chore: add debug root ML-DSA key

Trezor/Trezor firmware

17f783cd View source ↗

Public commit record

What the developer wrote

Authored by Ondřej Vejpustek

57/100 · Thin

chore: add debug root ML-DSA key

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit adds a new public 'debug' root key for a quantum-resistant signature scheme called ML-DSA-44. It is labeled DEBUG, which means it is intended only for development/testing and is not a production key. The change only inserts a public key into three data files; it does not change any code logic. By itself, this commit does not create a security vulnerability, but adding debug keys is a routine part of preparing secure-boot or device-authentication infrastructure.

Recommended action

No immediate action is required. Treat this as a routine infrastructure/key-data update. If reviewing for supply-chain security, verify that DEBUG keys are not compiled into production firmware images or trusted by production verification logic, and confirm the key was generated and stored according to the project's debug-key management policy.

Security signals we found

Addition of a DEBUG-labeled root public key for ML-DSA-44

No executable code changes; only key material constants added

Key is added to HSM/prodtest key list and Python library root-key module

Existing adjacent keys use the same DEBUG/STAGING naming convention

Technical analysis

Evidence from the diff

The commit adds a single new root public key, DEV_AUTH_ROOT_DEBUG_MLDSA44, to common/hsm_keys.json, core/embed/projects/prodtest/cmd/hsm_keys.h, and python/src/trezorlib/root_keys.py. The key is a 1312-byte ML-DSA-44 public key (hex encoded). It sits alongside existing DEV_AUTH_ROOT_DEBUG and STAGING_ keys for P-256, Ed25519, and ML-DSA-44. No executable code is modified. The key is marked DEBUG, indicating it is for non-production use. There is no indication in the commit that this key is trusted in production verification paths.

Changed components

common/hsm_keys.jsoncore/embed/projects/prodtest/cmd/hsm_keys.hpython/src/trezorlib/_root_keys.py

Inspect captured patch +116 / −0

diff --git a/common/hsm_keys.json b/common/hsm_keys.json
index 1ca52841..f0ad25cc 100644
--- a/common/hsm_keys.json
+++ b/common/hsm_keys.json
@@ -28,6 +28,7 @@
       "DEV_AUTH_ROOT_STAGING_P256": "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519",
       "DEV_AUTH_ROOT_DEBUG_ED25519": "04e3856182309678a15767451f931ed86617b1d25462afcbddc81dc80bfc1661",
       "DEV_AUTH_ROOT_STAGING_ED25519": "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b",
+      "DEV_AUTH_ROOT_DEBUG_MLDSA44": "5a61ce3b69fba4941df3679245d144dde75cfbb583f95d3572fa1260a055cbdaadae1eba65d4a9dea1ba61b10d5a8b560411786cf74caa11552efd9f4290ee81ec9b125ea1ae613cb6740112019134718b0b885cd98dfcb3b1ece95c57b3d6dbb38349db5f977128dcc39a05c321cdd2df86aed29ff9779e51a3a69b44ad300c886559087b2def34972fa19fa23019d625452847675770eab62c8f3970f7d978e0fee482a542c876c42f7005ca52a242327c41f65aeca792f22e6d94bd2eaf36813ce6bb1c8b3947c49813d4aee9c225419af1b5506853cd5bf3d9207a0b379d8cd446118178fe0fd8c46e625575e592ab16e6b90b6e44cc4c1e5d66132078916e9c476e95567b7d964891f6753cd3ee883e607be15605e6fdd77514722dfcea0b01d0d1b4a71c86d617963ae1f5ebdbbbf3500cac6bcd32ca46b18e01e43d156b75d159f0edd341e25b5ad345175dbadcb1ba2a46e11e9a502f66ccbbf0f69c75dab9906929636a2ec8acb3a4c02fda3ca734b226328e85a66be9e61e2eec3ba29946436cd0796980d95d0a53aa65de9b6a84a3bcf93be06da343f2aacdd42c182083d6bf3d5b841ce1db9a3da5f5c5788521d37c5f4dd429377fa830e381ddc88255b47b761a8efee2821b5479abe26d3ddca1ac97979936d6d925b0d8455e9709f95945f7b0f6a559d5ec6cfe227d1b889b17598e58402d278ee68486563b1b7e3a379d32f191095637e8f3881b8e62d1549b71a82c40a78f3861bf5f6657ffd21ddf20918934b27ca390ff573987fb16d3c0759a33a1a3f8b0c47acbbfae98dd510707987a5f830a0da345fd9e096b6f2ca421292649b6302b2c0a391a7085943ac1d8d7f957088d28af40d6ea4a67ce4f0d58f277313d1c75cc5e9552fe1c06b9f0ff6311262715485dee2c4840ade5941e8b66d787c76c75d8b2eb74138c81c4e0f2a1dfb935c4b0df9b37fa10669b45460b7300f0eddaa42111cf66a45a120754745ca25448fb801edfeb77e8eb13d337ac5c58a08e7e2a3bde074fb43d7ca62f5edd06f991fb01ca41aac5d3e5370689b317651955bd7ea747cc1942fdd499ba9bfb8fed8c81154eeeddaa8853e189a8815c3a992fcec7924cc0a2e90c8076a95571f2105acc44fa46b3dd60792963336bd2eb764c48a9940173177610589482bfc4a728de120708b48dd857dca209df2275f2c077ea84c4dfb73dbda2615c2bbbc2449f2c9ca0e9b3c97b1393445e7f18848ea2748b6b2843fcea57e78390398545c5e7535273f6108d99a105225fb137174633a27bbb042d2f5b70dde53a6c0f8fc944bbdf6bb58c9e59e9c3d0e4909a081435c97485f99c4b1de80a43c0a73697cc601c3ec83974fbc1662a3869ee85a1095e80f759cb687a6060f7696407cead663415f5005717d69933180d45a3c365e513a5eff234d7165ed5b1852462057d355d10bc4730f22833fb27dc92faa2db4c70af2063bb78da23509033365c03c7daa3d150b76ce42748c9a58569bc8538354d4fdda1c188ca45cdb9429c708a9771211a8fd0fc5c79c5921c20cd23f64c215e8776ac5d848142745f1aad28d188f59686203360b2d0d3e4bb6200281331ce986d3e8cf4ec988aa54fdf1cb4b8f80f6e8b5e7224e6c67086ad526837fad4eaac50225665bb140877b8ea87e0d1a8bc69beaa5ab58c11e2c1f5c979c3a69614c7ffa87274d27f11640d5cae60294aea8002c2bdfb3665767636a74c0cac5b3bb7659dd72212bb462208fb36b634a0169aa85a5803e81962185e34d678213ae8ca369bbea4cd72938e0166c54c8381f84adbf9aef4c7d5430d1c7ebaad897e137b0641c133c6a53881",
       "DEV_AUTH_ROOT_STAGING_MLDSA44": "1f3e5edad45fc6980dbfd597ed17b77e4d4ad1b1ec4804e04dc061cc2cfe77bc96fbc93f698f1fe00c47177c8150276dab86cbf407add7527deb09b65a6623ef581422292d77744be64f4401ca65b9bd027e32a76f307413b086869eccbcfc5e8823be8e0b3897727bca568feeff62957cd1e261e4aab67271725d240c7e7d2a20a5c201699be83d6c6a57fdfc09ac9b6b599e2a14a50e421d246d1d1df805db0b25534e500fed76fa89975a4270e274a9fa72b528e47d999abdeca5e08e51d447ae4019f699088d485bb52d5eec7a8c725cd34ff955c16437877a131f068438b5699c2285000463e24c633b023cde279be015db2f8b16de07fa82ee9adcbf868b898e25eeef5d60d03e1da874aca6f2089b1e7c72d7b532d3a27e38936d53c0080f9908b6727b13fe961ec8b08004f077b9cce95b5eee9b44d351e79eb222aba1bc18895d36cf4843ffcdfc735e1b66f3e72db5aaf8b5ecf56dbf0d616cf53d192a60e61ad3c51a595213100fd00835434a28aab3eb5949d3405de5db1a586bd6e937444913e9f1d4c00247acd49a2ed9953636e5d74417b4c7144c6c22fd8f7e25cb6cf6c8510de6915b74c95a28c197152208096d0249b86150e807978ca985c110d07b7d0a24434039f6ef12a69d3e073af6ae44e7c4606a354a3e953bdcff10c8dc68b807f41ac563ff0d7141c328b34152a25a16e9cb8228f7707356d2d7f3caa8d778a85e3b66242c124281c0f3201ad28596b868db138149eb98b821dcaaf86b5e11c2ac1161975bf0b2ecefc111b7b7401ce261911526618044d126eeee885efe51be0e32e93aaaffe34899df5b10df7c5a9c54c5b4704671640a92e8631f0d401f44c2238b5f9a37499b3d83c1c60096f2b48c3081dd9769db325c1cd1ffe84bfd8a80dde3cd650c49e14af3ab6c317ee74bd39e976ff5b7ad490e80f3eff9edf3b3855070a5a06fbe9cbca54f521e3d74cf13a4d116e23e531a7c70232c044b7e7d02467afe2a40def14298688eced5d3d87a102d31d7cd5409918ced4bab190505df48f451deea1c29168246d621529f0346eaab0e2302f3ce206dd84837704b8bdedbadea5b5822cdecbfdb180cde14e62ee26a929f0a37a99bacfe237376a3e6c289b06b8e93ed9d1435e3ee6399ab1a06d4f70097f80e26fe6f60b27a68104f6333b8db1bc78e12d54647b23feb0f11ae070f3a6be9d9f4d89a6b5ef8595d010d410e72138cfcbd5e41cca1df33ddad657b699cf4d3dc602888e5aaa0a7a2325ba4a36d7de49c591d8e355fd1de644d772bf2a060093743388dbe5d30a2d97304abc17c547bd65276291d6aa7b0723703733239fabef39c2de47071d50074e68fbe71c88f75d4510bb5f6bc244b3e7b219eb89fe5f148459a2d693cd3fac32aa069cbdd4e27c9778096f6805bf6df9aec9671f0a58b28704f74775e81ac46826c1c4709b0e0989d6e8e73bd1795ce85d85c14ad2997cd2810272a5682e7ed9aa7a092708c0f4bc67f68d317d406a96ddd2842ea22cbf3410cd7a77005b61115b794894cf9d10ebb4f5552bec8c21d90ba97d6139d5261d7f51f4009c3618f9feb22cc929ade204eca7c0f813409ceb88a13512f85e03948314ba9c4488aafda88ce447a0e052a6a605e32d04a20e2e52c41f371247963f24fc28c5cc1ddd8fe1681a2a293daf2688e9b026303a76cc60f40290c4d823efb85f36cb5e092369cc20515a8077e7702ed54ca1565d37b83184ee46c4a6adf2840f5a5fb002db70690bbf93888e685fdd1f9ea211b42693e0bd5ba5235a6ea1b714774d13279d7db3440f7fbced53f203ce6500555bcb9251e6f36d3352326501c"
     }
   }
diff --git a/core/embed/projects/prodtest/cmd/hsm_keys.h b/core/embed/projects/prodtest/cmd/hsm_keys.h
index 8ac49a63..493b97db 100644
--- a/core/embed/projects/prodtest/cmd/hsm_keys.h
+++ b/core/embed/projects/prodtest/cmd/hsm_keys.h
@@ -368,6 +368,119 @@
    0x84, 0xdc, 0xb7, 0xb0, 0xcb, 0x0f, 0x0c, 0x21, 0x95, 0xc2, 0xca, \
    0x14, 0xa0, 0xf6, 0xfc, 0xcd, 0x91, 0x04, 0xe3, 0x2a, 0x4b}
 
+#define DEV_AUTH_ROOT_DEBUG_MLDSA44                                           \
+  {                                                                           \
+      0x5a, 0x61, 0xce, 0x3b, 0x69, 0xfb, 0xa4, 0x94, 0x1d, 0xf3, 0x67, 0x92, \
+      0x45, 0xd1, 0x44, 0xdd, 0xe7, 0x5c, 0xfb, 0xb5, 0x83, 0xf9, 0x5d, 0x35, \
+      0x72, 0xfa, 0x12, 0x60, 0xa0, 0x55, 0xcb, 0xda, 0xad, 0xae, 0x1e, 0xba, \
+      0x65, 0xd4, 0xa9, 0xde, 0xa1, 0xba, 0x61, 0xb1, 0x0d, 0x5a, 0x8b, 0x56, \
+      0x04, 0x11, 0x78, 0x6c, 0xf7, 0x4c, 0xaa, 0x11, 0x55, 0x2e, 0xfd, 0x9f, \
+      0x42, 0x90, 0xee, 0x81, 0xec, 0x9b, 0x12, 0x5e, 0xa1, 0xae, 0x61, 0x3c, \
+      0xb6, 0x74, 0x01, 0x12, 0x01, 0x91, 0x34, 0x71, 0x8b, 0x0b, 0x88, 0x5c, \
+      0xd9, 0x8d, 0xfc, 0xb3, 0xb1, 0xec, 0xe9, 0x5c, 0x57, 0xb3, 0xd6, 0xdb, \
+      0xb3, 0x83, 0x49, 0xdb, 0x5f, 0x97, 0x71, 0x28, 0xdc, 0xc3, 0x9a, 0x05, \
+      0xc3, 0x21, 0xcd, 0xd2, 0xdf, 0x86, 0xae, 0xd2, 0x9f, 0xf9, 0x77, 0x9e, \
+      0x51, 0xa3, 0xa6, 0x9b, 0x44, 0xad, 0x30, 0x0c, 0x88, 0x65, 0x59, 0x08, \
+      0x7b, 0x2d, 0xef, 0x34, 0x97, 0x2f, 0xa1, 0x9f, 0xa2, 0x30, 0x19, 0xd6, \
+      0x25, 0x45, 0x28, 0x47, 0x67, 0x57, 0x70, 0xea, 0xb6, 0x2c, 0x8f, 0x39, \
+      0x70, 0xf7, 0xd9, 0x78, 0xe0, 0xfe, 0xe4, 0x82, 0xa5, 0x42, 0xc8, 0x76, \
+      0xc4, 0x2f, 0x70, 0x05, 0xca, 0x52, 0xa2, 0x42, 0x32, 0x7c, 0x41, 0xf6, \
+      0x5a, 0xec, 0xa7, 0x92, 0xf2, 0x2e, 0x6d, 0x94, 0xbd, 0x2e, 0xaf, 0x36, \
+      0x81, 0x3c, 0xe6, 0xbb, 0x1c, 0x8b, 0x39, 0x47, 0xc4, 0x98, 0x13, 0xd4, \
+      0xae, 0xe9, 0xc2, 0x25, 0x41, 0x9a, 0xf1, 0xb5, 0x50, 0x68, 0x53, 0xcd, \
+      0x5b, 0xf3, 0xd9, 0x20, 0x7a, 0x0b, 0x37, 0x9d, 0x8c, 0xd4, 0x46, 0x11, \
+      0x81, 0x78, 0xfe, 0x0f, 0xd8, 0xc4, 0x6e, 0x62, 0x55, 0x75, 0xe5, 0x92, \
+      0xab, 0x16, 0xe6, 0xb9, 0x0b, 0x6e, 0x44, 0xcc, 0x4c, 0x1e, 0x5d, 0x66, \
+      0x13, 0x20, 0x78, 0x91, 0x6e, 0x9c, 0x47, 0x6e, 0x95, 0x56, 0x7b, 0x7d, \
+      0x96, 0x48, 0x91, 0xf6, 0x75, 0x3c, 0xd3, 0xee, 0x88, 0x3e, 0x60, 0x7b, \
+      0xe1, 0x56, 0x05, 0xe6, 0xfd, 0xd7, 0x75, 0x14, 0x72, 0x2d, 0xfc, 0xea, \
+      0x0b, 0x01, 0xd0, 0xd1, 0xb4, 0xa7, 0x1c, 0x86, 0xd6, 0x17, 0x96, 0x3a, \
+      0xe1, 0xf5, 0xeb, 0xdb, 0xbb, 0xf3, 0x50, 0x0c, 0xac, 0x6b, 0xcd, 0x32, \
+      0xca, 0x46, 0xb1, 0x8e, 0x01, 0xe4, 0x3d, 0x15, 0x6b, 0x75, 0xd1, 0x59, \
+      0xf0, 0xed, 0xd3, 0x41, 0xe2, 0x5b, 0x5a, 0xd3, 0x45, 0x17, 0x5d, 0xba, \
+      0xdc, 0xb1, 0xba, 0x2a, 0x46, 0xe1, 0x1e, 0x9a, 0x50, 0x2f, 0x66, 0xcc, \
+      0xbb, 0xf0, 0xf6, 0x9c, 0x75, 0xda, 0xb9, 0x90, 0x69, 0x29, 0x63, 0x6a, \
+      0x2e, 0xc8, 0xac, 0xb3, 0xa4, 0xc0, 0x2f, 0xda, 0x3c, 0xa7, 0x34, 0xb2, \
+      0x26, 0x32, 0x8e, 0x85, 0xa6, 0x6b, 0xe9, 0xe6, 0x1e, 0x2e, 0xec, 0x3b, \
+      0xa2, 0x99, 0x46, 0x43, 0x6c, 0xd0, 0x79, 0x69, 0x80, 0xd9, 0x5d, 0x0a, \
+      0x53, 0xaa, 0x65, 0xde, 0x9b, 0x6a, 0x84, 0xa3, 0xbc, 0xf9, 0x3b, 0xe0, \
+      0x6d, 0xa3, 0x43, 0xf2, 0xaa, 0xcd, 0xd4, 0x2c, 0x18, 0x20, 0x83, 0xd6, \
+      0xbf, 0x3d, 0x5b, 0x84, 0x1c, 0xe1, 0xdb, 0x9a, 0x3d, 0xa5, 0xf5, 0xc5, \
+      0x78, 0x85, 0x21, 0xd3, 0x7c, 0x5f, 0x4d, 0xd4, 0x29, 0x37, 0x7f, 0xa8, \
+      0x30, 0xe3, 0x81, 0xdd, 0xc8, 0x82, 0x55, 0xb4, 0x7b, 0x76, 0x1a, 0x8e, \
+      0xfe, 0xe2, 0x82, 0x1b, 0x54, 0x79, 0xab, 0xe2, 0x6d, 0x3d, 0xdc, 0xa1, \
+      0xac, 0x97, 0x97, 0x99, 0x36, 0xd6, 0xd9, 0x25, 0xb0, 0xd8, 0x45, 0x5e, \
+      0x97, 0x09, 0xf9, 0x59, 0x45, 0xf7, 0xb0, 0xf6, 0xa5, 0x59, 0xd5, 0xec, \
+      0x6c, 0xfe, 0x22, 0x7d, 0x1b, 0x88, 0x9b, 0x17, 0x59, 0x8e, 0x58, 0x40, \
+      0x2d, 0x27, 0x8e, 0xe6, 0x84, 0x86, 0x56, 0x3b, 0x1b, 0x7e, 0x3a, 0x37, \
+      0x9d, 0x32, 0xf1, 0x91, 0x09, 0x56, 0x37, 0xe8, 0xf3, 0x88, 0x1b, 0x8e, \
+      0x62, 0xd1, 0x54, 0x9b, 0x71, 0xa8, 0x2c, 0x40, 0xa7, 0x8f, 0x38, 0x61, \
+      0xbf, 0x5f, 0x66, 0x57, 0xff, 0xd2, 0x1d, 0xdf, 0x20, 0x91, 0x89, 0x34, \
+      0xb2, 0x7c, 0xa3, 0x90, 0xff, 0x57, 0x39, 0x87, 0xfb, 0x16, 0xd3, 0xc0, \
+      0x75, 0x9a, 0x33, 0xa1, 0xa3, 0xf8, 0xb0, 0xc4, 0x7a, 0xcb, 0xbf, 0xae, \
+      0x98, 0xdd, 0x51, 0x07, 0x07, 0x98, 0x7a, 0x5f, 0x83, 0x0a, 0x0d, 0xa3, \
+      0x45, 0xfd, 0x9e, 0x09, 0x6b, 0x6f, 0x2c, 0xa4, 0x21, 0x29, 0x26, 0x49, \
+      0xb6, 0x30, 0x2b, 0x2c, 0x0a, 0x39, 0x1a, 0x70, 0x85, 0x94, 0x3a, 0xc1, \
+      0xd8, 0xd7, 0xf9, 0x57, 0x08, 0x8d, 0x28, 0xaf, 0x40, 0xd6, 0xea, 0x4a, \
+      0x67, 0xce, 0x4f, 0x0d, 0x58, 0xf2, 0x77, 0x31, 0x3d, 0x1c, 0x75, 0xcc, \
+      0x5e, 0x95, 0x52, 0xfe, 0x1c, 0x06, 0xb9, 0xf0, 0xff, 0x63, 0x11, 0x26, \
+      0x27, 0x15, 0x48, 0x5d, 0xee, 0x2c, 0x48, 0x40, 0xad, 0xe5, 0x94, 0x1e, \
+      0x8b, 0x66, 0xd7, 0x87, 0xc7, 0x6c, 0x75, 0xd8, 0xb2, 0xeb, 0x74, 0x13, \
+      0x8c, 0x81, 0xc4, 0xe0, 0xf2, 0xa1, 0xdf, 0xb9, 0x35, 0xc4, 0xb0, 0xdf, \
+      0x9b, 0x37, 0xfa, 0x10, 0x66, 0x9b, 0x45, 0x46, 0x0b, 0x73, 0x00, 0xf0, \
+      0xed, 0xda, 0xa4, 0x21, 0x11, 0xcf, 0x66, 0xa4, 0x5a, 0x12, 0x07, 0x54, \
+      0x74, 0x5c, 0xa2, 0x54, 0x48, 0xfb, 0x80, 0x1e, 0xdf, 0xeb, 0x77, 0xe8, \
+      0xeb, 0x13, 0xd3, 0x37, 0xac, 0x5c, 0x58, 0xa0, 0x8e, 0x7e, 0x2a, 0x3b, \
+      0xde, 0x07, 0x4f, 0xb4, 0x3d, 0x7c, 0xa6, 0x2f, 0x5e, 0xdd, 0x06, 0xf9, \
+      0x91, 0xfb, 0x01, 0xca, 0x41, 0xaa, 0xc5, 0xd3, 0xe5, 0x37, 0x06, 0x89, \
+      0xb3, 0x17, 0x65, 0x19, 0x55, 0xbd, 0x7e, 0xa7, 0x47, 0xcc, 0x19, 0x42, \
+      0xfd, 0xd4, 0x99, 0xba, 0x9b, 0xfb, 0x8f, 0xed, 0x8c, 0x81, 0x15, 0x4e, \
+      0xee, 0xdd, 0xaa, 0x88, 0x53, 0xe1, 0x89, 0xa8, 0x81, 0x5c, 0x3a, 0x99, \
+      0x2f, 0xce, 0xc7, 0x92, 0x4c, 0xc0, 0xa2, 0xe9, 0x0c, 0x80, 0x76, 0xa9, \
+      0x55, 0x71, 0xf2, 0x10, 0x5a, 0xcc, 0x44, 0xfa, 0x46, 0xb3, 0xdd, 0x60, \
+      0x79, 0x29, 0x63, 0x33, 0x6b, 0xd2, 0xeb, 0x76, 0x4c, 0x48, 0xa9, 0x94, \
+      0x01, 0x73, 0x17, 0x76, 0x10, 0x58, 0x94, 0x82, 0xbf, 0xc4, 0xa7, 0x28, \
+      0xde, 0x12, 0x07, 0x08, 0xb4, 0x8d, 0xd8, 0x57, 0xdc, 0xa2, 0x09, 0xdf, \
+      0x22, 0x75, 0xf2, 0xc0, 0x77, 0xea, 0x84, 0xc4, 0xdf, 0xb7, 0x3d, 0xbd, \
+      0xa2, 0x61, 0x5c, 0x2b, 0xbb, 0xc2, 0x44, 0x9f, 0x2c, 0x9c, 0xa0, 0xe9, \
+      0xb3, 0xc9, 0x7b, 0x13, 0x93, 0x44, 0x5e, 0x7f, 0x18, 0x84, 0x8e, 0xa2, \
+      0x74, 0x8b, 0x6b, 0x28, 0x43, 0xfc, 0xea, 0x57, 0xe7, 0x83, 0x90, 0x39, \
+      0x85, 0x45, 0xc5, 0xe7, 0x53, 0x52, 0x73, 0xf6, 0x10, 0x8d, 0x99, 0xa1, \
+      0x05, 0x22, 0x5f, 0xb1, 0x37, 0x17, 0x46, 0x33, 0xa2, 0x7b, 0xbb, 0x04, \
+      0x2d, 0x2f, 0x5b, 0x70, 0xdd, 0xe5, 0x3a, 0x6c, 0x0f, 0x8f, 0xc9, 0x44, \
+      0xbb, 0xdf, 0x6b, 0xb5, 0x8c, 0x9e, 0x59, 0xe9, 0xc3, 0xd0, 0xe4, 0x90, \
+      0x9a, 0x08, 0x14, 0x35, 0xc9, 0x74, 0x85, 0xf9, 0x9c, 0x4b, 0x1d, 0xe8, \
+      0x0a, 0x43, 0xc0, 0xa7, 0x36, 0x97, 0xcc, 0x60, 0x1c, 0x3e, 0xc8, 0x39, \
+      0x74, 0xfb, 0xc1, 0x66, 0x2a, 0x38, 0x69, 0xee, 0x85, 0xa1, 0x09, 0x5e, \
+      0x80, 0xf7, 0x59, 0xcb, 0x68, 0x7a, 0x60, 0x60, 0xf7, 0x69, 0x64, 0x07, \
+      0xce, 0xad, 0x66, 0x34, 0x15, 0xf5, 0x00, 0x57, 0x17, 0xd6, 0x99, 0x33, \
+      0x18, 0x0d, 0x45, 0xa3, 0xc3, 0x65, 0xe5, 0x13, 0xa5, 0xef, 0xf2, 0x34, \
+      0xd7, 0x16, 0x5e, 0xd5, 0xb1, 0x85, 0x24, 0x62, 0x05, 0x7d, 0x35, 0x5d, \
+      0x10, 0xbc, 0x47, 0x30, 0xf2, 0x28, 0x33, 0xfb, 0x27, 0xdc, 0x92, 0xfa, \
+      0xa2, 0xdb, 0x4c, 0x70, 0xaf, 0x20, 0x63, 0xbb, 0x78, 0xda, 0x23, 0x50, \
+      0x90, 0x33, 0x36, 0x5c, 0x03, 0xc7, 0xda, 0xa3, 0xd1, 0x50, 0xb7, 0x6c, \
+      0xe4, 0x27, 0x48, 0xc9, 0xa5, 0x85, 0x69, 0xbc, 0x85, 0x38, 0x35, 0x4d, \
+      0x4f, 0xdd, 0xa1, 0xc1, 0x88, 0xca, 0x45, 0xcd, 0xb9, 0x42, 0x9c, 0x70, \
+      0x8a, 0x97, 0x71, 0x21, 0x1a, 0x8f, 0xd0, 0xfc, 0x5c, 0x79, 0xc5, 0x92, \
+      0x1c, 0x20, 0xcd, 0x23, 0xf6, 0x4c, 0x21, 0x5e, 0x87, 0x76, 0xac, 0x5d, \
+      0x84, 0x81, 0x42, 0x74, 0x5f, 0x1a, 0xad, 0x28, 0xd1, 0x88, 0xf5, 0x96, \
+      0x86, 0x20, 0x33, 0x60, 0xb2, 0xd0, 0xd3, 0xe4, 0xbb, 0x62, 0x00, 0x28, \
+      0x13, 0x31, 0xce, 0x98, 0x6d, 0x3e, 0x8c, 0xf4, 0xec, 0x98, 0x8a, 0xa5, \
+      0x4f, 0xdf, 0x1c, 0xb4, 0xb8, 0xf8, 0x0f, 0x6e, 0x8b, 0x5e, 0x72, 0x24, \
+      0xe6, 0xc6, 0x70, 0x86, 0xad, 0x52, 0x68, 0x37, 0xfa, 0xd4, 0xea, 0xac, \
+      0x50, 0x22, 0x56, 0x65, 0xbb, 0x14, 0x08, 0x77, 0xb8, 0xea, 0x87, 0xe0, \
+      0xd1, 0xa8, 0xbc, 0x69, 0xbe, 0xaa, 0x5a, 0xb5, 0x8c, 0x11, 0xe2, 0xc1, \
+      0xf5, 0xc9, 0x79, 0xc3, 0xa6, 0x96, 0x14, 0xc7, 0xff, 0xa8, 0x72, 0x74, \
+      0xd2, 0x7f, 0x11, 0x64, 0x0d, 0x5c, 0xae, 0x60, 0x29, 0x4a, 0xea, 0x80, \
+      0x02, 0xc2, 0xbd, 0xfb, 0x36, 0x65, 0x76, 0x76, 0x36, 0xa7, 0x4c, 0x0c, \
+      0xac, 0x5b, 0x3b, 0xb7, 0x65, 0x9d, 0xd7, 0x22, 0x12, 0xbb, 0x46, 0x22, \
+      0x08, 0xfb, 0x36, 0xb6, 0x34, 0xa0, 0x16, 0x9a, 0xa8, 0x5a, 0x58, 0x03, \
+      0xe8, 0x19, 0x62, 0x18, 0x5e, 0x34, 0xd6, 0x78, 0x21, 0x3a, 0xe8, 0xca, \
+      0x36, 0x9b, 0xbe, 0xa4, 0xcd, 0x72, 0x93, 0x8e, 0x01, 0x66, 0xc5, 0x4c, \
+      0x83, 0x81, 0xf8, 0x4a, 0xdb, 0xf9, 0xae, 0xf4, 0xc7, 0xd5, 0x43, 0x0d, \
+      0x1c, 0x7e, 0xba, 0xad, 0x89, 0x7e, 0x13, 0x7b, 0x06, 0x41, 0xc1, 0x33, \
+      0xc6, 0xa5, 0x38, 0x81}
+
 #define DEV_AUTH_ROOT_STAGING_MLDSA44                                         \
   {                                                                           \
       0x1f, 0x3e, 0x5e, 0xda, 0xd4, 0x5f, 0xc6, 0x98, 0x0d, 0xbf, 0xd5, 0x97, \
diff --git a/python/src/trezorlib/_root_keys.py b/python/src/trezorlib/_root_keys.py
index 56ef1875..64db95cf 100644
--- a/python/src/trezorlib/_root_keys.py
+++ b/python/src/trezorlib/_root_keys.py
@@ -51,4 +51,6 @@ T3W1_DEV_AUTH_ROOT_DEBUG_ED25519_HEX = "04e3856182309678a15767451f931ed86617b1d2
 
 T3W1_DEV_AUTH_ROOT_STAGING_ED25519_HEX = "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b"
 
+T3W1_DEV_AUTH_ROOT_DEBUG_MLDSA44_HEX = "5a61ce3b69fba4941df3679245d144dde75cfbb583f95d3572fa1260a055cbdaadae1eba65d4a9dea1ba61b10d5a8b560411786cf74caa11552efd9f4290ee81ec9b125ea1ae613cb6740112019134718b0b885cd98dfcb3b1ece95c57b3d6dbb38349db5f977128dcc39a05c321cdd2df86aed29ff9779e51a3a69b44ad300c886559087b2def34972fa19fa23019d625452847675770eab62c8f3970f7d978e0fee482a542c876c42f7005ca52a242327c41f65aeca792f22e6d94bd2eaf36813ce6bb1c8b3947c49813d4aee9c225419af1b5506853cd5bf3d9207a0b379d8cd446118178fe0fd8c46e625575e592ab16e6b90b6e44cc4c1e5d66132078916e9c476e95567b7d964891f6753cd3ee883e607be15605e6fdd77514722dfcea0b01d0d1b4a71c86d617963ae1f5ebdbbbf3500cac6bcd32ca46b18e01e43d156b75d159f0edd341e25b5ad345175dbadcb1ba2a46e11e9a502f66ccbbf0f69c75dab9906929636a2ec8acb3a4c02fda3ca734b226328e85a66be9e61e2eec3ba29946436cd0796980d95d0a53aa65de9b6a84a3bcf93be06da343f2aacdd42c182083d6bf3d5b841ce1db9a3da5f5c5788521d37c5f4dd429377fa830e381ddc88255b47b761a8efee2821b5479abe26d3ddca1ac97979936d6d925b0d8455e9709f95945f7b0f6a559d5ec6cfe227d1b889b17598e58402d278ee68486563b1b7e3a379d32f191095637e8f3881b8e62d1549b71a82c40a78f3861bf5f6657ffd21ddf20918934b27ca390ff573987fb16d3c0759a33a1a3f8b0c47acbbfae98dd510707987a5f830a0da345fd9e096b6f2ca421292649b6302b2c0a391a7085943ac1d8d7f957088d28af40d6ea4a67ce4f0d58f277313d1c75cc5e9552fe1c06b9f0ff6311262715485dee2c4840ade5941e8b66d787c76c75d8b2eb74138c81c4e0f2a1dfb935c4b0df9b37fa10669b45460b7300f0eddaa42111cf66a45a120754745ca25448fb801edfeb77e8eb13d337ac5c58a08e7e2a3bde074fb43d7ca62f5edd06f991fb01ca41aac5d3e5370689b317651955bd7ea747cc1942fdd499ba9bfb8fed8c81154eeeddaa8853e189a8815c3a992fcec7924cc0a2e90c8076a95571f2105acc44fa46b3dd60792963336bd2eb764c48a9940173177610589482bfc4a728de120708b48dd857dca209df2275f2c077ea84c4dfb73dbda2615c2bbbc2449f2c9ca0e9b3c97b1393445e7f18848ea2748b6b2843fcea57e78390398545c5e7535273f6108d99a105225fb137174633a27bbb042d2f5b70dde53a6c0f8fc944bbdf6bb58c9e59e9c3d0e4909a081435c97485f99c4b1de80a43c0a73697cc601c3ec83974fbc1662a3869ee85a1095e80f759cb687a6060f7696407cead663415f5005717d69933180d45a3c365e513a5eff234d7165ed5b1852462057d355d10bc4730f22833fb27dc92faa2db4c70af2063bb78da23509033365c03c7daa3d150b76ce42748c9a58569bc8538354d4fdda1c188ca45cdb9429c708a9771211a8fd0fc5c79c5921c20cd23f64c215e8776ac5d848142745f1aad28d188f59686203360b2d0d3e4bb6200281331ce986d3e8cf4ec988aa54fdf1cb4b8f80f6e8b5e7224e6c67086ad526837fad4eaac50225665bb140877b8ea87e0d1a8bc69beaa5ab58c11e2c1f5c979c3a69614c7ffa87274d27f11640d5cae60294aea8002c2bdfb3665767636a74c0cac5b3bb7659dd72212bb462208fb36b634a0169aa85a5803e81962185e34d678213ae8ca369bbea4cd72938e0166c54c8381f84adbf9aef4c7d5430d1c7ebaad897e137b0641c133c6a53881"
+
 T3W1_DEV_AUTH_ROOT_STAGING_MLDSA44_HEX = "1f3e5edad45fc6980dbfd597ed17b77e4d4ad1b1ec4804e04dc061cc2cfe77bc96fbc93f698f1fe00c47177c8150276dab86cbf407add7527deb09b65a6623ef581422292d77744be64f4401ca65b9bd027e32a76f307413b086869eccbcfc5e8823be8e0b3897727bca568feeff62957cd1e261e4aab67271725d240c7e7d2a20a5c201699be83d6c6a57fdfc09ac9b6b599e2a14a50e421d246d1d1df805db0b25534e500fed76fa89975a4270e274a9fa72b528e47d999abdeca5e08e51d447ae4019f699088d485bb52d5eec7a8c725cd34ff955c16437877a131f068438b5699c2285000463e24c633b023cde279be015db2f8b16de07fa82ee9adcbf868b898e25eeef5d60d03e1da874aca6f2089b1e7c72d7b532d3a27e38936d53c0080f9908b6727b13fe961ec8b08004f077b9cce95b5eee9b44d351e79eb222aba1bc18895d36cf4843ffcdfc735e1b66f3e72db5aaf8b5ecf56dbf0d616cf53d192a60e61ad3c51a595213100fd00835434a28aab3eb5949d3405de5db1a586bd6e937444913e9f1d4c00247acd49a2ed9953636e5d74417b4c7144c6c22fd8f7e25cb6cf6c8510de6915b74c95a28c197152208096d0249b86150e807978ca985c110d07b7d0a24434039f6ef12a69d3e073af6ae44e7c4606a354a3e953bdcff10c8dc68b807f41ac563ff0d7141c328b34152a25a16e9cb8228f7707356d2d7f3caa8d778a85e3b66242c124281c0f3201ad28596b868db138149eb98b821dcaaf86b5e11c2ac1161975bf0b2ecefc111b7b7401ce261911526618044d126eeee885efe51be0e32e93aaaffe34899df5b10df7c5a9c54c5b4704671640a92e8631f0d401f44c2238b5f9a37499b3d83c1c60096f2b48c3081dd9769db325c1cd1ffe84bfd8a80dde3cd650c49e14af3ab6c317ee74bd39e976ff5b7ad490e80f3eff9edf3b3855070a5a06fbe9cbca54f521e3d74cf13a4d116e23e531a7c70232c044b7e7d02467afe2a40def14298688eced5d3d87a102d31d7cd5409918ced4bab190505df48f451deea1c29168246d621529f0346eaab0e2302f3ce206dd84837704b8bdedbadea5b5822cdecbfdb180cde14e62ee26a929f0a37a99bacfe237376a3e6c289b06b8e93ed9d1435e3ee6399ab1a06d4f70097f80e26fe6f60b27a68104f6333b8db1bc78e12d54647b23feb0f11ae070f3a6be9d9f4d89a6b5ef8595d010d410e72138cfcbd5e41cca1df33ddad657b699cf4d3dc602888e5aaa0a7a2325ba4a36d7de49c591d8e355fd1de644d772bf2a060093743388dbe5d30a2d97304abc17c547bd65276291d6aa7b0723703733239fabef39c2de47071d50074e68fbe71c88f75d4510bb5f6bc244b3e7b219eb89fe5f148459a2d693cd3fac32aa069cbdd4e27c9778096f6805bf6df9aec9671f0a58b28704f74775e81ac46826c1c4709b0e0989d6e8e73bd1795ce85d85c14ad2997cd2810272a5682e7ed9aa7a092708c0f4bc67f68d317d406a96ddd2842ea22cbf3410cd7a77005b61115b794894cf9d10ebb4f5552bec8c21d90ba97d6139d5261d7f51f4009c3618f9feb22cc929ade204eca7c0f813409ceb88a13512f85e03948314ba9c4488aafda88ce447a0e052a6a605e32d04a20e2e52c41f371247963f24fc28c5cc1ddd8fe1681a2a293daf2688e9b026303a76cc60f40290c4d823efb85f36cb5e092369cc20515a8077e7702ed54ca1565d37b83184ee46c4a6adf2840f5a5fb002db70690bbf93888e685fdd1f9ea211b42693e0bd5ba5235a6ea1b714774d13279d7db3440f7fbced53f203ce6500555bcb9251e6f36d3352326501c"

Risk score

Why this scored 18/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 18/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW