From 8a3133bacc21d1d7ae04fcbe5244d7012a5b57f5 Mon Sep 17 00:00:00 2001 From: matejcik Date: Mon, 10 Jun 2024 13:36:59 +0200 Subject: [PATCH] fix(core): include valid staging certificate for T3T1 emulator --- core/embed/trezorhal/unix/certs/README.md | 7 ++ core/embed/trezorhal/unix/certs/T2B1.der | Bin 0 -> 901 bytes core/embed/trezorhal/unix/certs/T2B1.h | 80 ++++++++++++++++ core/embed/trezorhal/unix/certs/T3T1.der | Bin 0 -> 906 bytes core/embed/trezorhal/unix/certs/T3T1.h | 80 ++++++++++++++++ core/embed/trezorhal/unix/certs/gen.sh | 11 +++ core/embed/trezorhal/unix/optiga.c | 86 ++---------------- core/site_scons/models/T3T1/emulator.py | 1 + .../device_tests/test_authenticate_device.py | 16 ++-- tests/ui_tests/fixtures.json | 20 ++++ tools/snippets/README.md | 5 + tools/snippets/recalc_optiga_for_emulator.py | 50 ++++++++++ 12 files changed, 273 insertions(+), 83 deletions(-) create mode 100644 core/embed/trezorhal/unix/certs/README.md create mode 100644 core/embed/trezorhal/unix/certs/T2B1.der create mode 100644 core/embed/trezorhal/unix/certs/T2B1.h create mode 100644 core/embed/trezorhal/unix/certs/T3T1.der create mode 100644 core/embed/trezorhal/unix/certs/T3T1.h create mode 100755 core/embed/trezorhal/unix/certs/gen.sh create mode 100644 tools/snippets/recalc_optiga_for_emulator.py diff --git a/core/embed/trezorhal/unix/certs/README.md b/core/embed/trezorhal/unix/certs/README.md new file mode 100644 index 0000000000..d2e3f0f364 --- /dev/null +++ b/core/embed/trezorhal/unix/certs/README.md @@ -0,0 +1,7 @@ +# Certificate chains for emulators + +The DER files are generated by asking the staging HSM for the given model, to sign +a certificate for a private key `01000000...`. + +When you add a new certificate, please add it to the `certs` directory and generate +the header with `gen.py` (using `xxd` to convert bytes into a C array). diff --git a/core/embed/trezorhal/unix/certs/T2B1.der b/core/embed/trezorhal/unix/certs/T2B1.der new file mode 100644 index 0000000000000000000000000000000000000000..e7b00ca3770cfdc6c9bd2c88028502bd9968f6ab GIT binary patch literal 901 zcmXqLVw`W##OS(!nTe5!iN){HQhoz2HV&;ek8`#x%uELUhTI06Y|No7Y{E>=QHF8` zG9V5Yk7!6yYE^!bf^&XuL1JE|La|}Vh-&TC|3U}9`wXkut)U>GINYl6%*kTsMxkc5~a6k_CLr~ox6I590%!Pp?uK$wjk z>^de!s56-v*_oXfSZ42MyLEGQBfpw10kyyz`~vQsj_h_Fyn@Wm06==i}C0 zb+@$q$jv3ozc=N6HRcYO7Pvm~XxYIFadGKgeoP7u%kNHZUg4l}xjN{h1X4B8kos2LuOCLx(&H@D+Qlq&b E0NiXKr2qf` literal 0 HcmV?d00001 diff --git a/core/embed/trezorhal/unix/certs/T2B1.h b/core/embed/trezorhal/unix/certs/T2B1.h new file mode 100644 index 0000000000..2380fb25d1 --- /dev/null +++ b/core/embed/trezorhal/unix/certs/T2B1.h @@ -0,0 +1,80 @@ +// This file was generated via ./gen.sh + +static const unsigned char T2B1_der[] = { + 0x30, 0x82, 0x01, 0x9f, 0x30, 0x82, 0x01, 0x45, 0xa0, 0x03, 0x02, 0x01, + 0x02, 0x02, 0x04, 0x4e, 0xe2, 0xa5, 0x0f, 0x30, 0x0a, 0x06, 0x08, 0x2a, + 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x4f, 0x31, 0x0b, 0x30, + 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, + 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, + 0x7a, 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, + 0x73, 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, + 0x55, 0x04, 0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, + 0x4d, 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, + 0x67, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x34, + 0x33, 0x30, 0x31, 0x34, 0x31, 0x36, 0x30, 0x31, 0x5a, 0x17, 0x0d, 0x34, + 0x32, 0x30, 0x34, 0x33, 0x30, 0x31, 0x34, 0x31, 0x36, 0x30, 0x31, 0x5a, + 0x30, 0x1d, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, + 0x12, 0x54, 0x32, 0x42, 0x31, 0x20, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, + 0x20, 0x53, 0x61, 0x66, 0x65, 0x20, 0x33, 0x30, 0x59, 0x30, 0x13, 0x06, + 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, + 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x9b, 0xbf, + 0x06, 0xda, 0xd9, 0xab, 0x59, 0x05, 0xe0, 0x54, 0x71, 0xce, 0x16, 0xd5, + 0x22, 0x2c, 0x89, 0xc2, 0xca, 0xa3, 0x9f, 0x26, 0x26, 0x7a, 0xc0, 0x74, + 0x71, 0x29, 0x88, 0x5f, 0xbd, 0x44, 0x1b, 0xcc, 0x7f, 0xa8, 0x4d, 0xe1, + 0x20, 0xa3, 0x67, 0x55, 0xda, 0xf3, 0x0a, 0x6f, 0x47, 0xe8, 0xc0, 0xd4, + 0xbd, 0xdc, 0x15, 0x03, 0x6e, 0xd2, 0xa3, 0x44, 0x7d, 0xfa, 0x7a, 0x1d, + 0x3e, 0x88, 0xa3, 0x41, 0x30, 0x3f, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, + 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x00, 0x80, 0x30, 0x0c, + 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, + 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, + 0x14, 0x67, 0xc5, 0xd4, 0xe7, 0xf0, 0x8f, 0x91, 0xb6, 0xe7, 0x48, 0xdf, + 0x42, 0xbf, 0x9f, 0x74, 0x1f, 0x43, 0xd2, 0x73, 0x75, 0x30, 0x0a, 0x06, + 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, + 0x30, 0x45, 0x02, 0x21, 0x00, 0xbe, 0x4c, 0x46, 0x8b, 0x7a, 0xdd, 0x75, + 0x77, 0xc4, 0xd9, 0xa4, 0xa7, 0xf7, 0x82, 0x6d, 0xf5, 0x33, 0x0b, 0x50, + 0x96, 0x51, 0xaf, 0x61, 0xc5, 0x76, 0xc1, 0xd0, 0x5e, 0x5e, 0x67, 0x8a, + 0x4e, 0x02, 0x20, 0x40, 0xa7, 0xdd, 0x93, 0x83, 0xa8, 0x40, 0x24, 0xc4, + 0xf9, 0xca, 0x89, 0xd9, 0x96, 0xa4, 0xf0, 0x1d, 0x7d, 0x8d, 0x37, 0xb5, + 0x0b, 0x2b, 0x98, 0x3f, 0xcc, 0x48, 0xee, 0xa4, 0x15, 0x5e, 0x55, 0x30, + 0x82, 0x01, 0xde, 0x30, 0x82, 0x01, 0x84, 0xa0, 0x03, 0x02, 0x01, 0x02, + 0x02, 0x04, 0x48, 0xf1, 0xf6, 0xc5, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, + 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x54, 0x31, 0x0b, 0x30, 0x09, + 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, + 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, + 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, + 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, + 0x04, 0x03, 0x0c, 0x1c, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, + 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, + 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x30, 0x20, 0x17, 0x0d, + 0x32, 0x33, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, + 0x5a, 0x18, 0x0f, 0x32, 0x30, 0x35, 0x33, 0x30, 0x31, 0x30, 0x31, 0x30, + 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x4f, 0x31, 0x0b, 0x30, 0x09, + 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, + 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, + 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, + 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, + 0x04, 0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, + 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, + 0x20, 0x43, 0x41, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, + 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, + 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xba, 0x60, 0x84, 0xcb, 0x9f, 0xba, + 0x7c, 0x86, 0xd5, 0xd5, 0xa8, 0x61, 0x08, 0xa9, 0x1d, 0x55, 0xa2, 0x70, + 0x56, 0xda, 0x4e, 0xab, 0xbe, 0xdd, 0xe8, 0x8a, 0x95, 0xe1, 0xca, 0xe8, + 0xbc, 0xe3, 0x62, 0x08, 0x89, 0x16, 0x7a, 0xaf, 0x7f, 0x2d, 0xb1, 0x66, + 0x99, 0x8f, 0x95, 0x09, 0x84, 0xaa, 0x19, 0x5e, 0x86, 0x8f, 0x96, 0xe2, + 0x28, 0x03, 0xc3, 0xcd, 0x99, 0x1b, 0xe3, 0x1d, 0x39, 0xe7, 0xa3, 0x47, + 0x30, 0x45, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, + 0x04, 0x04, 0x03, 0x02, 0x02, 0x04, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, + 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, + 0x01, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, + 0x16, 0x80, 0x14, 0xc8, 0xb5, 0xb2, 0x43, 0xb3, 0x30, 0x43, 0xcc, 0x08, + 0xb4, 0xdc, 0x3a, 0x72, 0xa1, 0xde, 0xcd, 0xcf, 0xd7, 0xea, 0xdb, 0x30, + 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, + 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x02, 0xc1, 0x02, 0x0a, 0xb3, 0xc6, + 0x4e, 0xd9, 0xe6, 0x58, 0xfd, 0xf8, 0x70, 0x93, 0x72, 0xc9, 0xe0, 0x53, + 0x82, 0xde, 0x4e, 0x58, 0x75, 0x80, 0xc8, 0xba, 0xc4, 0x2f, 0x43, 0x78, + 0x4a, 0xd9, 0x02, 0x21, 0x00, 0x99, 0x00, 0x98, 0x1c, 0xbc, 0x68, 0xae, + 0xb0, 0x6d, 0x3e, 0xa9, 0x11, 0x94, 0x8d, 0x63, 0x11, 0xd6, 0xf6, 0x94, + 0x40, 0x3a, 0xbb, 0xbb, 0x65, 0x9e, 0x5a, 0xf5, 0x2b, 0xf3, 0x2e, 0x33, + 0xc4}; +static const unsigned int T2B1_der_len = 901; diff --git a/core/embed/trezorhal/unix/certs/T3T1.der b/core/embed/trezorhal/unix/certs/T3T1.der new file mode 100644 index 0000000000000000000000000000000000000000..0cc915224914d3759584656ecf9b3ce8f24f4859 GIT binary patch literal 906 zcmXqLVw`W##OS(!nTe5!iG^|hhb0DFY#dr`9_MUXn3)Xx4Y>_C*_cCF*o2v!qYUK? zWI!A)9?_7Z)T;a<1?T+Sg2cQ^g<`!Ty?i}G1p_&dJTs3tRNgl+uQV+&xumoxGcR4i z+0j5woY%<6z|_dZz|6$Z&>~8l*94hsAZsXXAPF%;D8x9#PyuRCaAI1jf~i5IfiN38 z*mX>dP-ikTvNJm|u*}}icI)QqNY)1-h3CYsD(Q3{I<KRHjg^(6ass_rCAeO-zO+oqjC7`%c z0LGPxfw3VF8d;i{L`m=iqY5ZsU "$header_file" + echo >> "$header_file" + xxd -i "$file" | sed 's/unsigned/static const unsigned/' >> "$header_file" + clang-format -i "$header_file" +done diff --git a/core/embed/trezorhal/unix/optiga.c b/core/embed/trezorhal/unix/optiga.c index c80e8bb852..e6380fdd9a 100644 --- a/core/embed/trezorhal/unix/optiga.c +++ b/core/embed/trezorhal/unix/optiga.c @@ -24,83 +24,15 @@ #include "optiga_common.h" #include "rand.h" -static const uint8_t DEVICE_CERT_CHAIN[] = { - 0x30, 0x82, 0x01, 0x9f, 0x30, 0x82, 0x01, 0x45, 0xa0, 0x03, 0x02, 0x01, - 0x02, 0x02, 0x04, 0x4e, 0xe2, 0xa5, 0x0f, 0x30, 0x0a, 0x06, 0x08, 0x2a, - 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x4f, 0x31, 0x0b, 0x30, - 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, - 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, - 0x7a, 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, - 0x73, 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, - 0x55, 0x04, 0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, - 0x4d, 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, - 0x67, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x34, - 0x33, 0x30, 0x31, 0x34, 0x31, 0x36, 0x30, 0x31, 0x5a, 0x17, 0x0d, 0x34, - 0x32, 0x30, 0x34, 0x33, 0x30, 0x31, 0x34, 0x31, 0x36, 0x30, 0x31, 0x5a, - 0x30, 0x1d, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, - 0x12, 0x54, 0x32, 0x42, 0x31, 0x20, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, - 0x20, 0x53, 0x61, 0x66, 0x65, 0x20, 0x33, 0x30, 0x59, 0x30, 0x13, 0x06, - 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, - 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x9b, 0xbf, - 0x06, 0xda, 0xd9, 0xab, 0x59, 0x05, 0xe0, 0x54, 0x71, 0xce, 0x16, 0xd5, - 0x22, 0x2c, 0x89, 0xc2, 0xca, 0xa3, 0x9f, 0x26, 0x26, 0x7a, 0xc0, 0x74, - 0x71, 0x29, 0x88, 0x5f, 0xbd, 0x44, 0x1b, 0xcc, 0x7f, 0xa8, 0x4d, 0xe1, - 0x20, 0xa3, 0x67, 0x55, 0xda, 0xf3, 0x0a, 0x6f, 0x47, 0xe8, 0xc0, 0xd4, - 0xbd, 0xdc, 0x15, 0x03, 0x6e, 0xd2, 0xa3, 0x44, 0x7d, 0xfa, 0x7a, 0x1d, - 0x3e, 0x88, 0xa3, 0x41, 0x30, 0x3f, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, - 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x00, 0x80, 0x30, 0x0c, - 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, - 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, - 0x14, 0x67, 0xc5, 0xd4, 0xe7, 0xf0, 0x8f, 0x91, 0xb6, 0xe7, 0x48, 0xdf, - 0x42, 0xbf, 0x9f, 0x74, 0x1f, 0x43, 0xd2, 0x73, 0x75, 0x30, 0x0a, 0x06, - 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, - 0x30, 0x45, 0x02, 0x21, 0x00, 0xbe, 0x4c, 0x46, 0x8b, 0x7a, 0xdd, 0x75, - 0x77, 0xc4, 0xd9, 0xa4, 0xa7, 0xf7, 0x82, 0x6d, 0xf5, 0x33, 0x0b, 0x50, - 0x96, 0x51, 0xaf, 0x61, 0xc5, 0x76, 0xc1, 0xd0, 0x5e, 0x5e, 0x67, 0x8a, - 0x4e, 0x02, 0x20, 0x40, 0xa7, 0xdd, 0x93, 0x83, 0xa8, 0x40, 0x24, 0xc4, - 0xf9, 0xca, 0x89, 0xd9, 0x96, 0xa4, 0xf0, 0x1d, 0x7d, 0x8d, 0x37, 0xb5, - 0x0b, 0x2b, 0x98, 0x3f, 0xcc, 0x48, 0xee, 0xa4, 0x15, 0x5e, 0x55, 0x30, - 0x82, 0x01, 0xde, 0x30, 0x82, 0x01, 0x84, 0xa0, 0x03, 0x02, 0x01, 0x02, - 0x02, 0x04, 0x48, 0xf1, 0xf6, 0xc5, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, - 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x54, 0x31, 0x0b, 0x30, 0x09, - 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, - 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, - 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, - 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, - 0x04, 0x03, 0x0c, 0x1c, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, - 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, - 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x30, 0x20, 0x17, 0x0d, - 0x32, 0x33, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, - 0x5a, 0x18, 0x0f, 0x32, 0x30, 0x35, 0x33, 0x30, 0x31, 0x30, 0x31, 0x30, - 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x4f, 0x31, 0x0b, 0x30, 0x09, - 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, - 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, - 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, - 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, - 0x04, 0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, - 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, - 0x20, 0x43, 0x41, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, - 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, - 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xba, 0x60, 0x84, 0xcb, 0x9f, 0xba, - 0x7c, 0x86, 0xd5, 0xd5, 0xa8, 0x61, 0x08, 0xa9, 0x1d, 0x55, 0xa2, 0x70, - 0x56, 0xda, 0x4e, 0xab, 0xbe, 0xdd, 0xe8, 0x8a, 0x95, 0xe1, 0xca, 0xe8, - 0xbc, 0xe3, 0x62, 0x08, 0x89, 0x16, 0x7a, 0xaf, 0x7f, 0x2d, 0xb1, 0x66, - 0x99, 0x8f, 0x95, 0x09, 0x84, 0xaa, 0x19, 0x5e, 0x86, 0x8f, 0x96, 0xe2, - 0x28, 0x03, 0xc3, 0xcd, 0x99, 0x1b, 0xe3, 0x1d, 0x39, 0xe7, 0xa3, 0x47, - 0x30, 0x45, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, - 0x04, 0x04, 0x03, 0x02, 0x02, 0x04, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, - 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, - 0x01, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, - 0x16, 0x80, 0x14, 0xc8, 0xb5, 0xb2, 0x43, 0xb3, 0x30, 0x43, 0xcc, 0x08, - 0xb4, 0xdc, 0x3a, 0x72, 0xa1, 0xde, 0xcd, 0xcf, 0xd7, 0xea, 0xdb, 0x30, - 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, - 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x02, 0xc1, 0x02, 0x0a, 0xb3, 0xc6, - 0x4e, 0xd9, 0xe6, 0x58, 0xfd, 0xf8, 0x70, 0x93, 0x72, 0xc9, 0xe0, 0x53, - 0x82, 0xde, 0x4e, 0x58, 0x75, 0x80, 0xc8, 0xba, 0xc4, 0x2f, 0x43, 0x78, - 0x4a, 0xd9, 0x02, 0x21, 0x00, 0x99, 0x00, 0x98, 0x1c, 0xbc, 0x68, 0xae, - 0xb0, 0x6d, 0x3e, 0xa9, 0x11, 0x94, 0x8d, 0x63, 0x11, 0xd6, 0xf6, 0x94, - 0x40, 0x3a, 0xbb, 0xbb, 0x65, 0x9e, 0x5a, 0xf5, 0x2b, 0xf3, 0x2e, 0x33, - 0xc4}; +#if defined(TREZOR_MODEL_R) +#include "certs/T2B1.h" +#define DEVICE_CERT_CHAIN T2B1_der +#elif defined(TREZOR_MODEL_T3T1) +#include "certs/T3T1.h" +#define DEVICE_CERT_CHAIN T3T1_der +#else +#error "Cert chain for specified model is not available." +#endif int optiga_sign(uint8_t index, const uint8_t *digest, size_t digest_size, uint8_t *signature, size_t max_sig_size, size_t *sig_size) { diff --git a/core/site_scons/models/T3T1/emulator.py b/core/site_scons/models/T3T1/emulator.py index fa5400b536..b2ba96833d 100644 --- a/core/site_scons/models/T3T1/emulator.py +++ b/core/site_scons/models/T3T1/emulator.py @@ -57,6 +57,7 @@ def configure( if "optiga" in features_wanted: sources += ["embed/trezorhal/unix/optiga.c"] + features_available.append("optiga") if "input" in features_wanted: sources += ["embed/trezorhal/unix/touch.c"] diff --git a/tests/device_tests/test_authenticate_device.py b/tests/device_tests/test_authenticate_device.py index 4db77708ba..519c45a1d9 100644 --- a/tests/device_tests/test_authenticate_device.py +++ b/tests/device_tests/test_authenticate_device.py @@ -4,19 +4,23 @@ from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.asymmetric import ec from cryptography.x509 import extensions as ext -from trezorlib import device +from trezorlib import device, models from trezorlib.debuglink import TrezorClientDebugLink as Client from ..common import compact_size pytestmark = [pytest.mark.skip_t1b1, pytest.mark.skip_t2t1] -ROOT_PUBLIC_KEY = bytes.fromhex( - "047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a" -) +ROOT_PUBLIC_KEY = { + models.T2B1: bytes.fromhex( + "047f77368dea2d4d61e989f474a56723c3212dacf8a808d8795595ef38441427c4389bc454f02089d7f08b873005e4c28d432468997871c0bf286fd3861e21e96a" + ), + models.T3T1: bytes.fromhex( + "04e48b69cd7962068d3cca3bcc6b1747ef496c1e28b5529e34ad7295215ea161dbe8fb08ae0479568f9d2cb07630cb3e52f4af0692102da5873559e45e9fa72959" + ), +} -@pytest.mark.skip_t3t1 # FIXME https://github.com/trezor/trezor-firmware/issues/3596 @pytest.mark.parametrize( "challenge", ( @@ -37,7 +41,7 @@ def test_authenticate_device(client: Client, challenge: bytes) -> None: # Verify the last certificate in the certificate chain against trust anchor. root_public_key = ec.EllipticCurvePublicKey.from_encoded_point( - ec.SECP256R1(), ROOT_PUBLIC_KEY + ec.SECP256R1(), ROOT_PUBLIC_KEY[client.model] ) root_public_key.verify( certs[-1].signature, diff --git a/tests/ui_tests/fixtures.json b/tests/ui_tests/fixtures.json index bf9bf85671..a0563b6b13 100644 --- a/tests/ui_tests/fixtures.json +++ b/tests/ui_tests/fixtures.json @@ -16998,6 +16998,10 @@ "T3T1_cs_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-0]": "2480e92bb23741957a33c55727e1107c89c3161e919eeac7ac571833927030aa", "T3T1_cs_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-1575234180]": "f49ef66e4f6bb867a23a5ae8ec6442bb2ad3ac91ba10cb07dbb5edd9bad8d258", "T3T1_cs_stellar-test_stellar.py::test_sign_tx[tx_source_account_not_equal_signing_key]": "2301f38538123cb20a4688800cf60635173f8f4465577d68a89f012aa41b6a2b", +"T3T1_cs_test_authenticate_device.py::test_authenticate_device[!\\xf3\\xd4\\x0ec\\xc3\\x04\\xd01-b\\xeb\\x82-e4b4eb3a": "5b819bf081463e339f3dc0754f84b8d69b1a8155378d6a1ef4f206b37bfe1eff", +"T3T1_cs_test_authenticate_device.py::test_authenticate_device[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\-d824e03c": "5b819bf081463e339f3dc0754f84b8d69b1a8155378d6a1ef4f206b37bfe1eff", +"T3T1_cs_test_authenticate_device.py::test_authenticate_device[]": "5b819bf081463e339f3dc0754f84b8d69b1a8155378d6a1ef4f206b37bfe1eff", +"T3T1_cs_test_authenticate_device.py::test_authenticate_device[hello world]": "5b819bf081463e339f3dc0754f84b8d69b1a8155378d6a1ef4f206b37bfe1eff", "T3T1_cs_test_autolock.py::test_apply_auto_lock_delay": "10861ca732e29baa2598872f1281dcf03009939a2f5babde882d975fc11820c8", "T3T1_cs_test_autolock.py::test_apply_auto_lock_delay_out_of_range[0]": "8221eb7ae04f946892b117dec3b55e0806321e5d34257edb02729dfb2090d22f", "T3T1_cs_test_autolock.py::test_apply_auto_lock_delay_out_of_range[1]": "8221eb7ae04f946892b117dec3b55e0806321e5d34257edb02729dfb2090d22f", @@ -18362,6 +18366,10 @@ "T3T1_de_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-0]": "4eca37db90b32012f390115dcbbbf154dea6785d6ac39a32378b048e5e106302", "T3T1_de_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-1575234180]": "e55a9c9bc7648ece67e5f2da1196f09745338d5c77c6cc957bd5b4b482a4c9ab", "T3T1_de_stellar-test_stellar.py::test_sign_tx[tx_source_account_not_equal_signing_key]": "f6df1471a998bfcff8920accfd4bc0949d9bb86109c50b1a191c9a88dc6052b1", +"T3T1_de_test_authenticate_device.py::test_authenticate_device[!\\xf3\\xd4\\x0ec\\xc3\\x04\\xd01-b\\xeb\\x82-e4b4eb3a": "76ffd01c81f0cfcf46c169ec9a6ce2a75024ed186be929b2d365494a54602e09", +"T3T1_de_test_authenticate_device.py::test_authenticate_device[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\-d824e03c": "76ffd01c81f0cfcf46c169ec9a6ce2a75024ed186be929b2d365494a54602e09", +"T3T1_de_test_authenticate_device.py::test_authenticate_device[]": "76ffd01c81f0cfcf46c169ec9a6ce2a75024ed186be929b2d365494a54602e09", +"T3T1_de_test_authenticate_device.py::test_authenticate_device[hello world]": "76ffd01c81f0cfcf46c169ec9a6ce2a75024ed186be929b2d365494a54602e09", "T3T1_de_test_autolock.py::test_apply_auto_lock_delay": "c3fb7e8e0bf81b89cd6badc79dc13a55345de491daaf6f093ed9c567ce196f64", "T3T1_de_test_autolock.py::test_apply_auto_lock_delay_out_of_range[0]": "82c76aa990f9570c127e629bdbbb48454c2935c518750ab34f2c2f3e4c576efa", "T3T1_de_test_autolock.py::test_apply_auto_lock_delay_out_of_range[1]": "82c76aa990f9570c127e629bdbbb48454c2935c518750ab34f2c2f3e4c576efa", @@ -19726,6 +19734,10 @@ "T3T1_en_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-0]": "d5e2ff9126931e6be96ca37160cf2c49315598181b586e52645b919a874d2303", "T3T1_en_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-1575234180]": "dff608ce1e062b82c7acea1f69b17cf5d658a0c890c496bff83ecbeac9ab9493", "T3T1_en_stellar-test_stellar.py::test_sign_tx[tx_source_account_not_equal_signing_key]": "d5102f43eca35b66ed3dbd99c6d6dd8bb7a63d01ba85ca9cf3f5843143c99d35", +"T3T1_en_test_authenticate_device.py::test_authenticate_device[!\\xf3\\xd4\\x0ec\\xc3\\x04\\xd01-b\\xeb\\x82-e4b4eb3a": "1a60f93e249861e97de0d5bbac6b3d0712bdfed93be0265172dd0f75b1268681", +"T3T1_en_test_authenticate_device.py::test_authenticate_device[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\-d824e03c": "1a60f93e249861e97de0d5bbac6b3d0712bdfed93be0265172dd0f75b1268681", +"T3T1_en_test_authenticate_device.py::test_authenticate_device[]": "1a60f93e249861e97de0d5bbac6b3d0712bdfed93be0265172dd0f75b1268681", +"T3T1_en_test_authenticate_device.py::test_authenticate_device[hello world]": "1a60f93e249861e97de0d5bbac6b3d0712bdfed93be0265172dd0f75b1268681", "T3T1_en_test_autolock.py::test_apply_auto_lock_delay": "13e2eb2a974686f59cf552ec3cac9e889772b05f772b80dc1eadf3e815305da2", "T3T1_en_test_autolock.py::test_apply_auto_lock_delay_out_of_range[0]": "fbdb420a333659780b7f85d62898f07f7ed2d77d89196cc9354456504fb5a8c2", "T3T1_en_test_autolock.py::test_apply_auto_lock_delay_out_of_range[1]": "fbdb420a333659780b7f85d62898f07f7ed2d77d89196cc9354456504fb5a8c2", @@ -21090,6 +21102,10 @@ "T3T1_es_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-0]": "b510d27178903d732a757c21710916e67e28819f4e985aa6fe82c6c95cb9018f", "T3T1_es_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-1575234180]": "a28f6b3e3e2850718047f29b64cbe66f528ac59b925fdafc20bc16eb4ca29e41", "T3T1_es_stellar-test_stellar.py::test_sign_tx[tx_source_account_not_equal_signing_key]": "6a63d2376341c8892d5cdaa7d85a3adaecd48161de82d85595b9650c2d0b714a", +"T3T1_es_test_authenticate_device.py::test_authenticate_device[!\\xf3\\xd4\\x0ec\\xc3\\x04\\xd01-b\\xeb\\x82-e4b4eb3a": "2222f68a64f0c3ce247e36e145bbcb6065ac0873fbc9fc66cfc541df141fdae4", +"T3T1_es_test_authenticate_device.py::test_authenticate_device[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\-d824e03c": "2222f68a64f0c3ce247e36e145bbcb6065ac0873fbc9fc66cfc541df141fdae4", +"T3T1_es_test_authenticate_device.py::test_authenticate_device[]": "2222f68a64f0c3ce247e36e145bbcb6065ac0873fbc9fc66cfc541df141fdae4", +"T3T1_es_test_authenticate_device.py::test_authenticate_device[hello world]": "2222f68a64f0c3ce247e36e145bbcb6065ac0873fbc9fc66cfc541df141fdae4", "T3T1_es_test_autolock.py::test_apply_auto_lock_delay": "d9ebe7756ab918a916a7ea21f966ffc7d93481a4e05e9188a3ca3172cdbc8407", "T3T1_es_test_autolock.py::test_apply_auto_lock_delay_out_of_range[0]": "c9b3a43c1674ee94d5c206d7d182cb3ea0666e98ab7bf5c1e233ddf21444aae6", "T3T1_es_test_autolock.py::test_apply_auto_lock_delay_out_of_range[1]": "c9b3a43c1674ee94d5c206d7d182cb3ea0666e98ab7bf5c1e233ddf21444aae6", @@ -22454,6 +22470,10 @@ "T3T1_fr_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-0]": "c90a598b899bb8b4185c1dcca9a4b292b8c3e308aafb2eecce39aa1ff2f56658", "T3T1_fr_stellar-test_stellar.py::test_sign_tx[timebounds-461535181-1575234180]": "0ed58a40aa061ec895a923c5cc3c98fc9d9230818038ebee3cf9ba4b21f045d0", "T3T1_fr_stellar-test_stellar.py::test_sign_tx[tx_source_account_not_equal_signing_key]": "8469e1292faff89db8a0a10f923c5ab94f5594fb30fd8fd8e5e615b7b2864c99", +"T3T1_fr_test_authenticate_device.py::test_authenticate_device[!\\xf3\\xd4\\x0ec\\xc3\\x04\\xd01-b\\xeb\\x82-e4b4eb3a": "919aab5d554f644b77fa391ade84093719e1a2835bda15af0470813ea75c3e1a", +"T3T1_fr_test_authenticate_device.py::test_authenticate_device[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\-d824e03c": "919aab5d554f644b77fa391ade84093719e1a2835bda15af0470813ea75c3e1a", +"T3T1_fr_test_authenticate_device.py::test_authenticate_device[]": "919aab5d554f644b77fa391ade84093719e1a2835bda15af0470813ea75c3e1a", +"T3T1_fr_test_authenticate_device.py::test_authenticate_device[hello world]": "919aab5d554f644b77fa391ade84093719e1a2835bda15af0470813ea75c3e1a", "T3T1_fr_test_autolock.py::test_apply_auto_lock_delay": "7cdfb0607eca40cbc6ea696491ea4afd8f244a6eac57abb7acbdb2ba8c7bd38c", "T3T1_fr_test_autolock.py::test_apply_auto_lock_delay_out_of_range[0]": "8896efd29f4bebc3035a764581fea4b74269fd539bda3f1b47dc4a3188fd263a", "T3T1_fr_test_autolock.py::test_apply_auto_lock_delay_out_of_range[1]": "8896efd29f4bebc3035a764581fea4b74269fd539bda3f1b47dc4a3188fd263a", diff --git a/tools/snippets/README.md b/tools/snippets/README.md index 11119d52a1..c0d093f7f0 100644 --- a/tools/snippets/README.md +++ b/tools/snippets/README.md @@ -21,3 +21,8 @@ These scripts do not need to have a high standard, but each of those should have ## [eth_defs_unpack.py](./eth_defs_unpack.py) - Unpacks the definitions from a `definitions-sparse.zip` that does not contain the Merkle proofs for space-saving. This format is not currently distributed. + +## [recalc_optiga_for_emulator.py](./recalc_optiga_for_emulator.py) +- Takes a valid Infineon certificate from an Optiga and replaces its public key with + a pubkey for private key 0x01000000..., so that the staging HSM can sign the resulting + certificate. diff --git a/tools/snippets/recalc_optiga_for_emulator.py b/tools/snippets/recalc_optiga_for_emulator.py new file mode 100644 index 0000000000..95345781b8 --- /dev/null +++ b/tools/snippets/recalc_optiga_for_emulator.py @@ -0,0 +1,50 @@ +import sys +from pathlib import Path + +from pyasn1.codec.der.encoder import encode +from pyasn1.codec.der.decoder import decode +from pyasn1.type.univ import BitString +from pyasn1_modules import rfc2459 +from cryptography.hazmat.primitives import serialization +from cryptography.hazmat.primitives.asymmetric import ec + + +def load_certificate(data: bytes): + return decode(data, asn1Spec=rfc2459.Certificate())[0] + + +def save_certificate(certificate) -> bytes: + return encode(certificate) + + +def calculate_ecdsa_public_key(): + privkey_bytes = b"\x01" + b"\x00" * 31 + private_key = ec.derive_private_key( + int.from_bytes(privkey_bytes, "big"), ec.SECP256R1() + ) + + return private_key.public_key() + + +def replace_public_key(certificate, public_key): + public_key_bytes = public_key.public_bytes( + encoding=serialization.Encoding.X962, + format=serialization.PublicFormat.UncompressedPoint, + ) + certificate["tbsCertificate"]["subjectPublicKeyInfo"]["subjectPublicKey"] = ( + BitString(hexValue=public_key_bytes.hex()) + ) + + +def main(): + in_cert = Path(sys.argv[1]) + certificate = load_certificate(in_cert.read_bytes()) + public_key = calculate_ecdsa_public_key() + replace_public_key(certificate, public_key) + updated_cert = save_certificate(certificate) + out_cert = Path(sys.argv[2]) + out_cert.write_bytes(updated_cert) + + +if __name__ == "__main__": + main()