feat(core): Add MCU signature to AuthenticityProof

Trezor/Trezor firmware

db430e92 View source ↗

Public commit record

What the developer wrote

Authored by Andrew Kozlik

67/100 · Adequate

feat(core): Add MCU signature to AuthenticityProof

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Names security-relevant behavior explicitly! No meaningful explanatory body

The short version

What changed, and why it matters

This commit only adds two new optional data fields to an existing device-authentication proof message used in Trezor hardware wallets. It extends the protocol definition and the matching generated code in Python, Rust, and the core firmware so that future firmware can include an MCU (microcontroller) certificate and signature alongside the already-present Optiga and Tropic proofs. The change is additive and does not by itself alter any verification logic, cryptographic checks, or access controls visible in the diff.

Recommended action

No immediate action required. Treat as a normal feature commit. If reviewing for security, inspect the companion firmware commits that populate and verify mcu_certificates/mcu_signature to ensure the MCU certificate chain is validated correctly and that accepting missing/empty MCU proof does not weaken authenticity guarantees.

Security signals we found

New optional fields added to an existing device-authentication proof message

Fields mirror existing optiga/tropic certificate/signature pattern

No verification logic, parser changes, or access-control changes visible in diff

No changelog entry and no security wording in commit message

Technical analysis

Evidence from the diff

The change extends the AuthenticityProof protobuf message (common/protob/messages-management.proto) with mcu_certificates (field 5, repeated bytes) and mcu_signature (field 6, optional bytes). Corresponding generated/typed bindings are updated in core/src/trezor/messages.py, python/src/trezorlib/messages.py, and rust/trezor-client/src/protos/generated/messages_management.rs. The embedded file descriptor bytes are regenerated. No logic that consumes, validates, or acts on these fields is present in the supplied diff.

Changed components

common/protob/messages-management.protocore/src/trezor/messages.pypython/src/trezorlib/messages.pyrust/trezor-client/src/protos/generated/messages_management.rs

Inspect captured patch +167 / −80

diff --git a/common/protob/messages-management.proto b/common/protob/messages-management.proto
index 3ed9a485..f87c012a 100644
--- a/common/protob/messages-management.proto
+++ b/common/protob/messages-management.proto
@@ -411,6 +411,9 @@ message AuthenticityProof {
                                              // Trezor company's root CA.
     optional bytes tropic_signature = 4;     // A DER-encoded signature of "\x13AuthenticateDevice:" + length-prefixed
                                              // challenge that should be verified using the Tropic device certificate.
+    repeated bytes mcu_certificates = 5;     // An MCU device certificate signed by Trezor company's root CA.
+    optional bytes mcu_signature = 6;        // A DER-encoded signature of "\x13AuthenticateDevice:" + length-prefixed
+                                             // challenge that should be verified using the MCU device certificate.
 }
 
 /**
diff --git a/core/src/trezor/messages.py b/core/src/trezor/messages.py
index bc5e2cf4..87bb813a 100644
--- a/core/src/trezor/messages.py
+++ b/core/src/trezor/messages.py
@@ -2427,6 +2427,8 @@ if TYPE_CHECKING:
         optiga_signature: "AnyBytes"
         tropic_certificates: "list[AnyBytes]"
         tropic_signature: "AnyBytes | None"
+        mcu_certificates: "list[AnyBytes]"
+        mcu_signature: "AnyBytes | None"
 
         def __init__(
             self,
@@ -2434,7 +2436,9 @@ if TYPE_CHECKING:
             optiga_signature: "AnyBytes",
             optiga_certificates: "list[AnyBytes] | None" = None,
             tropic_certificates: "list[AnyBytes] | None" = None,
+            mcu_certificates: "list[AnyBytes] | None" = None,
             tropic_signature: "AnyBytes | None" = None,
+            mcu_signature: "AnyBytes | None" = None,
         ) -> None:
             pass
 
diff --git a/python/src/trezorlib/messages.py b/python/src/trezorlib/messages.py
index adcb6cb3..959d3400 100644
--- a/python/src/trezorlib/messages.py
+++ b/python/src/trezorlib/messages.py
@@ -3699,6 +3699,8 @@ class AuthenticityProof(protobuf.MessageType):
         2: protobuf.Field("optiga_signature", "bytes", repeated=False, required=True),
         3: protobuf.Field("tropic_certificates", "bytes", repeated=True, required=False, default=None),
         4: protobuf.Field("tropic_signature", "bytes", repeated=False, required=False, default=None),
+        5: protobuf.Field("mcu_certificates", "bytes", repeated=True, required=False, default=None),
+        6: protobuf.Field("mcu_signature", "bytes", repeated=False, required=False, default=None),
     }
 
     def __init__(
@@ -3707,12 +3709,16 @@ class AuthenticityProof(protobuf.MessageType):
         optiga_signature: "bytes",
         optiga_certificates: Optional[Sequence["bytes"]] = None,
         tropic_certificates: Optional[Sequence["bytes"]] = None,
+        mcu_certificates: Optional[Sequence["bytes"]] = None,
         tropic_signature: Optional["bytes"] = None,
+        mcu_signature: Optional["bytes"] = None,
     ) -> None:
         self.optiga_certificates: Sequence["bytes"] = optiga_certificates if optiga_certificates is not None else []
         self.tropic_certificates: Sequence["bytes"] = tropic_certificates if tropic_certificates is not None else []
+        self.mcu_certificates: Sequence["bytes"] = mcu_certificates if mcu_certificates is not None else []
         self.optiga_signature = optiga_signature
         self.tropic_signature = tropic_signature
+        self.mcu_signature = mcu_signature
 
 
 class WipeDevice(protobuf.MessageType):
diff --git a/rust/trezor-client/src/protos/generated/messages_management.rs b/rust/trezor-client/src/protos/generated/messages_management.rs
index 43c68054..d1359436 100644
--- a/rust/trezor-client/src/protos/generated/messages_management.rs
+++ b/rust/trezor-client/src/protos/generated/messages_management.rs
@@ -6492,6 +6492,10 @@ pub struct AuthenticityProof {
     pub tropic_certificates: ::std::vec::Vec<::std::vec::Vec<u8>>,
     // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.tropic_signature)
     pub tropic_signature: ::std::option::Option<::std::vec::Vec<u8>>,
+    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.mcu_certificates)
+    pub mcu_certificates: ::std::vec::Vec<::std::vec::Vec<u8>>,
+    // @@protoc_insertion_point(field:hw.trezor.messages.management.AuthenticityProof.mcu_signature)
+    pub mcu_signature: ::std::option::Option<::std::vec::Vec<u8>>,
     // special fields
     // @@protoc_insertion_point(special_field:hw.trezor.messages.management.AuthenticityProof.special_fields)
     pub special_fields: ::protobuf::SpecialFields,
@@ -6580,8 +6584,44 @@ impl AuthenticityProof {
         self.tropic_signature.take().unwrap_or_else(|| ::std::vec::Vec::new())
     }
 
+    // optional bytes mcu_signature = 6;
+
+    pub fn mcu_signature(&self) -> &[u8] {
+        match self.mcu_signature.as_ref() {
+            Some(v) => v,
+            None => &[],
+        }
+    }
+
+    pub fn clear_mcu_signature(&mut self) {
+        self.mcu_signature = ::std::option::Option::None;
+    }
+
+    pub fn has_mcu_signature(&self) -> bool {
+        self.mcu_signature.is_some()
+    }
+
+    // Param is passed by value, moved
+    pub fn set_mcu_signature(&mut self, v: ::std::vec::Vec<u8>) {
+        self.mcu_signature = ::std::option::Option::Some(v);
+    }
+
+    // Mutable pointer to the field.
+    // If field is not initialized, it is initialized with default value first.
+    pub fn mut_mcu_signature(&mut self) -> &mut ::std::vec::Vec<u8> {
+        if self.mcu_signature.is_none() {
+            self.mcu_signature = ::std::option::Option::Some(::std::vec::Vec::new());
+        }
+        self.mcu_signature.as_mut().unwrap()
+    }
+
+    // Take field
+    pub fn take_mcu_signature(&mut self) -> ::std::vec::Vec<u8> {
+        self.mcu_signature.take().unwrap_or_else(|| ::std::vec::Vec::new())
+    }
+
     fn generated_message_descriptor_data() -> ::protobuf::reflect::GeneratedMessageDescriptorData {
-        let mut fields = ::std::vec::Vec::with_capacity(4);
+        let mut fields = ::std::vec::Vec::with_capacity(6);
         let mut oneofs = ::std::vec::Vec::with_capacity(0);
         fields.push(::protobuf::reflect::rt::v2::make_vec_simpler_accessor::<_, _>(
             "optiga_certificates",
@@ -6603,6 +6643,16 @@ impl AuthenticityProof {
             |m: &AuthenticityProof| { &m.tropic_signature },
             |m: &mut AuthenticityProof| { &mut m.tropic_signature },
         ));
+        fields.push(::protobuf::reflect::rt::v2::make_vec_simpler_accessor::<_, _>(
+            "mcu_certificates",
+            |m: &AuthenticityProof| { &m.mcu_certificates },
+            |m: &mut AuthenticityProof| { &mut m.mcu_certificates },
+        ));
+        fields.push(::protobuf::reflect::rt::v2::make_option_accessor::<_, _>(
+            "mcu_signature",
+            |m: &AuthenticityProof| { &m.mcu_signature },
+            |m: &mut AuthenticityProof| { &mut m.mcu_signature },
+        ));
         ::protobuf::reflect::GeneratedMessageDescriptorData::new_2::<AuthenticityProof>(
             "AuthenticityProof",
             fields,
@@ -6636,6 +6686,12 @@ impl ::protobuf::Message for AuthenticityProof {
                 34 => {
                     self.tropic_signature = ::std::option::Option::Some(is.read_bytes()?);
                 },
+                42 => {
+                    self.mcu_certificates.push(is.read_bytes()?);
+                },
+                50 => {
+                    self.mcu_signature = ::std::option::Option::Some(is.read_bytes()?);
+                },
                 tag => {
                     ::protobuf::rt::read_unknown_or_skip_group(tag, is, self.special_fields.mut_unknown_fields())?;
                 },
@@ -6660,6 +6716,12 @@ impl ::protobuf::Message for AuthenticityProof {
         if let Some(v) = self.tropic_signature.as_ref() {
             my_size += ::protobuf::rt::bytes_size(4, &v);
         }
+        for value in &self.mcu_certificates {
+            my_size += ::protobuf::rt::bytes_size(5, &value);
+        };
+        if let Some(v) = self.mcu_signature.as_ref() {
+            my_size += ::protobuf::rt::bytes_size(6, &v);
+        }
         my_size += ::protobuf::rt::unknown_fields_size(self.special_fields.unknown_fields());
         self.special_fields.cached_size().set(my_size as u32);
         my_size
@@ -6678,6 +6740,12 @@ impl ::protobuf::Message for AuthenticityProof {
         if let Some(v) = self.tropic_signature.as_ref() {
             os.write_bytes(4, v)?;
         }
+        for v in &self.mcu_certificates {
+            os.write_bytes(5, &v)?;
+        };
+        if let Some(v) = self.mcu_signature.as_ref() {
+            os.write_bytes(6, v)?;
+        }
         os.write_unknown_fields(self.special_fields.unknown_fields())?;
         ::std::result::Result::Ok(())
     }
@@ -6699,6 +6767,8 @@ impl ::protobuf::Message for AuthenticityProof {
         self.optiga_signature = ::std::option::Option::None;
         self.tropic_certificates.clear();
         self.tropic_signature = ::std::option::Option::None;
+        self.mcu_certificates.clear();
+        self.mcu_signature = ::std::option::Option::None;
         self.special_fields.clear();
     }
 
@@ -6708,6 +6778,8 @@ impl ::protobuf::Message for AuthenticityProof {
             optiga_signature: ::std::option::Option::None,
             tropic_certificates: ::std::vec::Vec::new(),
             tropic_signature: ::std::option::Option::None,
+            mcu_certificates: ::std::vec::Vec::new(),
+            mcu_signature: ::std::option::Option::None,
             special_fields: ::protobuf::SpecialFields::new(),
         };
         &instance
@@ -12583,89 +12655,91 @@ static file_descriptor_proto_data: &'static [u8] = b"\
     \x07entropy\x18\x01\x20\x02(\x0cR\x07entropy\"/\n\x0fGetFirmwareHash\x12\
     \x1c\n\tchallenge\x18\x01\x20\x01(\x0cR\tchallenge\"\"\n\x0cFirmwareHash\
     \x12\x12\n\x04hash\x18\x01\x20\x02(\x0cR\x04hash\"2\n\x12AuthenticateDev\
-    ice\x12\x1c\n\tchallenge\x18\x01\x20\x02(\x0cR\tchallenge\"\xcb\x01\n\
+    ice\x12\x1c\n\tchallenge\x18\x01\x20\x02(\x0cR\tchallenge\"\x9b\x02\n\
     \x11AuthenticityProof\x12/\n\x13optiga_certificates\x18\x01\x20\x03(\x0c\
     R\x12optigaCertificates\x12)\n\x10optiga_signature\x18\x02\x20\x02(\x0cR\
     \x0foptigaSignature\x12/\n\x13tropic_certificates\x18\x03\x20\x03(\x0cR\
     \x12tropicCertificates\x12)\n\x10tropic_signature\x18\x04\x20\x01(\x0cR\
-    \x0ftropicSignature\"\x0c\n\nWipeDevice\"\xda\x02\n\nLoadDevice\x12\x1c\
-    \n\tmnemonics\x18\x01\x20\x03(\tR\tmnemonics\x12\x10\n\x03pin\x18\x03\
-    \x20\x01(\tR\x03pin\x123\n\x15passphrase_protection\x18\x04\x20\x01(\x08\
-    R\x14passphraseProtection\x12\x1e\n\x08language\x18\x05\x20\x01(\tR\x08l\
-    anguageB\x02\x18\x01\x12\x14\n\x05label\x18\x06\x20\x01(\tR\x05label\x12\
-    #\n\rskip_checksum\x18\x07\x20\x01(\x08R\x0cskipChecksum\x12\x1f\n\x0bu2\
-    f_counter\x18\x08\x20\x01(\rR\nu2fCounter\x12!\n\x0cneeds_backup\x18\t\
-    \x20\x01(\x08R\x0bneedsBackup\x12\x1b\n\tno_backup\x18\n\x20\x01(\x08R\
-    \x08noBackup\x12+\n\x11unfinished_backup\x18\x0b\x20\x01(\x08R\x10unfini\
-    shedBackup\"\xf8\x03\n\x0bResetDevice\x12\x1f\n\x08strength\x18\x02\x20\
-    \x01(\r:\x03256R\x08strength\x123\n\x15passphrase_protection\x18\x03\x20\
-    \x01(\x08R\x14passphraseProtection\x12%\n\x0epin_protection\x18\x04\x20\
-    \x01(\x08R\rpinProtection\x12\x1e\n\x08language\x18\x05\x20\x01(\tR\x08l\
-    anguageB\x02\x18\x01\x12\x14\n\x05label\x18\x06\x20\x01(\tR\x05label\x12\
-    \x1f\n\x0bu2f_counter\x18\x07\x20\x01(\rR\nu2fCounter\x12\x1f\n\x0bskip_\
-    backup\x18\x08\x20\x01(\x08R\nskipBackup\x12\x1b\n\tno_backup\x18\t\x20\
-    \x01(\x08R\x08noBackup\x12Q\n\x0bbackup_type\x18\n\x20\x01(\x0e2).hw.tre\
-    zor.messages.management.BackupType:\x05Bip39R\nbackupType\x12#\n\rentrop\
-    y_check\x18\x0b\x20\x01(\x08R\x0centropyCheck\x12Y\n\rbackup_method\x18\
-    \x0c\x20\x01(\x0e2+.hw.trezor.messages.management.BackupMethod:\x07Displ\
-    ayR\x0cbackupMethodJ\x04\x08\x01\x10\x02\"\xc0\x02\n\x0cBackupDevice\x12\
-    '\n\x0fgroup_threshold\x18\x01\x20\x01(\rR\x0egroupThreshold\x12O\n\x06g\
-    roups\x18\x02\x20\x03(\x0b27.hw.trezor.messages.management.BackupDevice.\
-    Slip39GroupR\x06groups\x12Y\n\rbackup_method\x18\x03\x20\x01(\x0e2+.hw.t\
-    rezor.messages.management.BackupMethod:\x07DisplayR\x0cbackupMethod\x1a[\
-    \n\x0bSlip39Group\x12)\n\x10member_threshold\x18\x01\x20\x02(\rR\x0fmemb\
-    erThreshold\x12!\n\x0cmember_count\x18\x02\x20\x02(\rR\x0bmemberCount\"b\
-    \n\x0eEntropyRequest\x12-\n\x12entropy_commitment\x18\x01\x20\x01(\x0cR\
-    \x11entropyCommitment\x12!\n\x0cprev_entropy\x18\x02\x20\x01(\x0cR\x0bpr\
-    evEntropy\"&\n\nEntropyAck\x12\x18\n\x07entropy\x18\x01\x20\x02(\x0cR\
-    \x07entropy\"\x13\n\x11EntropyCheckReady\"5\n\x14EntropyCheckContinue\
-    \x12\x1d\n\x06finish\x18\x01\x20\x01(\x08:\x05falseR\x06finish\"\xdf\x04\
-    \n\x0eRecoveryDevice\x12\x1d\n\nword_count\x18\x01\x20\x01(\rR\twordCoun\
-    t\x123\n\x15passphrase_protection\x18\x02\x20\x01(\x08R\x14passphrasePro\
-    tection\x12%\n\x0epin_protection\x18\x03\x20\x01(\x08R\rpinProtection\
-    \x12\x1e\n\x08language\x18\x04\x20\x01(\tR\x08languageB\x02\x18\x01\x12\
-    \x14\n\x05label\x18\x05\x20\x01(\tR\x05label\x12)\n\x10enforce_wordlist\
-    \x18\x06\x20\x01(\x08R\x0fenforceWordlist\x12j\n\x0cinput_method\x18\x08\
-    \x20\x01(\x0e2G.hw.trezor.messages.management.RecoveryDevice.RecoveryDev\
-    iceInputMethodR\x0binputMethod\x12\x1f\n\x0bu2f_counter\x18\t\x20\x01(\r\
-    R\nu2fCounter\x12O\n\x04type\x18\n\x20\x01(\x0e2+.hw.trezor.messages.man\
-    agement.RecoveryType:\x0eNormalRecoveryR\x04type\x12P\n\rbackup_method\
-    \x18\x0b\x20\x01(\x0e2+.hw.trezor.messages.management.BackupMethodR\x0cb\
-    ackupMethod\";\n\x19RecoveryDeviceInputMethod\x12\x12\n\x0eScrambledWord\
-    s\x10\0\x12\n\n\x06Matrix\x10\x01J\x04\x08\x07\x10\x08\"\xc5\x01\n\x0bWo\
-    rdRequest\x12N\n\x04type\x18\x01\x20\x02(\x0e2:.hw.trezor.messages.manag\
-    ement.WordRequest.WordRequestTypeR\x04type\"f\n\x0fWordRequestType\x12\
-    \x19\n\x15WordRequestType_Plain\x10\0\x12\x1b\n\x17WordRequestType_Matri\
-    x9\x10\x01\x12\x1b\n\x17WordRequestType_Matrix6\x10\x02\"\x1d\n\x07WordA\
-    ck\x12\x12\n\x04word\x18\x01\x20\x02(\tR\x04word\"0\n\rSetU2FCounter\x12\
-    \x1f\n\x0bu2f_counter\x18\x01\x20\x02(\rR\nu2fCounter\"\x13\n\x11GetNext\
-    U2FCounter\"1\n\x0eNextU2FCounter\x12\x1f\n\x0bu2f_counter\x18\x01\x20\
-    \x02(\rR\nu2fCounter\"\x11\n\x0fDoPreauthorized\"\x16\n\x14Preauthorized\
-    Request\"\x15\n\x13CancelAuthorization\"\xeb\x01\n\x12RebootToBootloader\
-    \x12o\n\x0cboot_command\x18\x01\x20\x01(\x0e2=.hw.trezor.messages.manage\
-    ment.RebootToBootloader.BootCommand:\rSTOP_AND_WAITR\x0bbootCommand\x12'\
-    \n\x0ffirmware_header\x18\x02\x20\x01(\x0cR\x0efirmwareHeader\"5\n\x0bBo\
-    otCommand\x12\x11\n\rSTOP_AND_WAIT\x10\0\x12\x13\n\x0fINSTALL_UPGRADE\
-    \x10\x01J\x04\x08\x03\x10\x04\"\n\n\x08GetNonce\"\x1d\n\x05Nonce\x12\x14\
-    \n\x05nonce\x18\x01\x20\x02(\x0cR\x05nonce\";\n\nUnlockPath\x12\x1b\n\ta\
-    ddress_n\x18\x01\x20\x03(\rR\x08addressN\x12\x10\n\x03mac\x18\x02\x20\
-    \x01(\x0cR\x03mac\"'\n\x13UnlockedPathRequest\x12\x10\n\x03mac\x18\x01\
-    \x20\x02(\x0cR\x03mac\"\x14\n\x12ShowDeviceTutorial\"\x12\n\x10UnlockBoo\
-    tloader\"%\n\rSetBrightness\x12\x14\n\x05value\x18\x01\x20\x01(\rR\x05va\
-    lue\"\x11\n\x0fGetSerialNumber\"3\n\x0cSerialNumber\x12#\n\rserial_numbe\
-    r\x18\x01\x20\x02(\tR\x0cserialNumber*\x99\x01\n\nBackupType\x12\t\n\x05\
-    Bip39\x10\0\x12\x10\n\x0cSlip39_Basic\x10\x01\x12\x13\n\x0fSlip39_Advanc\
-    ed\x10\x02\x12\x1c\n\x18Slip39_Single_Extendable\x10\x03\x12\x1b\n\x17Sl\
-    ip39_Basic_Extendable\x10\x04\x12\x1e\n\x1aSlip39_Advanced_Extendable\
-    \x10\x05*%\n\x0cBackupMethod\x12\x0b\n\x07Display\x10\0\x12\x08\n\x04N4W\
-    1\x10\x01*G\n\x10SafetyCheckLevel\x12\n\n\x06Strict\x10\0\x12\x10\n\x0cP\
-    romptAlways\x10\x01\x12\x15\n\x11PromptTemporarily\x10\x02*=\n\x0fDispla\
-    yRotation\x12\t\n\x05North\x10\0\x12\x08\n\x04East\x10Z\x12\n\n\x05South\
-    \x10\xb4\x01\x12\t\n\x04West\x10\x8e\x02*0\n\x10HomescreenFormat\x12\x08\
-    \n\x04Toif\x10\x01\x12\x08\n\x04Jpeg\x10\x02\x12\x08\n\x04ToiG\x10\x03*H\
-    \n\x0cRecoveryType\x12\x12\n\x0eNormalRecovery\x10\0\x12\n\n\x06DryRun\
-    \x10\x01\x12\x18\n\x14UnlockRepeatedBackup\x10\x02BB\n#com.satoshilabs.t\
-    rezor.lib.protobufB\x17TrezorMessageManagement\x80\xa6\x1d\x01\
+    \x0ftropicSignature\x12)\n\x10mcu_certificates\x18\x05\x20\x03(\x0cR\x0f\
+    mcuCertificates\x12#\n\rmcu_signature\x18\x06\x20\x01(\x0cR\x0cmcuSignat\
+    ure\"\x0c\n\nWipeDevice\"\xda\x02\n\nLoadDevice\x12\x1c\n\tmnemonics\x18\
+    \x01\x20\x03(\tR\tmnemonics\x12\x10\n\x03pin\x18\x03\x20\x01(\tR\x03pin\
+    \x123\n\x15passphrase_protection\x18\x04\x20\x01(\x08R\x14passphraseProt\
+    ection\x12\x1e\n\x08language\x18\x05\x20\x01(\tR\x08languageB\x02\x18\
+    \x01\x12\x14\n\x05label\x18\x06\x20\x01(\tR\x05label\x12#\n\rskip_checks\
+    um\x18\x07\x20\x01(\x08R\x0cskipChecksum\x12\x1f\n\x0bu2f_counter\x18\
+    \x08\x20\x01(\rR\nu2fCounter\x12!\n\x0cneeds_backup\x18\t\x20\x01(\x08R\
+    \x0bneedsBackup\x12\x1b\n\tno_backup\x18\n\x20\x01(\x08R\x08noBackup\x12\
+    +\n\x11unfinished_backup\x18\x0b\x20\x01(\x08R\x10unfinishedBackup\"\xf8\
+    \x03\n\x0bResetDevice\x12\x1f\n\x08strength\x18\x02\x20\x01(\r:\x03256R\
+    \x08strength\x123\n\x15passphrase_protection\x18\x03\x20\x01(\x08R\x14pa\
+    ssphraseProtection\x12%\n\x0epin_protection\x18\x04\x20\x01(\x08R\rpinPr\
+    otection\x12\x1e\n\x08language\x18\x05\x20\x01(\tR\x08languageB\x02\x18\
+    \x01\x12\x14\n\x05label\x18\x06\x20\x01(\tR\x05label\x12\x1f\n\x0bu2f_co\
+    unter\x18\x07\x20\x01(\rR\nu2fCounter\x12\x1f\n\x0bskip_backup\x18\x08\
+    \x20\x01(\x08R\nskipBackup\x12\x1b\n\tno_backup\x18\t\x20\x01(\x08R\x08n\
+    oBackup\x12Q\n\x0bbackup_type\x18\n\x20\x01(\x0e2).hw.trezor.messages.ma\
+    nagement.BackupType:\x05Bip39R\nbackupType\x12#\n\rentropy_check\x18\x0b\
+    \x20\x01(\x08R\x0centropyCheck\x12Y\n\rbackup_method\x18\x0c\x20\x01(\
+    \x0e2+.hw.trezor.messages.management.BackupMethod:\x07DisplayR\x0cbackup\
+    MethodJ\x04\x08\x01\x10\x02\"\xc0\x02\n\x0cBackupDevice\x12'\n\x0fgroup_\
+    threshold\x18\x01\x20\x01(\rR\x0egroupThreshold\x12O\n\x06groups\x18\x02\
+    \x20\x03(\x0b27.hw.trezor.messages.management.BackupDevice.Slip39GroupR\
+    \x06groups\x12Y\n\rbackup_method\x18\x03\x20\x01(\x0e2+.hw.trezor.messag\
+    es.management.BackupMethod:\x07DisplayR\x0cbackupMethod\x1a[\n\x0bSlip39\
+    Group\x12)\n\x10member_threshold\x18\x01\x20\x02(\rR\x0fmemberThreshold\
+    \x12!\n\x0cmember_count\x18\x02\x20\x02(\rR\x0bmemberCount\"b\n\x0eEntro\
+    pyRequest\x12-\n\x12entropy_commitment\x18\x01\x20\x01(\x0cR\x11entropyC\
+    ommitment\x12!\n\x0cprev_entropy\x18\x02\x20\x01(\x0cR\x0bprevEntropy\"&\
+    \n\nEntropyAck\x12\x18\n\x07entropy\x18\x01\x20\x02(\x0cR\x07entropy\"\
+    \x13\n\x11EntropyCheckReady\"5\n\x14EntropyCheckContinue\x12\x1d\n\x06fi\
+    nish\x18\x01\x20\x01(\x08:\x05falseR\x06finish\"\xdf\x04\n\x0eRecoveryDe\
+    vice\x12\x1d\n\nword_count\x18\x01\x20\x01(\rR\twordCount\x123\n\x15pass\
+    phrase_protection\x18\x02\x20\x01(\x08R\x14passphraseProtection\x12%\n\
+    \x0epin_protection\x18\x03\x20\x01(\x08R\rpinProtection\x12\x1e\n\x08lan\
+    guage\x18\x04\x20\x01(\tR\x08languageB\x02\x18\x01\x12\x14\n\x05label\
+    \x18\x05\x20\x01(\tR\x05label\x12)\n\x10enforce_wordlist\x18\x06\x20\x01\
+    (\x08R\x0fenforceWordlist\x12j\n\x0cinput_method\x18\x08\x20\x01(\x0e2G.\
+    hw.trezor.messages.management.RecoveryDevice.RecoveryDeviceInputMethodR\
+    \x0binputMethod\x12\x1f\n\x0bu2f_counter\x18\t\x20\x01(\rR\nu2fCounter\
+    \x12O\n\x04type\x18\n\x20\x01(\x0e2+.hw.trezor.messages.management.Recov\
+    eryType:\x0eNormalRecoveryR\x04type\x12P\n\rbackup_method\x18\x0b\x20\
+    \x01(\x0e2+.hw.trezor.messages.management.BackupMethodR\x0cbackupMethod\
+    \";\n\x19RecoveryDeviceInputMethod\x12\x12\n\x0eScrambledWords\x10\0\x12\
+    \n\n\x06Matrix\x10\x01J\x04\x08\x07\x10\x08\"\xc5\x01\n\x0bWordRequest\
+    \x12N\n\x04type\x18\x01\x20\x02(\x0e2:.hw.trezor.messages.management.Wor\
+    dRequest.WordRequestTypeR\x04type\"f\n\x0fWordRequestType\x12\x19\n\x15W\
+    ordRequestType_Plain\x10\0\x12\x1b\n\x17WordRequestType_Matrix9\x10\x01\
+    \x12\x1b\n\x17WordRequestType_Matrix6\x10\x02\"\x1d\n\x07WordAck\x12\x12\
+    \n\x04word\x18\x01\x20\x02(\tR\x04word\"0\n\rSetU2FCounter\x12\x1f\n\x0b\
+    u2f_counter\x18\x01\x20\x02(\rR\nu2fCounter\"\x13\n\x11GetNextU2FCounter\
+    \"1\n\x0eNextU2FCounter\x12\x1f\n\x0bu2f_counter\x18\x01\x20\x02(\rR\nu2\
+    fCounter\"\x11\n\x0fDoPreauthorized\"\x16\n\x14PreauthorizedRequest\"\
+    \x15\n\x13CancelAuthorization\"\xeb\x01\n\x12RebootToBootloader\x12o\n\
+    \x0cboot_command\x18\x01\x20\x01(\x0e2=.hw.trezor.messages.management.Re\
+    bootToBootloader.BootCommand:\rSTOP_AND_WAITR\x0bbootCommand\x12'\n\x0ff\
+    irmware_header\x18\x02\x20\x01(\x0cR\x0efirmwareHeader\"5\n\x0bBootComma\
+    nd\x12\x11\n\rSTOP_AND_WAIT\x10\0\x12\x13\n\x0fINSTALL_UPGRADE\x10\x01J\
+    \x04\x08\x03\x10\x04\"\n\n\x08GetNonce\"\x1d\n\x05Nonce\x12\x14\n\x05non\
+    ce\x18\x01\x20\x02(\x0cR\x05nonce\";\n\nUnlockPath\x12\x1b\n\taddress_n\
+    \x18\x01\x20\x03(\rR\x08addressN\x12\x10\n\x03mac\x18\x02\x20\x01(\x0cR\
+    \x03mac\"'\n\x13UnlockedPathRequest\x12\x10\n\x03mac\x18\x01\x20\x02(\
+    \x0cR\x03mac\"\x14\n\x12ShowDeviceTutorial\"\x12\n\x10UnlockBootloader\"\
+    %\n\rSetBrightness\x12\x14\n\x05value\x18\x01\x20\x01(\rR\x05value\"\x11\
+    \n\x0fGetSerialNumber\"3\n\x0cSerialNumber\x12#\n\rserial_number\x18\x01\
+    \x20\x02(\tR\x0cserialNumber*\x99\x01\n\nBackupType\x12\t\n\x05Bip39\x10\
+    \0\x12\x10\n\x0cSlip39_Basic\x10\x01\x12\x13\n\x0fSlip39_Advanced\x10\
+    \x02\x12\x1c\n\x18Slip39_Single_Extendable\x10\x03\x12\x1b\n\x17Slip39_B\
+    asic_Extendable\x10\x04\x12\x1e\n\x1aSlip39_Advanced_Extendable\x10\x05*\
+    %\n\x0cBackupMethod\x12\x0b\n\x07Display\x10\0\x12\x08\n\x04N4W1\x10\x01\
+    *G\n\x10SafetyCheckLevel\x12\n\n\x06Strict\x10\0\x12\x10\n\x0cPromptAlwa\
+    ys\x10\x01\x12\x15\n\x11PromptTemporarily\x10\x02*=\n\x0fDisplayRotation\
+    \x12\t\n\x05North\x10\0\x12\x08\n\x04East\x10Z\x12\n\n\x05South\x10\xb4\
+    \x01\x12\t\n\x04West\x10\x8e\x02*0\n\x10HomescreenFormat\x12\x08\n\x04To\
+    if\x10\x01\x12\x08\n\x04Jpeg\x10\x02\x12\x08\n\x04ToiG\x10\x03*H\n\x0cRe\
+    coveryType\x12\x12\n\x0eNormalRecovery\x10\0\x12\n\n\x06DryRun\x10\x01\
+    \x12\x18\n\x14UnlockRepeatedBackup\x10\x02BB\n#com.satoshilabs.trezor.li\
+    b.protobufB\x17TrezorMessageManagement\x80\xa6\x1d\x01\
 ";
 
 /// `FileDescriptorProto` object which was a source for this generated file

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 3/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters