Symptom
core/keystore.c's compiled-in default_dev_key claims — in a #warning and in comments — to be the RFC 8032 §7.1 TEST 1 public key. It is not: it agrees with the RFC for 21 bytes and then diverges, and the 32 bytes it holds do not decode to a point on edwards25519.
Verified by decoding y and solving for x² against the curve equation: no square root exists. So unpackneg() rejects it before any arithmetic and eos_ed25519_verify() returns EOS_ERR_SIGNATURE for every signature ever presented to a board on the compiled-in path.
Impact
Latent since v0.1.0; live since #104 made signature verification unconditional at install: firmware update refuses every image on every board that falls back to the compiled-in anchor — which, since no board under boards/ implements otp_read, is every board.
Fix
#116 corrects the bytes and adds a keystore test that verifies the RFC's own TEST 1 signature against the compiled-in anchor (fails on the old bytes).
Symptom
core/keystore.c's compiled-indefault_dev_keyclaims — in a#warningand in comments — to be the RFC 8032 §7.1 TEST 1 public key. It is not: it agrees with the RFC for 21 bytes and then diverges, and the 32 bytes it holds do not decode to a point on edwards25519.Verified by decoding y and solving for x² against the curve equation: no square root exists. So
unpackneg()rejects it before any arithmetic andeos_ed25519_verify()returnsEOS_ERR_SIGNATUREfor every signature ever presented to a board on the compiled-in path.Impact
Latent since v0.1.0; live since #104 made signature verification unconditional at install: firmware update refuses every image on every board that falls back to the compiled-in anchor — which, since no board under
boards/implementsotp_read, is every board.Fix
#116 corrects the bytes and adds a keystore test that verifies the RFC's own TEST 1 signature against the compiled-in anchor (fails on the old bytes).