Skip to content

R04 — Shared capacity, memory and power-loss endurance

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

Dedicated fresh device, R01–R03 passed; switched USB power that really cuts VBUS; UART/SWO only on a separate debug measurement image, followed by functional revalidation without debug.

Steps

  1. Run uv run pytest -q tests/host/fido2/test_capacity_budget.py tests/host/core/test_storage_budget.py and make test-upy for each model emulator. Keep these results separate from hardware evidence.
  2. Over physical HID, use the R03 Ctap2 client to create 100 distinct discoverable credentials: 128-byte RP, 64-byte user.id, 64-byte name/displayName, credProtect=3, hmac-secret and largeBlobKey. Renew the MAKE_CREDENTIAL token before every creation and confirm physically. Exact scenarios/sizes are in tests/host/fido2/test_capacity_budget.py; replace its simulated connection with physical HID, without internal firmware-memory access.
  3. Import 32 distinct HOTP accounts through the real volume: 64-byte secrets, 32-byte issuer, 64-byte account, SHA512/8 digits. Generate each at least once. Build QR images with segno/Pillow and the referenced scenario parameters, following R05 for every import.
  4. Over HID LargeBlobs, write/read three serialized 4096-byte arrays so both A/B copies become active across updates ([{1: b"x" * 4074}], then y and z). Replace an existing passkey by registration with the same RP/user.id, then restore an existing OTP from its encrypted export with specific overwrite consent, exercising copy-before-delete.
  5. Perform at least 100 update/delete/re-add cycles and trigger compaction. Count entries and verify an assertion/code after every reboot. Try a 101st passkey, a 33rd OTP and 4097-byte largeBlob; verify rejection without altering existing data.
  6. Cut VBUS during 30 writes, distributed before/during/after mutation and compaction. Reconnect and verify every identity is either old or new, never partial. Record timings/results and expand the campaign if a defect appears.
  7. Measure physical peak RAM/heap/stack during normal use, image import, RSA, PBKDF2 and export/restore at maximum occupancy. Record method and margins; the emulator’s 20 MiB heap is not this measurement.

Expected result

100 passkeys + 32 OTP + 4096-byte largeBlobs coexist and remain usable; overflow rejects without corruption; updates/compaction recover after cuts; no MemoryError/panic. Theoretical flash totals and emulator success are insufficient.

Evidence to retain

Before/after inventories, exact host scripts/parameters, public counters/fingerprints, overflow errors, power/compaction traces, per-model memory reports and firmware hash.