Caliptra Debug Unlock Calculator

Compute debug unlock tokens for the Caliptra WASM emulator. Manufacturing mode uses a shared secret token; production mode uses a cryptographic challenge-response.

Manufacturing Debug Unlock

Send a 32-byte token via the MANUF_DEBUG_UNLOCK_REQ_TOKEN (0x4D445554) mailbox command. The ROM computes SHA-512 of the token and compares against the fuse value.

Default Token (Caliptra-only mode)

Used when running with default Fuses (non-subsystem mode).

Token (32 bytes hex):

SHA-512 Hash (stored in fuses, 64 bytes):

Mailbox Command Bytes (with checksum):

Default Token (Subsystem / MCU mode)

Used with OTP provisioning (DEFAULT_MANUF_DEBUG_UNLOCK_RAW_TOKEN from hw-model).

Token (32 bytes hex):

SHA-512 Hash:

Mailbox Command Bytes (with checksum):

Production Auth Debug Unlock

Two-step challenge-response flow using ECC P-384 + ML-DSA-87 signatures. The public key hash must be programmed into OTP fuses for the desired unlock level.

Step 1: Key Setup

Generate or import key pairs. The PK hash must match OTP fuses for the unlock level.

ECC P-384 Key Pair

Not generated

Public Key X (48 bytes): Public Key Y (48 bytes): Private Key D (48 bytes):

ML-DSA-87 Key Pair Loading library...

Not generated

Public Key (2592 bytes): Secret Key (4896 bytes) — paste to import:

Public Key Hash (SHA-384 of ECC pub key [hw format] || MLDSA pub key [hw format])

Program this 48-byte hash into OTP for the desired unlock level.

Generate both key pairs first

Step 2: Send Debug Unlock Request

Send PRODUCTION_AUTH_DEBUG_UNLOCK_REQ (0x50445552) to get a challenge.

Unlock Level (1–8):

Mailbox Command Bytes:

Step 3: Parse Challenge Response

Paste the hex response from PRODUCTION_AUTH_DEBUG_UNLOCK_REQ command.

Challenge Response Hex (88 bytes):

FIPS Status: Length (DWORDs): Unique Device Identifier (32 bytes): Challenge Nonce (48 bytes):

Step 4: Sign & Generate Token

Signs SHA-384(uid || level || reserved || challenge) with ECC, and SHA-512(uid || level || reserved || challenge) with MLDSA. Assembles the complete PRODUCTION_AUTH_DEBUG_UNLOCK_TOKEN (0x50445554) mailbox command.

Token Command Bytes (7504 bytes):

🔓 Debug Unlock Calculator