch and index. Every refusal (branch, nonce floor, zero challenge)
happens before the screen; every field used after the screen is an owned
copy, shown through `wire::with_screen`.
- **64-bit key indexes.** The SDK's `make_bip32_path` accumulates each
path element in a wrapping `u32`, so every index was really `index mod
2^32`. That made sender-offset bases 32-bit and let a host difference
colliding replies with no prompt. The index now spans two path elements:
`m/44'/coin'/account'/{index >> 32}/{index & 0xFFFF_FFFF}'/key_type`.
Indexes below `2^32` keep byte-identical path... (continued)

Coverage Stats

481 of 514 new or added lines in 7 files covered. (93.58%)

34 existing lines in 16 files now uncovered.

122353 of 164031 relevant lines covered (74.59%)

328590.1 hits per line