feat(core): Support Optiga in Trezor firmware.

core/SConscript.firmware

@@ -80,6 +80,7 @@ SOURCE_MOD += [
     'embed/extmod/modtrezorcrypto/rand.c',
     'vendor/trezor-crypto/address.c',
     'vendor/trezor-crypto/aes/aes_modes.c',
+    'vendor/trezor-crypto/aes/aesccm.c',
     'vendor/trezor-crypto/aes/aescrypt.c',
     'vendor/trezor-crypto/aes/aeskey.c',
     'vendor/trezor-crypto/aes/aestab.c',
@@ -127,6 +128,7 @@ SOURCE_MOD += [
     'vendor/trezor-crypto/shamir.c',
     'vendor/trezor-crypto/slip39.c',
     'vendor/trezor-crypto/slip39_english.c',
+    'vendor/trezor-crypto/tls_prf.c',
 ]
 if EVERYTHING:
     SOURCE_MOD += [
@@ -639,7 +641,8 @@ if FROZEN:
         source=SOURCE_PY,
         source_dir=SOURCE_PY_DIR,
         bitcoin_only=BITCOIN_ONLY,
-        backlight='backlight' in FEATURES_AVAILABLE
+        backlight='backlight' in FEATURES_AVAILABLE,
+        optiga='optiga' in FEATURES_AVAILABLE
         )
 
     source_mpyc = env.FrozenCFile(

core/SConscript.unix

@@ -390,6 +390,14 @@ if TREZOR_MODEL in ('T', 'R'):
         'embed/trezorhal/unix/sdcard.c',
     ]
 
+if TREZOR_MODEL == 'R':
+    CPPDEFINES_MOD += [
+        ('USE_OPTIGA', '1'),
+    ]
+    SOURCE_UNIX += [
+        'embed/trezorhal/unix/optiga.c',
+    ]
+
 if DMA2D:
     CPPDEFINES_MOD += [
         'USE_DMA2D',
@@ -653,7 +661,9 @@ if FROZEN:
     SOURCE_PY.extend(Glob(SOURCE_PY_DIR + 'apps/management/*.py',
         exclude=[
             SOURCE_PY_DIR + 'apps/management/sd_protect.py',
-        ] if TREZOR_MODEL not in ('T',) else [])
+        ] if TREZOR_MODEL not in ('T',) else [] + [
+            SOURCE_PY_DIR + 'apps/management/authenticate_device.py',
+        ] if TREZOR_MODEL not in ('R',) else [])
     )
     SOURCE_PY.extend(Glob(SOURCE_PY_DIR + 'apps/management/*/*.py'))
     SOURCE_PY.extend(Glob(SOURCE_PY_DIR + 'apps/misc/*.py'))
@@ -714,7 +724,8 @@ if FROZEN:
         source=SOURCE_PY,
         source_dir=SOURCE_PY_DIR,
         bitcoin_only=BITCOIN_ONLY,
-        backlight=TREZOR_MODEL in ('T',)
+        backlight=TREZOR_MODEL in ('T',),
+        optiga=TREZOR_MODEL in ('R',)
         )
 
     source_mpyc = env.FrozenCFile(

core/embed/extmod/modtrezorcrypto/modtrezorcrypto-optiga.h

@@ -0,0 +1,122 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#if USE_OPTIGA
+
+#include "py/objstr.h"
+
+#include "optiga.h"
+#include "optiga_commands.h"
+
+/// package: trezorcrypto.optiga
+
+#define MAX_DER_SIGNATURE_SIZE 72
+
+/// def get_certificate(cert_index: int) -> bytes:
+///     """
+///     Return the certificate stored at the given index.
+///     """
+STATIC mp_obj_t mod_trezorcrypto_optiga_get_certificate(mp_obj_t cert_index) {
+  mp_int_t idx = mp_obj_get_int(cert_index);
+  if (idx < 0 || idx >= OPTIGA_CERT_COUNT) {
+    mp_raise_ValueError("Invalid index.");
+  }
+
+  size_t cert_size = 0;
+  if (!optiga_cert_size(idx, &cert_size)) {
+    mp_raise_ValueError("Failed to get certificate size.");
+  }
+
+  vstr_t cert = {0};
+  vstr_init_len(&cert, cert_size);
+  if (!optiga_read_cert(idx, (uint8_t *)cert.buf, cert.alloc, &cert_size)) {
+    vstr_clear(&cert);
+    mp_raise_ValueError("Failed to read certificate.");
+  }
+
+  cert.len = cert_size;
+  return mp_obj_new_str_from_vstr(&mp_type_bytes, &cert);
+}
+STATIC MP_DEFINE_CONST_FUN_OBJ_1(mod_trezorcrypto_optiga_get_certificate_obj,
+                                 mod_trezorcrypto_optiga_get_certificate);
+
+/// def sign(
+///     key_index: int,
+///     digest: bytes,
+/// ) -> bytes:
+///     """
+///     Uses the private key at key_index to produce a DER-encoded signature of
+///     the digest.
+///     """
+STATIC mp_obj_t mod_trezorcrypto_optiga_sign(mp_obj_t key_index,
+                                             mp_obj_t digest) {
+  mp_int_t idx = mp_obj_get_int(key_index);
+  if (idx < 0 || idx >= OPTIGA_ECC_KEY_COUNT) {
+    mp_raise_ValueError("Invalid index.");
+  }
+
+  mp_buffer_info_t dig = {0};
+  mp_get_buffer_raise(digest, &dig, MP_BUFFER_READ);
+  if (dig.len != 32) {
+    mp_raise_ValueError("Invalid length of digest.");
+  }
+
+  vstr_t sig = {0};
+  vstr_init_len(&sig, MAX_DER_SIGNATURE_SIZE);
+  size_t sig_size = 0;
+  int ret = optiga_sign(idx, (const uint8_t *)dig.buf, dig.len,
+                        ((uint8_t *)sig.buf), sig.alloc, &sig_size);
+  if (ret != 0) {
+    vstr_clear(&sig);
+    if (ret == OPTIGA_ERR_ACCESS_COND_NOT_SAT) {
+      mp_raise_msg(&mp_type_RuntimeError, "Signing inaccessible.");
+    } else {
+      mp_raise_msg(&mp_type_RuntimeError, "Signing failed.");
+    }
+  }
+
+  sig.len = sig_size;
+  return mp_obj_new_str_from_vstr(&mp_type_bytes, &sig);
+}
+
+STATIC MP_DEFINE_CONST_FUN_OBJ_2(mod_trezorcrypto_optiga_sign_obj,
+                                 mod_trezorcrypto_optiga_sign);
+
+/// DEVICE_CERT_INDEX: int
+/// DEVICE_ECC_KEY_INDEX: int
+
+STATIC const mp_rom_map_elem_t mod_trezorcrypto_optiga_globals_table[] = {
+    {MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_optiga)},
+    {MP_ROM_QSTR(MP_QSTR_get_certificate),
+     MP_ROM_PTR(&mod_trezorcrypto_optiga_get_certificate_obj)},
+    {MP_ROM_QSTR(MP_QSTR_sign), MP_ROM_PTR(&mod_trezorcrypto_optiga_sign_obj)},
+    {MP_ROM_QSTR(MP_QSTR_DEVICE_CERT_INDEX),
+     MP_ROM_INT(OPTIGA_DEVICE_CERT_INDEX)},
+    {MP_ROM_QSTR(MP_QSTR_DEVICE_ECC_KEY_INDEX),
+     MP_ROM_INT(OPTIGA_DEVICE_ECC_KEY_INDEX)},
+};
+STATIC MP_DEFINE_CONST_DICT(mod_trezorcrypto_optiga_globals,
+                            mod_trezorcrypto_optiga_globals_table);
+
+STATIC const mp_obj_module_t mod_trezorcrypto_optiga_module = {
+    .base = {&mp_type_module},
+    .globals = (mp_obj_dict_t *)&mod_trezorcrypto_optiga_globals,
+};
+
+#endif

core/embed/extmod/modtrezorcrypto/modtrezorcrypto.c

@@ -64,6 +64,9 @@ static void wrapped_ui_wait_callback(uint32_t current, uint32_t total) {
 #include "modtrezorcrypto-sha512.h"
 #include "modtrezorcrypto-shamir.h"
 #include "modtrezorcrypto-slip39.h"
+#ifdef USE_OPTIGA
+#include "modtrezorcrypto-optiga.h"
+#endif
 #if !BITCOIN_ONLY
 #include "modtrezorcrypto-cardano.h"
 #include "modtrezorcrypto-monero.h"
@@ -120,6 +123,9 @@ STATIC const mp_rom_map_elem_t mp_module_trezorcrypto_globals_table[] = {
      MP_ROM_PTR(&mod_trezorcrypto_Sha3_512_type)},
     {MP_ROM_QSTR(MP_QSTR_shamir), MP_ROM_PTR(&mod_trezorcrypto_shamir_module)},
     {MP_ROM_QSTR(MP_QSTR_slip39), MP_ROM_PTR(&mod_trezorcrypto_slip39_module)},
+#if USE_OPTIGA
+    {MP_ROM_QSTR(MP_QSTR_optiga), MP_ROM_PTR(&mod_trezorcrypto_optiga_module)},
+#endif
 };
 STATIC MP_DEFINE_CONST_DICT(mp_module_trezorcrypto_globals,
                             mp_module_trezorcrypto_globals_table);

core/embed/firmware/main.c

@@ -43,6 +43,7 @@
 #include "display.h"
 #include "flash.h"
 #include "image.h"
+#include "memzero.h"
 #include "model.h"
 #include "mpu.h"
 #include "random_delays.h"
@@ -71,7 +72,9 @@
 #include "sdcard.h"
 #endif
 #ifdef USE_OPTIGA
+#include "optiga_commands.h"
 #include "optiga_transport.h"
+#include "secret.h"
 #endif
 #include "unit_variant.h"
 
@@ -162,6 +165,14 @@ int main(void) {
 
 #ifdef USE_OPTIGA
   optiga_init();
+  optiga_open_application();
+
+  uint8_t secret[SECRET_OPTIGA_KEY_LEN] = {0};
+  if (secret_read(secret, SECRET_OPTIGA_KEY_OFFSET, SECRET_OPTIGA_KEY_LEN) ==
+      sectrue) {
+    optiga_sec_chan_handshake(secret, sizeof(secret));
+  }
+  memzero(secret, sizeof(secret));
 #endif
 
 #if !defined TREZOR_MODEL_1

core/embed/prodtest/optiga_prodtest.c

@@ -71,7 +71,7 @@ static bool optiga_paired(void) {
 }
 
 static bool set_metadata(uint16_t oid, const optiga_metadata *metadata) {
-  uint8_t serialized[258] = {0};
+  uint8_t serialized[OPTIGA_MAX_METADATA_SIZE] = {0};
   size_t size = 0;
   optiga_result ret = optiga_serialize_metadata(metadata, serialized,
                                                 sizeof(serialized), &size);
@@ -232,7 +232,7 @@ optiga_locked_status get_optiga_locked_status(void) {
   optiga_metadata locked_metadata = {0};
   locked_metadata.lcso = OPTIGA_LCS_OPERATIONAL;
   for (size_t i = 0; i < sizeof(oids) / sizeof(oids[0]); ++i) {
-    uint8_t metadata_buffer[258] = {0};
+    uint8_t metadata_buffer[OPTIGA_MAX_METADATA_SIZE] = {0};
     size_t metadata_size = 0;
     optiga_result ret =
         optiga_get_data_object(oids[i], true, metadata_buffer,

core/embed/rust/Cargo.toml

@@ -29,6 +29,7 @@ sd_card = []
 rgb_led = []
 backlight = []
 usb = []
+optiga = []
 test = [
     "button",
     "cc",
@@ -39,7 +40,8 @@ test = [
     "ui",
     "dma2d",
     "touch",
-    "backlight"
+    "backlight",
+    "optiga"
 ]
 
 [lib]

core/embed/trezorhal/optiga.h

@@ -0,0 +1,42 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TREZORHAL_OPTIGA_H
+#define TREZORHAL_OPTIGA_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define OPTIGA_DEVICE_CERT_INDEX 1
+#define OPTIGA_DEVICE_ECC_KEY_INDEX 0
+#define OPTIGA_COMMAND_ERROR_OFFSET 0x100
+
+// Error code 7: Access conditions not satisfied
+#define OPTIGA_ERR_ACCESS_COND_NOT_SAT (OPTIGA_COMMAND_ERROR_OFFSET + 0x07)
+
+int optiga_sign(uint8_t index, const uint8_t *digest, size_t digest_size,
+                uint8_t *signature, size_t max_sig_size, size_t *sig_size);
+
+bool optiga_cert_size(uint8_t index, size_t *cert_size);
+
+bool optiga_read_cert(uint8_t index, uint8_t *cert, size_t max_cert_size,
+                      size_t *cert_size);
+
+#endif

core/embed/trezorhal/optiga/optiga.c

@@ -0,0 +1,91 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "optiga.h"
+#include "optiga_commands.h"
+
+int optiga_sign(uint8_t index, const uint8_t *digest, size_t digest_size,
+                uint8_t *signature, size_t max_sig_size, size_t *sig_size) {
+  if (index >= OPTIGA_ECC_KEY_COUNT) {
+    return OPTIGA_ERR_PARAM;
+  }
+
+  optiga_result ret =
+      optiga_calc_sign(OPTIGA_OID_ECC_KEY + index, digest, digest_size,
+                       &signature[2], max_sig_size - 2, sig_size);
+  if (ret == OPTIGA_ERR_CMD) {
+    uint8_t error_code = 0;
+    optiga_get_error_code(&error_code);
+    return error_code + OPTIGA_COMMAND_ERROR_OFFSET;
+  }
+
+  if (ret != OPTIGA_SUCCESS) {
+    return ret;
+  }
+
+  // Add sequence tag and length.
+  if (*sig_size >= 0x80) {
+    // Length not supported.
+    return OPTIGA_ERR_SIZE;
+  }
+  signature[0] = 0x30;
+  signature[1] = *sig_size;
+  *sig_size += 2;
+  return OPTIGA_SUCCESS;
+}
+
+bool optiga_cert_size(uint8_t index, size_t *cert_size) {
+  *cert_size = 0;
+
+  if (index >= OPTIGA_CERT_COUNT) {
+    return false;
+  }
+
+  uint8_t metadata_bytes[OPTIGA_MAX_METADATA_SIZE] = {0};
+  size_t metadata_size = 0;
+  optiga_metadata metadata = {0};
+  optiga_result ret =
+      optiga_get_data_object(OPTIGA_OID_CERT + index, true, metadata_bytes,
+                             sizeof(metadata_bytes), &metadata_size);
+  if (OPTIGA_SUCCESS != ret) {
+    return false;
+  }
+
+  ret = optiga_parse_metadata(metadata_bytes, metadata_size, &metadata);
+  if (OPTIGA_SUCCESS != ret || metadata.used_size.ptr == NULL) {
+    return false;
+  }
+
+  for (int i = 0; i < metadata.used_size.len; ++i) {
+    *cert_size = (*cert_size << 8) + metadata.used_size.ptr[i];
+  }
+
+  return true;
+}
+
+bool optiga_read_cert(uint8_t index, uint8_t *cert, size_t max_cert_size,
+                      size_t *cert_size) {
+  if (index >= OPTIGA_CERT_COUNT) {
+    return false;
+  }
+
+  optiga_result ret = optiga_get_data_object(OPTIGA_OID_CERT + index, false,
+                                             cert, max_cert_size, cert_size);
+  return OPTIGA_SUCCESS == ret;
+}

core/embed/trezorhal/optiga_commands.h

@@ -122,6 +122,10 @@ typedef struct {
   optiga_metadata_item reset_type;   // F0 - Factory reset type.
 } optiga_metadata;
 
+#define OPTIGA_ECC_KEY_COUNT 4
+#define OPTIGA_CERT_COUNT 4
+#define OPTIGA_MAX_METADATA_SIZE 44
+
 #define OPTIGA_ACCESS_CONDITION(ac_id, oid) \
   { (const uint8_t[]){ac_id, oid >> 8, oid & 0xff}, 3 }
 

core/embed/trezorhal/unix/optiga.c

@@ -0,0 +1,147 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "optiga.h"
+#include <string.h>
+#include "ecdsa.h"
+#include "nist256p1.h"
+#include "optiga_common.h"
+
+static const uint8_t DEVICE_CERT_CHAIN[] = {
+    0x30, 0x82, 0x01, 0x90, 0x30, 0x82, 0x01, 0x37, 0xa0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x04, 0x4e, 0xe2, 0xa5, 0x0f, 0x30, 0x0a, 0x06, 0x08, 0x2a,
+    0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x4f, 0x31, 0x0b, 0x30,
+    0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e,
+    0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65,
+    0x7a, 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20,
+    0x73, 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03,
+    0x55, 0x04, 0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20,
+    0x4d, 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e,
+    0x67, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x32, 0x30, 0x34,
+    0x33, 0x30, 0x31, 0x34, 0x31, 0x36, 0x30, 0x31, 0x5a, 0x17, 0x0d, 0x34,
+    0x32, 0x30, 0x34, 0x33, 0x30, 0x31, 0x34, 0x31, 0x36, 0x30, 0x31, 0x5a,
+    0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
+    0x04, 0x54, 0x32, 0x42, 0x31, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a,
+    0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
+    0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x9b, 0xbf, 0x06, 0xda,
+    0xd9, 0xab, 0x59, 0x05, 0xe0, 0x54, 0x71, 0xce, 0x16, 0xd5, 0x22, 0x2c,
+    0x89, 0xc2, 0xca, 0xa3, 0x9f, 0x26, 0x26, 0x7a, 0xc0, 0x74, 0x71, 0x29,
+    0x88, 0x5f, 0xbd, 0x44, 0x1b, 0xcc, 0x7f, 0xa8, 0x4d, 0xe1, 0x20, 0xa3,
+    0x67, 0x55, 0xda, 0xf3, 0x0a, 0x6f, 0x47, 0xe8, 0xc0, 0xd4, 0xbd, 0xdc,
+    0x15, 0x03, 0x6e, 0xd2, 0xa3, 0x44, 0x7d, 0xfa, 0x7a, 0x1d, 0x3e, 0x88,
+    0xa3, 0x41, 0x30, 0x3f, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01,
+    0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x00, 0x80, 0x30, 0x0c, 0x06, 0x03,
+    0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f,
+    0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x0a,
+    0x80, 0xa4, 0x22, 0xc1, 0x6e, 0x36, 0x94, 0x24, 0xd3, 0xb8, 0x12, 0x67,
+    0xb5, 0xaa, 0xe6, 0x46, 0x74, 0x74, 0xc8, 0x30, 0x0a, 0x06, 0x08, 0x2a,
+    0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x47, 0x00, 0x30, 0x44,
+    0x02, 0x20, 0x2f, 0xba, 0xc7, 0xe7, 0x99, 0x5b, 0x0e, 0x00, 0xc2, 0xc2,
+    0xa7, 0xcb, 0xd8, 0xdd, 0x1d, 0x4e, 0xce, 0xf5, 0x58, 0x75, 0xa2, 0x65,
+    0xc6, 0x86, 0xd4, 0xa8, 0xd2, 0x80, 0x68, 0x63, 0x5b, 0xf8, 0x02, 0x20,
+    0x1e, 0xee, 0x62, 0x10, 0x0d, 0x0c, 0x97, 0x5a, 0x96, 0x34, 0x6f, 0x14,
+    0xef, 0xe2, 0x6b, 0xc9, 0x3b, 0x00, 0xba, 0x30, 0x28, 0x9c, 0xe3, 0x7c,
+    0xef, 0x17, 0x89, 0xbc, 0xc0, 0x68, 0xba, 0xb9, 0x30, 0x82, 0x01, 0xe0,
+    0x30, 0x82, 0x01, 0x85, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x05, 0x00,
+    0x94, 0x4e, 0x25, 0x7c, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
+    0x3d, 0x04, 0x03, 0x02, 0x30, 0x54, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
+    0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, 0x1c, 0x06,
+    0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72,
+    0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, 0x2e, 0x72,
+    0x2e, 0x6f, 0x2e, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03,
+    0x0c, 0x1c, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, 0x61, 0x6e,
+    0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x52,
+    0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x30, 0x20, 0x17, 0x0d, 0x32, 0x33,
+    0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18,
+    0x0f, 0x32, 0x30, 0x35, 0x33, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
+    0x30, 0x30, 0x30, 0x5a, 0x30, 0x4f, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
+    0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, 0x1c, 0x06,
+    0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72,
+    0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, 0x2e, 0x72,
+    0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03,
+    0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, 0x61, 0x6e,
+    0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x43,
+    0x41, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d,
+    0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07,
+    0x03, 0x42, 0x00, 0x04, 0x9b, 0xf0, 0x76, 0x0c, 0xd7, 0x55, 0x5e, 0xfc,
+    0x5b, 0x01, 0xe6, 0x4c, 0xe9, 0x46, 0x06, 0xcd, 0xee, 0xb4, 0x8a, 0x4f,
+    0x91, 0x96, 0xf4, 0x54, 0xbc, 0x2a, 0x01, 0x41, 0xb3, 0x31, 0x88, 0x2d,
+    0x06, 0x8b, 0x4b, 0x6e, 0x63, 0x79, 0x13, 0xdd, 0x22, 0x06, 0x54, 0xe2,
+    0x8f, 0xde, 0x3c, 0x44, 0x21, 0x41, 0xf9, 0x53, 0xb3, 0xe3, 0x6a, 0xd9,
+    0xa5, 0x75, 0x19, 0x00, 0x71, 0x19, 0xd9, 0xc9, 0xa3, 0x47, 0x30, 0x45,
+    0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04,
+    0x03, 0x02, 0x02, 0x04, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
+    0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x00,
+    0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
+    0x14, 0x28, 0xb2, 0x02, 0xf8, 0xf9, 0xc7, 0x8a, 0x74, 0xe8, 0xc1, 0x52,
+    0xbb, 0xfb, 0x43, 0x3d, 0x99, 0xd0, 0xca, 0x03, 0xef, 0x30, 0x0a, 0x06,
+    0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x49, 0x00,
+    0x30, 0x46, 0x02, 0x21, 0x00, 0x9b, 0x60, 0xfb, 0x5f, 0xc7, 0xee, 0x07,
+    0x00, 0x31, 0x2d, 0x40, 0x2d, 0xcb, 0xe0, 0x77, 0xe4, 0x81, 0x82, 0xbb,
+    0x94, 0x4b, 0xb1, 0xb3, 0x30, 0x79, 0xdd, 0xa0, 0xb6, 0xca, 0x9a, 0xb5,
+    0xb7, 0x02, 0x21, 0x00, 0x81, 0x5d, 0xd9, 0x76, 0xab, 0xec, 0xb9, 0xb3,
+    0xa8, 0x0f, 0x5b, 0x86, 0xb4, 0x49, 0x4f, 0xef, 0x94, 0xf2, 0xe0, 0xc1,
+    0xf2, 0xc4, 0x5d, 0xe6, 0xec, 0x5f, 0x89, 0x5c, 0xa5, 0x6f, 0x04, 0x8b};
+
+int optiga_sign(uint8_t index, const uint8_t *digest, size_t digest_size,
+                uint8_t *signature, size_t max_sig_size, size_t *sig_size) {
+  const uint8_t DEVICE_PRIV_KEY[32] = {1};
+
+  if (index != OPTIGA_DEVICE_ECC_KEY_INDEX) {
+    return false;
+  }
+
+  if (max_sig_size < 72) {
+    return OPTIGA_ERR_SIZE;
+  }
+
+  uint8_t raw_signature[64] = {0};
+  int ret = ecdsa_sign_digest(&nist256p1, DEVICE_PRIV_KEY, digest,
+                              raw_signature, NULL, NULL);
+  if (ret != 0) {
+    return OPTIGA_ERR_CMD;
+  }
+
+  *sig_size = ecdsa_sig_to_der(raw_signature, signature);
+  return OPTIGA_SUCCESS;
+}
+
+bool optiga_cert_size(uint8_t index, size_t *cert_size) {
+  if (index != OPTIGA_DEVICE_CERT_INDEX) {
+    return false;
+  }
+
+  *cert_size = sizeof(DEVICE_CERT_CHAIN);
+  return true;
+}
+
+bool optiga_read_cert(uint8_t index, uint8_t *cert, size_t max_cert_size,
+                      size_t *cert_size) {
+  if (index != OPTIGA_DEVICE_CERT_INDEX) {
+    return false;
+  }
+
+  if (max_cert_size < sizeof(DEVICE_CERT_CHAIN)) {
+    return false;
+  }
+
+  memcpy(cert, DEVICE_CERT_CHAIN, sizeof(DEVICE_CERT_CHAIN));
+  *cert_size = sizeof(DEVICE_CERT_CHAIN);
+  return true;
+}

core/mocks/generated/trezorcrypto/optiga.pyi

@@ -0,0 +1,21 @@
+from typing import *
+
+
+# extmod/modtrezorcrypto/modtrezorcrypto-optiga.h
+def get_certificate(cert_index: int) -> bytes:
+    """
+    Return the certificate stored at the given index.
+    """
+
+
+# extmod/modtrezorcrypto/modtrezorcrypto-optiga.h
+def sign(
+    key_index: int,
+    digest: bytes,
+) -> bytes:
+    """
+    Uses the private key at key_index to produce a DER-encoded signature of
+    the digest.
+    """
+DEVICE_CERT_INDEX: int
+DEVICE_ECC_KEY_INDEX: int

core/site_scons/boards/trezor_r_v10.py

@@ -33,6 +33,7 @@ def configure(
     defines += [f'TREZOR_BOARD=\\"boards/{board}\\"']
     defines += [f"HW_MODEL={hw_model}"]
     defines += [f"HW_REVISION={hw_revision}"]
+    defines += ["USE_OPTIGA=1"]
     sources += [
         "embed/models/model_T2B1_layout.c",
     ]
@@ -66,9 +67,11 @@ def configure(
 
     if "optiga" in features_wanted:
         sources += ["embed/trezorhal/stm32f4/optiga_hal.c"]
+        sources += ["embed/trezorhal/optiga/optiga.c"]
         sources += ["embed/trezorhal/optiga/optiga_commands.c"]
         sources += ["embed/trezorhal/optiga/optiga_transport.c"]
         sources += ["embed/trezorhal/stm32f4/secret.c"]
+        features_available.append("optiga")
 
     env.get("ENV")["TREZOR_BOARD"] = board
     env.get("ENV")["MCU_TYPE"] = mcu

core/site_scons/site_tools/micropython/__init__.py

@@ -37,11 +37,13 @@ def generate(env):
         # so the compiler can optimize out the things we don't want
         btc_only = env["bitcoin_only"] == "1"
         backlight = env["backlight"]
+        optiga = env["optiga"]
         interim = f"{target[:-4]}.i"  # replace .mpy with .i
         sed_scripts = " ".join(
             [
                 rf"-e 's/utils\.BITCOIN_ONLY/{btc_only}/g'",
                 rf"-e 's/utils\.USE_BACKLIGHT/{backlight}/g'",
+                rf"-e 's/utils\.USE_OPTIGA/{optiga}/g'",
                 r"-e 's/if TYPE_CHECKING/if False/'",
                 r"-e 's/import typing/# \0/'",
                 r"-e '/from typing import (/,/^\s*)/ {s/^/# /}'",

core/src/trezor/crypto/__init__.py

@@ -13,3 +13,6 @@ from trezor import utils
 
 if not utils.BITCOIN_ONLY:
     from trezorcrypto import cardano, monero, nem  # noqa: F401
+
+if utils.USE_OPTIGA:
+    from trezorcrypto import optiga  # noqa: F401