← Watch feed
chore: introduce new debug root P-256 key
Public commit record
57/100 · Thin
What the developer wrote
Authored by Ondřej Vejpustek
chore: introduce new debug root P-256 key
[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
What changed, and why it matters
This commit swaps in a new developer-debug-only public root key used to verify device certificates during factory testing. The old debug key is kept as a backup for compatibility. It is not a fix for a live user-facing vulnerability and does not change production keys. The change is routine key rotation for internal test infrastructure.
Recommended action
No action required for end users. For Trezor engineering, verify the new debug key was generated with proper key-management controls and that the old key has a planned deprecation date.
Security signals we found
01
Root public key rotation for debug/test trust anchor
02
Old key retained for backward compatibility
03
No production root keys changed
04
No code-path or parsing changes
Evidence from the diff
The patch updates the P-256 debug root public key used in prodtest (Trezor factory-test firmware) and in Python test helpers. The previous key is renamed *_OLD and retained in the trusted-key list so existing signed debug/test certificates continue to validate. Production, staging and backup root keys are untouched. No private key material, cryptographic logic, or certificate parsing code is modified.
Changed components
core/embed/projects/prodtest/cmd/common.ccore/embed/projects/prodtest/cmd/hsm_keys.hcommon/hsm_keys.jsonpython/src/trezorlib/_root_keys.pytests/device_tests/certificate.pyInspect captured patch +19 / −4
diff --git a/common/hsm_keys.json b/common/hsm_keys.json
index f0ad25cc..86b7db84 100644
--- a/common/hsm_keys.json
+++ b/common/hsm_keys.json
@@ -24,7 +24,8 @@
"DEV_AUTH_ROOT_PROD_BACKUP_P256": "04c6a673af4ec44b10441b1d78676e15173ad0e36df9f7f2fa1cd819955f20fe32917b60da5fed3b3aa54a9ab8b3ed27d198b3768cad26eef5935cd87af0af065e",
"DEV_AUTH_ROOT_PROD_BACKUP_ED25519": "5612606584ee7e0bc313b13f7ac94156bb4cb75bd77585ddbe579301306e85f1",
"DEV_AUTH_ROOT_PROD_BACKUP_MLDSA44": "fedf8b0c16164b9cec427882aa03d3bd6a1588cfbaebaf93cf2fc52f275417777433a938dcd6516345148f728c935a40ef3b6c41fd3ed831fea13774bd39887da8b06e2e671cc32a1c72e44a13d1cd985dc2ddcb63e457bbd29d38186ddb776b8e73b645c8bf616309f890d175538a9d10c82e595dea03f70564ff69b53497ecefd51fd8320041d9b1092386033ed37a93dd9b4b9da1297f808eac21020b8dc4747e01854ebdc407a04fc18b2758720125acb41f0c60e16cd53707a65392feed06c9fcc28a3e738dbc91614e89e5d535274c6b226d83f335a0dd088755571cf62496ca4642ec8e65eba8be2b8cec46416c6a3ad4be10569ac532e02d6e06b6ce0c0d4b7a99a11c910f9f0631b0cd72e20637237eeff723e722f7aa626732434c47843a099739e96e31267d8d6905d8b2b712a5a69d9343a3c1e07afb414b73950f4b1df196243005fb61c6200ef346826d6c0f4cc8ede052ed48235997bb366dade4483bfc11fe65fd0c5539e89d8bd271e54e30da6e5192a0f343dea3806aa798d12d62251a063d071ba67c35d3a26e582c2d361cf2d0fc36fb1b5a46e469669338b1c1744bdfe365700a6a1c641ab2b7906e2b7c0c0a9af8862ab5751a678e3e0156847ff6093ca7ebd48dd8b1d6f7736c2039e705c1e20f42ed5cac6db3dc7a7e2facbb75411e7fb8a156df52a2926afa9070937cde4dd4bd456294ba59bdcf123f11dcda267d475721abfecab1b31848a27236aa751e5b55015f033d87fb9cf5c086e09f1667cf7ec2e72436c907c5763690d698fffa997709bb89526cae772bb962c06ed1b89d418835672b85e1a1b2e3c55f4e607ecad09bdb3a18224b9805659aa2ecf0b62dbf6265e27d4101450edb590d52d525b62b1114dad2eb06c951a2c77c7ecfbf5f1f6fe285f39727958ce0b5cfe8fd465420c270309999e6694ee31fcb7d6480a75d0d72558cd6a050b8d11a9a6d7736700027fbe14b48949b7e1af2ca148ad4e4b4b93e9575a4119afd1b57c250606d5a4e258c2393c104d651995b1e75887f492ff05e92e1630332f176d86a0453b412d0869d98d6ab27377a74766e3cadde29c1853e6398a9edfa48c0d14e7c148b048f1bf25d11979e94878cb86eaf1e55638c1b39e0ac5254a009bf957f4b624796753c3451246e5a7b9022926aa77b7a1b4ae7d25f776d4395ba98a37d9e21b221da29564e50a669056650a40489386e8909c6ca21d369c3495c44b2f71373a392c9fa89c9085f467d24d6219fcdd2b56126792eb6a14269c4264a56926b1a7d9a1c03d9649d157f938abfdc2a56c20795065774838030da41a4c6178919cc1c6c88de1458d9baa1e51a4a1994e6d5cc94b049b15c235c5cf46d2cf23f09d565c5a5497ef0b3a5fbc8d1be8ed78f3794c49d4936139b0419faaffc52b55cb91f6e1bafacd55523c0b7eec56d98e4228cd0f9d00bc9866dac71e43db2b2cf311999d7bc3a49219836f558cbb5d8faa79e83079c6ce92288aae852553b655ef6bc87fbb25ca3ab482aecaf0a86eecc92341906cc89d234087f5abd6d2100a60d361d516d460d436b46706ad44b8b4ef3fe54ea198ffc2cf8c8e144ec62c4ce86ed5d181283fc17c926668ca4e0b8683e0c7bc662a54ea7f4c830365ad1cdea58abee9a726168ce9870729972884ecfe5baf06f1ee664aa422e26f9f76e20908d72e78c1a2dcd94fe1c07573d7706d7bdc07d0b41498c0d52ec3a90d6e7c0fcef597a884fb2caba29c2279569a1e64dd6c7ed4b312d2197b6391407899b25d21cefd1408eca42204f76cb0436f44c0a9c2e1eca19df8d93255c0da6469dc47da883e186387f76011cc8",
- "DEV_AUTH_ROOT_DEBUG_P256": "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578",
+ "DEV_AUTH_ROOT_DEBUG_P256_OLD": "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578",
+ "DEV_AUTH_ROOT_DEBUG_P256": "0423bf3b9859e851a40820d6c142074f495fd7d2714064e26cc5abcb09bff287b4ca835f861c5da427221adc8f5c009925fee638d1ee4d8a85cb2e0754b6069576",
"DEV_AUTH_ROOT_STAGING_P256": "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519",
"DEV_AUTH_ROOT_DEBUG_ED25519": "04e3856182309678a15767451f931ed86617b1d25462afcbddc81dc80bfc1661",
"DEV_AUTH_ROOT_STAGING_ED25519": "cd318dc8405ae4f4144e3284dcb7b0cb0f0c2195c2ca14a0f6fccd9104e32a4b",
diff --git a/core/embed/projects/prodtest/cmd/common.c b/core/embed/projects/prodtest/cmd/common.c
index f07e53e9..3c8df158 100644
--- a/core/embed/projects/prodtest/cmd/common.c
+++ b/core/embed/projects/prodtest/cmd/common.c
@@ -48,6 +48,9 @@ const uint8_t ROOT_KEYS_P256[][ECDSA_PUBLIC_KEY_SIZE] = {
DEV_AUTH_ROOT_PROD_BACKUP_P256,
#endif
#else
+#ifdef DEV_AUTH_ROOT_DEBUG_P256_OLD
+ DEV_AUTH_ROOT_DEBUG_P256_OLD,
+#endif
#ifdef DEV_AUTH_ROOT_DEBUG_P256
DEV_AUTH_ROOT_DEBUG_P256,
#endif
diff --git a/core/embed/projects/prodtest/cmd/hsm_keys.h b/core/embed/projects/prodtest/cmd/hsm_keys.h
index 493b97db..0a22e0ef 100644
--- a/core/embed/projects/prodtest/cmd/hsm_keys.h
+++ b/core/embed/projects/prodtest/cmd/hsm_keys.h
@@ -340,7 +340,7 @@
0x0d, 0xa6, 0x46, 0x9d, 0xc4, 0x7d, 0xa8, 0x83, 0xe1, 0x86, 0x38, 0x7f, \
0x76, 0x01, 0x1c, 0xc8}
-#define DEV_AUTH_ROOT_DEBUG_P256 \
+#define DEV_AUTH_ROOT_DEBUG_P256_OLD \
{ \
0x04, 0x52, 0x11, 0x92, 0xe1, 0x73, 0xa9, 0xda, 0x4e, 0x30, 0x23, \
0xf7, 0x47, 0xd8, 0x36, 0x56, 0x37, 0x25, 0x37, 0x26, 0x81, 0xeb, \
@@ -349,6 +349,15 @@
0x4f, 0x8c, 0x33, 0x2f, 0xc1, 0xe9, 0xc0, 0xf3, 0xb8, 0x0d, 0x42, \
0x12, 0x82, 0x26, 0x68, 0xb6, 0x31, 0x89, 0x70, 0x65, 0x78}
+#define DEV_AUTH_ROOT_DEBUG_P256 \
+ { \
+ 0x04, 0x23, 0xbf, 0x3b, 0x98, 0x59, 0xe8, 0x51, 0xa4, 0x08, 0x20, \
+ 0xd6, 0xc1, 0x42, 0x07, 0x4f, 0x49, 0x5f, 0xd7, 0xd2, 0x71, 0x40, \
+ 0x64, 0xe2, 0x6c, 0xc5, 0xab, 0xcb, 0x09, 0xbf, 0xf2, 0x87, 0xb4, \
+ 0xca, 0x83, 0x5f, 0x86, 0x1c, 0x5d, 0xa4, 0x27, 0x22, 0x1a, 0xdc, \
+ 0x8f, 0x5c, 0x00, 0x99, 0x25, 0xfe, 0xe6, 0x38, 0xd1, 0xee, 0x4d, \
+ 0x8a, 0x85, 0xcb, 0x2e, 0x07, 0x54, 0xb6, 0x06, 0x95, 0x76}
+
#define DEV_AUTH_ROOT_STAGING_P256 \
{ \
0x04, 0x65, 0xe8, 0x8f, 0x9b, 0x2c, 0xea, 0x67, 0xe8, 0x36, 0x4f, \
diff --git a/python/src/trezorlib/_root_keys.py b/python/src/trezorlib/_root_keys.py
index 64db95cf..e95cc1f1 100644
--- a/python/src/trezorlib/_root_keys.py
+++ b/python/src/trezorlib/_root_keys.py
@@ -43,7 +43,9 @@ T3W1_DEV_AUTH_ROOT_PROD_BACKUP_ED25519_HEX = "5612606584ee7e0bc313b13f7ac94156bb
T3W1_DEV_AUTH_ROOT_PROD_BACKUP_MLDSA44_HEX = "fedf8b0c16164b9cec427882aa03d3bd6a1588cfbaebaf93cf2fc52f275417777433a938dcd6516345148f728c935a40ef3b6c41fd3ed831fea13774bd39887da8b06e2e671cc32a1c72e44a13d1cd985dc2ddcb63e457bbd29d38186ddb776b8e73b645c8bf616309f890d175538a9d10c82e595dea03f70564ff69b53497ecefd51fd8320041d9b1092386033ed37a93dd9b4b9da1297f808eac21020b8dc4747e01854ebdc407a04fc18b2758720125acb41f0c60e16cd53707a65392feed06c9fcc28a3e738dbc91614e89e5d535274c6b226d83f335a0dd088755571cf62496ca4642ec8e65eba8be2b8cec46416c6a3ad4be10569ac532e02d6e06b6ce0c0d4b7a99a11c910f9f0631b0cd72e20637237eeff723e722f7aa626732434c47843a099739e96e31267d8d6905d8b2b712a5a69d9343a3c1e07afb414b73950f4b1df196243005fb61c6200ef346826d6c0f4cc8ede052ed48235997bb366dade4483bfc11fe65fd0c5539e89d8bd271e54e30da6e5192a0f343dea3806aa798d12d62251a063d071ba67c35d3a26e582c2d361cf2d0fc36fb1b5a46e469669338b1c1744bdfe365700a6a1c641ab2b7906e2b7c0c0a9af8862ab5751a678e3e0156847ff6093ca7ebd48dd8b1d6f7736c2039e705c1e20f42ed5cac6db3dc7a7e2facbb75411e7fb8a156df52a2926afa9070937cde4dd4bd456294ba59bdcf123f11dcda267d475721abfecab1b31848a27236aa751e5b55015f033d87fb9cf5c086e09f1667cf7ec2e72436c907c5763690d698fffa997709bb89526cae772bb962c06ed1b89d418835672b85e1a1b2e3c55f4e607ecad09bdb3a18224b9805659aa2ecf0b62dbf6265e27d4101450edb590d52d525b62b1114dad2eb06c951a2c77c7ecfbf5f1f6fe285f39727958ce0b5cfe8fd465420c270309999e6694ee31fcb7d6480a75d0d72558cd6a050b8d11a9a6d7736700027fbe14b48949b7e1af2ca148ad4e4b4b93e9575a4119afd1b57c250606d5a4e258c2393c104d651995b1e75887f492ff05e92e1630332f176d86a0453b412d0869d98d6ab27377a74766e3cadde29c1853e6398a9edfa48c0d14e7c148b048f1bf25d11979e94878cb86eaf1e55638c1b39e0ac5254a009bf957f4b624796753c3451246e5a7b9022926aa77b7a1b4ae7d25f776d4395ba98a37d9e21b221da29564e50a669056650a40489386e8909c6ca21d369c3495c44b2f71373a392c9fa89c9085f467d24d6219fcdd2b56126792eb6a14269c4264a56926b1a7d9a1c03d9649d157f938abfdc2a56c20795065774838030da41a4c6178919cc1c6c88de1458d9baa1e51a4a1994e6d5cc94b049b15c235c5cf46d2cf23f09d565c5a5497ef0b3a5fbc8d1be8ed78f3794c49d4936139b0419faaffc52b55cb91f6e1bafacd55523c0b7eec56d98e4228cd0f9d00bc9866dac71e43db2b2cf311999d7bc3a49219836f558cbb5d8faa79e83079c6ce92288aae852553b655ef6bc87fbb25ca3ab482aecaf0a86eecc92341906cc89d234087f5abd6d2100a60d361d516d460d436b46706ad44b8b4ef3fe54ea198ffc2cf8c8e144ec62c4ce86ed5d181283fc17c926668ca4e0b8683e0c7bc662a54ea7f4c830365ad1cdea58abee9a726168ce9870729972884ecfe5baf06f1ee664aa422e26f9f76e20908d72e78c1a2dcd94fe1c07573d7706d7bdc07d0b41498c0d52ec3a90d6e7c0fcef597a884fb2caba29c2279569a1e64dd6c7ed4b312d2197b6391407899b25d21cefd1408eca42204f76cb0436f44c0a9c2e1eca19df8d93255c0da6469dc47da883e186387f76011cc8"
-T3W1_DEV_AUTH_ROOT_DEBUG_P256_HEX = "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578"
+T3W1_DEV_AUTH_ROOT_DEBUG_P256_OLD_HEX = "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578"
+
+T3W1_DEV_AUTH_ROOT_DEBUG_P256_HEX = "0423bf3b9859e851a40820d6c142074f495fd7d2714064e26cc5abcb09bff287b4ca835f861c5da427221adc8f5c009925fee638d1ee4d8a85cb2e0754b6069576"
T3W1_DEV_AUTH_ROOT_STAGING_P256_HEX = "0465e88f9b2cea67e8364f0cfcfacd500af24e9040b357beee629ccc4fce1704d1a7ef7284f387708f92ef14600e2caad6894016fee819d623b95d66210c3e7519"
diff --git a/tests/device_tests/certificate.py b/tests/device_tests/certificate.py
index 8a926c18..397c1225 100644
--- a/tests/device_tests/certificate.py
+++ b/tests/device_tests/certificate.py
@@ -19,7 +19,7 @@ OPTIGA_ROOT_PUBLIC_KEY = {
"047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a"
),
models.T3W1: bytes.fromhex(
- "04521192e173a9da4e3023f747d836563725372681eba3079c56ff11b2fc137ab189eb4155f371127651b5594f8c332fc1e9c0f3b80d4212822668b63189706578"
+ "0423bf3b9859e851a40820d6c142074f495fd7d2714064e26cc5abcb09bff287b4ca835f861c5da427221adc8f5c009925fee638d1ee4d8a85cb2e0754b6069576"
),
}
Risk score
Our methodology →Why this scored 18/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.