Authenticator commands continue after passphrase rejection against a stale decrypted cache

[BitHighlander]

Summary

Authenticator Ping commands continue after the user rejects passphrase authorization. The bug becomes a practical authorization bypass because the decrypted authenticator cache survives ClearSession, lock, Initialize, and Cancel in this 7.14.3 branch.

Found while auditing PR #604 at exact head 1d446ccbc9cf32a6e499990e65bcf7b358f1325b.

Evidence

• lib/firmware/fsm_msg_common.h:196-203 declares checkPassphrase() as void; on failure it sends ActionCancelled and returns only from the helper.
• The authenticator dispatcher calls it at fsm_msg_common.h:268-270, ignores the result, and enters the command switch at :271.
• lib/firmware/authenticator.c:38-55 keeps decrypted authData in a static cache and skips storage/passphrase validation once localAuthdataUpdate becomes false.
• Only explicit permanent wipeAuthData() clears the cache (authenticator.c:80-92). fsm_msgClearSession() (fsm.c:300-303), Initialize, Cancel, and session lock do not invalidate it.
• Consequently generateOTP(), getAuthAccount(), removeAuthAccount(), and addAuthAccount() can execute against a previously decrypted cache after passphrase rejection. generateOTP() also discards the return of review_immediate() at authenticator.c:257-258.

Related history: #398 was closed after the cache-clear fix landed on alpha, but that remediation is absent from this 7.14.3 product branch. #542 separately tracks stack-local authSecret cleanup.

Impact

High — explicit authorization rejection does not stop access to TOTP secrets/accounts. A host that previously caused the cache to load can continue an authenticator command after the user cancels passphrase entry or after authorization loss.

Acceptance criteria

• Make checkPassphrase() return bool and return from the dispatcher before the command switch on failure.
• Backport authenticator_clear_cache() semantics from the alpha remediation and invoke them on every authorization-loss path.
• Propagate every authenticator confirmation/review rejection.
• Zero temporary decoded secret, HMAC, and OTP buffers on every exit.
• Add tests: load cache, ClearSession/lock/Initialize/Cancel, reject passphrase, then prove no OTP/account data is returned and the persistent account reloads correctly only after reauthorization.

[BitHighlander]

Resolved on PR #604 at exact reviewed head d842f1e. Passphrase rejection now returns before authenticator dispatch, cancellation propagates, and plaintext passphrase/HMAC/OTP/temporary secret buffers are cleared. Native and wire regressions pass, as do both exact-head CI gates. Re-review attestation: #604 (comment). Leaving this issue open until merge.