Back to security portal

Side-channel analysis (SCA) of PIN comparison

Reported on October 31, 2018

Using a SCA bench an attacker could create the database of power consumption and electromagnetic traces of a device. This database could later be used to unlock a locked device using the same SCA bench. The issue was fixed by rewriting the device storage to not compare PINs directly, but rather compare random data stretched by the PIN.

Fixed in firmware 1.8.0.

Reported by Charles Guillemet
Trezor Model One, Trezor Model T

Resolved vulnerabilities

Reported by community. Investigated. Resolved. Because your security is never optional.