Skip to content

R15 — Physical consent, PINs, timeouts, erase and RAM

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

R01–R14 passed; sacrificial device and restored identity copy; standard host tools; no debuglink; separate instrumented build for RAM inspection.

Steps

  1. Through HID/CCID/MSC, try creation, signing, decryption, export and deletion without local approval, with refusal and with timeout. No raw secret/export or implicit sensitive approval may be obtained.
  2. Lock and check private operations; repeat after five idle minutes. Verify PIN re-entry before QR export and sensitive management; a backup passphrase equal to the PIN must be rejected.
  3. With disposable secrets, verify separate retry/lockout rules for device PIN, FIDO PIN, PW1/PW3 and PIV PIN/PUK. Reconnect between failures to verify persistence. Exhausting device attempts must erase, not allow an unlimited retry loop.
  4. After export/import/cancellation/timeout, verify hidden display, purged temporary native buffers and no secret disk. Inspect erasable buffers and abandoned references after lock on the instrumented image. Separately document MicroPython immutable bytes/str zeroisation limits; do not claim all RAM is physically cleared without evidence.
  5. Open Settings → Full wipe. Refuse at every confirmation and verify no loss. Finally accept with PIN and held consent, reboot and verify fresh onboarding, absent keys and unusable previous codes/credentials.
  6. Return to the non-instrumented candidate and check all three USB modes and delivered artifacts for absence of debuglink and secret logs.

Expected result

Local consent/authentication follow policy; persistent retry limits; effective explicit wipe; no hidden USB export/debuglink; cleanup verified within actual runtime guarantees.

Evidence to retain

Operation/refusal/timeout/PIN matrix, erase/cancel videos, USB descriptors, buffer-inspection results and justified residual limits, separate image hashes. Publish no secrets.