Hello,
First of all, you can’t be buying hardware from SatoshiLabs if you don’t trust SatoshiLabs at least a little. Even if we ignore nation-state level stuff like building a custom chip that looks identical to a STM32, there’s a lot of things the pre-loaded software can do to mess with your verification attempts.
The only true way around this issue is to buy components off the shelf and assemble a custom T1 at home.
For now, let’s assume that the fact that everything is legit if you build a custom T1 indicates that it works the same on an official T1 (in other words, SatoshiLabs is not actively malicious and is not subverting its own firmwares on its own hardware).
Bootloader is not actually signed separately. The firmware however has a list of known bootloader hashes, i.e., for every firmware version, the bootloader must be in a hard-coded list of known bootloaders.
This btw means that you can’t install too old firmware on a too new bootloader, because it will not recognize the bootloader and fail.
Correct.
Exactly. The code is here.
You can do this, but it’s kind of pointless. The firmware always contains its own bootloader and replaces the installed one with the firmware one. If you trust the firmware that it does the check right, you can also trust it that it will do the replacement right.
If you want to be extra thorough, you could check out bootloaders from the versions in known_bootloader, build them, and verify that the hashes match. This might however prove difficult, because historically the build was not entirely reproducible. Results can depend on compiler version, which was not properly pinned, and so trying to get the same result might be hit-and-miss.
Sure.
You can. If you use trezorctl from git of the firmware repository, there are even commands that do it:
trezorctl fw download
trezorctl fw verify trezor-1.10.3.bin
trezorctl fw update -f trezor-1.10.3.bin
(In the released version, there is only a single command firmware-update that does all three at once.)
Oh, no, that is very much not guaranteed. For starters, there is no guarantee that the pre-installed bootloader actually installs the firmware that you upload. What it could do instead is extract the version number and report it next time you start the Trezor.
As pointed out at start of my post, there is really a lot that the pre-installed software can do to trick you.
A relatively good way to verify that there is no hidden firmware is to build your own firmware that is exactly as big as the T1 memory, filled with random garbage, and when you boot it up, it shows the hash of itself on the screen. It’s technically possible for a hidden software to show you the right result and still remain malicious in the background, but we’re solidly pushing the attacker into the realm of nation-states.