refactor(core): split rng module into sys/rng and sec/rng_strong

diff --git a/core/embed/io/nrf/stm32u5/nrf.c b/core/embed/io/nrf/stm32u5/nrf.c
index 05a5fb6e..dfcd32e6 100644
--- a/core/embed/io/nrf/stm32u5/nrf.c
+++ b/core/embed/io/nrf/stm32u5/nrf.c
@@ -23,10 +23,10 @@
 #include <trezor_rtl.h>
 
 #include <io/nrf.h>
-#include <sec/rng.h>
 #include <sec/secret_keys.h>
 #include <sys/irq.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <sys/systick.h>
 #include <sys/systimer.h>
 #include <util/tsqueue.h>
diff --git a/core/embed/projects/boardloader/main.c b/core/embed/projects/boardloader/main.c
index b453c427..8d03d2aa 100644
--- a/core/embed/projects/boardloader/main.c
+++ b/core/embed/projects/boardloader/main.c
@@ -21,10 +21,10 @@
 #include <trezor_rtl.h>
 
 #include <io/display.h>
-#include <sec/rng.h>
 #include <sec/secret.h>
 #include <sys/bootutils.h>
 #include <sys/reset_flags.h>
+#include <sys/rng.h>
 #include <sys/system.h>
 #include <sys/systick.h>
 #include <util/board_capabilities.h>
diff --git a/core/embed/projects/bootloader/wire/wire_iface_ble.c b/core/embed/projects/bootloader/wire/wire_iface_ble.c
index 74f9be28..ea9f25cb 100644
--- a/core/embed/projects/bootloader/wire/wire_iface_ble.c
+++ b/core/embed/projects/bootloader/wire/wire_iface_ble.c
@@ -25,7 +25,7 @@
 
 #include <io/ble.h>
 #include <rtl/strutils.h>
-#include <sec/rng.h>
+#include <sys/rng.h>
 #include <sys/sysevent.h>
 #include <sys/systick.h>
 
diff --git a/core/embed/projects/bootloader_ci/main.c b/core/embed/projects/bootloader_ci/main.c
index dd0037e3..86621b62 100644
--- a/core/embed/projects/bootloader_ci/main.c
+++ b/core/embed/projects/bootloader_ci/main.c
@@ -27,10 +27,10 @@
 #include <io/usb.h>
 #include <io/usb_config.h>
 #include <sec/random_delays.h>
-#include <sec/rng.h>
 #include <sys/bootargs.h>
 #include <sys/bootutils.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <sys/sysevent.h>
 #include <sys/system.h>
 #include <sys/systick.h>
diff --git a/core/embed/projects/prodtest/cmd/prodtest_secrets.c b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
index 0790bc1f..02d6ee64 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_secrets.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
@@ -22,7 +22,7 @@
 #include <string.h>
 
 #include <rtl/cli.h>
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sec/secret.h>
 #include <sec/secret_keys.h>
 
diff --git a/core/embed/sec/consumption_mask/stm32f4/consumption_mask.c b/core/embed/sec/consumption_mask/stm32f4/consumption_mask.c
index 5b16b1c9..15d604d4 100644
--- a/core/embed/sec/consumption_mask/stm32f4/consumption_mask.c
+++ b/core/embed/sec/consumption_mask/stm32f4/consumption_mask.c
@@ -20,8 +20,8 @@
 #include <trezor_bsp.h>
 #include <trezor_rtl.h>
 
-#include <sec/rng.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 
 #ifdef KERNEL_MODE
 
diff --git a/core/embed/sec/consumption_mask/stm32u5/consumption_mask.c b/core/embed/sec/consumption_mask/stm32u5/consumption_mask.c
index 380dd79c..7a380472 100644
--- a/core/embed/sec/consumption_mask/stm32u5/consumption_mask.c
+++ b/core/embed/sec/consumption_mask/stm32u5/consumption_mask.c
@@ -19,7 +19,7 @@
 
 #include <trezor_bsp.h>
 
-#include <sec/rng.h>
+#include <sys/rng.h>
 
 #ifdef KERNEL_MODE
 
diff --git a/core/embed/sec/optiga/optiga.c b/core/embed/sec/optiga/optiga.c
index 7e0260c7..67ed7db7 100644
--- a/core/embed/sec/optiga/optiga.c
+++ b/core/embed/sec/optiga/optiga.c
@@ -25,7 +25,7 @@
 #include <sec/optiga.h>
 #include <sec/optiga_commands.h>
 #include <sec/optiga_transport.h>
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sec/secret_keys.h>
 #include <sec/storage.h>
 #include "ecdsa.h"
diff --git a/core/embed/sec/optiga/unix/optiga.c b/core/embed/sec/optiga/unix/optiga.c
index 0eff6c49..2fdc42a3 100644
--- a/core/embed/sec/optiga/unix/optiga.c
+++ b/core/embed/sec/optiga/unix/optiga.c
@@ -21,8 +21,8 @@
 
 #include <sec/optiga.h>
 #include <sec/optiga_common.h>
-#include <sec/rng.h>
 #include <sec/storage.h>
+#include <sys/rng.h>
 
 #include "ecdsa.h"
 #include "nist256p1.h"
diff --git a/core/embed/sec/random_delays/stm32/random_delays.c b/core/embed/sec/random_delays/stm32/random_delays.c
index caa4fcc7..30ea9484 100644
--- a/core/embed/sec/random_delays/stm32/random_delays.c
+++ b/core/embed/sec/random_delays/stm32/random_delays.c
@@ -22,7 +22,7 @@
 #include <stdatomic.h>
 
 #include <sec/random_delays.h>
-#include <sec/rng.h>
+#include <sys/rng.h>
 #include <sys/systimer.h>
 
 #include "chacha_drbg.h"
diff --git a/core/embed/sec/rng/inc/sec/rng.h b/core/embed/sec/rng/inc/sec/rng.h
deleted file mode 100644
index 72b1dfe2..00000000
--- a/core/embed/sec/rng/inc/sec/rng.h
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#pragma once
-
-#include <trezor_types.h>
-
-#ifdef SECURE_MODE
-
-/**
- * @brief Initializes the hardware random number generator.
- *
- */
-void rng_init(void);
-
-#endif
-
-/**
- * @brief Fills a buffer with random bytes using the hardware RNG
- *
- * This function uses only single source of entropy - the hardware RNG
- * available on the microcontroller. It is fast but less suitable for
- * generating critical secrets.
- *
- * @param buffer Buffer to fill with random bytes.
- * @param buffer_size Size of the buffer in bytes.
- */
-void rng_fill_buffer(void* buffer, size_t buffer_size);
-
-/**
- * @brief Gets 32 bits of random data using from the hardware RNG.
- *
- * @return uint32_t Random data.
- */
-static inline uint32_t rng_get(void) {
-  uint32_t r = 0;
-  rng_fill_buffer((uint8_t*)&r, sizeof(r));
-  return r;
-}
-
-/**
- * @brief Fills a buffer with random bytes using the hardware RNG and
- * combines it with other entropy sources (e.g., Optiga, Tropic) if
- * available.
- *
- * This function is suitable for generating critical secrets since it
- * combines multiple sources of entropy, but it is slower than
- * `rng_fill_buffer()` since it may use external chips on I2C/SPI.
- *
- * The function requires that Optiga and/or Tropic to be initialized
- * if they are enabled by USE_OPTIGA/USE_TROPIC.
- *
- * @param buffer Buffer to fill with random bytes.
- * @param buffer_size Size of the buffer in bytes.
- *
- * @return True on success, false on failure.
- */
-bool __wur rng_fill_buffer_strong(void* buffer, size_t buffer_size);
-
-void rng_fill_buffer_strong_time(uint32_t* time_ms);
diff --git a/core/embed/sec/rng/inc/sec/rng_strong.h b/core/embed/sec/rng/inc/sec/rng_strong.h
new file mode 100644
index 00000000..49ad7676
--- /dev/null
+++ b/core/embed/sec/rng/inc/sec/rng_strong.h
@@ -0,0 +1,45 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <trezor_types.h>
+
+#include <sys/rng.h>
+
+/**
+ * @brief Fills a buffer with random bytes using the hardware RNG and
+ * combines it with other entropy sources (e.g., Optiga, Tropic) if
+ * available.
+ *
+ * This function is suitable for generating critical secrets since it
+ * combines multiple sources of entropy, but it is slower than
+ * `rng_fill_buffer()` since it may use external chips on I2C/SPI.
+ *
+ * The function requires that Optiga and/or Tropic to be initialized
+ * if they are enabled by USE_OPTIGA/USE_TROPIC.
+ *
+ * @param buffer Buffer to fill with random bytes.
+ * @param buffer_size Size of the buffer in bytes.
+ *
+ * @return True on success, false on failure.
+ */
+bool __wur rng_fill_buffer_strong(void* buffer, size_t buffer_size);
+
+void rng_fill_buffer_strong_time(uint32_t* time_ms);
diff --git a/core/embed/sec/rng/rng_common.c b/core/embed/sec/rng/rng_common.c
deleted file mode 100644
index 66188d52..00000000
--- a/core/embed/sec/rng/rng_common.c
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <trezor_rtl.h>
-
-#include <sec/rng.h>
-
-#ifdef SECURE_MODE
-
-#ifdef USE_OPTIGA
-#include <sec/optiga.h>
-#endif
-
-#ifdef USE_TROPIC
-#include <sec/tropic.h>
-#endif
-
-#include "memzero.h"
-#include "rand.h"
-
-bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
-  rng_fill_buffer(buffer, buffer_size);
-
-  uint8_t* dst = (uint8_t*)buffer;
-  size_t remaining = buffer_size;
-
-  uint8_t block[32] = {0};
-
-  while (remaining > 0) {
-    size_t block_size = MIN(remaining, sizeof(block));
-#ifdef USE_OPTIGA
-    if (!optiga_random_buffer(block, block_size)) {
-      return false;
-    }
-
-    for (size_t i = 0; i < block_size; i++) {
-      dst[i] ^= block[i];
-    }
-#endif
-#ifdef USE_TROPIC
-    if (!tropic_random_buffer(block, block_size)) {
-      return false;
-    }
-
-    for (size_t i = 0; i < block_size; i++) {
-      dst[i] ^= block[i];
-    }
-#endif
-    dst += block_size;
-    remaining -= block_size;
-  }
-
-  memzero(block, sizeof(block));
-  return true;
-}
-
-void rng_fill_buffer_strong_time(uint32_t* time_ms) {
-  // Assuming the buffer size is 32 bytes
-#ifdef USE_OPTIGA
-  optiga_random_buffer_time(time_ms);
-#endif
-#ifdef USE_TROPIC
-  tropic_random_buffer_time(time_ms);
-#endif
-}
-
-#endif  // SECURE_MODE
diff --git a/core/embed/sec/rng/rng_strong.c b/core/embed/sec/rng/rng_strong.c
new file mode 100644
index 00000000..af036613
--- /dev/null
+++ b/core/embed/sec/rng/rng_strong.c
@@ -0,0 +1,83 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <trezor_rtl.h>
+
+#include <sec/rng_strong.h>
+
+#ifdef SECURE_MODE
+
+#ifdef USE_OPTIGA
+#include <sec/optiga.h>
+#endif
+
+#ifdef USE_TROPIC
+#include <sec/tropic.h>
+#endif
+
+#include "memzero.h"
+#include "rand.h"
+
+bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
+  rng_fill_buffer(buffer, buffer_size);
+
+  uint8_t* dst = (uint8_t*)buffer;
+  size_t remaining = buffer_size;
+
+  uint8_t block[32] = {0};
+
+  while (remaining > 0) {
+    size_t block_size = MIN(remaining, sizeof(block));
+#ifdef USE_OPTIGA
+    if (!optiga_random_buffer(block, block_size)) {
+      return false;
+    }
+
+    for (size_t i = 0; i < block_size; i++) {
+      dst[i] ^= block[i];
+    }
+#endif
+#ifdef USE_TROPIC
+    if (!tropic_random_buffer(block, block_size)) {
+      return false;
+    }
+
+    for (size_t i = 0; i < block_size; i++) {
+      dst[i] ^= block[i];
+    }
+#endif
+    dst += block_size;
+    remaining -= block_size;
+  }
+
+  memzero(block, sizeof(block));
+  return true;
+}
+
+void rng_fill_buffer_strong_time(uint32_t* time_ms) {
+  // Assuming the buffer size is 32 bytes
+#ifdef USE_OPTIGA
+  optiga_random_buffer_time(time_ms);
+#endif
+#ifdef USE_TROPIC
+  tropic_random_buffer_time(time_ms);
+#endif
+}
+
+#endif  // SECURE_MODE
diff --git a/core/embed/sec/rng/stm32/rng.c b/core/embed/sec/rng/stm32/rng.c
deleted file mode 100644
index ce217566..00000000
--- a/core/embed/sec/rng/stm32/rng.c
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#pragma GCC optimize( \
-    "no-stack-protector")  // applies to all functions in this file
-
-#include <trezor_bsp.h>
-#include <trezor_rtl.h>
-
-#include <sec/rng.h>
-
-#include "rand.h"
-
-#ifdef SECURE_MODE
-
-void rng_init(void) {
-  // enable TRNG peripheral clock
-  // use the HAL version due to section 2.1.6 of STM32F42xx Errata sheet
-  // "Delay after an RCC peripheral clock enabling"
-  __HAL_RCC_RNG_CLK_ENABLE();
-  RNG->CR = RNG_CR_RNGEN;  // enable TRNG
-}
-
-static uint32_t rng_read_u32(const uint32_t previous,
-                             const uint32_t compare_previous) {
-  uint32_t temp = previous;
-  do {
-    while ((RNG->SR & (RNG_SR_SECS | RNG_SR_CECS | RNG_SR_DRDY)) != RNG_SR_DRDY)
-      ;              // wait until TRNG is ready
-    temp = RNG->DR;  // read the data from the TRNG
-  } while (compare_previous &&
-           (temp == previous));  // RM0090 section 24.3.1 FIPS continuous random
-                                 // number generator test
-  return temp;
-}
-
-static uint32_t rng_get_u32(void) {
-  // reason for keeping history: RM0090 section 24.3.1 FIPS continuous random
-  // number generator test
-  static uint32_t previous = 0, current = 0;
-  if (previous == current) {
-    previous = rng_read_u32(previous, 0);
-  } else {
-    previous = current;
-  }
-  current = rng_read_u32(previous, 1);
-  return current;
-}
-
-void rng_fill_buffer(void* buffer, size_t buffer_size) {
-  uint32_t* dst = (uint32_t*)buffer;
-  size_t remaining = buffer_size;
-
-  while (remaining >= sizeof(uint32_t)) {
-    *dst++ = rng_get_u32();
-    remaining -= sizeof(uint32_t);
-  }
-
-  if (remaining > 0) {
-    uint32_t r = rng_get_u32();
-    memcpy(dst, &r, remaining);
-  }
-}
-
-#endif  // SECURE_MODE
-
-// Implements random_buffer() function declared in crypto/rand.h
-// as a wrapper for rng_fill_buffer().
-void random_buffer(uint8_t* buf, size_t len) { rng_fill_buffer(buf, len); }
diff --git a/core/embed/sec/rng/unix/rng.c b/core/embed/sec/rng/unix/rng.c
deleted file mode 100644
index 18f9594f..00000000
--- a/core/embed/sec/rng/unix/rng.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <trezor_rtl.h>
-
-#include <sec/rng.h>
-
-#include "rand.h"
-
-void rng_fill_buffer(void* buffer, size_t buffer_size) {
-#ifdef USE_INSECURE_PRNG
-
-  // Use PRNG implemented in crypto/rand_insecure.c
-  random_buffer((uint8_t*)buffer, buffer_size);
-
-#else
-
-  static FILE* frand = NULL;
-  if (!frand) {
-    frand = fopen("/dev/urandom", "r");
-  }
-  ensure(sectrue * (frand != NULL), "fopen failed");
-  ensure(sectrue * (buffer_size == fread(buffer, 1, buffer_size, frand)),
-         "fread failed");
-
-#endif
-}
diff --git a/core/embed/sec/secret/stm32f4/secret_keys.c b/core/embed/sec/secret/stm32f4/secret_keys.c
index 72c65e9c..4ea4e5bc 100644
--- a/core/embed/sec/secret/stm32f4/secret_keys.c
+++ b/core/embed/sec/secret/stm32f4/secret_keys.c
@@ -27,7 +27,7 @@
 #include <sec/secret_keys.h>
 #include "../secret_keys_common.h"
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sys/mpu.h>
 #include <util/flash_otp.h>
 #include "memzero.h"
diff --git a/core/embed/sec/secret/stm32u5/secret.c b/core/embed/sec/secret/stm32u5/secret.c
index 0bd94cb8..6f52d873 100644
--- a/core/embed/sec/secret/stm32u5/secret.c
+++ b/core/embed/sec/secret/stm32u5/secret.c
@@ -21,11 +21,11 @@
 #include <trezor_model.h>
 #include <trezor_rtl.h>
 
-#include <sec/rng.h>
 #include <sec/secret.h>
 #include <sec/secure_aes.h>
 #include <sys/bootutils.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <util/flash.h>
 #include <util/flash_utils.h>
 #include <util/rsod_special.h>
diff --git a/core/embed/sec/secret/stm32u5/secret_keys.c b/core/embed/sec/secret/stm32u5/secret_keys.c
index 9b4340b4..9e0d46cb 100644
--- a/core/embed/sec/secret/stm32u5/secret_keys.c
+++ b/core/embed/sec/secret/stm32u5/secret_keys.c
@@ -157,7 +157,7 @@ secbool secret_key_storage_salt(uint16_t fw_type,
 }
 
 #else  // SECRET_PRIVILEGED_MASTER_KEY_SLOT
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sys/mpu.h>
 #include <util/flash_otp.h>
 
diff --git a/core/embed/sec/storage/stm32f4/storage_salt.c b/core/embed/sec/storage/stm32f4/storage_salt.c
index d3f89c91..3ade5bb9 100644
--- a/core/embed/sec/storage/stm32f4/storage_salt.c
+++ b/core/embed/sec/storage/stm32f4/storage_salt.c
@@ -22,8 +22,8 @@
 #include <trezor_model.h>
 #include <trezor_rtl.h>
 
-#include <sec/rng.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <util/flash_otp.h>
 
 #include "stm32f4xx_ll_utils.h"
diff --git a/core/embed/sec/storage/stm32u5/storage_salt.c b/core/embed/sec/storage/stm32u5/storage_salt.c
index b2e258b3..b19219f8 100644
--- a/core/embed/sec/storage/stm32u5/storage_salt.c
+++ b/core/embed/sec/storage/stm32u5/storage_salt.c
@@ -22,9 +22,9 @@
 #include <trezor_model.h>
 #include <trezor_rtl.h>
 
-#include <sec/rng.h>
 #include <sec/secret_keys.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <util/flash_otp.h>
 #include <util/image.h>
 
diff --git a/core/embed/sec/tropic/stm32/tropic01.c b/core/embed/sec/tropic/stm32/tropic01.c
index 0e390770..754de3ce 100644
--- a/core/embed/sec/tropic/stm32/tropic01.c
+++ b/core/embed/sec/tropic/stm32/tropic01.c
@@ -24,7 +24,7 @@
 #include <libtropic.h>
 
 #include <memzero.h>
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sec/tropic.h>
 #include <sys/systick.h>
 
diff --git a/core/embed/sec/tropic/tropic.c b/core/embed/sec/tropic/tropic.c
index 78e62660..eb67b98e 100644
--- a/core/embed/sec/tropic/tropic.c
+++ b/core/embed/sec/tropic/tropic.c
@@ -20,7 +20,7 @@
 #include <trezor_rtl.h>
 #include <trezor_types.h>
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sec/secret_keys.h>
 #include <sec/tropic.h>
 #include <sys/systick.h>
diff --git a/core/embed/sys/rng/inc/sys/rng.h b/core/embed/sys/rng/inc/sys/rng.h
new file mode 100644
index 00000000..f972b407
--- /dev/null
+++ b/core/embed/sys/rng/inc/sys/rng.h
@@ -0,0 +1,55 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <trezor_types.h>
+
+#ifdef SECURE_MODE
+
+/**
+ * @brief Initializes the hardware random number generator.
+ *
+ */
+void rng_init(void);
+
+#endif
+
+/**
+ * @brief Fills a buffer with random bytes using the hardware RNG
+ *
+ * This function uses only single source of entropy - the hardware RNG
+ * available on the microcontroller. It is fast but less suitable for
+ * generating critical secrets.
+ *
+ * @param buffer Buffer to fill with random bytes.
+ * @param buffer_size Size of the buffer in bytes.
+ */
+void rng_fill_buffer(void* buffer, size_t buffer_size);
+
+/**
+ * @brief Gets 32 bits of random data using from the hardware RNG.
+ *
+ * @return uint32_t Random data.
+ */
+static inline uint32_t rng_get(void) {
+  uint32_t r = 0;
+  rng_fill_buffer((uint8_t*)&r, sizeof(r));
+  return r;
+}
diff --git a/core/embed/sys/rng/stm32/rng.c b/core/embed/sys/rng/stm32/rng.c
new file mode 100644
index 00000000..9cb305da
--- /dev/null
+++ b/core/embed/sys/rng/stm32/rng.c
@@ -0,0 +1,85 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma GCC optimize( \
+    "no-stack-protector")  // applies to all functions in this file
+
+#include <trezor_bsp.h>
+#include <trezor_rtl.h>
+
+#include <sys/rng.h>
+
+#include "rand.h"
+
+#ifdef SECURE_MODE
+
+void rng_init(void) {
+  // enable TRNG peripheral clock
+  // use the HAL version due to section 2.1.6 of STM32F42xx Errata sheet
+  // "Delay after an RCC peripheral clock enabling"
+  __HAL_RCC_RNG_CLK_ENABLE();
+  RNG->CR = RNG_CR_RNGEN;  // enable TRNG
+}
+
+static uint32_t rng_read_u32(const uint32_t previous,
+                             const uint32_t compare_previous) {
+  uint32_t temp = previous;
+  do {
+    while ((RNG->SR & (RNG_SR_SECS | RNG_SR_CECS | RNG_SR_DRDY)) != RNG_SR_DRDY)
+      ;              // wait until TRNG is ready
+    temp = RNG->DR;  // read the data from the TRNG
+  } while (compare_previous &&
+           (temp == previous));  // RM0090 section 24.3.1 FIPS continuous random
+                                 // number generator test
+  return temp;
+}
+
+static uint32_t rng_get_u32(void) {
+  // reason for keeping history: RM0090 section 24.3.1 FIPS continuous random
+  // number generator test
+  static uint32_t previous = 0, current = 0;
+  if (previous == current) {
+    previous = rng_read_u32(previous, 0);
+  } else {
+    previous = current;
+  }
+  current = rng_read_u32(previous, 1);
+  return current;
+}
+
+void rng_fill_buffer(void* buffer, size_t buffer_size) {
+  uint32_t* dst = (uint32_t*)buffer;
+  size_t remaining = buffer_size;
+
+  while (remaining >= sizeof(uint32_t)) {
+    *dst++ = rng_get_u32();
+    remaining -= sizeof(uint32_t);
+  }
+
+  if (remaining > 0) {
+    uint32_t r = rng_get_u32();
+    memcpy(dst, &r, remaining);
+  }
+}
+
+#endif  // SECURE_MODE
+
+// Implements random_buffer() function declared in crypto/rand.h
+// as a wrapper for rng_fill_buffer().
+void random_buffer(uint8_t* buf, size_t len) { rng_fill_buffer(buf, len); }
diff --git a/core/embed/sys/rng/unix/rng.c b/core/embed/sys/rng/unix/rng.c
new file mode 100644
index 00000000..071eece2
--- /dev/null
+++ b/core/embed/sys/rng/unix/rng.c
@@ -0,0 +1,43 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <trezor_rtl.h>
+
+#include <sys/rng.h>
+
+#include "rand.h"
+
+void rng_fill_buffer(void* buffer, size_t buffer_size) {
+#ifdef USE_INSECURE_PRNG
+
+  // Use PRNG implemented in crypto/rand_insecure.c
+  random_buffer((uint8_t*)buffer, buffer_size);
+
+#else
+
+  static FILE* frand = NULL;
+  if (!frand) {
+    frand = fopen("/dev/urandom", "r");
+  }
+  ensure(sectrue * (frand != NULL), "fopen failed");
+  ensure(sectrue * (buffer_size == fread(buffer, 1, buffer_size, frand)),
+         "fread failed");
+
+#endif
+}
diff --git a/core/embed/sys/smcall/stm32/smcall_dispatch.c b/core/embed/sys/smcall/stm32/smcall_dispatch.c
index bfcb9b4c..44794627 100644
--- a/core/embed/sys/smcall/stm32/smcall_dispatch.c
+++ b/core/embed/sys/smcall/stm32/smcall_dispatch.c
@@ -22,7 +22,7 @@
 #include <trezor_rtl.h>
 
 #include <sec/random_delays.h>
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sec/secret.h>
 #include <sec/secret_keys.h>
 #include <sys/bootargs.h>
diff --git a/core/embed/sys/smcall/stm32/smcall_stubs.c b/core/embed/sys/smcall/stm32/smcall_stubs.c
index cf227b8e..e95b9ac4 100644
--- a/core/embed/sys/smcall/stm32/smcall_stubs.c
+++ b/core/embed/sys/smcall/stm32/smcall_stubs.c
@@ -313,7 +313,7 @@ secbool storage_next_counter(const uint16_t key, uint32_t *count) {
 // rng.h
 // =============================================================================
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 
 void rng_fill_buffer(void *buffer, size_t buffer_size) {
   smcall_invoke2((uint32_t)buffer, buffer_size, SMCALL_RNG_FILL_BUFFER);
diff --git a/core/embed/sys/smcall/stm32/smcall_verifiers.c b/core/embed/sys/smcall/stm32/smcall_verifiers.c
index a6563ff1..ea5cf062 100644
--- a/core/embed/sys/smcall/stm32/smcall_verifiers.c
+++ b/core/embed/sys/smcall/stm32/smcall_verifiers.c
@@ -388,7 +388,7 @@ access_violation:
 
 // ---------------------------------------------------------------------
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 
 void rng_fill_buffer__verified(void *buffer, size_t buffer_size) {
   if (!probe_write_access(buffer, buffer_size)) {
diff --git a/core/embed/sys/smcall/stm32/smcall_verifiers.h b/core/embed/sys/smcall/stm32/smcall_verifiers.h
index beedbfe8..489937ce 100644
--- a/core/embed/sys/smcall/stm32/smcall_verifiers.h
+++ b/core/embed/sys/smcall/stm32/smcall_verifiers.h
@@ -108,7 +108,7 @@ secbool storage_set__verified(const uint16_t key, const void *val,
 secbool storage_next_counter__verified(const uint16_t key, uint32_t *count);
 
 // ---------------------------------------------------------------------
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 
 void rng_fill_buffer__verified(void *buffer, size_t buffer_size);
 
diff --git a/core/embed/sys/startup/stm32f4/startup_init.c b/core/embed/sys/startup/stm32f4/startup_init.c
index 1ebaba10..a2ee67af 100644
--- a/core/embed/sys/startup/stm32f4/startup_init.c
+++ b/core/embed/sys/startup/stm32f4/startup_init.c
@@ -20,10 +20,10 @@
 #include <trezor_bsp.h>
 #include <trezor_rtl.h>
 
-#include <sec/rng.h>
 #include <sys/bootargs.h>
 #include <sys/bootutils.h>
 #include <sys/linker_utils.h>
+#include <sys/rng.h>
 #include <sys/stack_utils.h>
 #include <sys/system.h>
 #include <sys/systick.h>
diff --git a/core/embed/sys/startup/stm32u5/startup_init.c b/core/embed/sys/startup/stm32u5/startup_init.c
index 6f1030ba..c4eb193b 100644
--- a/core/embed/sys/startup/stm32u5/startup_init.c
+++ b/core/embed/sys/startup/stm32u5/startup_init.c
@@ -20,9 +20,9 @@
 #include <trezor_bsp.h>
 #include <trezor_rtl.h>
 
-#include <sec/rng.h>
 #include <sys/bootargs.h>
 #include <sys/linker_utils.h>
+#include <sys/rng.h>
 #include <sys/stack_utils.h>
 #include <sys/system.h>
 
diff --git a/core/embed/sys/syscall/stm32/syscall_dispatch.c b/core/embed/sys/syscall/stm32/syscall_dispatch.c
index 94356561..7e7bc222 100644
--- a/core/embed/sys/syscall/stm32/syscall_dispatch.c
+++ b/core/embed/sys/syscall/stm32/syscall_dispatch.c
@@ -26,7 +26,7 @@
 #include <gfx/dma2d_bitblt.h>
 #include <io/display.h>
 #include <io/usb.h>
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sec/secret.h>
 #include <sec/secret_keys.h>
 #include <sys/bootutils.h>
diff --git a/core/embed/sys/syscall/stm32/syscall_stubs.c b/core/embed/sys/syscall/stm32/syscall_stubs.c
index 37362a66..ea0ffc33 100644
--- a/core/embed/sys/syscall/stm32/syscall_stubs.c
+++ b/core/embed/sys/syscall/stm32/syscall_stubs.c
@@ -586,7 +586,7 @@ uint32_t translations_area_bytesize(void) {
 // rng.h
 // =============================================================================
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 
 void rng_fill_buffer(void *buffer, size_t buffer_size) {
   syscall_invoke2((uint32_t)buffer, buffer_size, SYSCALL_RNG_FILL_BUFFER);
diff --git a/core/embed/sys/syscall/stm32/syscall_verifiers.h b/core/embed/sys/syscall/stm32/syscall_verifiers.h
index ca51346d..6282d39a 100644
--- a/core/embed/sys/syscall/stm32/syscall_verifiers.h
+++ b/core/embed/sys/syscall/stm32/syscall_verifiers.h
@@ -179,7 +179,7 @@ secbool storage_set__verified(const uint16_t key, const void *val,
 secbool storage_next_counter__verified(const uint16_t key, uint32_t *count);
 
 // ---------------------------------------------------------------------
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 
 void rng_fill_buffer__verified(void *buffer, size_t buffer_size);
 
diff --git a/core/embed/sys/task/stm32/applet.c b/core/embed/sys/task/stm32/applet.c
index 3d00cdf0..ab267c92 100644
--- a/core/embed/sys/task/stm32/applet.c
+++ b/core/embed/sys/task/stm32/applet.c
@@ -21,9 +21,9 @@
 #include <trezor_rtl.h>
 
 #include <io/display.h>
-#include <sec/rng.h>
 #include <sys/applet.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <sys/systask.h>
 
 #ifdef USE_TRUSTZONE
diff --git a/core/embed/sys/task/stm32/coreapp.c b/core/embed/sys/task/stm32/coreapp.c
index 764331bd..48abf142 100644
--- a/core/embed/sys/task/stm32/coreapp.c
+++ b/core/embed/sys/task/stm32/coreapp.c
@@ -23,10 +23,10 @@
 #include <trezor_rtl.h>
 
 #include <rtl/sizedefs.h>
-#include <sec/rng.h>
 #include <sys/applet.h>
 #include <sys/coreapp.h>
 #include <sys/mpu.h>
+#include <sys/rng.h>
 #include <sys/systask.h>
 
 static mpu_area_t coreapp_code_area;
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip340.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip340.h
index 64d00bfb..c5bf0c42 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip340.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip340.h
@@ -19,7 +19,7 @@
 
 #if USE_SECP256K1_ZKP
 
-#include <sec/rng.h>
+#include <sys/rng.h>
 
 #include "py/objstr.h"
 
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-curve25519.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-curve25519.h
index bc443cd5..04dec57a 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-curve25519.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-curve25519.h
@@ -17,7 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include <sec/rng.h>
+#include <sys/rng.h>
 
 #include "py/objstr.h"
 
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-ed25519.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-ed25519.h
index bb281171..1c8df495 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-ed25519.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-ed25519.h
@@ -17,7 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include <sec/rng.h>
+#include <sys/rng.h>
 
 #include "py/objstr.h"
 
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-nist256p1.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-nist256p1.h
index b04afd8d..5f214ad0 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-nist256p1.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-nist256p1.h
@@ -17,7 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include <sec/rng.h>
+#include <sys/rng.h>
 
 #include "py/objstr.h"
 
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-random.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-random.h
index 4f3d1e6e..128abc46 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-random.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-random.h
@@ -21,7 +21,7 @@
 
 #include "embed/upymod/trezorobj.h"
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include "rand.h"
 
 /// package: trezorcrypto.random
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-secp256k1.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-secp256k1.h
index 2273f337..4deaa9d5 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-secp256k1.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-secp256k1.h
@@ -17,7 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include <sec/rng.h>
+#include <sys/rng.h>
 
 #include "py/objstr.h"
 
diff --git a/core/site_scons/models/stm32f4_common.py b/core/site_scons/models/stm32f4_common.py
index 3e7b8d77..9c081614 100644
--- a/core/site_scons/models/stm32f4_common.py
+++ b/core/site_scons/models/stm32f4_common.py
@@ -23,6 +23,7 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/mpu/inc",
         "embed/sys/notify/inc",
         "embed/sys/pvd/inc",
+        "embed/sys/rng/inc",
         "embed/sec/secret/inc",
         "embed/sys/stack/inc",
         "embed/sys/startup/inc",
@@ -67,8 +68,7 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
     sources += [
         "embed/sec/monoctr/stm32f4/monoctr.c",
         "embed/sec/random_delays/stm32/random_delays.c",
-        "embed/sec/rng/stm32/rng.c",
-        "embed/sec/rng/rng_common.c",
+        "embed/sec/rng/rng_strong.c",
         "embed/sec/secret/stm32f4/secret.c",
         "embed/sec/secret/stm32f4/secret_keys.c",
         "embed/sec/secret/secret_keys_common.c",
@@ -79,6 +79,7 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/mpu/stm32f4/mpu.c",
         "embed/sys/notify/notify.c",
         "embed/sys/pvd/stm32/pvd.c",
+        "embed/sys/rng/stm32/rng.c",
         "embed/sys/stack/stm32/stack_utils.c",
         "embed/sys/startup/stm32/bootutils.c",
         "embed/sys/startup/stm32/sysutils.c",
diff --git a/core/site_scons/models/stm32u5_common.py b/core/site_scons/models/stm32u5_common.py
index 7252879d..7dc3560b 100644
--- a/core/site_scons/models/stm32u5_common.py
+++ b/core/site_scons/models/stm32u5_common.py
@@ -26,6 +26,7 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/mpu/inc",
         "embed/sys/notify/inc",
         "embed/sys/pvd/inc",
+        "embed/sys/rng/inc",
         "embed/sys/stack/inc",
         "embed/sys/startup/inc",
         "embed/sys/syscall/inc",
@@ -90,8 +91,7 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/sec/hash_processor/stm32u5/hash_processor.c",
         "embed/sec/monoctr/stm32u5/monoctr.c",
         "embed/sec/random_delays/stm32/random_delays.c",
-        "embed/sec/rng/stm32/rng.c",
-        "embed/sec/rng/rng_common.c",
+        "embed/sec/rng/rng_strong.c",
         "embed/sec/secret/stm32u5/secret.c",
         "embed/sec/secret/stm32u5/secret_keys.c",
         "embed/sec/secret/secret_keys_common.c",
@@ -105,6 +105,7 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/mpu/stm32u5/mpu.c",
         "embed/sys/notify/notify.c",
         "embed/sys/pvd/stm32/pvd.c",
+        "embed/sys/rng/stm32/rng.c",
         "embed/sys/smcall/stm32/smcall_dispatch.c",
         "embed/sys/smcall/stm32/smcall_probe.c",
         "embed/sys/smcall/stm32/smcall_stubs.c",
diff --git a/core/site_scons/models/unix_common.py b/core/site_scons/models/unix_common.py
index 75fc5278..f0eecbfd 100644
--- a/core/site_scons/models/unix_common.py
+++ b/core/site_scons/models/unix_common.py
@@ -21,6 +21,7 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/irq/inc",
         "embed/sys/mpu/inc",
         "embed/sys/notify/inc",
+        "embed/sys/rng/inc",
         "embed/sys/startup/inc",
         "embed/sys/task/inc",
         "embed/sys/time/inc",
@@ -40,11 +41,11 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
         "embed/sec/secret/secret_keys_common.c",
         "embed/sec/storage/unix/storage_salt.c",
         "embed/sec/monoctr/unix/monoctr.c",
-        "embed/sec/rng/unix/rng.c",
-        "embed/sec/rng/rng_common.c",
+        "embed/sec/rng/rng_strong.c",
         "embed/sec/time_estimate/unix/time_estimate.c",
         "embed/sys/mpu/unix/mpu.c",
         "embed/sys/notify/notify.c",
+        "embed/sys/rng/unix/rng.c",
         "embed/sys/startup/unix/bootutils.c",
         "embed/sys/task/sysevent.c",
         "embed/sys/task/unix/sdl_event.c",
diff --git a/legacy/sec/rng.h b/legacy/sec/rng.h
deleted file mode 100644
index d92a5d72..00000000
--- a/legacy/sec/rng.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#pragma once
-
-#include <stdbool.h>
-
-#include "rand.h"
-
-// Minimal implementation of sec/rng.h from core/embed
-
-static inline bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
-  random_buffer((uint8_t*)buffer, buffer_size);
-  return true;
-}
-
-static inline void rng_fill_buffer_strong_time(uint32_t* time) {
-  (void)time;  // Suppress unused parameter warning
-}
-
-static inline bool rng_fill_buffer(void* buffer, size_t buffer_size) {
-  random_buffer((uint8_t*)buffer, buffer_size);
-  return true;
-}
diff --git a/legacy/sec/rng_strong.h b/legacy/sec/rng_strong.h
new file mode 100644
index 00000000..35095aa9
--- /dev/null
+++ b/legacy/sec/rng_strong.h
@@ -0,0 +1,40 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+
+#include "rand.h"
+
+// Minimal implementation of sec/rng_strong.h from core/embed
+
+static inline bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
+  random_buffer((uint8_t*)buffer, buffer_size);
+  return true;
+}
+
+static inline void rng_fill_buffer_strong_time(uint32_t* time) {
+  (void)time;  // Suppress unused parameter warning
+}
+
+static inline bool rng_fill_buffer(void* buffer, size_t buffer_size) {
+  random_buffer((uint8_t*)buffer, buffer_size);
+  return true;
+}
diff --git a/storage/storage.c b/storage/storage.c
index ba4f7c66..c5c07d9d 100644
--- a/storage/storage.c
+++ b/storage/storage.c
@@ -22,7 +22,7 @@
 #include <stdint.h>
 #include <string.h>
 
-#include <sec/rng.h>
+#include <sec/rng_strong.h>
 #include <sys/mpu.h>
 
 #include "chacha20poly1305/rfc7539.h"
diff --git a/storage/tests/c/sec/rng.h b/storage/tests/c/sec/rng.h
deleted file mode 100644
index bee1be65..00000000
--- a/storage/tests/c/sec/rng.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#pragma once
-
-#include <stdbool.h>
-
-#include "rand.h"
-
-// Minimal implementation of rng.h for the storage tests
-
-static inline bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
-  random_buffer((uint8_t*)buffer, buffer_size);
-  return true;
-}
-
-static inline void rng_fill_buffer_strong_time(uint32_t* time) {
-  (void)time;  // Suppress unused parameter warning
-}
-
-static inline bool rng_fill_buffer(void* buffer, size_t buffer_size) {
-  random_buffer((uint8_t*)buffer, buffer_size);
-  return true;
-}
diff --git a/storage/tests/c/sec/rng_strong.h b/storage/tests/c/sec/rng_strong.h
new file mode 100644
index 00000000..3bf55c3f
--- /dev/null
+++ b/storage/tests/c/sec/rng_strong.h
@@ -0,0 +1,40 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+
+#include "rand.h"
+
+// Minimal implementation of sec/rng_strong.h for the storage tests
+
+static inline bool rng_fill_buffer_strong(void* buffer, size_t buffer_size) {
+  random_buffer((uint8_t*)buffer, buffer_size);
+  return true;
+}
+
+static inline void rng_fill_buffer_strong_time(uint32_t* time) {
+  (void)time;  // Suppress unused parameter warning
+}
+
+static inline bool rng_fill_buffer(void* buffer, size_t buffer_size) {
+  random_buffer((uint8_t*)buffer, buffer_size);
+  return true;
+}