trussed-dev · sosthene-nitrokey · Sep 8, 2025
diff --git a/Cargo.toml b/Cargo.toml
@@ -11,10 +11,10 @@ description = "FIDO authenticator Trussed app"
 [dependencies]
 cbor-smol = { version = "0.5" }
 ctap-types = { version = "0.4", features = ["get-info-full", "large-blobs", "third-party-payment"] }
-cosey = "0.3"
+cosey = "0.4"
 delog = "0.1.0"
-heapless = "0.7"
-heapless-bytes = "0.3"
+heapless = "0.9"
+heapless-bytes = { version = "0.5", features = ["heapless-0.9"]}
 littlefs2-core = "0.1"
 serde = { version = "1.0", default-features = false }
 serde_bytes = { version = "0.11.14", default-features = false }
@@ -27,7 +27,7 @@ trussed-chunked = { version = "0.2.0", optional = true }
 
 apdu-app = { version = "0.1", optional = true }
 ctaphid-app = { version = "0.1.0-rc.1", optional = true }
-iso7816 = { version = "0.1.2", optional = true }
+iso7816 = { version = "0.2", optional = true }
 
 [features]
 dispatch = ["apdu-dispatch", "ctaphid-dispatch", "iso7816"]
@@ -61,7 +61,7 @@ hex-literal = "0.4.1"
 hmac = "0.12.1"
 interchange = "0.3.0"
 itertools = "0.14.0"
-littlefs2 = "0.6.0"
+littlefs2 = "0.7.0"
 log = "0.4.21"
 p256 = { version = "0.13.2", features = ["ecdh"] }
 rand = "0.8.4"
@@ -78,10 +78,24 @@ x509-parser = "0.16.0"
 features = ["dispatch"]
 
 [patch.crates-io]
-admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.20" }
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "024e0eca5fb7dbd2457831f7c7bffe4341e08775" }
-trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "7922d67e9637a87e5625aaff9e5111f0d4ec0346" }
-trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "504674453c9573a30aa2f155101df49eb2af1ba7" }
+trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "1e7b09a983dc8ae64a7ad8401ce541a9a77e5939" }
+trussed-core = { git = "https://github.com/trussed-dev/trussed.git", rev = "1e7b09a983dc8ae64a7ad8401ce541a9a77e5939" }
+trussed-manage = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "eff09d1613641531630d962f81136f64f3dd2716" }
+trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "eff09d1613641531630d962f81136f64f3dd2716" }
+trussed-chunked = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "eff09d1613641531630d962f81136f64f3dd2716" }
+
+
+littlefs2 = { git = "https://github.com/trussed-dev/littlefs2.git", rev = "e9d3a1ca98f80e92cd20ee9b94707067810b9036" }
+littlefs2-core = { git = "https://github.com/trussed-dev/littlefs2.git", rev = "e9d3a1ca98f80e92cd20ee9b94707067810b9036" }
+littlefs2-sys = { git = "https://github.com/trussed-dev/littlefs2-sys", rev = "v0.3.1-nitrokey.1" }
+salty = { git = "https://github.com/ycrypto/salty.git", rev = "ae17f04ec965913e08032d266f6a47c001031f06" }
+ctaphid-app = { git = "https://github.com/trussed-dev/ctaphid-dispatch.git", rev = "f11fdcbc62d06b8be23e6cbae21bcfefd52c0661" }
+ctaphid-dispatch = { git = "https://github.com/trussed-dev/ctaphid-dispatch.git", rev = "f11fdcbc62d06b8be23e6cbae21bcfefd52c0661" }
+apdu-app = { git = "https://github.com/trussed-dev/apdu-dispatch.git", rev = "931c4269d1d293954fae2012d809e9663cd2cb7e" }
+admin-app = { git = "https://github.com/Nitrokey/admin-app.git", rev = "2b3f758016afbc56535d8a65f98a067d5a2d843e" }
+trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "0ff1992f15c273c87e0607384e3dd94d341b721e" }
+usbd-ctaphid = { git = "https://github.com/trussed-dev/usbd-ctaphid.git", rev = "94881f83a6b4229a7a3187a5dd7b3ccf6eb6dc00" }
+ctap-types = { git = "https://github.com/trussed-dev/ctap-types", rev = "cff44662b48088511fa8ae30557c457f8252f220"}
 
 [profile.test]
 opt-level = 2
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
@@ -10,7 +10,7 @@ cargo-fuzz = true
 [dependencies]
 ctap-types = { version = "0.4", features = ["arbitrary"] }
 libfuzzer-sys = "0.4"
-trussed = { version = "0.1", features = ["clients-1", "certificate-client", "crypto-client", "filesystem-client", "management-client", "aes256-cbc", "ed255", "p256", "sha256"] }
+trussed = { version = "0.1", features = ["certificate-client", "crypto-client", "filesystem-client", "management-client", "aes256-cbc", "ed255", "p256", "sha256"] }
 trussed-staging = { version = "0.3.0", features = ["chunked", "hkdf", "virt", "fs-info"] }
 
 [dependencies.fido-authenticator]
@@ -24,5 +24,14 @@ doc = false
 bench = false
 
 [patch.crates-io]
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "6bba8fde36d05c0227769eb63345744e87d84b2b" }
-trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "1e1ca03a3a62ea9b802f4070ea4bce002eeb4bec" }
+trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "1e7b09a983dc8ae64a7ad8401ce541a9a77e5939" }
+trussed-core = { git = "https://github.com/trussed-dev/trussed.git", rev = "1e7b09a983dc8ae64a7ad8401ce541a9a77e5939" }
+trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "eff09d1613641531630d962f81136f64f3dd2716" }
+trussed-chunked = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "eff09d1613641531630d962f81136f64f3dd2716" }
+
+
+littlefs2 = { git = "https://github.com/trussed-dev/littlefs2.git", rev = "e9d3a1ca98f80e92cd20ee9b94707067810b9036" }
+littlefs2-core = { git = "https://github.com/trussed-dev/littlefs2.git", rev = "e9d3a1ca98f80e92cd20ee9b94707067810b9036" }
+littlefs2-sys = { git = "https://github.com/trussed-dev/littlefs2-sys", rev = "v0.3.1-nitrokey.1" }
+salty = { git = "https://github.com/ycrypto/salty.git", rev = "ae17f04ec965913e08032d266f6a47c001031f06" }
+ctap-types = { git = "https://github.com/trussed-dev/ctap-types", rev = "cff44662b48088511fa8ae30557c457f8252f220"}
diff --git a/fuzz/fuzz_targets/ctap.rs b/fuzz/fuzz_targets/ctap.rs
@@ -2,12 +2,13 @@
 
 use ctap_types::{authenticator::Request, ctap1::Authenticator as _, ctap2::Authenticator as _};
 use fido_authenticator::{Authenticator, Config, Conforming};
+use trussed::virt::StoreConfig;
 use trussed_staging::virt;
 
 use libfuzzer_sys::fuzz_target;
 
 fuzz_target!(|requests: Vec<Request<'_>>| {
-    virt::with_ram_client("fido", |client| {
+    virt::with_client(StoreConfig::ram(), "fido", |client| {
         let mut authenticator = Authenticator::new(
             client,
             Conforming {},

diff --git a/src/credential.rs b/src/credential.rs
@@ -202,13 +202,14 @@ impl Credential {
 fn deserialize_bytes<E: serde::de::Error, const N: usize>(
     s: &[u8],
 ) -> core::result::Result<Bytes<N>, E> {
-    Bytes::from_slice(s).map_err(|_| E::invalid_length(s.len(), &"a fixed-size sequence of bytes"))
+    Bytes::try_from(s).map_err(|_| E::invalid_length(s.len(), &"a fixed-size sequence of bytes"))
 }
 
 fn deserialize_str<E: serde::de::Error, const N: usize>(
     s: &str,
 ) -> core::result::Result<String<N>, E> {
-    Ok(s.into())
+    s.try_into()
+        .map_err(|_| E::custom("Serialized string doesn't fit "))
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -794,20 +795,20 @@ mod test {
     fn credential_data() -> CredentialData {
         CredentialData {
             rp: Rp::new(PublicKeyCredentialRpEntity {
-                id: String::from("John Doe"),
+                id: String::try_from("John Doe").unwrap(),
                 name: None,
                 icon: None,
             }),
             user: User::new(PublicKeyCredentialUserEntity {
-                id: Bytes::from_slice(&[1, 2, 3]).unwrap(),
+                id: Bytes::from(&[1, 2, 3]),
                 icon: None,
                 name: None,
                 display_name: None,
             }),
             creation_time: 123,
             use_counter: false,
             algorithm: -7,
-            key: Key::WrappedKey(Bytes::from_slice(&[1, 2, 3]).unwrap()),
+            key: Key::WrappedKey(Bytes::from(&[1, 2, 3])),
             hmac_secret: Some(false),
             cred_protect: None,
             use_short_id: Some(true),
@@ -821,15 +822,15 @@ mod test {
             rp: Rp {
                 format: SerializationFormat::Long,
                 inner: PublicKeyCredentialRpEntity {
-                    id: String::from("John Doe"),
+                    id: String::try_from("John Doe").unwrap(),
                     name: None,
                     icon: None,
                 },
             },
             user: User {
                 format: SerializationFormat::Long,
                 inner: PublicKeyCredentialUserEntity {
-                    id: Bytes::from_slice(&[1, 2, 3]).unwrap(),
+                    id: Bytes::from(&[1, 2, 3]),
                     icon: None,
                     name: None,
                     display_name: None,
@@ -838,7 +839,7 @@ mod test {
             creation_time: 123,
             use_counter: false,
             algorithm: -7,
-            key: Key::WrappedKey(Bytes::from_slice(&[1, 2, 3]).unwrap()),
+            key: Key::WrappedKey(Bytes::from(&[1, 2, 3])),
             hmac_secret: Some(false),
             cred_protect: None,
             use_short_id: None,
@@ -865,7 +866,7 @@ mod test {
         let between = Uniform::from(0..(N + 1));
         let n = between.sample(&mut OsRng);
 
-        bytes.resize_default(n).unwrap();
+        bytes.resize_zero(n).unwrap();
 
         OsRng.fill_bytes(&mut bytes);
         bytes
@@ -1079,7 +1080,7 @@ mod test {
     #[test]
     fn max_credential_id() {
         let rp_id: String<256> = core::iter::repeat_n('?', 256).collect();
-        let key = Bytes::from_slice(&[u8::MAX; 128]).unwrap();
+        let key = Bytes::from(&[u8::MAX; 128]);
         let credential = StrippedCredential {
             ctap: CtapVersion::Fido21Pre,
             creation_time: u32::MAX,
@@ -1160,8 +1161,8 @@ mod test {
 
         fn inner(&self) -> PublicKeyCredentialRpEntity {
             PublicKeyCredentialRpEntity {
-                id: self.id.into(),
-                name: self.name.map(From::from),
+                id: self.id.try_into().unwrap(),
+                name: self.name.map(|n| n.try_into().unwrap()),
                 icon: None,
             }
         }
@@ -1225,10 +1226,10 @@ mod test {
 
         fn inner(&self) -> PublicKeyCredentialUserEntity {
             PublicKeyCredentialUserEntity {
-                id: Bytes::from_slice(self.id).unwrap(),
-                icon: self.icon.map(From::from),
-                name: self.name.map(From::from),
-                display_name: self.display_name.map(From::from),
+                id: Bytes::try_from(self.id).unwrap(),
+                icon: self.icon.map(|v| v.try_into().unwrap()),
+                name: self.name.map(|v| v.try_into().unwrap()),
+                display_name: self.display_name.map(|v| v.try_into().unwrap()),
             }
         }
     }
@@ -1300,7 +1301,7 @@ mod test {
         "
         );
 
-        let credential = FullCredential::deserialize(&Bytes::from_slice(&data).unwrap()).unwrap();
+        let credential = FullCredential::deserialize(&Bytes::from(&data)).unwrap();
         assert!(matches!(credential.ctap, CtapVersion::Fido21Pre));
         assert_eq!(credential.nonce, &hex!("F62CA01ED181A3D03D561FC7"));
         assert_eq!(
@@ -1309,17 +1310,17 @@ mod test {
                 rp: Rp {
                     format: SerializationFormat::Long,
                     inner: PublicKeyCredentialRpEntity {
-                        id: "webauthn.io".into(),
+                        id: "webauthn.io".try_into().unwrap(),
                         name: None,
                         icon: None,
                     },
                 },
                 user: User {
                     format: SerializationFormat::Long,
                     inner: PublicKeyCredentialUserEntity {
-                        id: Bytes::from_slice(&hex!("6447567A644445")).unwrap(),
+                        id: Bytes::from(&hex!("6447567A644445")),
                         icon: None,
-                        name: Some("test1".into()),
+                        name: Some("test1".try_into().unwrap()),
                         display_name: None,
                     },
                 },

diff --git a/src/ctap1.rs b/src/ctap1.rs
@@ -1,9 +1,7 @@
 //! The `ctap_types::ctap1::Authenticator` implementation.
 
-use ctap_types::{
-    ctap1::{authenticate, register, Authenticator, ControlByte, Error, Result},
-    heapless_bytes::Bytes,
-};
+use ctap_types::ctap1::{authenticate, register, Authenticator, ControlByte, Error, Result};
+use heapless_bytes::Bytes;
 use serde_bytes::ByteArray;
 
 use trussed_core::{
@@ -71,9 +69,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
         syscall!(self.trussed.delete(private_key));
 
         let key = Key::WrappedKey(
-            wrapped_key
-                .to_bytes()
-                .map_err(|_| Error::UnspecifiedCheckingError)?,
+            Bytes::try_from(&*wrapped_key).map_err(|_| Error::UnspecifiedCheckingError)?,
         );
         let nonce = ByteArray::new(self.nonce());
 
@@ -124,14 +120,15 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
             (Some((key, cert)), _aaguid) => {
                 info!("aaguid: {}", hex_str!(&_aaguid));
                 (
-                    syscall!(self.trussed.sign(
-                        Mechanism::P256,
-                        key,
-                        &commitment,
-                        SignatureSerialization::Asn1Der
-                    ))
-                    .signature
-                    .to_bytes()
+                    Bytes::try_from(
+                        &*syscall!(self.trussed.sign(
+                            Mechanism::P256,
+                            key,
+                            &commitment,
+                            SignatureSerialization::Asn1Der
+                        ))
+                        .signature,
+                    )
                     .unwrap(),
                     cert,
                 )
@@ -226,14 +223,15 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
             .unwrap();
         commitment.extend_from_slice(auth.challenge).unwrap();
 
-        let signature = syscall!(self.trussed.sign(
-            Mechanism::P256,
-            key,
-            &commitment,
-            SignatureSerialization::Asn1Der
-        ))
-        .signature
-        .to_bytes()
+        let signature = Bytes::try_from(
+            &*syscall!(self.trussed.sign(
+                Mechanism::P256,
+                key,
+                &commitment,
+                SignatureSerialization::Asn1Der
+            ))
+            .signature,
+        )
         .unwrap();
 
         Ok(authenticate::Response {