feat(python): Ensure that Trezor provides Tropic signature when expected.
What the developer wrote
Authored by Andrew Kozlik
feat(python): Ensure that Trezor provides Tropic signature when expected.
What changed, and why it matters
This commit tightens device authentication checks in Trezor's Python library. Previously, if a hardware wallet returned a Tropic signature, it was verified. Now, the library also raises an error if a Tropic signature is expected (because an Ed25519 root public key is configured) but missing. This prevents a device from skipping a required signature check and being accepted as authentic.
Review related authentication paths to ensure consistent mandatory-signature behavior across all supported root public key types and firmware variants. Consider regression tests covering missing signature scenarios.
Security signals we found
Missing-signature bypass prevented
Authentication/attestation logic change
Device authenticity check strengthened
Evidence from the diff
In python/src/trezorlib/authentication.py, authenticate_device() now checks whether an Ed25519 root public key is present (either via optiga_root.ed25519_pubkey or ed25519_root_pubkey). If such a key exists, the response must include resp.tropic_signature; otherwise DeviceNotAuthentic is raised. Previously, the code only verified the signature if it was present, potentially allowing a missing signature to pass authentication when Ed25519/Tropic verification was intended to be mandatory.
Changed components
python/src/trezorlib/authentication.pyauthenticate_device() functionTropic/Ed25519 device authentication pathInspect captured patch +8 / −1
diff --git a/python/src/trezorlib/authentication.py b/python/src/trezorlib/authentication.py
index c57e2d7e..f3f33b27 100644
--- a/python/src/trezorlib/authentication.py
+++ b/python/src/trezorlib/authentication.py
@@ -553,7 +553,14 @@ def authenticate_device(
root_pubkey=p256_root_pubkey,
)
- if resp.tropic_signature:
+ if (
+ getattr(optiga_root, "ed25519_pubkey", None) is not None
+ or ed25519_root_pubkey is not None
+ ):
+ if not resp.tropic_signature:
+ LOG.error("Missing Tropic signature.")
+ raise DeviceNotAuthentic
+
tropic_root = verify_authentication_response(
challenge,
resp.tropic_signature,
Why this scored 45/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.