From 7abc9a15633fcec5123c40e4ef6bd8329db664fa Mon Sep 17 00:00:00 2001
From: kormax <3392860+kormax@users.noreply.github.com>
Date: Tue, 5 May 2026 18:40:18 +0300
Subject: [PATCH] Use LEAF certificate instead of bare public key

---
 .../leaf_community-root-public-key.der        | Bin 91 -> 0 bytes
 .../nxp-leaf-e200-sn63709320131000-c02.pem    |  14 ++++++++++++
 .../nxp-leaf-e500-sn63709320130000-c01.pem    |  15 +++++++++++++
 client/src/cmdhfmfdes.c                       |  20 ++++++++++++++----
 4 files changed, 45 insertions(+), 4 deletions(-)
 delete mode 100644 client/resources/duox_trust/leaf_community/leaf_community-root-public-key.der
 create mode 100644 client/resources/duox_trust/nxp/nxp-leaf-e200-sn63709320131000-c02.pem
 create mode 100644 client/resources/duox_trust/nxp/nxp-leaf-e500-sn63709320130000-c01.pem

diff --git a/client/resources/duox_trust/leaf_community/leaf_community-root-public-key.der b/client/resources/duox_trust/leaf_community/leaf_community-root-public-key.der
deleted file mode 100644
index e12db2a074d9d34a691629bc2eeed0f203979f0a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 91
zcmXqrG!SNE*J|@PXUoLM#sOw9GqN)~F|g>WH|}#hq#m(MxRF2oO~rk|vLj{DirSuv
tJvk8$T~W7eXBI2WZPJ)%)gd<B=3mUb{Wp$fmKvSCy4CKX$)%6dHUJhJB7y(_

diff --git a/client/resources/duox_trust/nxp/nxp-leaf-e200-sn63709320131000-c02.pem b/client/resources/duox_trust/nxp/nxp-leaf-e200-sn63709320131000-c02.pem
new file mode 100644
index 000000000..243853610
--- /dev/null
+++ b/client/resources/duox_trust/nxp/nxp-leaf-e200-sn63709320131000-c02.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICKDCCAYmgAwIBAgIBAjAKBggqhkjOPQQDAjBGMQwwCgYDVQQKDANOWFAxHTAb
+BgNVBAMMFE5YUCBMRUFGIFJvb3RDQXZFNTAwMRcwFQYDVQQFEw42MzcwOTMyMDEz
+MDAwMDAgFw0yNTA2MzAxMzM0NDRaGA8yMDY1MDYzMDEzMzQ0NFowRjEMMAoGA1UE
+CgwDTlhQMR0wGwYDVQQDDBROWFAgTEVBRiBSb290Q0F2RTIwMDEXMBUGA1UEBRMO
+NjM3MDkzMjAxMzEwMDAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQtJ4G+QcIn
+WKYTgQ9n7HjfEXbEdlshK0khjGxYQIpa2j2ZcyCdgiiROogWlzz+XJ6/2MZpdTLN
+1bU+4TTS8Rs8o2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIB
+BjAdBgNVHQ4EFgQUdktaJUHxC+YHsMDqW+Cu4yoZt94wHwYDVR0jBBgwFoAUJm5E
+Yuw6nFX1IreUXpdhFNdmY5QwCgYIKoZIzj0EAwIDgYwAMIGIAkIA1PsrUHpbSGEH
+ETjfYygzBoqLCS+Ed6jzfAYCsEjPAEdIN7v+bej86yKckN2+FSiG5/LJwJi5nTLg
+fbRrFH+M+yACQgDH9nudmERpYiOiEHwWHZFHOHyXT8di6KEmPqR7WN2mSFAqYN2n
+psI8ZlIxiHmLs2kEUqIR36XxLk4LBIiMInLvHw==
+-----END CERTIFICATE-----
diff --git a/client/resources/duox_trust/nxp/nxp-leaf-e500-sn63709320130000-c01.pem b/client/resources/duox_trust/nxp/nxp-leaf-e500-sn63709320130000-c01.pem
new file mode 100644
index 000000000..985c90cb5
--- /dev/null
+++ b/client/resources/duox_trust/nxp/nxp-leaf-e500-sn63709320130000-c01.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICajCCAcygAwIBAgIBATAKBggqhkjOPQQDBDBGMQwwCgYDVQQKDANOWFAxHTAb
+BgNVBAMMFE5YUCBMRUFGIFJvb3RDQXZFNTAwMRcwFQYDVQQFEw42MzcwOTMyMDEz
+MDAwMDAgFw0yNTA2MzAxMzI3NDlaGA8yMDc1MDYzMDEzMjc0OVowRjEMMAoGA1UE
+CgwDTlhQMR0wGwYDVQQDDBROWFAgTEVBRiBSb290Q0F2RTUwMDEXMBUGA1UEBRMO
+NjM3MDkzMjAxMzAwMDAwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAC3O2rxBVGV
+IVtqIP43XLA7/Jg3vaYXZPBppyjHcdnn5zylnLP3B9igEld/SWCosMdrpKuqddps
+EiTeIMJIUu9VRQDS6leU5itYBrAsHccq/KUpUDigSj6HI0WiVRzLpUyYXOUIYq+l
+zytBQb0jXRXT4ddOyw5x0nL6wLjJADPZ+Qi8c6NmMGQwEgYDVR0TAQH/BAgwBgEB
+/wIBATAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFCZuRGLsOpxV9SK3lF6XYRTX
+ZmOUMB8GA1UdIwQYMBaAFCZuRGLsOpxV9SK3lF6XYRTXZmOUMAoGCCqGSM49BAME
+A4GLADCBhwJCAP0JGHZUujRaVqvLH3NZFxhxRGjAJ0c4Sg/NRMq2XQTrJmwZ6P/A
+5yuscF/TtVk1GpqRuyMiNyCHZrzkR61/kh8JAkF1xB2/wdgpfdmnJMZQw0p4ofim
+g8YJjVLRj3Ug5lPvWbG7TS7BGZcsLxPMZp2UvB1K+O1YqNuxLWxIm/xIPHWmjQ==
+-----END CERTIFICATE-----
diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index e307ff5a2..7b3f69e32 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -85,7 +85,7 @@
 #define LEAF_VERIFIED_DEFAULT_AID       0xF51CD6U
 #define LEAF_VERIFIED_CERT_FILE         0x02
 #define LEAF_VERIFIED_MAX_CERT_LEN      4096
-#define LEAF_COMMUNITY_ROOT_KEY_PATH    "duox_trust/leaf_community/leaf_community-root-public-key.der"
+#define LEAF_COMMUNITY_ROOT_CERT_PATH   "duox_trust/nxp/nxp-leaf-e200-sn63709320131000-c02.pem"
 #define DUOX_VDE_DEFAULT_AID            0x1010F6U
 #define DUOX_VDE_CERT_FILE              0x00
 
@@ -8119,12 +8119,24 @@ static int CmdHF14ADesLeaf(const char *Cmd) {
     SetAPDULogging(APDULogging);
     CLIParserFree(ctx);
 
-    uint8_t leaf_root_pubkey[65] = {0};
-    int pk_res = ensure_ec_public_key(LEAF_COMMUNITY_ROOT_KEY_PATH, MBEDTLS_ECP_DP_SECP256R1, leaf_root_pubkey, sizeof(leaf_root_pubkey));
+    duox_certificate_anchor_t leaf_root_anchor = {0};
+    int pk_res = duox_load_certificate_anchor_from_input(LEAF_COMMUNITY_ROOT_CERT_PATH, DUOX_DEFAULT_CA_DIR, &leaf_root_anchor);
+    mbedtls_ecp_group_id leaf_root_curveid = MBEDTLS_ECP_DP_NONE;
+    const uint8_t *leaf_root_anchor_pubkey = NULL;
+    size_t leaf_root_pubkey_len = 0;
+    if (pk_res == PM3_SUCCESS) {
+        pk_res = duox_certificate_anchor_public_key(&leaf_root_anchor, &leaf_root_curveid, &leaf_root_anchor_pubkey, &leaf_root_pubkey_len);
+    }
     if (pk_res != PM3_SUCCESS) {
-        PrintAndLogEx(ERR, "Failed to load LEAF Root CA public key from " _YELLOW_("%s") " (%d)", LEAF_COMMUNITY_ROOT_KEY_PATH, pk_res);
+        PrintAndLogEx(ERR, "Failed to load LEAF Root CA certificate from " _YELLOW_("%s") " (%d)", LEAF_COMMUNITY_ROOT_CERT_PATH, pk_res);
         return pk_res;
     }
+    if (leaf_root_curveid != MBEDTLS_ECP_DP_SECP256R1 || leaf_root_anchor_pubkey == NULL || leaf_root_pubkey_len != 65) {
+        PrintAndLogEx(ERR, "LEAF Root CA certificate has unsupported public key");
+        return PM3_ECRYPTO;
+    }
+    uint8_t leaf_root_pubkey[65] = {0};
+    memcpy(leaf_root_pubkey, leaf_root_anchor_pubkey, sizeof(leaf_root_pubkey));
 
     if (!challenge_provided) {
         int res = pcrypto_rng_fill_oneshot(challenge, sizeof(challenge), "hf_mfdes_leaf");