feat(core/prodtest): enable writing MCU attestation certificate
What the developer wrote
Authored by Ondřej Vejpustek
feat(core/prodtest): enable writing MCU attestation certificate
[no changelog]
What changed, and why it matters
This commit changes a factory-production testing tool (prodtest) so that the commands for writing and reading the device's MCU attestation certificate also work in the software emulator, instead of returning 'not implemented'. In the emulator, the written certificate is only stored in memory and disappears after reboot. The change removes compile-time guards that previously disabled these commands for emulator builds. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a feature-enablement change for testing/development workflows.
Treat as a low-sensitivity feature commit. Review whether enabling certificate write/read in the emulator exposes any prodtest secrets or allows unintended certificate injection in CI/dev environments. Verify that mcu_attestation_write_cert() in the emulator does not persist to disk or leak across emulator restarts. No urgent security action is indicated by the diff alone.
Security signals we found
Removal of compile-time disabling of certificate write/read in emulator build
Certificate chain validation (check_device_cert_chain) is now exercised in emulator path
Emulator write path explicitly warns that certificate is non-persistent
No changelog entry provided ([no changelog])
No explicit security wording in commit title or message
Evidence from the diff
The patch modifies core/embed/projects/prodtest/cmd/prodtest_secrets.c. It removes #ifndef TREZOR_EMULATOR around check_device_cert_chain() and removes #ifdef TREZOR_EMULATOR early-error branches in prodtest_secrets_certdev_write() and prodtest_secrets_certdev_read(). For emulator builds, write now parses the certificate, validates the chain, writes it via mcu_attestation_write_cert(), and warns that persistence is only until reboot. Read now calls mcu_attestation_read_cert() and returns the data. The change is confined to the prodtest project and USE_MCU_ATTESTATION guard remains.
Changed components
core/embed/projects/prodtest/cmd/prodtest_secrets.cprodtest CLI command 'secrets certdev write'prodtest CLI command 'secrets certdev read'Trezor emulator build of prodtestInspect captured patch +6 / −11
diff --git a/core/embed/projects/prodtest/cmd/prodtest_secrets.c b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
index a2dd602d..35155dce 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_secrets.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
@@ -213,7 +213,6 @@ cleanup:
memzero(mcu_private, sizeof(mcu_private));
}
-#ifndef TREZOR_EMULATOR
static bool check_device_cert_chain(cli_t* cli, const uint8_t* chain,
size_t chain_size) {
bool ret = false;
@@ -263,7 +262,6 @@ cleanup:
memzero(rnd, sizeof(rnd));
return ret;
}
-#endif // TREZOR_EMULATOR
static void prodtest_secrets_certdev_write(cli_t* cli) {
if (cli_arg_count(cli) != 1) {
@@ -271,10 +269,6 @@ static void prodtest_secrets_certdev_write(cli_t* cli) {
return;
}
-#ifdef TREZOR_EMULATOR
- cli_error(cli, PRODTEST_ERR_SECRETS_CERTDEV_WRITE_NOT_IMPL,
- "Not implemented");
-#else
size_t certificate_length = 0;
uint8_t certificate[MCU_ATTESTATION_MAX_CERT_SIZE] = {0};
if (!cli_arg_hex(cli, "hex-data", certificate, sizeof(certificate),
@@ -301,8 +295,13 @@ static void prodtest_secrets_certdev_write(cli_t* cli) {
return;
}
- cli_ok(cli, "");
+#ifdef TREZOR_EMULATOR
+ cli_trace(cli,
+ "The certificate is not persistent, it will be wiped after "
+ "reboot");
#endif // TREZOR_EMULATOR
+
+ cli_ok(cli, "");
}
static void prodtest_secrets_certdev_read(cli_t* cli) {
@@ -311,9 +310,6 @@ static void prodtest_secrets_certdev_read(cli_t* cli) {
return;
}
-#ifdef TREZOR_EMULATOR
- cli_error(cli, PRODTEST_ERR_SECRETS_CERTDEV_READ_NOT_IMPL, "Not implemented");
-#else
uint8_t certificate[MCU_ATTESTATION_MAX_CERT_SIZE] = {0};
size_t certificate_length = 0;
@@ -325,7 +321,6 @@ static void prodtest_secrets_certdev_read(cli_t* cli) {
}
cli_ok_hexdata(cli, certificate, certificate_length);
-#endif // TREZOR_EMULATOR
}
#endif // USE_MCU_ATTESTATION
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.