test(reset): gate the dice tests on Features.supports_dice_modes; fix the driver

Findings from an adversarial review of the unit, all confirmed against the
firmware's own font tables and message pump:

- The full 32-byte digest wraps to two constant-power subpages, and under
  DEBUG_LINK each subpage after a debug decision raises its own ButtonRequest.
  The driver acked once and asserted EntropyRequest, so both verifiability
  tests would have failed before proving anything. It now holds through every
  digest page, as the backup-word loop already did.
- _inject_rolls diverged from dice_input_collect() once the target was reached:
  the device stops consuming a chunk at that point, undo included, and leaves
  the roll screen, so a later chunk would arrive at the digest confirm as a
  "no" decision. The host simulation now mirrors that exactly and stops
  sending.
- The dice tests were gated on a version. Firmware without the unit skips the
  unknown dice_only field and runs the older ceremony, so a version gate fails
  red on such a build -- and a host on the same signal would derive a
  different wallet without complaint. A Features.supports_dice_modes
  capability now gates both (requires_dice_modes(), after requires_taproot).

Adds tests for the two refusals the review asked for -- dice with no_backup,
and Cancel at the consent screen leaving nothing armed -- and catalogues all
six dice tests in the report atlas in place of the renamed original, with
screen lists matching what each captures.

Bindings regenerated inside kktech/firmware:v8 from device-protocol
feat/dice-only-field @ fbaf8ec (adds Features.supports_dice_modes = 28).

Author: BitHighlander

device-protocol

@@ -359,7 +359,7 @@ def detect_fw():
 # Census of everything the merged JUnit actually contained, so the report can
 # state how much of the run it covers.  Without this the PDF silently implies
 # that its catalog IS the test suite -- an RC audit read "no dice in the report"
-# as "dice is untested" when test_reset_device_dice had in fact run green.
+# as "dice is untested" when the dice reset test had in fact run green.
 JUNIT_CENSUS = {'ran': 0, 'skipped': 0, 'native': 0}
 
 
@@ -824,14 +824,45 @@ def _arg_shown(a):
          'PIN KDF: a v16 storage blob must still unlock and then rewrap to v19, or the upgrade bricks.',
      ],
      [
-         ('K1', 'test_msg_resetdevice', 'test_reset_device_dice',
-          'Dice entropy end-to-end',
-          'Drives the full on-device dice flow over DebugLink: 99 rolls injected in chunks with undo '
-          'exercised, extras past the cap dropped. Asserts the device-computed digest equals '
-          'SHA256 of exactly the expected roll string, then derives the mnemonic from the post-mix '
-          'internal entropy and compares -- which is what proves the rolls actually reached the seed '
-          'rather than being collected and discarded.',
-          ['Dice entry screen', 'Digest confirmation']),
+         ('K1', 'test_msg_resetdevice', 'test_reset_device_dice_mixed_is_verifiable',
+          'Dice + device entropy, verified offline',
+          'Host selects MIXED (dice_entropy alone). The device shows the consent screen naming the '
+          'mode, then its own 32-byte draw as 24 BIP-39 words BEFORE any roll, then collects 99 rolls '
+          'over DebugLink with undo exercised. The test decodes the 24 words with its own '
+          'checksum-verified BIP-39 decoder, recomputes '
+          'seed = SHA256d(tag || draw || SHA256(tag || rolls)) from the published formula -- with the '
+          'host\'s EntropyAck bytes nowhere in it -- and requires the backup words to match. That is '
+          'the proof a user can repeat with tools/verify_dice_seed.py: the rolls reached the seed, '
+          'the device draw was the one it committed to, and the host contributed nothing.',
+          ['Mode consent', 'Dice entry screen', 'Digest confirmation']),
+         ('K1b', 'test_msg_resetdevice', 'test_reset_device_dice_only_is_verifiable',
+          'Dice only, verified offline',
+          'Host selects DICE ONLY (dice_entropy + dice_only), 50 rolls for a 12-word seed. No device '
+          'words are shown -- the rolls are the entire derivation -- and the test requires the backup '
+          'words to equal BIP39(SHA256(rolls)) while sending a nonzero EntropyAck that must be '
+          'ignored. Byte-identical to Coldcard\'s Dice-Rolls-Only.',
+          ['Mode consent', 'Dice entry screen', 'Digest confirmation']),
+         ('K1c', 'test_msg_resetdevice', 'test_reset_device_dice_rejects_biased_rolls',
+          'Loaded die is refused',
+          'Fifty ones -- one face on 100% of the rolls. Refused with SyntaxError before any digest '
+          'is drawn, per Coldcard\'s 30%-per-face rule, so a biased die never becomes a wallet.',
+          []),
+         ('K1d', 'test_msg_resetdevice', 'test_reset_device_dice_only_requires_dice_entropy',
+          'dice_only without dice_entropy is refused',
+          'The rolls-only derivation is a modifier of the dice ceremony, not a ceremony of its own; '
+          'the request is refused before any screen.',
+          []),
+         ('K1e', 'test_msg_resetdevice', 'test_reset_device_dice_refuses_no_backup',
+          'Dice with no_backup is refused',
+          'The dice modes exist to be checked against the backup words. A reset that never shows '
+          'them has nothing to verify and would put seed material on the screen under a WARNING '
+          'that recovery is impossible; refused before any screen.',
+          []),
+         ('K1f', 'test_msg_resetdevice', 'test_reset_device_dice_consent_cancel_aborts',
+          'Cancel at the consent screen aborts everything',
+          'The consent screen\'s only "no" is the host\'s Cancel. Asserts ActionCancelled, that a '
+          'subsequent EntropyAck finds no armed ceremony, and that the device is still uninitialized.',
+          []),
          ('K2', 'test_msg_resetdevice', 'test_reset_reentry_disarms_entropy_ack',
           'Aborted reset disarms EntropyAck',
           'Regression for a host-chosen-seed hole: reset_init aborts left awaiting_entropy set from '

keepkeylib/messages_pb2.py

@@ -174,6 +174,19 @@ def requires_taproot(self):
         if not getattr(self.client.features, 'supports_taproot', False):
             self.skipTest("Firmware does not report supports_taproot")
 
+    def requires_dice_modes(self):
+        """Skip unless the firmware reports the verifiable dice modes.
+
+        A capability, not a version. Firmware without the unit skips the
+        unknown ResetDevice.dice_only field and runs the older ceremony, so a
+        version gate would fail these tests red on such a build -- and a host
+        must refuse to offer the modes on exactly this same signal, because
+        that older firmware would derive a different wallet without complaint.
+        """
+        self.client.init_device()
+        if not getattr(self.client.features, 'supports_dice_modes', False):
+            self.skipTest("Firmware does not report supports_dice_modes")
+
     def requires_structured_eip712(self):
         """Skip unless the FIRMWARE drives the structured EIP-712 walk.
 

scripts/generate-test-report.py

@@ -208,14 +208,22 @@ def _inject_rolls(self, target):
         ]
         expected = []
         for chunk in chunks:
+            # Mirror dice_input_collect() exactly: it stops consuming a chunk
+            # the moment the target is reached -- undo included -- and leaves
+            # the roll screen at that moment. A chunk sent after that would
+            # arrive at the digest confirm as a "no" decision, so stop too.
             for c in chunk:
+                if len(expected) >= target:
+                    break
                 if c == 'u':
                     if expected:
                         expected.pop()
-                elif len(expected) < target:
+                else:
                     expected.append(c)
             self.client.debug.press_input(chunk)
             time.sleep(0.2)
+            if len(expected) >= target:
+                break
         expected = ''.join(expected)
         self.assertEqual(len(expected), target)
         return expected
@@ -279,8 +287,15 @@ def _dice_reset(self, dice_only, strength, external_entropy):
         self.assertEqual(self.client.debug.read_dice_digest(),
                          hashlib.sha256(rolls.encode('ascii')).digest())
 
-        self.client.debug.press_yes()
-        ret = self.client.call_raw(proto.ButtonAck())
+        # The full digest pages locally under one request on hardware, but
+        # under DEBUG_LINK every subpage after a debug decision raises its own
+        # ButtonRequest, exactly as the backup pager does. Hold through all of
+        # them; how many there are depends on the digest's glyph widths.
+        ret = resp
+        while isinstance(ret, proto.ButtonRequest):
+            self.assertEqual(ret.code, proto_types.ButtonRequest_DiceRoll)
+            self.client.debug.press_yes()
+            ret = self.client.call_raw(proto.ButtonAck())
 
         # The wire flow is unchanged: EntropyRequest is still sent and its ack
         # consumed. Its bytes must not reach the seed, which the callers prove
@@ -306,9 +321,7 @@ def _dice_reset(self, dice_only, strength, external_entropy):
         return ' '.join(device_words), rolls, ' '.join(mnemonic), resp
 
     def test_reset_device_dice_mixed_is_verifiable(self):
-        # Dice exist from 7.14.3; the mode selector this drives ships with the
-        # verifiable-dice unit on both 7.14.3 and 7.15.
-        self.requires_firmware("7.14.3")
+        self.requires_dice_modes()
 
         external_entropy = b'zlutoucky kun upel divoke ody' * 2
         strength = 256  # 99 rolls, 24 words
@@ -332,7 +345,7 @@ def test_reset_device_dice_mixed_is_verifiable(self):
         self.assertEqual(24, len(mnemonic.split()))
 
     def test_reset_device_dice_only_is_verifiable(self):
-        self.requires_firmware("7.14.3")
+        self.requires_dice_modes()
 
         # A nonzero, known host contribution, so a device that mixed it in
         # would produce a different sentence and fail below.
@@ -351,7 +364,7 @@ def test_reset_device_dice_only_is_verifiable(self):
         self.assertEqual(12, len(mnemonic.split()))
 
     def test_reset_device_dice_rejects_biased_rolls(self):
-        self.requires_firmware("7.14.3")
+        self.requires_dice_modes()
 
         ret = self.client.call_raw(proto.ResetDevice(display_random=False,
                                                strength=128,
@@ -382,7 +395,7 @@ def test_reset_device_dice_rejects_biased_rolls(self):
         self.assertEqual(resp.code, proto_types.Failure_SyntaxError)
 
     def test_reset_device_dice_only_requires_dice_entropy(self):
-        self.requires_firmware("7.14.3")
+        self.requires_dice_modes()
 
         # dice_only is a modifier of the dice ceremony, not a ceremony of its
         # own. Refused before any screen, so a host cannot reach the
@@ -398,6 +411,52 @@ def test_reset_device_dice_only_requires_dice_entropy(self):
         self.assertIsInstance(ret, proto.Failure)
         self.assertEqual(ret.code, proto_types.Failure_SyntaxError)
 
+    def test_reset_device_dice_refuses_no_backup(self):
+        self.requires_dice_modes()
+
+        # The dice modes exist to be checked against the backup words; a reset
+        # that never shows them has nothing to verify and would put seed
+        # material on the screen under a WARNING that recovery is impossible.
+        ret = self.client.call_raw(proto.ResetDevice(display_random=False,
+                                               strength=128,
+                                               passphrase_protection=False,
+                                               pin_protection=False,
+                                               language='english',
+                                               label='dice',
+                                               no_backup=True,
+                                               dice_entropy=True))
+        self.assertIsInstance(ret, proto.Failure)
+        self.assertEqual(ret.code, proto_types.Failure_SyntaxError)
+
+    def test_reset_device_dice_consent_cancel_aborts(self):
+        self.requires_dice_modes()
+
+        # The consent screen's only "no" is the host's Cancel. It must abort
+        # the whole ceremony: nothing armed, nothing staged, device still
+        # uninitialized.
+        ret = self.client.call_raw(proto.ResetDevice(display_random=False,
+                                               strength=128,
+                                               passphrase_protection=False,
+                                               pin_protection=False,
+                                               language='english',
+                                               label='dice',
+                                               dice_entropy=True,
+                                               dice_only=True))
+        self.assertIsInstance(ret, proto.ButtonRequest)
+        self.assertEqual(ret.code, proto_types.ButtonRequest_DiceRoll)
+
+        resp = self.client.call_raw(proto.Cancel())
+        self.assertIsInstance(resp, proto.Failure)
+        self.assertEqual(resp.code, proto_types.Failure_ActionCancelled)
+
+        # An EntropyAck after the abort finds no armed ceremony to consume it.
+        resp = self.client.call_raw(proto.EntropyAck(entropy=b'\x42' * 32))
+        self.assertIsInstance(resp, proto.Failure)
+
+        features = self.client.call_raw(proto.Initialize())
+        self.assertIsInstance(features, proto.Features)
+        self.assertFalse(features.initialized)
+
     def test_reset_reentry_disarms_entropy_ack(self):
         """An abandoned reset must never leave EntropyAck armed.