chore(core): Add Tropic fields to AuthenticityProof.

Trezor/Trezor firmware

24659231 View source ↗

Public commit record

What the developer wrote

Authored by Andrew Kozlik

62/100 · Adequate

chore(core): Add Tropic fields to AuthenticityProof.

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit renames existing fields in a device-authentication proof message and adds optional fields for a second security chip (Tropic). It is a schema-only change across generated protobuf bindings; there is no new executable logic shown. By itself it does not create a vulnerability, but it changes the public API used to verify whether a Trezor device is genuine.

Recommended action

Review the companion firmware and host-side commits that consume these new fields to ensure the Tropic certificate chain is validated with the same rigor as the Optiga chain (path validation, root CA pinning, signature verification over the challenge, and downgrade/selection logic).

Security signals we found

Schema-only protobuf field rename and extension

Adds optional Tropic secure-element certificate chain and signature fields

Keeps Optiga fields required; Tropic fields are optional, preserving backward wire compatibility

No executable verification code, bounds checks, or cryptographic logic present in diff

Technical analysis

Evidence from the diff

The AuthenticityProof protobuf message is updated to carry two parallel certificate chains/signatures: optiga_ (the existing Infineon OPTIGA secure element) and tropic_ (a new Tropic secure element). The old certificates/signature fields are renamed to optiga_certificates/optiga_signature, and tropic_certificates (repeated bytes) plus tropic_signature (optional bytes) are added. The change is propagated to Python, Rust, and core generated message code. No verification logic, parser behavior, or trust assumptions are visible in the diff.

Changed components

common/protob/messages-management.protocore/src/trezor/messages.pypython/src/trezorlib/messages.pyrust/trezor-client/src/protos/generated/messages_management.rs

Inspect captured patch +209 / −123

diff --git a/common/protob/messages-management.proto b/common/protob/messages-management.proto
index 4e361165a..88acecca9 100644
--- a/common/protob/messages-management.proto
+++ b/common/protob/messages-management.proto
@@ -381,8 +381,10 @@ message AuthenticateDevice {
  * @end
  */
 message AuthenticityProof {
-    repeated bytes certificates = 1;  // A certificate chain starting with the device certificate, followed by intermediate CA certificates, the last of which is signed by Trezor company's root CA.
-    required bytes signature = 2;     // A DER-encoded signature of "\0x13AuthenticateDevice:" + length-prefixed challenge that should be verified using the device certificate.
+    repeated bytes optiga_certificates = 1;  // A certificate chain starting with the Optiga device certificate, followed by intermediate CA certificates, the last of which is signed by Trezor company's root CA.
+    required bytes optiga_signature = 2;     // A DER-encoded signature of "\0x13AuthenticateDevice:" + length-prefixed challenge that should be verified using the Optiga device certificate.
+    repeated bytes tropic_certificates = 3;  // A certificate chain starting with the Tropic device certificate, followed by intermediate CA certificates, the last of which is signed by Trezor company's root CA.
+    optional bytes tropic_signature = 4;     // A DER-encoded signature of "\0x13AuthenticateDevice:" + length-prefixed challenge that should be verified using the Tropic device certificate.
 }
 
 /**
diff --git a/core/src/trezor/messages.py b/core/src/trezor/messages.py
index f7c0c93aa..907e4f3dd 100644
--- a/core/src/trezor/messages.py
+++ b/core/src/trezor/messages.py
@@ -2405,14 +2405,18 @@ if TYPE_CHECKING:
             return isinstance(msg, cls)
 
     class AuthenticityProof(protobuf.MessageType):
-        certificates: "list[bytes]"
-        signature: "bytes"
+        optiga_certificates: "list[bytes]"
+        optiga_signature: "bytes"
+        tropic_certificates: "list[bytes]"
+        tropic_signature: "bytes | None"
 
         def __init__(
             self,
             *,
-            signature: "bytes",
-            certificates: "list[bytes] | None" = None,
+            optiga_signature: "bytes",
+            optiga_certificates: "list[bytes] | None" = None,
+            tropic_certificates: "list[bytes] | None" = None,
+            tropic_signature: "bytes | None" = None,
         ) -> None:
             pass
 
diff --git a/python/src/trezorlib/messages.py b/python/src/trezorlib/messages.py
index d498857a3..3a519e90a 100644
--- a/python/src/trezorlib/messages.py
+++ b/python/src/trezorlib/messages.py
@@ -3626,18 +3626,24 @@ class AuthenticateDevice(protobuf.MessageType):
 class AuthenticityProof(protobuf.MessageType):
     MESSAGE_WIRE_TYPE = 98
     FIELDS = {
-        1: protobuf.Field("certificates", "bytes", repeated=True, required=False, default=None),
-        2: protobuf.Field("signature", "bytes", repeated=False, required=True),
+        1: protobuf.Field("optiga_certificates", "bytes", repeated=True, required=False, default=None),
+        2: protobuf.Field("optiga_signature", "bytes", repeated=False, required=True),
+        3: protobuf.Field("tropic_certificates", "bytes", repeated=True, required=False, default=None),
+        4: protobuf.Field("tropic_signature", "bytes", repeated=False, required=False, default=None),
     }
 
     def __init__(
         self,
         *,
-        signature: "bytes",
-        certificates: Optional[Sequence["bytes"]] = None,
+        optiga_signature: "bytes",
+        optiga_certificates: Optional[Sequence["bytes"]] = None,
+        tropic_certificates: Optional[Sequence["bytes"]] = None,
+        tropic_signature: Optional["bytes"] = None,
     ) -> None:
-        self.certificates: Sequence["bytes"] = certificates if certificates is not None else []
-        self.signature = signature
+        self.optiga_certificates: Sequence["bytes"] = optiga_certificates if optiga_certificates is not None else []
+        self.tropic_certificates: Sequence["bytes"] = tropic_certificates if tropic_certificates is not None else []
+        self.optiga_signature = optiga_signature
+        self.tropic_signature = tropic_signature
 
 
 class WipeDevice(protobuf.MessageType):
diff --git a/rust/trezor-client/src/protos/generated/messages_management.rs b/rust/trezor-client/src/protos/generated/messages_management.rs
index 911ce8c5f..7ba465b67 100644
--- a/rust/trezor-client/src/protos/generated/messages_management.rs
+++ b/rust/trezor-client/src/protos/generated/messages_management.rs
@@ -6219,10 +6219,14 @@ impl ::protobuf::reflect::ProtobufValue for AuthenticateDevice {
 #[derive(PartialEq,Clone,Default,Debug)]
 pub struct AuthenticityProof {
     // message fields
-    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.certificates)
-    pub certificates: ::std::vec::Vec<::std::vec::Vec<u8>>,
-    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.signature)
-    pub signature: ::std::option::Option<::std::vec::Vec<u8>>,
+    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.optiga_certificates)
+    pub optiga_certificates: ::std::vec::Vec<::std::vec::Vec<u8>>,
+    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.optiga_signature)
+    pub optiga_signature: ::std::option::Option<::std::vec::Vec<u8>>,
+    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.tropic_certificates)
+    pub tropic_certificates: ::std::vec::Vec<::std::vec::Vec<u8>>,
+    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.tropic_signature)
+    pub tropic_signature: ::std::option::Option<::std::vec::Vec<u8>>,
     // special fields
     // @@protoc_insertion_point(special_field:hw.trezor.messages.management.AuthenticityProof.special_fields)
     pub special_fields: ::protobuf::SpecialFields,
@@ -6239,54 +6243,100 @@ impl AuthenticityProof {
         ::std::default::Default::default()
     }
 
-    // required bytes signature = 2;
+    // required bytes optiga_signature = 2;
 
-    pub fn signature(&self) -> &[u8] {
-        match self.signature.as_ref() {
+    pub fn optiga_signature(&self) -> &[u8] {
+        match self.optiga_signature.as_ref() {
             Some(v) => v,
             None => &[],
         }
     }
 
-    pub fn clear_signature(&mut self) {
-        self.signature = ::std::option::Option::None;
+    pub fn clear_optiga_signature(&mut self) {
+        self.optiga_signature = ::std::option::Option::None;
     }
 
-    pub fn has_signature(&self) -> bool {
-        self.signature.is_some()
+    pub fn has_optiga_signature(&self) -> bool {
+        self.optiga_signature.is_some()
     }
 
     // Param is passed by value, moved
-    pub fn set_signature(&mut self, v: ::std::vec::Vec<u8>) {
-        self.signature = ::std::option::Option::Some(v);
+    pub fn set_optiga_signature(&mut self, v: ::std::vec::Vec<u8>) {
+        self.optiga_signature = ::std::option::Option::Some(v);
     }
 
     // Mutable pointer to the field.
     // If field is not initialized, it is initialized with default value first.
-    pub fn mut_signature(&mut self) -> &mut ::std::vec::Vec<u8> {
-        if self.signature.is_none() {
-            self.signature = ::std::option::Option::Some(::std::vec::Vec::new());
+    pub fn mut_optiga_signature(&mut self) -> &mut ::std::vec::Vec<u8> {
+        if self.optiga_signature.is_none() {
+            self.optiga_signature = ::std::option::Option::Some(::std::vec::Vec::new());
         }
-        self.signature.as_mut().unwrap()
+        self.optiga_signature.as_mut().unwrap()
     }
 
     // Take field
-    pub fn take_signature(&mut self) -> ::std::vec::Vec<u8> {
-        self.signature.take().unwrap_or_else(|| ::std::vec::Vec::new())
+    pub fn take_optiga_signature(&mut self) -> ::std::vec::Vec<u8> {
+        self.optiga_signature.take().unwrap_or_else(|| ::std::vec::Vec::new())
+    }
+
+    // optional bytes tropic_signature = 4;
+
+    pub fn tropic_signature(&self) -> &[u8] {
+        match self.tropic_signature.as_ref() {
+            Some(v) => v,
+            None => &[],
+        }
+    }
+
+    pub fn clear_tropic_signature(&mut self) {
+        self.tropic_signature = ::std::option::Option::None;
+    }
+
+    pub fn has_tropic_signature(&self) -> bool {
+        self.tropic_signature.is_some()
+    }
+
+    // Param is passed by value, moved
+    pub fn set_tropic_signature(&mut self, v: ::std::vec::Vec<u8>) {
+        self.tropic_signature = ::std::option::Option::Some(v);
+    }
+
+    // Mutable pointer to the field.
+    // If field is not initialized, it is initialized with default value first.
+    pub fn mut_tropic_signature(&mut self) -> &mut ::std::vec::Vec<u8> {
+        if self.tropic_signature.is_none() {
+            self.tropic_signature = ::std::option::Option::Some(::std::vec::Vec::new());
+        }
+        self.tropic_signature.as_mut().unwrap()
+    }
+
+    // Take field
+    pub fn take_tropic_signature(&mut self) -> ::std::vec::Vec<u8> {
+        self.tropic_signature.take().unwrap_or_else(|| ::std::vec::Vec::new())
     }
 
     fn generated_message_descriptor_data() -> ::protobuf::reflect::GeneratedMessageDescriptorData {
-        let mut fields = ::std::vec::Vec::with_capacity(2);
+        let mut fields = ::std::vec::Vec::with_capacity(4);
         let mut oneofs = ::std::vec::Vec::with_capacity(0);
         fields.push(::protobuf::reflect::rt::v2::make_vec_simpler_accessor::<_, _>(
-            "certificates",
-            |m: &AuthenticityProof| { &m.certificates },
-            |m: &mut AuthenticityProof| { &mut m.certificates },
+            "optiga_certificates",
+            |m: &AuthenticityProof| { &m.optiga_certificates },
+            |m: &mut AuthenticityProof| { &mut m.optiga_certificates },
         ));
         fields.push(::protobuf::reflect::rt::v2::make_option_accessor::<_, _>(
-            "signature",
-            |m: &AuthenticityProof| { &m.signature },
-            |m: &mut AuthenticityProof| { &mut m.signature },
+            "optiga_signature",
+            |m: &AuthenticityProof| { &m.optiga_signature },
+            |m: &mut AuthenticityProof| { &mut m.optiga_signature },
+        ));
+        fields.push(::protobuf::reflect::rt::v2::make_vec_simpler_accessor::<_, _>(
+            "tropic_certificates",
+            |m: &AuthenticityProof| { &m.tropic_certificates },
+            |m: &mut AuthenticityProof| { &mut m.tropic_certificates },
+        ));
+        fields.push(::protobuf::reflect::rt::v2::make_option_accessor::<_, _>(
+            "tropic_signature",
+            |m: &AuthenticityProof| { &m.tropic_signature },
+            |m: &mut AuthenticityProof| { &mut m.tropic_signature },
         ));
         ::protobuf::reflect::GeneratedMessageDescriptorData::new_2::<AuthenticityProof>(
             "AuthenticityProof",
@@ -6300,7 +6350,7 @@ impl ::protobuf::Message for AuthenticityProof {
     const NAME: &'static str = "AuthenticityProof";
 
     fn is_initialized(&self) -> bool {
-        if self.signature.is_none() {
+        if self.optiga_signature.is_none() {
             return false;
         }
         true
@@ -6310,10 +6360,16 @@ impl ::protobuf::Message for AuthenticityProof {
         while let Some(tag) = is.read_raw_tag_or_eof()? {
             match tag {
                 10 => {
-                    self.certificates.push(is.read_bytes()?);
+                    self.optiga_certificates.push(is.read_bytes()?);
                 },
                 18 => {
-                    self.signature = ::std::option::Option::Some(is.read_bytes()?);
+                    self.optiga_signature = ::std::option::Option::Some(is.read_bytes()?);
+                },
+                26 => {
+                    self.tropic_certificates.push(is.read_bytes()?);
+                },
+                34 => {
+                    self.tropic_signature = ::std::option::Option::Some(is.read_bytes()?);
                 },
                 tag => {
                     ::protobuf::rt::read_unknown_or_skip_group(tag, is, self.special_fields.mut_unknown_fields())?;
@@ -6327,24 +6383,36 @@ impl ::protobuf::Message for AuthenticityProof {
     #[allow(unused_variables)]
     fn compute_size(&self) -> u64 {
         let mut my_size = 0;
-        for value in &self.certificates {
+        for value in &self.optiga_certificates {
             my_size += ::protobuf::rt::bytes_size(1, &value);
         };
-        if let Some(v) = self.signature.as_ref() {
+        if let Some(v) = self.optiga_signature.as_ref() {
             my_size += ::protobuf::rt::bytes_size(2, &v);
         }
+        for value in &self.tropic_certificates {
+            my_size += ::protobuf::rt::bytes_size(3, &value);
+        };
+        if let Some(v) = self.tropic_signature.as_ref() {
+            my_size += ::protobuf::rt::bytes_size(4, &v);
+        }
         my_size += ::protobuf::rt::unknown_fields_size(self.special_fields.unknown_fields());
         self.special_fields.cached_size().set(my_size as u32);
         my_size
     }
 
     fn write_to_with_cached_sizes(&self, os: &mut ::protobuf::CodedOutputStream<'_>) -> ::protobuf::Result<()> {
-        for v in &self.certificates {
+        for v in &self.optiga_certificates {
             os.write_bytes(1, &v)?;
         };
-        if let Some(v) = self.signature.as_ref() {
+        if let Some(v) = self.optiga_signature.as_ref() {
             os.write_bytes(2, v)?;
         }
+        for v in &self.tropic_certificates {
+            os.write_bytes(3, &v)?;
+        };
+        if let Some(v) = self.tropic_signature.as_ref() {
+            os.write_bytes(4, v)?;
+        }
         os.write_unknown_fields(self.special_fields.unknown_fields())?;
         ::std::result::Result::Ok(())
     }
@@ -6362,15 +6430,19 @@ impl ::protobuf::Message for AuthenticityProof {
     }
 
     fn clear(&mut self) {
-        self.certificates.clear();
-        self.signature = ::std::option::Option::None;
+        self.optiga_certificates.clear();
+        self.optiga_signature = ::std::option::Option::None;
+        self.tropic_certificates.clear();
+        self.tropic_signature = ::std::option::Option::None;
         self.special_fields.clear();
     }
 
     fn default_instance() -> &'static AuthenticityProof {
         static instance: AuthenticityProof = AuthenticityProof {
-            certificates: ::std::vec::Vec::new(),
-            signature: ::std::option::Option::None,
+            optiga_certificates: ::std::vec::Vec::new(),
+            optiga_signature: ::std::option::Option::None,
+            tropic_certificates: ::std::vec::Vec::new(),
+            tropic_signature: ::std::option::Option::None,
             special_fields: ::protobuf::SpecialFields::new(),
         };
         &instance
@@ -11794,80 +11866,82 @@ static file_descriptor_proto_data: &'static [u8] = b"\
     \x20\x02(\x0cR\x07entropy\"/\n\x0fGetFirmwareHash\x12\x1c\n\tchallenge\
     \x18\x01\x20\x01(\x0cR\tchallenge\"\"\n\x0cFirmwareHash\x12\x12\n\x04has\
     h\x18\x01\x20\x02(\x0cR\x04hash\"2\n\x12AuthenticateDevice\x12\x1c\n\tch\
-    allenge\x18\x01\x20\x02(\x0cR\tchallenge\"U\n\x11AuthenticityProof\x12\"\
-    \n\x0ccertificates\x18\x01\x20\x03(\x0cR\x0ccertificates\x12\x1c\n\tsign\
-    ature\x18\x02\x20\x02(\x0cR\tsignature\"\x0c\n\nWipeDevice\"\xad\x02\n\n\
-    LoadDevice\x12\x1c\n\tmnemonics\x18\x01\x20\x03(\tR\tmnemonics\x12\x10\n\
-    \x03pin\x18\x03\x20\x01(\tR\x03pin\x123\n\x15passphrase_protection\x18\
-    \x04\x20\x01(\x08R\x14passphraseProtection\x12\x1e\n\x08language\x18\x05\
-    \x20\x01(\tR\x08languageB\x02\x18\x01\x12\x14\n\x05label\x18\x06\x20\x01\
-    (\tR\x05label\x12#\n\rskip_checksum\x18\x07\x20\x01(\x08R\x0cskipChecksu\
-    m\x12\x1f\n\x0bu2f_counter\x18\x08\x20\x01(\rR\nu2fCounter\x12!\n\x0cnee\
-    ds_backup\x18\t\x20\x01(\x08R\x0bneedsBackup\x12\x1b\n\tno_backup\x18\n\
-    \x20\x01(\x08R\x08noBackup\"\x9d\x03\n\x0bResetDevice\x12\x1f\n\x08stren\
-    gth\x18\x02\x20\x01(\r:\x03256R\x08strength\x123\n\x15passphrase_protect\
-    ion\x18\x03\x20\x01(\x08R\x14passphraseProtection\x12%\n\x0epin_protecti\
-    on\x18\x04\x20\x01(\x08R\rpinProtection\x12\x1e\n\x08language\x18\x05\
-    \x20\x01(\tR\x08languageB\x02\x18\x01\x12\x14\n\x05label\x18\x06\x20\x01\
-    (\tR\x05label\x12\x1f\n\x0bu2f_counter\x18\x07\x20\x01(\rR\nu2fCounter\
-    \x12\x1f\n\x0bskip_backup\x18\x08\x20\x01(\x08R\nskipBackup\x12\x1b\n\tn\
-    o_backup\x18\t\x20\x01(\x08R\x08noBackup\x12Q\n\x0bbackup_type\x18\n\x20\
-    \x01(\x0e2).hw.trezor.messages.management.BackupType:\x05Bip39R\nbackupT\
-    ype\x12#\n\rentropy_check\x18\x0b\x20\x01(\x08R\x0centropyCheckJ\x04\x08\
-    \x01\x10\x02\"\xe5\x01\n\x0cBackupDevice\x12'\n\x0fgroup_threshold\x18\
-    \x01\x20\x01(\rR\x0egroupThreshold\x12O\n\x06groups\x18\x02\x20\x03(\x0b\
-    27.hw.trezor.messages.management.BackupDevice.Slip39GroupR\x06groups\x1a\
-    [\n\x0bSlip39Group\x12)\n\x10member_threshold\x18\x01\x20\x02(\rR\x0fmem\
-    berThreshold\x12!\n\x0cmember_count\x18\x02\x20\x02(\rR\x0bmemberCount\"\
-    b\n\x0eEntropyRequest\x12-\n\x12entropy_commitment\x18\x01\x20\x01(\x0cR\
-    \x11entropyCommitment\x12!\n\x0cprev_entropy\x18\x02\x20\x01(\x0cR\x0bpr\
-    evEntropy\"&\n\nEntropyAck\x12\x18\n\x07entropy\x18\x01\x20\x02(\x0cR\
-    \x07entropy\"\x13\n\x11EntropyCheckReady\"5\n\x14EntropyCheckContinue\
-    \x12\x1d\n\x06finish\x18\x01\x20\x01(\x08:\x05falseR\x06finish\"\x8d\x04\
-    \n\x0eRecoveryDevice\x12\x1d\n\nword_count\x18\x01\x20\x01(\rR\twordCoun\
-    t\x123\n\x15passphrase_protection\x18\x02\x20\x01(\x08R\x14passphrasePro\
-    tection\x12%\n\x0epin_protection\x18\x03\x20\x01(\x08R\rpinProtection\
-    \x12\x1e\n\x08language\x18\x04\x20\x01(\tR\x08languageB\x02\x18\x01\x12\
-    \x14\n\x05label\x18\x05\x20\x01(\tR\x05label\x12)\n\x10enforce_wordlist\
-    \x18\x06\x20\x01(\x08R\x0fenforceWordlist\x12j\n\x0cinput_method\x18\x08\
-    \x20\x01(\x0e2G.hw.trezor.messages.management.RecoveryDevice.RecoveryDev\
-    iceInputMethodR\x0binputMethod\x12\x1f\n\x0bu2f_counter\x18\t\x20\x01(\r\
-    R\nu2fCounter\x12O\n\x04type\x18\n\x20\x01(\x0e2+.hw.trezor.messages.man\
-    agement.RecoveryType:\x0eNormalRecoveryR\x04type\";\n\x19RecoveryDeviceI\
-    nputMethod\x12\x12\n\x0eScrambledWords\x10\0\x12\n\n\x06Matrix\x10\x01J\
-    \x04\x08\x07\x10\x08\"\xc5\x01\n\x0bWordRequest\x12N\n\x04type\x18\x01\
-    \x20\x02(\x0e2:.hw.trezor.messages.management.WordRequest.WordRequestTyp\
-    eR\x04type\"f\n\x0fWordRequestType\x12\x19\n\x15WordRequestType_Plain\
-    \x10\0\x12\x1b\n\x17WordRequestType_Matrix9\x10\x01\x12\x1b\n\x17WordReq\
-    uestType_Matrix6\x10\x02\"\x1d\n\x07WordAck\x12\x12\n\x04word\x18\x01\
-    \x20\x02(\tR\x04word\"0\n\rSetU2FCounter\x12\x1f\n\x0bu2f_counter\x18\
-    \x01\x20\x02(\rR\nu2fCounter\"\x13\n\x11GetNextU2FCounter\"1\n\x0eNextU2\
-    FCounter\x12\x1f\n\x0bu2f_counter\x18\x01\x20\x02(\rR\nu2fCounter\"\x11\
-    \n\x0fDoPreauthorized\"\x16\n\x14PreauthorizedRequest\"\x15\n\x13CancelA\
-    uthorization\"\x9a\x02\n\x12RebootToBootloader\x12o\n\x0cboot_command\
-    \x18\x01\x20\x01(\x0e2=.hw.trezor.messages.management.RebootToBootloader\
-    .BootCommand:\rSTOP_AND_WAITR\x0bbootCommand\x12'\n\x0ffirmware_header\
-    \x18\x02\x20\x01(\x0cR\x0efirmwareHeader\x123\n\x14language_data_length\
-    \x18\x03\x20\x01(\r:\x010R\x12languageDataLength\"5\n\x0bBootCommand\x12\
-    \x11\n\rSTOP_AND_WAIT\x10\0\x12\x13\n\x0fINSTALL_UPGRADE\x10\x01\"\x10\n\
-    \x08GetNonce:\x04\x88\xb2\x19\x01\"#\n\x05Nonce\x12\x14\n\x05nonce\x18\
-    \x01\x20\x02(\x0cR\x05nonce:\x04\x88\xb2\x19\x01\";\n\nUnlockPath\x12\
-    \x1b\n\taddress_n\x18\x01\x20\x03(\rR\x08addressN\x12\x10\n\x03mac\x18\
-    \x02\x20\x01(\x0cR\x03mac\"'\n\x13UnlockedPathRequest\x12\x10\n\x03mac\
-    \x18\x01\x20\x02(\x0cR\x03mac\"\x14\n\x12ShowDeviceTutorial\"\x12\n\x10U\
-    nlockBootloader\"%\n\rSetBrightness\x12\x14\n\x05value\x18\x01\x20\x01(\
-    \rR\x05value*\x99\x01\n\nBackupType\x12\t\n\x05Bip39\x10\0\x12\x10\n\x0c\
-    Slip39_Basic\x10\x01\x12\x13\n\x0fSlip39_Advanced\x10\x02\x12\x1c\n\x18S\
-    lip39_Single_Extendable\x10\x03\x12\x1b\n\x17Slip39_Basic_Extendable\x10\
-    \x04\x12\x1e\n\x1aSlip39_Advanced_Extendable\x10\x05*G\n\x10SafetyCheckL\
-    evel\x12\n\n\x06Strict\x10\0\x12\x10\n\x0cPromptAlways\x10\x01\x12\x15\n\
-    \x11PromptTemporarily\x10\x02*=\n\x0fDisplayRotation\x12\t\n\x05North\
-    \x10\0\x12\x08\n\x04East\x10Z\x12\n\n\x05South\x10\xb4\x01\x12\t\n\x04We\
-    st\x10\x8e\x02*0\n\x10HomescreenFormat\x12\x08\n\x04Toif\x10\x01\x12\x08\
-    \n\x04Jpeg\x10\x02\x12\x08\n\x04ToiG\x10\x03*H\n\x0cRecoveryType\x12\x12\
-    \n\x0eNormalRecovery\x10\0\x12\n\n\x06DryRun\x10\x01\x12\x18\n\x14Unlock\
-    RepeatedBackup\x10\x02BB\n#com.satoshilabs.trezor.lib.protobufB\x17Trezo\
-    rMessageManagement\x80\xa6\x1d\x01\
+    allenge\x18\x01\x20\x02(\x0cR\tchallenge\"\xcb\x01\n\x11AuthenticityProo\
+    f\x12/\n\x13optiga_certificates\x18\x01\x20\x03(\x0cR\x12optigaCertifica\
+    tes\x12)\n\x10optiga_signature\x18\x02\x20\x02(\x0cR\x0foptigaSignature\
+    \x12/\n\x13tropic_certificates\x18\x03\x20\x03(\x0cR\x12tropicCertificat\
+    es\x12)\n\x10tropic_signature\x18\x04\x20\x01(\x0cR\x0ftropicSignature\"\
+    \x0c\n\nWipeDevice\"\xad\x02\n\nLoadDevice\x12\x1c\n\tmnemonics\x18\x01\
+    \x20\x03(\tR\tmnemonics\x12\x10\n\x03pin\x18\x03\x20\x01(\tR\x03pin\x123\
+    \n\x15passphrase_protection\x18\x04\x20\x01(\x08R\x14passphraseProtectio\
+    n\x12\x1e\n\x08language\x18\x05\x20\x01(\tR\x08languageB\x02\x18\x01\x12\
+    \x14\n\x05label\x18\x06\x20\x01(\tR\x05label\x12#\n\rskip_checksum\x18\
+    \x07\x20\x01(\x08R\x0cskipChecksum\x12\x1f\n\x0bu2f_counter\x18\x08\x20\
+    \x01(\rR\nu2fCounter\x12!\n\x0cneeds_backup\x18\t\x20\x01(\x08R\x0bneeds\
+    Backup\x12\x1b\n\tno_backup\x18\n\x20\x01(\x08R\x08noBackup\"\x9d\x03\n\
+    \x0bResetDevice\x12\x1f\n\x08strength\x18\x02\x20\x01(\r:\x03256R\x08str\
+    ength\x123\n\x15passphrase_protection\x18\x03\x20\x01(\x08R\x14passphras\
+    eProtection\x12%\n\x0epin_protection\x18\x04\x20\x01(\x08R\rpinProtectio\
+    n\x12\x1e\n\x08language\x18\x05\x20\x01(\tR\x08languageB\x02\x18\x01\x12\
+    \x14\n\x05label\x18\x06\x20\x01(\tR\x05label\x12\x1f\n\x0bu2f_counter\
+    \x18\x07\x20\x01(\rR\nu2fCounter\x12\x1f\n\x0bskip_backup\x18\x08\x20\
+    \x01(\x08R\nskipBackup\x12\x1b\n\tno_backup\x18\t\x20\x01(\x08R\x08noBac\
+    kup\x12Q\n\x0bbackup_type\x18\n\x20\x01(\x0e2).hw.trezor.messages.manage\
+    ment.BackupType:\x05Bip39R\nbackupType\x12#\n\rentropy_check\x18\x0b\x20\
+    \x01(\x08R\x0centropyCheckJ\x04\x08\x01\x10\x02\"\xe5\x01\n\x0cBackupDev\
+    ice\x12'\n\x0fgroup_threshold\x18\x01\x20\x01(\rR\x0egroupThreshold\x12O\
+    \n\x06groups\x18\x02\x20\x03(\x0b27.hw.trezor.messages.management.Backup\
+    Device.Slip39GroupR\x06groups\x1a[\n\x0bSlip39Group\x12)\n\x10member_thr\
+    eshold\x18\x01\x20\x02(\rR\x0fmemberThreshold\x12!\n\x0cmember_count\x18\
+    \x02\x20\x02(\rR\x0bmemberCount\"b\n\x0eEntropyRequest\x12-\n\x12entropy\
+    _commitment\x18\x01\x20\x01(\x0cR\x11entropyCommitment\x12!\n\x0cprev_en\
+    tropy\x18\x02\x20\x01(\x0cR\x0bprevEntropy\"&\n\nEntropyAck\x12\x18\n\
+    \x07entropy\x18\x01\x20\x02(\x0cR\x07entropy\"\x13\n\x11EntropyCheckRead\
+    y\"5\n\x14EntropyCheckContinue\x12\x1d\n\x06finish\x18\x01\x20\x01(\x08:\
+    \x05falseR\x06finish\"\x8d\x04\n\x0eRecoveryDevice\x12\x1d\n\nword_count\
+    \x18\x01\x20\x01(\rR\twordCount\x123\n\x15passphrase_protection\x18\x02\
+    \x20\x01(\x08R\x14passphraseProtection\x12%\n\x0epin_protection\x18\x03\
+    \x20\x01(\x08R\rpinProtection\x12\x1e\n\x08language\x18\x04\x20\x01(\tR\
+    \x08languageB\x02\x18\x01\x12\x14\n\x05label\x18\x05\x20\x01(\tR\x05labe\
+    l\x12)\n\x10enforce_wordlist\x18\x06\x20\x01(\x08R\x0fenforceWordlist\
+    \x12j\n\x0cinput_method\x18\x08\x20\x01(\x0e2G.hw.trezor.messages.manage\
+    ment.RecoveryDevice.RecoveryDeviceInputMethodR\x0binputMethod\x12\x1f\n\
+    \x0bu2f_counter\x18\t\x20\x01(\rR\nu2fCounter\x12O\n\x04type\x18\n\x20\
+    \x01(\x0e2+.hw.trezor.messages.management.RecoveryType:\x0eNormalRecover\
+    yR\x04type\";\n\x19RecoveryDeviceInputMethod\x12\x12\n\x0eScrambledWords\
+    \x10\0\x12\n\n\x06Matrix\x10\x01J\x04\x08\x07\x10\x08\"\xc5\x01\n\x0bWor\
+    dRequest\x12N\n\x04type\x18\x01\x20\x02(\x0e2:.hw.trezor.messages.manage\
+    ment.WordRequest.WordRequestTypeR\x04type\"f\n\x0fWordRequestType\x12\
+    \x19\n\x15WordRequestType_Plain\x10\0\x12\x1b\n\x17WordRequestType_Matri\
+    x9\x10\x01\x12\x1b\n\x17WordRequestType_Matrix6\x10\x02\"\x1d\n\x07WordA\
+    ck\x12\x12\n\x04word\x18\x01\x20\x02(\tR\x04word\"0\n\rSetU2FCounter\x12\
+    \x1f\n\x0bu2f_counter\x18\x01\x20\x02(\rR\nu2fCounter\"\x13\n\x11GetNext\
+    U2FCounter\"1\n\x0eNextU2FCounter\x12\x1f\n\x0bu2f_counter\x18\x01\x20\
+    \x02(\rR\nu2fCounter\"\x11\n\x0fDoPreauthorized\"\x16\n\x14Preauthorized\
+    Request\"\x15\n\x13CancelAuthorization\"\x9a\x02\n\x12RebootToBootloader\
+    \x12o\n\x0cboot_command\x18\x01\x20\x01(\x0e2=.hw.trezor.messages.manage\
+    ment.RebootToBootloader.BootCommand:\rSTOP_AND_WAITR\x0bbootCommand\x12'\
+    \n\x0ffirmware_header\x18\x02\x20\x01(\x0cR\x0efirmwareHeader\x123\n\x14\
+    language_data_length\x18\x03\x20\x01(\r:\x010R\x12languageDataLength\"5\
+    \n\x0bBootCommand\x12\x11\n\rSTOP_AND_WAIT\x10\0\x12\x13\n\x0fINSTALL_UP\
+    GRADE\x10\x01\"\x10\n\x08GetNonce:\x04\x88\xb2\x19\x01\"#\n\x05Nonce\x12\
+    \x14\n\x05nonce\x18\x01\x20\x02(\x0cR\x05nonce:\x04\x88\xb2\x19\x01\";\n\
+    \nUnlockPath\x12\x1b\n\taddress_n\x18\x01\x20\x03(\rR\x08addressN\x12\
+    \x10\n\x03mac\x18\x02\x20\x01(\x0cR\x03mac\"'\n\x13UnlockedPathRequest\
+    \x12\x10\n\x03mac\x18\x01\x20\x02(\x0cR\x03mac\"\x14\n\x12ShowDeviceTuto\
+    rial\"\x12\n\x10UnlockBootloader\"%\n\rSetBrightness\x12\x14\n\x05value\
+    \x18\x01\x20\x01(\rR\x05value*\x99\x01\n\nBackupType\x12\t\n\x05Bip39\
+    \x10\0\x12\x10\n\x0cSlip39_Basic\x10\x01\x12\x13\n\x0fSlip39_Advanced\
+    \x10\x02\x12\x1c\n\x18Slip39_Single_Extendable\x10\x03\x12\x1b\n\x17Slip\
+    39_Basic_Extendable\x10\x04\x12\x1e\n\x1aSlip39_Advanced_Extendable\x10\
+    \x05*G\n\x10SafetyCheckLevel\x12\n\n\x06Strict\x10\0\x12\x10\n\x0cPrompt\
+    Always\x10\x01\x12\x15\n\x11PromptTemporarily\x10\x02*=\n\x0fDisplayRota\
+    tion\x12\t\n\x05North\x10\0\x12\x08\n\x04East\x10Z\x12\n\n\x05South\x10\
+    \xb4\x01\x12\t\n\x04West\x10\x8e\x02*0\n\x10HomescreenFormat\x12\x08\n\
+    \x04Toif\x10\x01\x12\x08\n\x04Jpeg\x10\x02\x12\x08\n\x04ToiG\x10\x03*H\n\
+    \x0cRecoveryType\x12\x12\n\x0eNormalRecovery\x10\0\x12\n\n\x06DryRun\x10\
+    \x01\x12\x18\n\x14UnlockRepeatedBackup\x10\x02BB\n#com.satoshilabs.trezo\
+    r.lib.protobufB\x17TrezorMessageManagement\x80\xa6\x1d\x01\
 ";
 
 /// `FileDescriptorProto` object which was a source for this generated file

Risk score

Why this scored 18/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 3/15

Confidence 8/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 18/100

Community notes

Related watches

test(core/ethereum): EIP-7702 tuple nonce must be non-zero

build(core): propagate emulator feature from projects

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding