Revert "chore(core): don't send MCU attestation"
What the developer wrote
Authored by Roman Zeyde
Revert "chore(core): don't send MCU attestation"
This reverts commit 8bc6d1b28b130a881119dd7e48ae99166ff9870b.
What changed, and why it matters
This commit re-enables a security feature called 'MCU device attestation' for the T3W1 hardware wallet model. It is not a vulnerability fix; it restores a previously removed capability that lets the device cryptographically prove its microcontroller is genuine using a modern quantum-resistant signature scheme (ML-DSA-44).
No security action required. Reviewers may want to confirm the ML-DSA-44 implementation and certificate parsing are correct, but the commit itself restores a defensive feature.
Security signals we found
Re-enables hardware-based device attestation, a security feature, not a vulnerability patch
Uses ML-DSA-44 (post-quantum signature algorithm) for MCU attestation
Adds error handling that raises a ProcessError if MCU signing fails
No memory-safety, cryptographic, or authorization flaws visible in the diff
Evidence from the diff
The change reverts an earlier commit that disabled sending MCU attestation data. It adds back code that, when USE_MCU_ATTESTATION is enabled, signs the challenge with the MCU’s private key via trezor.crypto.mcu.sign(), reads the MCU certificate, and parses the certificate chain so it can be returned in the AuthenticityProof. The changelog notes this is for the T3W1 model and uses ML-DSA-44.
Changed components
core/src/apps/management/authenticate_device.pyTrezor Core device-authentication flowT3W1 model MCU attestation subsystemInspect captured patch +11 / −0
diff --git a/core/.changelog.d/6807.added b/core/.changelog.d/6807.added
new file mode 100644
index 00000000..e4bd45d0
--- /dev/null
+++ b/core/.changelog.d/6807.added
@@ -0,0 +1 @@
+[T3W1] Added MCU device attestation with ML-DSA-44.
diff --git a/core/src/apps/management/authenticate_device.py b/core/src/apps/management/authenticate_device.py
index 9d6c8fab..454333f2 100644
--- a/core/src/apps/management/authenticate_device.py
+++ b/core/src/apps/management/authenticate_device.py
@@ -65,6 +65,16 @@ async def authenticate_device(msg: AuthenticateDevice) -> AuthenticityProof | Su
mcu_certificates = None
mcu_signature = None
+ if utils.USE_MCU_ATTESTATION:
+ from trezor.crypto import mcu
+
+ try:
+ mcu_signature = mcu.sign(challenge_bytes)
+ except RuntimeError:
+ raise wire.ProcessError("MCU signing failed.")
+
+ r = BufferReader(mcu.get_certificate())
+ mcu_certificates = parse_cert_chain(r)
if not utils.DISABLE_ANIMATION:
frame_delay = sleep(60)
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.