Thanks, these are good catches, especially the stack one. The heap wipe on boot shipped yesterday in v0.2.1-alpha, but nothing clears the ARM9 stack yet, so C locals that touched key material can survive. I’ve put your notes where they’ll get worked on:

And agreed on the entropy number: dumping raw buffers and running ea_non_iid is the plan, it’s long overdue

bitdevs

I published a threat model for a SeedSigner on a Nintendo DSi. Tear it apart.

ndssigner

Thanks, these are good catches, especially the stack one. The heap wipe on boot shipped yesterday in v0.2.1-alpha, but nothing clears the ARM9 stack yet, so C locals that touched key material can survive. I’ve put your notes where they’ll get worked on:

* Health tests (RCT/APT) and the dropped buffers: [ndssigner/nds-signer#8](https://github.com/ndssigner/nds-signer/issues/8)
* The ARM9 stack and the secureZero word-length nit: [ndssigner/nds-signer#12](https://github.com/ndssigner/nds-signer/issues/12)

And agreed on the entropy number: dumping raw buffers and running ea_non_iid is the plan, it’s long overdue