Public commit record
57/100 · Thin
What the developer wrote
Authored by Ondřej Vejpustek
chore: add debug root ed25519 key
[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
What changed, and why it matters
This commit adds a new public 'debug' root key for verifying device authentication certificates on a Trezor hardware wallet variant (T3W1). It is a public key addition only, not a code change that fixes or introduces a vulnerability. The key is labeled 'DEBUG', which typically means it is used in development/testing environments rather than for production devices. The change also updates a test to use this debug key. There is no direct security issue visible in the diff itself, but adding debug trust roots is a sensitive configuration change that must be carefully reviewed to ensure it cannot be misused to bypass production authentication.
Recommended action
Verify that DEV_AUTH_ROOT_DEBUG_ED25519 is only used in debug/prodtest builds and is excluded from production firmware and production verification tooling. Confirm the corresponding private key is held under the same controls as other debug/staging keys and is not exposed. Review build-time gating to ensure this root cannot be accidentally enabled in release builds.
Security signals we found
01
Addition of a debug root authentication key
02
Test fixture switched from an unspecified key to the new debug root key
03
No code logic changes; only key material/configuration
04
Debug trust roots can be a supply-chain risk if enabled in production builds
Evidence from the diff
The commit adds DEV_AUTH_ROOT_DEBUG_ED25519, a 32-byte Ed25519 public key, to three files: common/hsm_keys.json, core/embed/projects/prodtest/cmd/hsm_keys.h, and python/src/trezorlib/_root_keys.py. It also updates tests/device_tests/certificate.py to use this debug key as the TROPIC_ROOT_PUBLIC_KEY for model T3W1. The change is purely additive and consistent with existing DEBUG_P256 and STAGING_ED25519 entries. No logic changes are present. The security relevance depends on whether this debug root is compiled into production firmware or only into prodtest/debug builds; the diff alone does not show that. If included in production, it could allow devices signed with the corresponding private key to be accepted as authentic, which would be a supply-chain/trust issue. The commit message is a routine ‘chore’ with [no changelog].
Changed components
common/hsm_keys.jsoncore/embed/projects/prodtest/cmd/hsm_keys.hpython/src/trezorlib/_root_keys.pytests/device_tests/certificate.pyInspect captured patch +10 / −1
diff --git a/common/hsm_keys.json b/common/hsm_keys.json
index 1f8eb243..1ca52841 100644
--- a/common/hsm_keys.json
+++ b/common/hsm_keys.json
@@ -26,6 +26,7 @@
"DEV_AUTH_ROOT_PROD_BACKUP_MLDSA44": "fedf8b0c16164b9cec427882aa03d3bd6a1588cfbaebaf93cf2fc52f275417777433a938dcd6516345148f728c935a40ef3b6c41fd3ed831fea13774bd39887da8b06e2e671cc32a1c72e44a13d1cd985dc2ddcb63e457bbd29d38186ddb776b8e73b645c8bf616309f890d175538a9d10c82e595dea03f70564ff69b53497ecefd51fd8320041d9b1092386033ed37a93dd9b4b9da1297f808eac21020b8dc4747e01854ebdc407a04fc18b2758720125acb41f0c60e16cd53707a65392feed06c9fcc28a3e738dbc91614e89e5d535274c6b226d83f335a0dd088755571cf62496ca4642ec8e65eba8be2b8cec46416c6a3ad4be10569ac532e02d6e06b6ce0c0d4b7a99a11c910f9f0631b0cd72e20637237eeff723e722f7aa626732434c47843a099739e96e31267d8d6905d8b2b712a5a69d9343a3c1e07afb414b73950f4b1df196243005fb61c6200ef346826d6c0f4cc8ede052ed48235997bb366dade4483bfc11fe65fd0c5539e89d8bd271e54e30da6e5192a0f343dea3806aa798d12d62251a063d071ba67c35d3a26e582c2d361cf2d0fc36fb1b5a46e469669338b1c1744bdfe365700a6a1c641ab2b7906e2b7c0c0a9af8862ab5751a678e3e0156847ff6093ca7ebd48dd8b1d6f7736c2039e705c1e20f42ed5cac6db3dc7a7e2facbb75411e7fb8a156df52a2926afa9070937cde4dd4bd456294ba59bdcf123f11dcda267d475721abfecab1b31848a27236aa751e5b55015f033d87fb9cf5c086e09f1667cf7ec2e72436c907c5763690d698fffa997709bb89526cae772bb962c06ed1b89d418835672b85e1a1b2e3c55f4e607ecad09bdb3a18224b9805659aa2ecf0b62dbf6265e27d4101450edb590d52d525b62b1114dad2eb06c951a2c77c7ecfbf5f1f6fe285f39727958ce0b5cfe8fd465420c270309999e6694ee31fcb7d6480a75d0d72558cd6a050b8d11a9a6d7736700027fbe14b48949b7e1af2ca148ad4e4b4b93e9575a4119afd1b57c250606d5a4e258c2393c104d651995b1e75887f492ff05e92e1630332f176d86a0453b412d0869d98d6ab27377a74766e3cadde29c1853e6398a9edfa48c0d14e7c148b048f1bf25d11979e94878cb86eaf1e55638c1b39e0ac5254a009bf957f4b624796753c3451246e5a7b9022926aa77b7a1b4ae7d25f776d4395ba98a37d9e21b221da29564e50a669056650a40489386e8909c6ca21d369c3495c44b2f71373a392c9fa89c9085f467d24d6219fcdd2b56126792eb6a14269c4264a56926b1a7d9a1c03d9649d157f938abfdc2a56c20795065774838030da41a4c6178919cc1c6c88de1458d9baa1e51a4a1994e6d5cc94b049b15c235c5cf46d2cf23f09d565c5a5497ef0b3a5fbc8d1be8ed78f3794c49d4936139b0419faaffc52b55cb91f6e1bafacd55523c0b7eec56d98e4228cd0f9d00bc9866dac71e43db2b2cf311999d7bc3a49219836f558cbb5d8faa79e83079c6ce92288aae852553b655ef6bc87fbb25ca3ab482aecaf0a86eecc92341906cc89d234087f5abd6d2100a60d361d516d460d436b46706ad44b8b4ef3fe54ea198ffc2cf8c8e144ec62c4ce86ed5d181283fc17c926668ca4e0b8683e0c7bc662a54ea7f4c830365ad1cdea58abee9a726168ce9870729972884ecfe5baf06f1ee664aa422e26f9f76e20908d72e78c1a2dcd94fe1c07573d7706d7bdc07d0b41498c0d52ec3a90d6e7c0fcef597a884fb2caba29c2279569a1e64dd6c7ed4b312d2197b6391407899b25d21cefd1408eca42204f76cb0436f44c0a9c2e1eca19df8d93255c0da6469dc47da883e186387f76011cc8",
"DEV_AUTH_ROOT_DEBUG_P256": "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578",
"DEV_AUTH_ROOT_STAGING_P256": "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519",
+ "DEV_AUTH_ROOT_DEBUG_ED25519": "04e3856182309678a15767451f931ed86617b1d25462afcbddc81dc80bfc1661",
"DEV_AUTH_ROOT_STAGING_ED25519": "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b",
"DEV_AUTH_ROOT_STAGING_MLDSA44": "1f3e5edad45fc6980dbfd597ed17b77e4d4ad1b1ec4804e04dc061cc2cfe77bc96fbc93f698f1fe00c47177c8150276dab86cbf407add7527deb09b65a6623ef581422292d77744be64f4401ca65b9bd027e32a76f307413b086869eccbcfc5e8823be8e0b3897727bca568feeff62957cd1e261e4aab67271725d240c7e7d2a20a5c201699be83d6c6a57fdfc09ac9b6b599e2a14a50e421d246d1d1df805db0b25534e500fed76fa89975a4270e274a9fa72b528e47d999abdeca5e08e51d447ae4019f699088d485bb52d5eec7a8c725cd34ff955c16437877a131f068438b5699c2285000463e24c633b023cde279be015db2f8b16de07fa82ee9adcbf868b898e25eeef5d60d03e1da874aca6f2089b1e7c72d7b532d3a27e38936d53c0080f9908b6727b13fe961ec8b08004f077b9cce95b5eee9b44d351e79eb222aba1bc18895d36cf4843ffcdfc735e1b66f3e72db5aaf8b5ecf56dbf0d616cf53d192a60e61ad3c51a595213100fd00835434a28aab3eb5949d3405de5db1a586bd6e937444913e9f1d4c00247acd49a2ed9953636e5d74417b4c7144c6c22fd8f7e25cb6cf6c8510de6915b74c95a28c197152208096d0249b86150e807978ca985c110d07b7d0a24434039f6ef12a69d3e073af6ae44e7c4606a354a3e953bdcff10c8dc68b807f41ac563ff0d7141c328b34152a25a16e9cb8228f7707356d2d7f3caa8d778a85e3b66242c124281c0f3201ad28596b868db138149eb98b821dcaaf86b5e11c2ac1161975bf0b2ecefc111b7b7401ce261911526618044d126eeee885efe51be0e32e93aaaffe34899df5b10df7c5a9c54c5b4704671640a92e8631f0d401f44c2238b5f9a37499b3d83c1c60096f2b48c3081dd9769db325c1cd1ffe84bfd8a80dde3cd650c49e14af3ab6c317ee74bd39e976ff5b7ad490e80f3eff9edf3b3855070a5a06fbe9cbca54f521e3d74cf13a4d116e23e531a7c70232c044b7e7d02467afe2a40def14298688eced5d3d87a102d31d7cd5409918ced4bab190505df48f451deea1c29168246d621529f0346eaab0e2302f3ce206dd84837704b8bdedbadea5b5822cdecbfdb180cde14e62ee26a929f0a37a99bacfe237376a3e6c289b06b8e93ed9d1435e3ee6399ab1a06d4f70097f80e26fe6f60b27a68104f6333b8db1bc78e12d54647b23feb0f11ae070f3a6be9d9f4d89a6b5ef8595d010d410e72138cfcbd5e41cca1df33ddad657b699cf4d3dc602888e5aaa0a7a2325ba4a36d7de49c591d8e355fd1de644d772bf2a060093743388dbe5d30a2d97304abc17c547bd65276291d6aa7b0723703733239fabef39c2de47071d50074e68fbe71c88f75d4510bb5f6bc244b3e7b219eb89fe5f148459a2d693cd3fac32aa069cbdd4e27c9778096f6805bf6df9aec9671f0a58b28704f74775e81ac46826c1c4709b0e0989d6e8e73bd1795ce85d85c14ad2997cd2810272a5682e7ed9aa7a092708c0f4bc67f68d317d406a96ddd2842ea22cbf3410cd7a77005b61115b794894cf9d10ebb4f5552bec8c21d90ba97d6139d5261d7f51f4009c3618f9feb22cc929ade204eca7c0f813409ceb88a13512f85e03948314ba9c4488aafda88ce447a0e052a6a605e32d04a20e2e52c41f371247963f24fc28c5cc1ddd8fe1681a2a293daf2688e9b026303a76cc60f40290c4d823efb85f36cb5e092369cc20515a8077e7702ed54ca1565d37b83184ee46c4a6adf2840f5a5fb002db70690bbf93888e685fdd1f9ea211b42693e0bd5ba5235a6ea1b714774d13279d7db3440f7fbced53f203ce6500555bcb9251e6f36d3352326501c"
}
diff --git a/core/embed/projects/prodtest/cmd/hsm_keys.h b/core/embed/projects/prodtest/cmd/hsm_keys.h
index 697cf492..8ac49a63 100644
--- a/core/embed/projects/prodtest/cmd/hsm_keys.h
+++ b/core/embed/projects/prodtest/cmd/hsm_keys.h
@@ -358,6 +358,11 @@
0x60, 0x0e, 0x2c, 0xaa, 0xd6, 0x89, 0x40, 0x16, 0xfe, 0xe8, 0x19, \
0xd6, 0x23, 0xb9, 0x5d, 0x66, 0x21, 0x0c, 0x3e, 0x75, 0x19}
+#define DEV_AUTH_ROOT_DEBUG_ED25519 \
+ {0x04, 0xe3, 0x85, 0x61, 0x82, 0x30, 0x96, 0x78, 0xa1, 0x57, 0x67, \
+ 0x45, 0x1f, 0x93, 0x1e, 0xd8, 0x66, 0x17, 0xb1, 0xd2, 0x54, 0x62, \
+ 0xaf, 0xcb, 0xdd, 0xc8, 0x1d, 0xc8, 0x0b, 0xfc, 0x16, 0x61}
+
#define DEV_AUTH_ROOT_STAGING_ED25519 \
{0xcd, 0x31, 0x8d, 0xc8, 0x40, 0x5a, 0xe4, 0xf4, 0x14, 0x4e, 0x32, \
0x84, 0xdc, 0xb7, 0xb0, 0xcb, 0x0f, 0x0c, 0x21, 0x95, 0xc2, 0xca, \
diff --git a/python/src/trezorlib/_root_keys.py b/python/src/trezorlib/_root_keys.py
index 3f031ca0..56ef1875 100644
--- a/python/src/trezorlib/_root_keys.py
+++ b/python/src/trezorlib/_root_keys.py
@@ -47,6 +47,8 @@ T3W1_DEV_AUTH_ROOT_DEBUG_P256_HEX = "04521192e173a9da4e3023f747d836563725372681e
T3W1_DEV_AUTH_ROOT_STAGING_P256_HEX = "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519"
+T3W1_DEV_AUTH_ROOT_DEBUG_ED25519_HEX = "04e3856182309678a15767451f931ed86617b1d25462afcbddc81dc80bfc1661"
+
T3W1_DEV_AUTH_ROOT_STAGING_ED25519_HEX = "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b"
T3W1_DEV_AUTH_ROOT_STAGING_MLDSA44_HEX = "1f3e5edad45fc6980dbfd597ed17b77e4d4ad1b1ec4804e04dc061cc2cfe77bc96fbc93f698f1fe00c47177c8150276dab86cbf407add7527deb09b65a6623ef581422292d77744be64f4401ca65b9bd027e32a76f307413b086869eccbcfc5e8823be8e0b3897727bca568feeff62957cd1e261e4aab67271725d240c7e7d2a20a5c201699be83d6c6a57fdfc09ac9b6b599e2a14a50e421d246d1d1df805db0b25534e500fed76fa89975a4270e274a9fa72b528e47d999abdeca5e08e51d447ae4019f699088d485bb52d5eec7a8c725cd34ff955c16437877a131f068438b5699c2285000463e24c633b023cde279be015db2f8b16de07fa82ee9adcbf868b898e25eeef5d60d03e1da874aca6f2089b1e7c72d7b532d3a27e38936d53c0080f9908b6727b13fe961ec8b08004f077b9cce95b5eee9b44d351e79eb222aba1bc18895d36cf4843ffcdfc735e1b66f3e72db5aaf8b5ecf56dbf0d616cf53d192a60e61ad3c51a595213100fd00835434a28aab3eb5949d3405de5db1a586bd6e937444913e9f1d4c00247acd49a2ed9953636e5d74417b4c7144c6c22fd8f7e25cb6cf6c8510de6915b74c95a28c197152208096d0249b86150e807978ca985c110d07b7d0a24434039f6ef12a69d3e073af6ae44e7c4606a354a3e953bdcff10c8dc68b807f41ac563ff0d7141c328b34152a25a16e9cb8228f7707356d2d7f3caa8d778a85e3b66242c124281c0f3201ad28596b868db138149eb98b821dcaaf86b5e11c2ac1161975bf0b2ecefc111b7b7401ce261911526618044d126eeee885efe51be0e32e93aaaffe34899df5b10df7c5a9c54c5b4704671640a92e8631f0d401f44c2238b5f9a37499b3d83c1c60096f2b48c3081dd9769db325c1cd1ffe84bfd8a80dde3cd650c49e14af3ab6c317ee74bd39e976ff5b7ad490e80f3eff9edf3b3855070a5a06fbe9cbca54f521e3d74cf13a4d116e23e531a7c70232c044b7e7d02467afe2a40def14298688eced5d3d87a102d31d7cd5409918ced4bab190505df48f451deea1c29168246d621529f0346eaab0e2302f3ce206dd84837704b8bdedbadea5b5822cdecbfdb180cde14e62ee26a929f0a37a99bacfe237376a3e6c289b06b8e93ed9d1435e3ee6399ab1a06d4f70097f80e26fe6f60b27a68104f6333b8db1bc78e12d54647b23feb0f11ae070f3a6be9d9f4d89a6b5ef8595d010d410e72138cfcbd5e41cca1df33ddad657b699cf4d3dc602888e5aaa0a7a2325ba4a36d7de49c591d8e355fd1de644d772bf2a060093743388dbe5d30a2d97304abc17c547bd65276291d6aa7b0723703733239fabef39c2de47071d50074e68fbe71c88f75d4510bb5f6bc244b3e7b219eb89fe5f148459a2d693cd3fac32aa069cbdd4e27c9778096f6805bf6df9aec9671f0a58b28704f74775e81ac46826c1c4709b0e0989d6e8e73bd1795ce85d85c14ad2997cd2810272a5682e7ed9aa7a092708c0f4bc67f68d317d406a96ddd2842ea22cbf3410cd7a77005b61115b794894cf9d10ebb4f5552bec8c21d90ba97d6139d5261d7f51f4009c3618f9feb22cc929ade204eca7c0f813409ceb88a13512f85e03948314ba9c4488aafda88ce447a0e052a6a605e32d04a20e2e52c41f371247963f24fc28c5cc1ddd8fe1681a2a293daf2688e9b026303a76cc60f40290c4d823efb85f36cb5e092369cc20515a8077e7702ed54ca1565d37b83184ee46c4a6adf2840f5a5fb002db70690bbf93888e685fdd1f9ea211b42693e0bd5ba5235a6ea1b714774d13279d7db3440f7fbced53f203ce6500555bcb9251e6f36d3352326501c"
diff --git a/tests/device_tests/certificate.py b/tests/device_tests/certificate.py
index 88737661..8a926c18 100644
--- a/tests/device_tests/certificate.py
+++ b/tests/device_tests/certificate.py
@@ -25,7 +25,8 @@ OPTIGA_ROOT_PUBLIC_KEY = {
TROPIC_ROOT_PUBLIC_KEY = {
models.T3W1: bytes.fromhex(
- "1ab1c5f12f4570e0de5c16a8d9feea381f53c8d813feeb0eb2fb7f393f2b6b5f"
+ # This is `DEV_AUTH_ROOT_DEBUG_ED25519` from `hsm_keys.json`
+ "04e3856182309678a15767451f931ed86617b1d25462afcbddc81dc80bfc1661"
),
}
Risk score
Our methodology →Why this scored 18/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.