@trezor/connect 10.0.0-alpha.1 → 10.0.0-beta.1

package/lib/device/thp/pairing.js

@@ -0,0 +1,242 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, concatBytes, randomBytes } from "@noble/hashes/utils.js";
+import { DEVICE } from "@trezor/connect-common";
+import { ERRORS } from "@trezor/connect-common/lib/constants/index.js";
+import { ThpPairingMethod, thp as protocolThp } from "@trezor/protocol";
+import { createDeferred, resolveAfter } from "@trezor/utils";
+import { abortThpWorkflow, thpCall } from "./thpCall.js";
+import * as settingsStore from "../../data/settingsStore.js";
+import { sanitizeString } from "../../utils/formatUtils.js";
+const sha256Hex = (...parts) => bytesToHex(sha256(concatBytes(...parts)));
+const processQrCodeTag = async (device, value) => {
+  const thpState = device.getThpState();
+  if (!thpState?.handshakeCredentials) {
+    throw ERRORS.TypedError('Device_ThpStateMissing');
+  }
+  const tagSha = sha256Hex(thpState.handshakeCredentials.handshakeHash, Buffer.from(value, 'hex'));
+  const qrCodeSecret = await thpCall(device, 'ThpQrCodeTag', {
+    tag: tagSha
+  });
+  protocolThp.validateQrCodeTag(thpState.handshakeCredentials, value, qrCodeSecret.message.secret);
+  return qrCodeSecret;
+};
+const processNfcTag = async (device, value) => {
+  const thpState = device.getThpState();
+  if (!thpState?.handshakeCredentials) {
+    throw ERRORS.TypedError('Device_ThpStateMissing');
+  }
+  if (!thpState?.nfcSecret) {
+    throw new Error('missing nfcSecret');
+  }
+  const tagSha = sha256Hex(Buffer.from([protocolThp.ThpPairingMethod.NFC]), thpState.handshakeCredentials.handshakeHash, Buffer.from(value, 'hex'));
+  const nfcTagTrezor = await thpCall(device, 'ThpNfcTagHost', {
+    tag: tagSha
+  });
+  protocolThp.validateNfcTag(thpState.handshakeCredentials, nfcTagTrezor.message.tag, thpState.nfcSecret);
+  return nfcTagTrezor;
+};
+const processCodeEntry = async (device, value) => {
+  const codeValue = Buffer.from(value, 'ascii');
+  const thpState = device.getThpState();
+  if (!thpState?.handshakeCredentials) {
+    throw ERRORS.TypedError('Device_ThpStateMissing');
+  }
+  const hostKeys = protocolThp.getCpaceHostKeys(codeValue, thpState.handshakeCredentials.handshakeHash);
+  const tag = protocolThp.getSharedSecret(thpState.handshakeCredentials.trezorCpacePublicKey, hostKeys.privateKey).toString('hex');
+  const codeEntrySecret = await thpCall(device, 'ThpCodeEntryCpaceHostTag', {
+    tag,
+    cpace_host_public_key: hostKeys.publicKey.toString('hex')
+  });
+  protocolThp.validateCodeEntryTag(thpState.handshakeCredentials, value, codeEntrySecret.message.secret);
+  return codeEntrySecret;
+};
+const processThpPairingResponse = (device, payload) => {
+  if ('selectedMethod' in payload) {
+    const selectedMethod = protocolThp.getThpPairingMethod(payload.selectedMethod);
+    device.getThpState()?.setPairingMethod(selectedMethod);
+    return thpCall(device, 'ThpSelectMethod', {
+      selected_pairing_method: selectedMethod
+    });
+  }
+  const selectedMethod = device.getThpState()?.pairingMethod;
+  if (selectedMethod === ThpPairingMethod.QrCode) {
+    return processQrCodeTag(device, payload.tag);
+  }
+  if (selectedMethod === ThpPairingMethod.NFC) {
+    return processNfcTag(device, payload.tag);
+  }
+  if (selectedMethod === ThpPairingMethod.CodeEntry) {
+    return processCodeEntry(device, payload.tag);
+  }
+  throw ERRORS.TypedError('Device_ThpPairingMethodsException');
+};
+const waitForPairingCancel = device => {
+  const readAbort = new AbortController();
+  device.getThpState()?.setExpectedResponses([0x04]);
+  const readCancel = device.getCurrentSession().receive({
+    signal: readAbort.signal
+  });
+  return {
+    readAbort,
+    readCancel
+  };
+};
+const waitForPairingTag = async device => {
+  const thpState = device.getThpState();
+  if (!thpState?.handshakeCredentials) {
+    throw ERRORS.TypedError('Device_ThpStateMissing');
+  }
+  if (thpState.pairingMethod === undefined) {
+    throw ERRORS.TypedError('Device_ThpPairingMethodsException');
+  }
+  const dfd = createDeferred();
+  const {
+    readAbort,
+    readCancel
+  } = waitForPairingCancel(device);
+  const cancelResult = readCancel.then(readResult => {
+    if (readResult.success) {
+      let code, message;
+      const {
+        payload
+      } = readResult;
+      if (payload.type === 'Failure') {
+        code = payload.message.code;
+        message = payload.message.message;
+      } else {
+        message = `Unexpected message type: ${readResult.payload.type}`;
+      }
+      dfd.resolve({
+        error: ERRORS.TypedError(code || 'ThpUnknownError', message)
+      });
+    }
+  }).catch(() => {});
+  thpState.setPairingTagPromise({
+    abort: async () => {
+      readAbort.abort();
+      await cancelResult;
+    }
+  });
+  const payload = {
+    availableMethods: thpState.handshakeCredentials.pairingMethods,
+    selectedMethod: thpState.pairingMethod,
+    nfcData: thpState.nfcData?.toString('hex')
+  };
+  device.prompt(DEVICE.THP_PAIRING, {
+    payload
+  }).then(response => {
+    if (response.success) {
+      dfd.resolve(response.payload);
+    } else {
+      abortThpWorkflow(device).then(() => {
+        dfd.resolve({
+          error: ERRORS.TypedError('ThpUnknownError', response.error.message)
+        });
+      });
+    }
+  });
+  const pairingResponse = await dfd.promise;
+  readAbort.abort();
+  await readCancel;
+  thpState.setPairingTagPromise(undefined);
+  if ('error' in pairingResponse) {
+    throw pairingResponse.error;
+  }
+  await resolveAfter(500);
+  return processThpPairingResponse(device, pairingResponse).catch(e => {
+    if (e.code === 'Failure_FirmwareError' || e.code === 'Failure_DataError') {
+      if ('tag' in pairingResponse) {
+        device.emit(DEVICE.THP_PAIRING_STATUS_CHANGED, {
+          status: 'invalid-tag',
+          tag: pairingResponse.tag
+        });
+      }
+      throw ERRORS.TypedError('Device_ThpPairingTagInvalid', e.message);
+    }
+    throw ERRORS.TypedError(e.code, e.message);
+  });
+};
+export const getThpCredentials = async (device, autoconnect = false) => {
+  const thpState = device.getThpState();
+  if (!thpState?.handshakeCredentials) {
+    throw ERRORS.TypedError('Device_ThpStateMissing');
+  }
+  const credentials = await thpCall(device, 'ThpCredentialRequest', {
+    autoconnect,
+    host_static_public_key: thpState.handshakeCredentials.hostStaticPublicKey.toString('hex'),
+    credential: thpState.pairingCredentials[0]?.credential
+  });
+  const host_static_key = thpState.handshakeCredentials.staticKey.toString('hex');
+  return {
+    ...credentials.message,
+    autoconnect,
+    host_static_key
+  };
+};
+export const thpPairingEnd = async device => {
+  const result = await thpCall(device, 'ThpEndRequest', {});
+  device.getThpState()?.setPhase('paired');
+  return result;
+};
+export const thpPairing = async device => {
+  const thpState = device.getThpState();
+  if (!thpState?.handshakeCredentials) {
+    throw ERRORS.TypedError('Device_ThpStateMissing');
+  }
+  if (thpState.isPaired && thpState.pairingMethod !== protocolThp.ThpPairingMethod.SkipPairing) {
+    if (!thpState.isAutoconnectPaired) {
+      await getThpCredentials(device, false);
+    }
+    return thpPairingEnd(device);
+  }
+  const {
+    pairingMethods
+  } = thpState.handshakeCredentials;
+  const selected_pairing_method = pairingMethods[0];
+  thpState.setPairingMethod(selected_pairing_method);
+  const settings = settingsStore.get('thp');
+  await thpCall(device, 'ThpPairingRequest', {
+    host_name: sanitizeString(settings?.hostName) || 'Unknown hostName',
+    app_name: sanitizeString(settings?.appName) || 'Unknown appName'
+  });
+  const selectMethod = await thpCall(device, 'ThpSelectMethod', {
+    selected_pairing_method
+  });
+  if (selectMethod.type === 'ThpEndResponse') {
+    thpState.setIsPaired(true);
+    device.getThpState()?.setPhase('paired');
+    return;
+  }
+  if (selectMethod.type === 'ThpCodeEntryCommitment') {
+    const codeEntryChallenge = Buffer.from(randomBytes(32));
+    const handshakeCommitment = Buffer.from(selectMethod.message.commitment, 'hex');
+    thpState.updateHandshakeCredentials({
+      handshakeCommitment,
+      codeEntryChallenge
+    });
+    const codeEntryCpace = await thpCall(device, 'ThpCodeEntryChallenge', {
+      challenge: codeEntryChallenge.toString('hex')
+    });
+    thpState.updateHandshakeCredentials({
+      trezorCpacePublicKey: Buffer.from(codeEntryCpace.message.cpace_trezor_public_key, 'hex')
+    });
+    await waitForPairingTag(device);
+  }
+  if (selectMethod.type === 'ThpPairingPreparationsFinished') {
+    if (thpState.pairingMethod === protocolThp.ThpPairingMethod.NFC) {
+      thpState.setNfcSecret(Buffer.from(randomBytes(16)));
+    }
+    await waitForPairingTag(device);
+  }
+  const credentials = await getThpCredentials(device, false);
+  device.emit(DEVICE.THP_CREDENTIALS_CHANGED, {
+    credentials
+  });
+  const settings1 = settingsStore.get('thp');
+  if (settings1) {
+    settings1.knownCredentials?.push(credentials);
+  }
+  thpState.setPairingCredentials([credentials]);
+  thpState.setIsPaired(true);
+  await thpPairingEnd(device);
+};

package/lib/device/thp/session.d.ts

@@ -0,0 +1,2 @@
+import type { IDevice } from "../../types/idevice.js";
+export declare const createThpSession: (device: IDevice, deriveCardano: boolean) => Promise<number>;

package/lib/device/thp/session.js

@@ -0,0 +1,27 @@
+import { thpCall } from "./thpCall.js";
+export const createThpSession = async (device, deriveCardano) => {
+  let passphrase;
+  if (device.features.passphrase_protection === false) {
+    passphrase = {
+      passphrase: ''
+    };
+  } else {
+    passphrase = await device.prompt('passphrase', {}).then(promptRes => {
+      if (!promptRes.success) {
+        return {
+          passphrase: ''
+        };
+      }
+      return promptRes.payload.passphraseOnDevice ? {
+        on_device: true
+      } : {
+        passphrase: promptRes.payload.value.normalize('NFKD')
+      };
+    });
+  }
+  await thpCall(device, 'ThpCreateNewSession', {
+    ...passphrase,
+    derive_cardano: deriveCardano
+  });
+  return 0;
+};

package/lib/device/thp/thpCall.d.ts

@@ -0,0 +1,31 @@
+import type { thp as protocolThp } from '@trezor/protocol';
+import type { IDevice } from "../../types/idevice.js";
+type ThpTypedCall = {
+  ThpCreateChannelRequest: 'ThpCreateChannelResponse';
+  ThpHandshakeInitRequest: 'ThpHandshakeInitResponse';
+  ThpHandshakeCompletionRequest: 'ThpHandshakeCompletionResponse';
+  ThpPairingRequest: 'ThpPairingRequestApproved';
+  ThpSelectMethod: ['ThpCodeEntryCommitment', 'ThpEndResponse', 'ThpPairingRequestApproved', 'ThpPairingPreparationsFinished'];
+  ThpCodeEntryChallenge: ['ThpCodeEntryCpaceTrezor'];
+  ThpCodeEntryCpaceHostTag: 'ThpCodeEntrySecret';
+  ThpQrCodeTag: 'ThpQrCodeSecret';
+  ThpNfcTagHost: 'ThpNfcTagTrezor';
+  ThpCredentialRequest: 'ThpCredentialResponse';
+  ThpEndRequest: 'ThpEndResponse';
+  ThpCreateNewSession: 'Success';
+};
+type ThpMessage = protocolThp.ThpMessageType & {
+  Success: Record<never, never>;
+};
+type TypedPayloadItem<K> = K extends keyof ThpMessage ? {
+  type: K;
+  message: ThpMessage[K];
+} : never;
+type ExtractFromArray<A extends any[]> = { [K in keyof A]: TypedPayloadItem<A[K]> }[number];
+type MessageKey = keyof ThpTypedCall;
+type TypedPayload<T extends MessageKey> = ThpTypedCall[T] extends any[] ? ExtractFromArray<ThpTypedCall[T]> : TypedPayloadItem<ThpTypedCall[T]>;
+type ThpCallResponse = { [K in keyof ThpTypedCall]: TypedPayload<K> };
+type ThpMessagePayload<T extends MessageKey = MessageKey> = ThpMessage[T];
+export declare const thpCall: <T extends MessageKey>(device: IDevice, name: T, data: ThpMessagePayload<T>) => Promise<ThpCallResponse[T]>;
+export declare const abortThpWorkflow: (device: IDevice) => Promise<void>;
+export {};

package/lib/device/thp/thpCall.js

@@ -0,0 +1,58 @@
+import { DEVICE } from "@trezor/connect-common";
+import { TypedError } from "@trezor/connect-common/lib/constants/errors.js";
+export const thpCall = async (device, name, data) => {
+  const thpState = device.getThpState();
+  if (!thpState) {
+    throw TypedError('Device_ThpStateMissing');
+  }
+  const result = await device.getCurrentSession().call(name, data);
+  if (!result.success) {
+    throw result.error;
+  }
+  thpState.setCancelablePromise(false);
+  if (result.payload.type === 'ButtonRequest') {
+    thpState.setCancelablePromise(true);
+    if (result.payload.message.code === 'ButtonRequest_PassphraseEntry') {
+      device.emit(DEVICE.PASSPHRASE_ON_DEVICE);
+    } else {
+      device.emit(DEVICE.BUTTON, {
+        device,
+        payload: result.payload.message
+      });
+    }
+    return thpCall(device, 'ButtonAck', {});
+  }
+  if (result.payload.type === 'Failure') {
+    const {
+      code,
+      message
+    } = result.payload.message;
+    throw TypedError(code || 'Failure_UnknownCode', message);
+  }
+  if (result.payload.type === 'ThpError') {
+    const {
+      code,
+      message
+    } = result.payload.message;
+    throw TypedError(code, message);
+  }
+  return result.payload;
+};
+export const abortThpWorkflow = async device => {
+  const thpState = device.getThpState();
+  if (!thpState || !device.currentRun) {
+    return Promise.resolve();
+  }
+  if (thpState.pairingTagPromise) {
+    await thpState.pairingTagPromise.abort();
+    await device.getCurrentSession().cancelCall();
+    thpState.resetState();
+    device.emit(DEVICE.THP_PAIRING_STATUS_CHANGED, {
+      status: 'canceled'
+    });
+  } else if (thpState.cancelablePromise) {
+    thpState.sync('send', 'Cancel');
+    await device.getCurrentSession().send('Cancel', {});
+    await device.currentRun;
+  }
+};

package/lib/device/validateMessageSize.d.ts

@@ -0,0 +1,2 @@
+import type { Device } from "./Device.js";
+export declare const validateModelOneMessageSize: (device: Device, messageHex: string) => void;

package/lib/device/validateMessageSize.js

@@ -0,0 +1,9 @@
+import { TypedError } from "@trezor/connect-common/lib/constants/errors.js";
+export const validateModelOneMessageSize = (device, messageHex) => {
+  if (device.features?.major_version === 1) {
+    const byteSize = messageHex.length / 2;
+    if (byteSize > 1024) {
+      throw TypedError('Method_DataOverflowModelOne');
+    }
+  }
+};

package/lib/device/workflow/changeLanguage.d.ts

@@ -0,0 +1,18 @@
+import type { IDevice } from "../../types/idevice.js";
+type Context = {
+  device: IDevice;
+} & ({
+  language?: undefined;
+  binary: ArrayBuffer;
+} | {
+  language: string;
+  binary?: undefined;
+});
+export declare const changeLanguage: ({
+  device,
+  language,
+  binary
+}: Context) => Promise<{
+  message: string;
+}>;
+export {};

package/lib/device/workflow/changeLanguage.js

@@ -0,0 +1,62 @@
+import { ERRORS } from "@trezor/connect-common/lib/constants/index.js";
+import { getLanguage } from "../../data/firmwareInfo.js";
+const uploadTranslationData = async (device, payload) => {
+  if (payload === null) {
+    const response = await device.getCurrentSession().typedCall('ChangeLanguage', ['Success'], {
+      data_length: 0
+    });
+    return response.message;
+  }
+  const length = payload.byteLength;
+  device.startPiggybackAck();
+  let response = await device.getCurrentSession().typedCall('ChangeLanguage', ['DataChunkRequest', 'Success'], {
+    data_length: length
+  });
+  while (response.type !== 'Success') {
+    const start = response.message.data_offset;
+    const end = response.message.data_offset + response.message.data_length;
+    const chunk = payload.slice(start, end);
+    response = await device.getCurrentSession().typedCall('DataChunkAck', ['DataChunkRequest', 'Success'], {
+      data_chunk: Buffer.from(chunk).toString('hex')
+    });
+  }
+  await device.stopPiggybackAck();
+  return response.message;
+};
+export const changeLanguage = async ({
+  device,
+  language,
+  binary
+}) => {
+  if (language === 'en-US') {
+    return uploadTranslationData(device, null);
+  }
+  if (binary) {
+    return uploadTranslationData(device, binary);
+  }
+  const version = device.getVersion();
+  if (!version) {
+    throw ERRORS.TypedError('Runtime', 'changeLanguage: device version unknown');
+  }
+  if (!device.firmwareType) {
+    throw ERRORS.TypedError('Runtime', 'changeLanguage: firmware type unknown');
+  }
+  if (!device.currentRelease) {
+    throw ERRORS.TypedError('Runtime', 'changeLanguage: release not found');
+  }
+  const {
+    translations
+  } = device.currentRelease;
+  const languageBinPath = translations[language];
+  const downloadedBinary = await getLanguage(languageBinPath);
+  if (!downloadedBinary) {
+    throw ERRORS.TypedError('Runtime', 'changeLanguage: translation not found');
+  }
+  let dataToSend;
+  if (Buffer.isBuffer(downloadedBinary)) {
+    dataToSend = new Uint8Array(downloadedBinary).buffer;
+  } else {
+    dataToSend = downloadedBinary;
+  }
+  return uploadTranslationData(device, dataToSend);
+};

package/lib/device/workflow/checkFirmwareHash.d.ts

@@ -0,0 +1,12 @@
+import type { FirmwareHashCheckResult } from '@trezor/connect-common';
+import { type Logger } from '@trezor/utils';
+import type { IDevice } from "../../types/idevice.js";
+type Context = {
+  device: IDevice;
+  logger: Logger;
+};
+export declare const checkFirmwareHash: ({
+  device,
+  logger
+}: Context) => Promise<FirmwareHashCheckResult | null>;
+export {};

package/lib/device/workflow/checkFirmwareHash.js

@@ -0,0 +1,86 @@
+import { randomBytes } from "@noble/hashes/utils.js";
+import { serializeError } from "@trezor/utils";
+import { calculateFirmwareHash, getBinaryOptional, stripFwHeaders } from "../../api/firmware/index.js";
+import { getFirmwareLocation, getReleaseByVersion } from "../../data/firmwareInfo.js";
+import * as settingsStore from "../../data/settingsStore.js";
+import { getFirmwareType } from "../../utils/firmwareUtils.js";
+const createFailResult = (error, errorPayload) => ({
+  success: false,
+  error,
+  errorPayload
+});
+export const checkFirmwareHash = async ({
+  device,
+  logger
+}) => {
+  const enabled = settingsStore.get('enableFirmwareHashCheck');
+  if (!enabled) return createFailResult('check-skipped');
+  const firmwareVersion = device.getVersion();
+  if (firmwareVersion === undefined || !device.features || device.features.bootloader_mode) {
+    return null;
+  }
+  const firmwareType = getFirmwareType(device.features);
+  const release = await getReleaseByVersion(device.features, firmwareVersion, firmwareType);
+  if (!release) return createFailResult('unknown-release');
+  const firmwareLocation = getFirmwareLocation({
+    firmwareVersion,
+    remotePath: release.url,
+    deviceModel: device.features.internal_model,
+    firmwareType: getFirmwareType(device.features)
+  });
+  const {
+    baseUrl,
+    path
+  } = firmwareLocation;
+  const timeoutThresholdsPerModel = settingsStore.get('firmwareHashCheckTimeouts');
+  if (firmwareVersion === undefined || !device.features || device.features.bootloader_mode) {
+    return null;
+  }
+  const checkSupported = !device.unavailableCapabilities.getFirmwareHash;
+  if (!checkSupported) return createFailResult('check-unsupported');
+  const firmwareBinary = await getBinaryOptional({
+    baseUrl,
+    path,
+    release
+  });
+  if (firmwareBinary === null) {
+    return createFailResult('check-unsupported');
+  }
+  if (firmwareBinary.binary.byteLength < 200) {
+    logger.warn(`Firmware binary for hash check suspiciously small (< 200 b)`);
+    return createFailResult('check-unsupported');
+  }
+  const strippedBinary = stripFwHeaders(firmwareBinary.binary);
+  const {
+    hash: expectedHash,
+    challenge
+  } = calculateFirmwareHash({
+    internal_model: device.features.internal_model,
+    firmwareVersion,
+    fw: Buffer.from(strippedBinary),
+    key: Buffer.from(randomBytes(32))
+  });
+  try {
+    const ts = performance.now();
+    const deviceResponse = await device.getCurrentSession().typedCall('GetFirmwareHash', 'FirmwareHash', {
+      challenge
+    });
+    if (!deviceResponse?.message?.hash) {
+      return createFailResult('other-error', 'Device response is missing hash');
+    }
+    if (deviceResponse.message.hash !== expectedHash) {
+      return createFailResult('hash-mismatch');
+    }
+    const duration = performance.now() - ts;
+    logger.debug('GetFirmwareHash time', duration);
+    const timeoutThreshold = timeoutThresholdsPerModel?.[device.features.internal_model];
+    if (timeoutThreshold !== undefined && duration > timeoutThreshold) {
+      return createFailResult('takes-too-long');
+    }
+    return {
+      success: true
+    };
+  } catch (errorPayload) {
+    return createFailResult('other-error', serializeError(errorPayload));
+  }
+};

package/lib/device/workflow/checkFirmwareHashWithRetries.d.ts

@@ -0,0 +1,8 @@
+import { type Logger } from '@trezor/utils';
+import type { IDevice } from "../../types/idevice.js";
+type Context = {
+  device: IDevice;
+  logger: Logger;
+};
+export declare const checkFirmwareHashWithRetries: (context: Context) => Promise<void>;
+export {};

package/lib/device/workflow/checkFirmwareHashWithRetries.js

@@ -0,0 +1,36 @@
+import { FIRMWARE } from "@trezor/connect-common";
+import { isArrayMember } from "@trezor/utils";
+import { checkFirmwareHash } from "./checkFirmwareHash.js";
+const PROBE_CHECK_TIME_RETRIES = 4;
+const probeCheckTime = async context => {
+  for (let i = 0; i < PROBE_CHECK_TIME_RETRIES; i++) {
+    const result = await checkFirmwareHash(context);
+    if (result !== null && (result.success || result.error !== 'takes-too-long')) {
+      context.device.setAuthenticityChecks(result);
+      return;
+    }
+  }
+};
+export const checkFirmwareHashWithRetries = async context => {
+  const lastResult = context.device.getAuthenticityChecks().firmwareHash;
+  const notDoneYet = lastResult === null;
+  const attemptsDone = lastResult?.attemptCount ?? 0;
+  if (attemptsDone >= FIRMWARE.HASH_CHECK_MAX_ATTEMPTS) return;
+  const wasError = lastResult !== null && !lastResult.success;
+  const wasErrorRetriable = wasError && isArrayMember(lastResult.error, FIRMWARE.HASH_CHECK_RETRIABLE_ERRORS);
+  const lastErrorPayload = wasError ? lastResult?.errorPayload : null;
+  if (notDoneYet || wasErrorRetriable) {
+    const result = await checkFirmwareHash(context);
+    context.device.setAuthenticityChecks(result);
+    if (result === null) return;
+    result.attemptCount = attemptsDone + 1;
+    if (!result.success && result.error === 'takes-too-long') {
+      await probeCheckTime(context);
+    }
+    if (result.success && lastErrorPayload) {
+      result.warningPayload = {
+        lastErrorPayload
+      };
+    }
+  }
+};

package/lib/device/workflow/handshake.d.ts

@@ -0,0 +1,13 @@
+import { type Logger } from '@trezor/utils';
+import type { WorkflowContext } from "../../types/workflow.js";
+type Context = {
+  device: WorkflowContext['device'];
+  signal: AbortSignal;
+  logger?: Logger;
+};
+export declare const handshakeCancel: ({
+  device,
+  logger,
+  signal
+}: Context) => Promise<void>;
+export {};

package/lib/device/workflow/handshake.js

@@ -0,0 +1,55 @@
+import { TypedError } from "@trezor/connect-common/lib/constants/errors.js";
+import { PROTOCOL_MALFORMED } from "@trezor/protocol/lib/errors.js";
+import { TRANSPORT_ERROR } from "@trezor/transport-common";
+import { resolveAfter, versionUtils } from "@trezor/utils";
+const CANCEL_TIMEOUT = 1_000;
+const ATTEMPTS_LIMIT = 10;
+const isLegacyBridge = transport => transport.name === 'BridgeTransport' && !versionUtils.isNewerOrEqual(transport.version, '3.0.0');
+export const handshakeCancel = async ({
+  device,
+  logger,
+  signal
+}) => {
+  if (device.features || device.getThpState()?.properties) {
+    return;
+  }
+  const timeout = device.possibleT1 ? CANCEL_TIMEOUT : undefined;
+  logger?.debug('handshake Cancel start');
+  const send = await device.getCurrentSession().send('Cancel', {}, {
+    signal,
+    timeout
+  });
+  if (!send.success) {
+    logger?.debug(`handshake Cancel send error ${send.error}`);
+    return;
+  }
+  logger?.debug('handshake Cancel sent');
+  for (let attempt = 0; attempt < ATTEMPTS_LIMIT; ++attempt) {
+    logger?.debug(`handshake Cancel read attempt ${attempt}`);
+    const result = await device.getCurrentSession().receive({
+      signal,
+      timeout: CANCEL_TIMEOUT
+    });
+    if (!result.success && result.error.message === TRANSPORT_ERROR.ABORTED_BY_TIMEOUT) {
+      if (isLegacyBridge(device.transport)) {
+        await resolveAfter(501);
+      }
+      await device.acquire();
+    }
+    if (!result.success && result.error.message !== PROTOCOL_MALFORMED) {
+      logger?.debug(`handshake Cancel read error: ${result.error}`);
+      return;
+    } else if (result.success) {
+      logger?.debug(`handshake Cancel read success: ${result.payload.type}`);
+      if (result.payload.type === 'Failure' && result.payload.message.code === 'Failure_InvalidProtocol') {
+        logger?.debug(`handshake Cancel protocol v2 detected`);
+        device.setupThp();
+      }
+      if (result.payload.type === 'Failure' && result.payload.message.code === 'Failure_Busy') {
+        throw TypedError(result.payload.message.code, result.payload.message.message);
+      }
+      return;
+    }
+  }
+  logger?.debug(`handshake Cancel attempts limit reached`);
+};