feat(core): use empty MCU attestation certificate in prodtest
What the developer wrote
Authored by Ondřej Vejpustek
feat(core): use empty MCU attestation certificate in prodtest
[no changelog]
What changed, and why it matters
This commit changes how Trezor hardware wallet firmware handles a special factory-testing mode called 'prodtest'. In prodtest builds, it now uses an empty placeholder certificate for MCU (microcontroller) attestation instead of a real device certificate. This appears to be a development/testing convenience change rather than a fix for a live security vulnerability, because prodtest is not the normal user-facing firmware. However, it touches attestation code, which is security-sensitive, and the commit message gives no security context.
Treat as a low-signal change requiring routine review. Verify that prodtest firmware is never shipped to end users, that the empty certificate cannot be activated in production builds, and that attestation verification correctly rejects a zero-length certificate. Request a changelog or security note from the vendor if this change affects device provisioning or factory workflows.
Security signals we found
Attestation certificate handling changed in a security-adjacent code path
Empty/zero-length certificate used in a production-test configuration
No changelog entry provided despite touching security-relevant code
Commit message does not explain security relevance or rationale
Evidence from the diff
The patch modifies core/embed/sec/secret/unix/secret.c. It introduces a TREZOR_PRODTEST preprocessor branch that defines MCU_DEVICE_CERT as {0} and MCU_DEVICE_CERT_SIZE as 0, overriding the previous behavior of including a model-specific certificate (T3W1.h). It also refactors the certificate storage into a static array and size variable. The actual write function secret_mcu_device_cert_write still validates cert_size against MCU_ATTESTATION_MAX_CERT_SIZE and only operates under TREZOR_PRODTEST. The change is confined to the Unix secret implementation and prodtest builds.
Changed components
core/embed/sec/secret/unix/secret.cMCU attestation subsystemTREZOR_PRODTEST build configurationInspect captured patch +11 / −1
diff --git a/core/embed/sec/secret/unix/secret.c b/core/embed/sec/secret/unix/secret.c
index 99221dac..8d21f7be 100644
--- a/core/embed/sec/secret/unix/secret.c
+++ b/core/embed/sec/secret/unix/secret.c
@@ -201,12 +201,22 @@ void secret_bhk_regenerate(void) {}
#include <sec/mcu_attestation.h>
-#if defined(TREZOR_MODEL_T3W1)
+#if defined(TREZOR_PRODTEST)
+#define MCU_DEVICE_CERT {0}
+#define MCU_DEVICE_CERT_SIZE 0
+#elif defined(TREZOR_MODEL_T3W1)
#include "certs/T3W1.h"
#else
#error "MCU attestation is only supported for T3W1 model."
#endif
+#ifndef MCU_DEVICE_CERT_SIZE
+#define MCU_DEVICE_CERT_SIZE sizeof((uint8_t[])MCU_DEVICE_CERT)
+#endif
+
+static uint8_t mcu_device_cert[MCU_ATTESTATION_MAX_CERT_SIZE] = MCU_DEVICE_CERT;
+static size_t mcu_device_cert_size = MCU_DEVICE_CERT_SIZE;
+
secbool secret_mcu_device_cert_write(const uint8_t* cert, size_t cert_size) {
#ifdef TREZOR_PRODTEST
if (cert_size > MCU_ATTESTATION_MAX_CERT_SIZE) {
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.