From 77188d969fafe609f00bd6390b3f33d34968b38b Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Mon, 12 Aug 2024 16:59:22 -0400
Subject: [PATCH 01/27] Initial VS Code debug config

---
 .vscode/launch.json             | 31 ++++++++++++++++++++++
 .vscode/tasks.json              | 20 ++++++++++++++
 runners/usbip/delayed-attach.sh | 47 +++++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+)
 create mode 100644 .vscode/launch.json
 create mode 100644 .vscode/tasks.json
 create mode 100644 runners/usbip/delayed-attach.sh

diff --git a/.vscode/launch.json b/.vscode/launch.json
new file mode 100644
index 00000000..e9ef10c0
--- /dev/null
+++ b/.vscode/launch.json
@@ -0,0 +1,31 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "lldb",
+            "request": "launch",
+            "name": "USB/IP Emulator",
+            "cargo": {
+                "args": [
+                    "build",
+                    "--features",
+                    "provisioner",
+                    "--bin=usbip-runner",
+                ],
+                "filter": {
+                    "kind": "bin",
+                }
+            },
+            "preLaunchTask": "DelayedUSBIPAttach",
+            "program": "${cargo:program}",
+            "args": [
+                "--ifs",
+                "${userHome}/nitrokey-usbip-ifs",
+            ],
+            "cwd": "${workspaceFolder}/runners/usbip",
+        }
+    ],
+}
\ No newline at end of file
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
new file mode 100644
index 00000000..e270ed88
--- /dev/null
+++ b/.vscode/tasks.json
@@ -0,0 +1,20 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            // This task waits for a few seconds before attaching
+            // the newly-created USB/IP adapter
+            "label": "DelayedUSBIPAttach",
+            "type": "shell",
+            "command": "sudo ${workspaceFolder}/runners/usbip/delayed-attach.sh",
+            "presentation": {
+                "echo": true,
+                "reveal": "always",
+                "focus": false,
+                "panel": "shared",
+                "showReuseMessage": true,
+                "clear": true
+            }
+        }
+    ]
+}
\ No newline at end of file
diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
new file mode 100644
index 00000000..bcb3abab
--- /dev/null
+++ b/runners/usbip/delayed-attach.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+SCRIPTPATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+
+function wait_and_attach() {
+    echo "PRELAUNCH TASK RUNNING!"
+    pushd "$1"
+
+    lsmod | grep vhci-hcd || sudo modprobe vhci-hcd
+
+    endtime=$(($(date +%s) + 10))
+    echo "$(date +%s) - $endtime"
+    while true; do
+        # Check if we've tried long enough and should time out
+        if [ $(date +%s) -gt $endtime ]; then
+            >&2 echo "Failed to find device before timeout"
+            return
+        fi
+        sleep 0.1
+        output=$(sudo usbip list -r "localhost" 2>&1)
+        retval=$?
+        if [ $retval -eq 0 ]; then
+            # The device is available! Now attach it.
+            sudo usbip attach -r "localhost" -b "1-1"
+            echo "Device attached!"
+            lsusb
+            return
+        elif [ $retval -eq 1 ]; then
+            # Couldn't find the port, so keep waiting
+            continue
+        else
+            # Some unexpected error, exit out
+            >&2 echo "$output"
+            return
+        fi
+    done
+}
+
+# Delete any existing output file
+sudo rm -f /tmp/DelayedUSBIPAttach
+
+FUNC=$(declare -f wait_and_attach)
+
+# Run the function as sudo (so it catches sudo login requirement here instead of in the backgroun process).
+# Direct all output to the output file so we can review it later if we like.
+# Run the command in the background.
+sudo bash -c "$FUNC; wait_and_attach \"$SCRIPTPATH\" 2>&1 | tee /tmp/DelayedUSBIPAttach &"

From 3bfa219b54720df2f8140984df507e370e7afaea Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Mon, 12 Aug 2024 17:03:56 -0400
Subject: [PATCH 02/27] Add verification of correct USB/IP attachment

---
 runners/usbip/delayed-attach.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
index bcb3abab..265dd38c 100644
--- a/runners/usbip/delayed-attach.sh
+++ b/runners/usbip/delayed-attach.sh
@@ -22,8 +22,12 @@ function wait_and_attach() {
         if [ $retval -eq 0 ]; then
             # The device is available! Now attach it.
             sudo usbip attach -r "localhost" -b "1-1"
-            echo "Device attached!"
-            lsusb
+            sudo usbip attach -r "localhost" -b "1-1"
+            if lsusb | grep -q "Clay Logic Nitrokey 3"; then
+                echo "Device attached!"
+            else
+                >&2 echo "Failed to attach device"
+            fi
             return
         elif [ $retval -eq 1 ]; then
             # Couldn't find the port, so keep waiting

From 7a1fb6e093eeef2fa00b64977bacd0e37e6d22d8 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Wed, 21 Aug 2024 16:11:39 +0000
Subject: [PATCH 03/27] Add execution permissions to delayed-attach

---
 runners/usbip/delayed-attach.sh | 1 -
 1 file changed, 1 deletion(-)
 mode change 100644 => 100755 runners/usbip/delayed-attach.sh

diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
old mode 100644
new mode 100755
index 265dd38c..0308cffd
--- a/runners/usbip/delayed-attach.sh
+++ b/runners/usbip/delayed-attach.sh
@@ -3,7 +3,6 @@
 SCRIPTPATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
 function wait_and_attach() {
-    echo "PRELAUNCH TASK RUNNING!"
     pushd "$1"
 
     lsmod | grep vhci-hcd || sudo modprobe vhci-hcd

From 1ec96049aabb04ca40258780dbd7a0098552166a Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Thu, 22 Aug 2024 02:48:36 +0000
Subject: [PATCH 04/27] Update debugging USB/IP attachment script

---
 .vscode/tasks.json              |  30 +++++++--
 runners/usbip/delayed-attach.sh | 107 ++++++++++++++++++++------------
 2 files changed, 93 insertions(+), 44 deletions(-)

diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index e270ed88..133cd11a 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -6,7 +6,11 @@
             // the newly-created USB/IP adapter
             "label": "DelayedUSBIPAttach",
             "type": "shell",
-            "command": "sudo ${workspaceFolder}/runners/usbip/delayed-attach.sh",
+            "command": "sudo",
+            "args": [
+                "${workspaceFolder}/runners/usbip/delayed-attach.sh"
+            ],
+            "isBackground": true,
             "presentation": {
                 "echo": true,
                 "reveal": "always",
@@ -14,7 +18,25 @@
                 "panel": "shared",
                 "showReuseMessage": true,
                 "clear": true
-            }
-        }
-    ]
+            },
+            // All this is needed so VSCode just lets this task run in the background.
+            "problemMatcher": [
+                {
+                    "pattern": [
+                        {
+                            "regexp": ".",
+                            "file": 1,
+                            "location": 2,
+                            "message": 3
+                        }
+                    ],
+                    "background": {
+                        "activeOnStart": true,
+                        "beginsPattern": ".",
+                        "endsPattern": ".",
+                    }
+                }
+            ],
+        },
+    ],
 }
\ No newline at end of file
diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
index 0308cffd..07718676 100755
--- a/runners/usbip/delayed-attach.sh
+++ b/runners/usbip/delayed-attach.sh
@@ -1,50 +1,77 @@
 #!/bin/bash
 
-SCRIPTPATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+# This script waits for the USB/IP device to be available, then attaches it.
+# It is designed to be used as a pre-launch task in a debugger, so that
+# the device is automatically mounted each time the debugger starts.
 
-function wait_and_attach() {
-    pushd "$1"
+set -e
+set -u
+total_timeout=30
+usbip_timeout=1
+attach_timeout=10
+device_name="Clay Logic Nitrokey 3"
 
-    lsmod | grep vhci-hcd || sudo modprobe vhci-hcd
+endtime=$(($(date +%s) + $total_timeout))
 
-    endtime=$(($(date +%s) + 10))
-    echo "$(date +%s) - $endtime"
-    while true; do
-        # Check if we've tried long enough and should time out
-        if [ $(date +%s) -gt $endtime ]; then
-            >&2 echo "Failed to find device before timeout"
-            return
-        fi
-        sleep 0.1
-        output=$(sudo usbip list -r "localhost" 2>&1)
-        retval=$?
-        if [ $retval -eq 0 ]; then
-            # The device is available! Now attach it.
-            sudo usbip attach -r "localhost" -b "1-1"
-            sudo usbip attach -r "localhost" -b "1-1"
-            if lsusb | grep -q "Clay Logic Nitrokey 3"; then
-                echo "Device attached!"
-            else
-                >&2 echo "Failed to attach device"
-            fi
-            return
-        elif [ $retval -eq 1 ]; then
-            # Couldn't find the port, so keep waiting
-            continue
+
+echo "Waiting for USB/IP device to be available..."
+
+# Check if we've tried long enough and should time out
+while [ $(date +%s) -le $endtime ]; do
+
+    sleep 0.1
+
+    set +e
+    # Get the list of usbip devices, with a timeout.
+    output=$(timeout -k $usbip_timeout $usbip_timeout sudo usbip list -r "localhost" 2>&1)
+    retval=$?
+    set -e
+
+    if [ $retval -eq 124 ] || [ $retval -eq 137 ]; then
+        echo "usbip list timed out"
+        # The command timed out, which means it's probably already been attached.
+        # Check to confirm.
+        if lsusb | grep -q "$device_name"; then
+            echo "Device attached!"
+            exit 0
         else
-            # Some unexpected error, exit out
-            >&2 echo "$output"
-            return
+            >&2 echo "Failed to attach device"
         fi
-    done
-}
 
-# Delete any existing output file
-sudo rm -f /tmp/DelayedUSBIPAttach
+    elif [ $retval -eq 0 ]; then
+        echo "Attaching..."
+        # The device is available! Now attach it.
+        
+        set +e
+        sudo usbip list -r "localhost"
+        sudo usbip attach -r "localhost" -b "1-1"
+        sudo usbip attach -r "localhost" -b "1-1"
+        set -e
+
+        sleep 4
+
+        # Check if it's been attached
+        if lsusb | grep -q "$device_name"; then
+            echo "Device attached!"
+            lsusb | grep "$device_name"
+            exit 0
+        fi
+
+        # It didn't attach. For some reason, we sometimes have
+        # to run this command multiple times for it to work,
+        # so start the loop again.
+        continue
+
+    elif [ $retval -eq 1 ]; then
+        # Couldn't find the port, so keep waiting
+        continue
 
-FUNC=$(declare -f wait_and_attach)
+    else
+        # Some unexpected error, exit out
+        >&2 echo "$output"
+        exit $retval
+    fi
+done
 
-# Run the function as sudo (so it catches sudo login requirement here instead of in the backgroun process).
-# Direct all output to the output file so we can review it later if we like.
-# Run the command in the background.
-sudo bash -c "$FUNC; wait_and_attach \"$SCRIPTPATH\" 2>&1 | tee /tmp/DelayedUSBIPAttach &"
+>&2 echo "Failed to find device before timeout"
+exit 1

From a82e47ced188c989d43fa13d11bdbc68c3a0f863 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Thu, 22 Aug 2024 02:58:44 +0000
Subject: [PATCH 05/27] Fix for delayed USB/IP attachment

---
 runners/usbip/delayed-attach.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
index 07718676..a3f184b3 100755
--- a/runners/usbip/delayed-attach.sh
+++ b/runners/usbip/delayed-attach.sh
@@ -8,7 +8,7 @@ set -e
 set -u
 total_timeout=30
 usbip_timeout=1
-attach_timeout=10
+attach_delay=5
 device_name="Clay Logic Nitrokey 3"
 
 endtime=$(($(date +%s) + $total_timeout))
@@ -48,7 +48,7 @@ while [ $(date +%s) -le $endtime ]; do
         sudo usbip attach -r "localhost" -b "1-1"
         set -e
 
-        sleep 4
+        sleep $attach_delay
 
         # Check if it's been attached
         if lsusb | grep -q "$device_name"; then

From 885d4e6886fd1ed80e791f22398e5c043e101676 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Fri, 27 Sep 2024 21:09:40 +0000
Subject: [PATCH 06/27] Add PQC backend

---
 .vscode/launch.json             | 31 ------------------------
 .vscode/tasks.json              | 42 ---------------------------------
 components/apps/Cargo.toml      |  8 +++++++
 components/apps/src/dispatch.rs | 11 +++++++++
 components/apps/src/lib.rs      | 11 +++++++++
 5 files changed, 30 insertions(+), 73 deletions(-)
 delete mode 100644 .vscode/launch.json
 delete mode 100644 .vscode/tasks.json

diff --git a/.vscode/launch.json b/.vscode/launch.json
deleted file mode 100644
index e9ef10c0..00000000
--- a/.vscode/launch.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-    // Use IntelliSense to learn about possible attributes.
-    // Hover to view descriptions of existing attributes.
-    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
-    "version": "0.2.0",
-    "configurations": [
-        {
-            "type": "lldb",
-            "request": "launch",
-            "name": "USB/IP Emulator",
-            "cargo": {
-                "args": [
-                    "build",
-                    "--features",
-                    "provisioner",
-                    "--bin=usbip-runner",
-                ],
-                "filter": {
-                    "kind": "bin",
-                }
-            },
-            "preLaunchTask": "DelayedUSBIPAttach",
-            "program": "${cargo:program}",
-            "args": [
-                "--ifs",
-                "${userHome}/nitrokey-usbip-ifs",
-            ],
-            "cwd": "${workspaceFolder}/runners/usbip",
-        }
-    ],
-}
\ No newline at end of file
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
deleted file mode 100644
index 133cd11a..00000000
--- a/.vscode/tasks.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-    "version": "2.0.0",
-    "tasks": [
-        {
-            // This task waits for a few seconds before attaching
-            // the newly-created USB/IP adapter
-            "label": "DelayedUSBIPAttach",
-            "type": "shell",
-            "command": "sudo",
-            "args": [
-                "${workspaceFolder}/runners/usbip/delayed-attach.sh"
-            ],
-            "isBackground": true,
-            "presentation": {
-                "echo": true,
-                "reveal": "always",
-                "focus": false,
-                "panel": "shared",
-                "showReuseMessage": true,
-                "clear": true
-            },
-            // All this is needed so VSCode just lets this task run in the background.
-            "problemMatcher": [
-                {
-                    "pattern": [
-                        {
-                            "regexp": ".",
-                            "file": 1,
-                            "location": 2,
-                            "message": 3
-                        }
-                    ],
-                    "background": {
-                        "activeOnStart": true,
-                        "beginsPattern": ".",
-                        "endsPattern": ".",
-                    }
-                }
-            ],
-        },
-    ],
-}
\ No newline at end of file
diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index 114c3e60..ad8c882c 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -25,6 +25,7 @@ trussed-auth = { version = "0.3.0", optional = true }
 trussed-rsa-alloc = { version = "0.2.0", optional = true }
 trussed-se050-backend = { version = "0.3.6", optional = true }
 trussed-staging = { version = "0.3.2", features = ["wrap-key-to-file", "chunked", "hkdf", "manage", "fs-info"] }
+trussed-pqc-backend = { version = "0.1.0", optional = true }
 
 # Extensions
 trussed-chunked = "0.1.0"
@@ -77,6 +78,13 @@ se050 = ["dep:se05x", "trussed-se050-backend", "trussed-se050-manage", "admin-ap
 backend-auth = ["trussed-auth"]
 backend-rsa = ["trussed-rsa-alloc"]
 backend-software-hpke = ["trussed-staging/hpke"]
+# If any of the PQC algorithms are selected for compilation, then the
+# PQC backend must be included and the corresponding algorithm features
+# there must be set.
+backend-dilithium = ["dep:trussed-pqc-backend"]
+backend-dilithium2 = ["backend-dilithium", "trussed-pqc-backend/dilithium2"]
+backend-dilithium3 = ["backend-dilithium", "trussed-pqc-backend/dilithium3"]
+backend-dilithium5 = ["backend-dilithium", "trussed-pqc-backend/dilithium5"]
 
 log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 
diff --git a/components/apps/src/dispatch.rs b/components/apps/src/dispatch.rs
index 0b62d83e..c519ffab 100644
--- a/components/apps/src/dispatch.rs
+++ b/components/apps/src/dispatch.rs
@@ -36,6 +36,9 @@ use trussed_auth::{AuthBackend, AuthContext, AuthExtension, MAX_HW_KEY_LEN};
 #[cfg(feature = "backend-rsa")]
 use trussed_rsa_alloc::SoftwareRsa;
 
+#[cfg(feature = "backend-dilithium")]
+use trussed_pqc_backend::SoftwareDilithium;
+
 use trussed_chunked::ChunkedExtension;
 use trussed_fs_info::FsInfoExtension;
 use trussed_hkdf::HkdfExtension;
@@ -232,6 +235,10 @@ impl<T: Twi, D: Delay> ExtensionDispatch for Dispatch<T, D> {
             Backend::HmacSha256P256 => Err(TrussedError::RequestNotAvailable),
             #[cfg(feature = "backend-rsa")]
             Backend::SoftwareRsa => SoftwareRsa.request(&mut ctx.core, &mut (), request, resources),
+            #[cfg(feature = "backend-dilithium")]
+            Backend::SoftwareDilithium => {
+                SoftwareDilithium.request(&mut ctx.core, &mut (), request, resources)
+            }
             Backend::Staging => {
                 self.staging
                     .request(&mut ctx.core, &mut ctx.backends.staging, request, resources)
@@ -281,6 +288,8 @@ impl<T: Twi, D: Delay> ExtensionDispatch for Dispatch<T, D> {
             },
             #[cfg(feature = "backend-rsa")]
             Backend::SoftwareRsa => Err(TrussedError::RequestNotAvailable),
+            #[cfg(feature = "backend-dilithium")]
+            Backend::SoftwareDilithium => Err(TrussedError::RequestNotAvailable),
             Backend::Staging => match extension {
                 Extension::Chunked => {
                     ExtensionImpl::<ChunkedExtension>::extension_request_serialized(
@@ -410,6 +419,8 @@ pub enum Backend {
     HmacSha256P256,
     #[cfg(feature = "backend-rsa")]
     SoftwareRsa,
+    #[cfg(feature = "backend-dilithium")]
+    SoftwareDilithium,
     Staging,
     /// Separate BackendId to prevent non-priviledged apps from accessing the manage Extension
     StagingManage,
diff --git a/components/apps/src/lib.rs b/components/apps/src/lib.rs
index d75eb52e..827e35df 100644
--- a/components/apps/src/lib.rs
+++ b/components/apps/src/lib.rs
@@ -217,7 +217,10 @@ pub struct OpcardConfig {
 impl OpcardConfig {
     fn backends(&self) -> &'static [BackendId<Backend>] {
         const BACKENDS_OPCARD_DEFAULT: &[BackendId<Backend>] = &[
+            #[cfg(feature = "backend-rsa")]
             BackendId::Custom(Backend::SoftwareRsa),
+            #[cfg(feature = "backend-dilithium")]
+            BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Auth),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
@@ -1004,7 +1007,10 @@ impl<R: Runner> App<R> for WebcryptApp<R> {
     }
     fn backends(runner: &R, _: &()) -> &'static [BackendId<Backend>] {
         const BACKENDS_WEBCRYPT: &[BackendId<Backend>] = &[
+            #[cfg(feature = "backend-rsa")]
             BackendId::Custom(Backend::SoftwareRsa),
+            #[cfg(feature = "backend-dilithium")]
+            BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Staging),
             BackendId::Custom(Backend::Auth),
             BackendId::Core,
@@ -1134,6 +1140,11 @@ impl<R: Runner> App<R> for PivApp<R> {
         const BACKENDS_PIV: &[BackendId<Backend>] = &[
             #[cfg(feature = "se050")]
             BackendId::Custom(Backend::Se050),
+            #[cfg(feature = "backend-rsa")]
+            BackendId::Custom(Backend::SoftwareRsa),
+            #[cfg(feature = "backend-dilithium")]
+            BackendId::Custom(Backend::SoftwareDilithium),
+            BackendId::Custom(Backend::Auth),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
         ];

From a6b27413e28013c0f4b669d96ff8a63f3305f233 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Fri, 27 Sep 2024 21:10:15 +0000
Subject: [PATCH 07/27] Ignore VSCode config files

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 8fc76fb5..ca11a963 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,5 @@ utils/nrf-builder/provisioner-nk3am-nrf52-1.2.2.bin
 utils/nrf-builder/provisioner-nk3am-nrf52-1.2.2.hex
 utils/nrf-builder/provisioner-nk3am-nrf52-1.2.2.zip
 utils/nrf-builder/test-certs/
+
+.vscode/
\ No newline at end of file

From 84c9a7eeb09f31cc5194a155d19497ac1dfb7e58 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Fri, 27 Sep 2024 21:22:22 +0000
Subject: [PATCH 08/27] Fix SoftwareDilithium inclusion

---
 components/apps/src/lib.rs | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/components/apps/src/lib.rs b/components/apps/src/lib.rs
index 827e35df..86508706 100644
--- a/components/apps/src/lib.rs
+++ b/components/apps/src/lib.rs
@@ -217,10 +217,7 @@ pub struct OpcardConfig {
 impl OpcardConfig {
     fn backends(&self) -> &'static [BackendId<Backend>] {
         const BACKENDS_OPCARD_DEFAULT: &[BackendId<Backend>] = &[
-            #[cfg(feature = "backend-rsa")]
             BackendId::Custom(Backend::SoftwareRsa),
-            #[cfg(feature = "backend-dilithium")]
-            BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Auth),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
@@ -983,7 +980,12 @@ impl<R: Runner> App<R> for FidoApp<R> {
     }
 
     fn backends(_runner: &R, _config: &Self::Config) -> &'static [BackendId<Backend>] {
-        &[BackendId::Custom(Backend::Staging), BackendId::Core]
+        &[
+            BackendId::Custom(Backend::Staging),
+            BackendId::Core,
+            #[cfg(feature = "backend-dilithium")]
+            BackendId::Custom(Backend::SoftwareDilithium),
+        ]
     }
 }
 
@@ -1007,10 +1009,7 @@ impl<R: Runner> App<R> for WebcryptApp<R> {
     }
     fn backends(runner: &R, _: &()) -> &'static [BackendId<Backend>] {
         const BACKENDS_WEBCRYPT: &[BackendId<Backend>] = &[
-            #[cfg(feature = "backend-rsa")]
             BackendId::Custom(Backend::SoftwareRsa),
-            #[cfg(feature = "backend-dilithium")]
-            BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Staging),
             BackendId::Custom(Backend::Auth),
             BackendId::Core,
@@ -1142,8 +1141,6 @@ impl<R: Runner> App<R> for PivApp<R> {
             BackendId::Custom(Backend::Se050),
             #[cfg(feature = "backend-rsa")]
             BackendId::Custom(Backend::SoftwareRsa),
-            #[cfg(feature = "backend-dilithium")]
-            BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Auth),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,

From 39c183362a6d7252c04a9d9e41eeda008ac4442d Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Mon, 30 Sep 2024 13:03:08 -0400
Subject: [PATCH 09/27] Re-order backends

Co-authored-by: sosthene-nitrokey <109070476+sosthene-nitrokey@users.noreply.github.com>
---
 components/apps/src/lib.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/components/apps/src/lib.rs b/components/apps/src/lib.rs
index 86508706..067d08a7 100644
--- a/components/apps/src/lib.rs
+++ b/components/apps/src/lib.rs
@@ -981,10 +981,10 @@ impl<R: Runner> App<R> for FidoApp<R> {
 
     fn backends(_runner: &R, _config: &Self::Config) -> &'static [BackendId<Backend>] {
         &[
+             #[cfg(feature = "backend-dilithium")]
+            BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
-            #[cfg(feature = "backend-dilithium")]
-            BackendId::Custom(Backend::SoftwareDilithium),
         ]
     }
 }

From 52509dc5cacc7ed0c9bc356eaa375a4527cbeaed Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Tue, 1 Oct 2024 03:20:37 +0000
Subject: [PATCH 10/27] Rename features; use local copies of dependencies

---
 components/apps/Cargo.toml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index ad8c882c..8c572f75 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -81,10 +81,10 @@ backend-software-hpke = ["trussed-staging/hpke"]
 # If any of the PQC algorithms are selected for compilation, then the
 # PQC backend must be included and the corresponding algorithm features
 # there must be set.
-backend-dilithium = ["dep:trussed-pqc-backend"]
-backend-dilithium2 = ["backend-dilithium", "trussed-pqc-backend/dilithium2"]
-backend-dilithium3 = ["backend-dilithium", "trussed-pqc-backend/dilithium3"]
-backend-dilithium5 = ["backend-dilithium", "trussed-pqc-backend/dilithium5"]
+backend-pqc = ["dep:trussed-pqc-backend"]
+backend-dilithium2 = ["backend-pqc", "trussed-pqc-backend/dilithium2", "fido-authenticator/backend-dilithium2"]
+backend-dilithium3 = ["backend-pqc", "trussed-pqc-backend/dilithium3", "fido-authenticator/backend-dilithium3"]
+backend-dilithium5 = ["backend-pqc", "trussed-pqc-backend/dilithium5", "fido-authenticator/backend-dilithium5"]
 
 log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 

From 1ed296ae5ed089b22a409de7c5cd1f1df2a4d11a Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Sun, 27 Oct 2024 22:11:48 +0000
Subject: [PATCH 11/27] Add features to USB emulator

---
 Cargo.lock                      | 1 -
 runners/usbip/Cargo.toml        | 5 +++++
 runners/usbip/delayed-attach.sh | 6 ++++--
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b1de7e3d..d818ae3b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3280,7 +3280,6 @@ dependencies = [
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
-source = "git+https://github.com/trussed-dev/trussed-rsa-backend.git?tag=v0.2.1#655eca355df59e85a9f1d803623bc2efa10a8b5a"
 dependencies = [
  "delog",
  "heapless-bytes",
diff --git a/runners/usbip/Cargo.toml b/runners/usbip/Cargo.toml
index 4ffab7e1..8b4e1912 100644
--- a/runners/usbip/Cargo.toml
+++ b/runners/usbip/Cargo.toml
@@ -26,3 +26,8 @@ utils = { path = "../../components/utils", features = ["build"] }
 test = ["apps/nk3-test"]
 provisioner = ["apps/nk3-provisioner"]
 ccid = ["apps/trussed-usbip-ccid", "trussed-usbip/ccid"]
+
+# PQC
+backend-dilithium2 = ["apps/backend-dilithium2"]
+backend-dilithium3 = ["apps/backend-dilithium3"]
+backend-dilithium5 = ["apps/backend-dilithium5"]
\ No newline at end of file
diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
index a3f184b3..82b0097e 100755
--- a/runners/usbip/delayed-attach.sh
+++ b/runners/usbip/delayed-attach.sh
@@ -51,9 +51,11 @@ while [ $(date +%s) -le $endtime ]; do
         sleep $attach_delay
 
         # Check if it's been attached
-        if lsusb | grep -q "$device_name"; then
+        if lsusb | tee /dev/tty | grep -q "$device_name"; then
             echo "Device attached!"
-            lsusb | grep "$device_name"
+            while true; do
+                sleep 100
+            done
             exit 0
         fi
 

From 44a9fbd5ea4d60afaadb4e94b9f7da53b2b2fc59 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Sun, 27 Oct 2024 23:20:46 +0000
Subject: [PATCH 12/27] Add VS Code configs

---
 .gitignore          |  2 --
 .vscode/launch.json | 33 +++++++++++++++++++++++++++++++++
 .vscode/tasks.json  | 42 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 75 insertions(+), 2 deletions(-)
 create mode 100644 .vscode/launch.json
 create mode 100644 .vscode/tasks.json

diff --git a/.gitignore b/.gitignore
index ca11a963..8fc76fb5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,5 +46,3 @@ utils/nrf-builder/provisioner-nk3am-nrf52-1.2.2.bin
 utils/nrf-builder/provisioner-nk3am-nrf52-1.2.2.hex
 utils/nrf-builder/provisioner-nk3am-nrf52-1.2.2.zip
 utils/nrf-builder/test-certs/
-
-.vscode/
\ No newline at end of file
diff --git a/.vscode/launch.json b/.vscode/launch.json
new file mode 100644
index 00000000..a27a1cb9
--- /dev/null
+++ b/.vscode/launch.json
@@ -0,0 +1,33 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "lldb",
+            "request": "launch",
+            "name": "USB/IP Emulator",
+            "cargo": {
+                "args": [
+                    "build",
+                    "--features",
+                    "provisioner,backend-dilithium2,backend-dilithium3,backend-dilithium5",
+                    "--bin=usbip-runner",
+                ],
+                "filter": {
+                    "kind": "bin",
+                }
+            },
+            "preLaunchTask": "DelayedUSBIPAttach",
+            "program": "${cargo:program}",
+            "args": [
+                // "--ifs",
+                // "${userHome}/nitrokey-usbip-ifs",
+                "--user-presence",
+                "interactive"
+            ],
+            "cwd": "${workspaceFolder}/runners/usbip",
+        }
+    ],
+}
\ No newline at end of file
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
new file mode 100644
index 00000000..133cd11a
--- /dev/null
+++ b/.vscode/tasks.json
@@ -0,0 +1,42 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            // This task waits for a few seconds before attaching
+            // the newly-created USB/IP adapter
+            "label": "DelayedUSBIPAttach",
+            "type": "shell",
+            "command": "sudo",
+            "args": [
+                "${workspaceFolder}/runners/usbip/delayed-attach.sh"
+            ],
+            "isBackground": true,
+            "presentation": {
+                "echo": true,
+                "reveal": "always",
+                "focus": false,
+                "panel": "shared",
+                "showReuseMessage": true,
+                "clear": true
+            },
+            // All this is needed so VSCode just lets this task run in the background.
+            "problemMatcher": [
+                {
+                    "pattern": [
+                        {
+                            "regexp": ".",
+                            "file": 1,
+                            "location": 2,
+                            "message": 3
+                        }
+                    ],
+                    "background": {
+                        "activeOnStart": true,
+                        "beginsPattern": ".",
+                        "endsPattern": ".",
+                    }
+                }
+            ],
+        },
+    ],
+}
\ No newline at end of file

From 1fbec4c54b492d7390d5223ec4ab2ec78ef4c848 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Sun, 27 Oct 2024 22:44:18 -0400
Subject: [PATCH 13/27] Fix feature name; use local copies for testing

---
 Cargo.lock                 | 203 ++++++++++++++++++++++++++++++++-----
 Cargo.toml                 |  11 +-
 components/apps/Cargo.toml |   8 +-
 3 files changed, 191 insertions(+), 31 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d818ae3b..d9673f72 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -194,6 +194,7 @@ dependencies = [
  "trussed-hkdf",
  "trussed-hpke",
  "trussed-manage",
+ "trussed-pqc-backend",
  "trussed-rsa-alloc",
  "trussed-se050-backend",
  "trussed-se050-manage",
@@ -318,7 +319,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -522,6 +523,11 @@ name = "cc"
 version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "066fce287b1d4eafef758e89e09d724a24808a9196fe9756b8ca90e86d0719a2"
+dependencies = [
+ "jobserver",
+ "libc",
+ "once_cell",
+]
 
 [[package]]
 name = "cexpr"
@@ -645,7 +651,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -787,11 +793,12 @@ dependencies = [
 [[package]]
 name = "cosey"
 version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39323fe531b92e7acad90b8550b58cec63d29a6c5a56e02de4b25b6aeedbf82e"
 dependencies = [
+ "cfg-if",
  "heapless-bytes",
+ "pqcrypto-dilithium",
  "serde",
+ "serde-big-array",
  "serde_repr",
 ]
 
@@ -878,8 +885,6 @@ dependencies = [
 [[package]]
 name = "ctap-types"
 version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1beeb5a05e42c7cbfb788ce3e9fd6ce7d0aa214893b5ca6cd38d09ac9afe722"
 dependencies = [
  "bitflags 1.3.2",
  "cbor-smol",
@@ -963,7 +968,7 @@ checksum = "5fe87ce4529967e0ba1dcf8450bab64d97dfd5010a6256187ffe2e43e6f0e049"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -1006,6 +1011,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "ecdsa"
 version = "0.16.9"
@@ -1180,7 +1191,6 @@ dependencies = [
 [[package]]
 name = "fido-authenticator"
 version = "0.1.1"
-source = "git+https://github.com/Nitrokey/fido-authenticator.git?tag=v0.1.1-nitrokey.23#5b6ae97b5f92962b545a1af1bf5b69fee66bca0a"
 dependencies = [
  "apdu-app",
  "cbor-smol",
@@ -1680,6 +1690,15 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.69"
@@ -2310,6 +2329,117 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
+[[package]]
+name = "pqcrypto"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ac15ee741fa95113ea76e7b08ce966e55c7e725621119ec1a59cf88a96e94b4"
+dependencies = [
+ "pqcrypto-classicmceliece",
+ "pqcrypto-dilithium",
+ "pqcrypto-falcon",
+ "pqcrypto-hqc",
+ "pqcrypto-kyber",
+ "pqcrypto-sphincsplus",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-classicmceliece"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020d75adba68e21bcd1a6268a7145bff549fe7559e75a122e19f6f00bfb896d7"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-dilithium"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "685de0fa68c6786559d5fcdaa414f0cd68ef3f5d162f61823bd7424cd276726f"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-falcon"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35d1d53b8392f416aa11943f83c0372d88090d9c236b21a7f19352e61542119d"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-hqc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e945bdfba5a47894067969abaa04d773c8dae56d1f33efa93fc5b84636b85bf"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-internals"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10cdd9eee50fe65bbd4f40211f1a492f1ee52e97a51100950b6f1fa319ab7cd"
+dependencies = [
+ "cc",
+ "dunce",
+ "getrandom",
+ "libc",
+]
+
+[[package]]
+name = "pqcrypto-kyber"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15c00293cf898859d0c771455388054fd69ab712263c73fdc7f287a39b1ba000"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-sphincsplus"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82ea17a14b7623f262460f07e2773ae62b25c65e935db87581addd60cc9316c3"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-traits"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94e851c7654eed9e68d7d27164c454961a616cf8c203d500607ef22c737b51bb"
+
 [[package]]
 name = "pretty_env_logger"
 version = "0.5.0"
@@ -2703,13 +2833,22 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.204"
+version = "1.0.213"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
+checksum = "3ea7893ff5e2466df8d720bb615088341b295f849602c6956047f8f80f0e9bc1"
 dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "serde-big-array"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11fc7cc2c76d73e0f27ee52abbd64eec84d46f370c88371120433196934e4b7f"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde-byte-array"
 version = "0.1.2"
@@ -2727,7 +2866,7 @@ checksum = "fca2da10b1f1623f47130256065e05e94fd7a98dbd26a780a4c5de831b21e5c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -2741,13 +2880,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.204"
+version = "1.0.213"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
+checksum = "7e85ad2009c50b58e87caa8cd6dac16bdf511bbfb7af6c33df902396aa480fa5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -2769,7 +2908,7 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -2962,7 +3101,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -2984,9 +3123,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.69"
+version = "2.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "201fcda3845c23e8212cd466bfebf0bd20694490fc0356ae8e428e0824a915a6"
+checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3042,7 +3181,7 @@ checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -3132,7 +3271,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -3177,7 +3316,6 @@ dependencies = [
 [[package]]
 name = "trussed"
 version = "0.1.0"
-source = "git+https://github.com/nitrokey/trussed.git?tag=v0.1.0-nitrokey.23#92dd7f010e61ba17895d7844ea31b8f288e308b8"
 dependencies = [
  "aes",
  "bitflags 2.6.0",
@@ -3202,6 +3340,7 @@ dependencies = [
  "nb 1.1.0",
  "p256-cortex-m4",
  "postcard 0.7.3",
+ "pqcrypto-dilithium",
  "rand_chacha",
  "rand_core",
  "salty",
@@ -3277,9 +3416,23 @@ dependencies = [
  "trussed",
 ]
 
+[[package]]
+name = "trussed-pqc-backend"
+version = "0.1.0"
+dependencies = [
+ "der",
+ "pkcs8",
+ "pqcrypto",
+ "pqcrypto-dilithium",
+ "serde",
+ "serde-big-array",
+ "trussed",
+]
+
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
+source = "git+https://github.com/trussed-dev/trussed-rsa-backend.git?tag=v0.2.1#655eca355df59e85a9f1d803623bc2efa10a8b5a"
 dependencies = [
  "delog",
  "heapless-bytes",
@@ -3404,7 +3557,7 @@ checksum = "560b82d656506509d43abe30e0ba64c56b1953ab3d4fe7ba5902747a7a3cedd5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
 
 [[package]]
@@ -3647,7 +3800,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
  "wasm-bindgen-shared",
 ]
 
@@ -3669,7 +3822,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3909,5 +4062,5 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.69",
+ "syn 2.0.85",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index af4a1f22..3e3df1b4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,8 +18,8 @@ memory-regions = { path = "components/memory-regions" }
 
 # forked
 admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.18" }
-fido-authenticator = { git = "https://github.com/Nitrokey/fido-authenticator.git", tag = "v0.1.1-nitrokey.23" }
-trussed = { git = "https://github.com/nitrokey/trussed.git", tag = "v0.1.0-nitrokey.23" }
+#fido-authenticator = { git = "https://github.com/Nitrokey/fido-authenticator.git", tag = "v0.1.1-nitrokey.23" }
+#trussed = { git = "https://github.com/nitrokey/trussed.git", tag = "v0.1.0-nitrokey.23" }
 
 # unreleased upstream changes
 ctaphid-dispatch = { git = "https://github.com/Nitrokey/ctaphid-dispatch.git", tag = "v0.1.1-nitrokey.3" }
@@ -45,6 +45,13 @@ trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner.git", tag =
 trussed-se050-manage = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", tag = "se050-manage-v0.1.0" }
 trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", rev = "f4ff60b8aa0f322a424613165f66ed9112c7a94f" }
 
+trussed-pqc-backend = { path = "../trussed-pqc-backend" }
+trussed = { path = "../trussed" }
+fido-authenticator = { path = "../fido-authenticator" }
+ctap-types = { path = "../ctap-types" }
+cosey = { path = "../cosey" }
+trussed-rsa-backend = { path = "../trussed-rsa-backend" }
+
 [profile.release]
 codegen-units = 1
 lto = "fat"
diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index 8c572f75..ef9530cd 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -81,10 +81,10 @@ backend-software-hpke = ["trussed-staging/hpke"]
 # If any of the PQC algorithms are selected for compilation, then the
 # PQC backend must be included and the corresponding algorithm features
 # there must be set.
-backend-pqc = ["dep:trussed-pqc-backend"]
-backend-dilithium2 = ["backend-pqc", "trussed-pqc-backend/dilithium2", "fido-authenticator/backend-dilithium2"]
-backend-dilithium3 = ["backend-pqc", "trussed-pqc-backend/dilithium3", "fido-authenticator/backend-dilithium3"]
-backend-dilithium5 = ["backend-pqc", "trussed-pqc-backend/dilithium5", "fido-authenticator/backend-dilithium5"]
+backend-dilithium = ["dep:trussed-pqc-backend"]
+backend-dilithium2 = ["backend-dilithium", "trussed-pqc-backend/dilithium2", "fido-authenticator/backend-dilithium2"]
+backend-dilithium3 = ["backend-dilithium", "trussed-pqc-backend/dilithium3", "fido-authenticator/backend-dilithium3"]
+backend-dilithium5 = ["backend-dilithium", "trussed-pqc-backend/dilithium5", "fido-authenticator/backend-dilithium5"]
 
 log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 

From 4f348c909b1a1149951c3b5cb5de7c87af5081cf Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Sun, 27 Oct 2024 22:51:08 -0400
Subject: [PATCH 14/27] Fix RSA backend patch

---
 Cargo.lock | 1 -
 Cargo.toml | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d9673f72..4c71d98a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3432,7 +3432,6 @@ dependencies = [
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
-source = "git+https://github.com/trussed-dev/trussed-rsa-backend.git?tag=v0.2.1#655eca355df59e85a9f1d803623bc2efa10a8b5a"
 dependencies = [
  "delog",
  "heapless-bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 3e3df1b4..e826890e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -40,7 +40,7 @@ trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git",
 trussed-auth = { git = "https://github.com/trussed-dev/trussed-auth", rev = "c030b82ad3441f337af09afe3a69e8a6da5785ea" }
 trussed-hkdf = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "hkdf-v0.2.0" }
 trussed-hpke = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "hpke-v0.1.0" }
-trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", tag = "v0.2.1" }
+#trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", tag = "v0.2.1" }
 trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner.git", tag = "v0.0.1-nitrokey.5" }
 trussed-se050-manage = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", tag = "se050-manage-v0.1.0" }
 trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", rev = "f4ff60b8aa0f322a424613165f66ed9112c7a94f" }
@@ -50,7 +50,7 @@ trussed = { path = "../trussed" }
 fido-authenticator = { path = "../fido-authenticator" }
 ctap-types = { path = "../ctap-types" }
 cosey = { path = "../cosey" }
-trussed-rsa-backend = { path = "../trussed-rsa-backend" }
+trussed-rsa-alloc = { path = "../trussed-rsa-backend" }
 
 [profile.release]
 codegen-units = 1

From 42eae887bf0213dbae5e26169a39e42b6af0e3cd Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Mon, 28 Oct 2024 00:21:59 -0400
Subject: [PATCH 15/27] Fix attachment script

---
 .vscode/launch.json             | 5 ++++-
 runners/usbip/delayed-attach.sh | 3 ---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index a27a1cb9..4ffeba02 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -27,7 +27,10 @@
                 "--user-presence",
                 "interactive"
             ],
+            "env": {
+                "RUST_BACKTRACE": "1",
+            },
             "cwd": "${workspaceFolder}/runners/usbip",
-        }
+        },
     ],
 }
\ No newline at end of file
diff --git a/runners/usbip/delayed-attach.sh b/runners/usbip/delayed-attach.sh
index 82b0097e..de71a9be 100755
--- a/runners/usbip/delayed-attach.sh
+++ b/runners/usbip/delayed-attach.sh
@@ -53,9 +53,6 @@ while [ $(date +%s) -le $endtime ]; do
         # Check if it's been attached
         if lsusb | tee /dev/tty | grep -q "$device_name"; then
             echo "Device attached!"
-            while true; do
-                sleep 100
-            done
             exit 0
         fi
 

From 799040335887584e476e5c0d2f333eabac1463d2 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Mon, 28 Oct 2024 00:50:34 -0400
Subject: [PATCH 16/27] Update launch.json

---
 .vscode/launch.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index a27a1cb9..b87726d0 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -22,8 +22,8 @@
             "preLaunchTask": "DelayedUSBIPAttach",
             "program": "${cargo:program}",
             "args": [
-                // "--ifs",
-                // "${userHome}/nitrokey-usbip-ifs",
+                "--ifs",
+                "${userHome}/nitrokey-usbip-ifs",
                 "--user-presence",
                 "interactive"
             ],

From 4ea6003b9a21565a05faa71add467d36da6fb4b9 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Tue, 29 Oct 2024 00:33:04 -0400
Subject: [PATCH 17/27] Fix spacing

---
 .vscode/launch.json        | 1 +
 components/apps/src/lib.rs | 2 +-
 runners/usbip/src/main.rs  | 2 --
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index b5aefa60..40e2f7f9 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -29,6 +29,7 @@
             ],
             "env": {
                 "RUST_BACKTRACE": "1",
+                "RUST_LOG": "debug",
             },
             "cwd": "${workspaceFolder}/runners/usbip",
         },
diff --git a/components/apps/src/lib.rs b/components/apps/src/lib.rs
index 067d08a7..d9d1f81a 100644
--- a/components/apps/src/lib.rs
+++ b/components/apps/src/lib.rs
@@ -981,7 +981,7 @@ impl<R: Runner> App<R> for FidoApp<R> {
 
     fn backends(_runner: &R, _config: &Self::Config) -> &'static [BackendId<Backend>] {
         &[
-             #[cfg(feature = "backend-dilithium")]
+            #[cfg(feature = "backend-dilithium")]
             BackendId::Custom(Backend::SoftwareDilithium),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
diff --git a/runners/usbip/src/main.rs b/runners/usbip/src/main.rs
index 5126c526..aafc8481 100644
--- a/runners/usbip/src/main.rs
+++ b/runners/usbip/src/main.rs
@@ -155,8 +155,6 @@ fn print_version() {
     let crate_name = clap::crate_name!();
     let crate_version = clap::crate_version!();
     let enabled_features: &[&str] = &[
-        #[cfg(feature = "alpha")]
-        "alpha",
         #[cfg(feature = "provisioner")]
         "provisioner",
     ];

From 943b812e8002d6f8a275fcd832c42e21ea8cfbe7 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Thu, 20 Feb 2025 21:00:19 -0500
Subject: [PATCH 18/27] Switch to ML-DSA

---
 .vscode/launch.json        |  12 +--
 Cargo.lock                 | 188 ++++++++++++++++++++++++++++++-------
 Cargo.toml                 |   7 +-
 components/apps/Cargo.toml |   8 +-
 runners/usbip/Cargo.toml   |   6 +-
 5 files changed, 174 insertions(+), 47 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index 40e2f7f9..f2ac65a6 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -12,7 +12,7 @@
                 "args": [
                     "build",
                     "--features",
-                    "provisioner,backend-dilithium2,backend-dilithium3,backend-dilithium5",
+                    "provisioner,backend-dilithium2,backend-dilithium3",
                     "--bin=usbip-runner",
                 ],
                 "filter": {
@@ -22,14 +22,14 @@
             "preLaunchTask": "DelayedUSBIPAttach",
             "program": "${cargo:program}",
             "args": [
-                "--ifs",
-                "${userHome}/nitrokey-usbip-ifs",
-                "--user-presence",
-                "interactive"
+                // "--ifs",
+                // "${userHome}/nitrokey-usbip-ifs",
+                // "--user-presence",
+                // "interactive"
             ],
             "env": {
                 "RUST_BACKTRACE": "1",
-                "RUST_LOG": "debug",
+                //"RUST_LOG": "debug",
             },
             "cwd": "${workspaceFolder}/runners/usbip",
         },
diff --git a/Cargo.lock b/Cargo.lock
index 4c71d98a..8b438593 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -159,7 +159,7 @@ dependencies = [
  "apdu-app",
  "delog",
  "heapless",
- "interchange",
+ "interchange 0.3.1",
  "iso7816",
 ]
 
@@ -189,9 +189,9 @@ dependencies = [
  "serde",
  "trussed",
  "trussed-auth",
- "trussed-chunked",
- "trussed-fs-info",
- "trussed-hkdf",
+ "trussed-chunked 0.1.0",
+ "trussed-fs-info 0.1.0",
+ "trussed-hkdf 0.2.0",
  "trussed-hpke",
  "trussed-manage",
  "trussed-pqc-backend",
@@ -384,7 +384,7 @@ dependencies = [
  "embedded-time",
  "fm11nc08",
  "generic-array",
- "interchange",
+ "interchange 0.3.1",
  "lfs-backup",
  "littlefs2",
  "lpc55-hal",
@@ -796,10 +796,12 @@ version = "0.3.1"
 dependencies = [
  "cfg-if",
  "heapless-bytes",
- "pqcrypto-dilithium",
+ "paste",
+ "pqcrypto-mldsa",
  "serde",
  "serde-big-array",
  "serde_repr",
+ "with_builtin_macros",
 ]
 
 [[package]]
@@ -888,6 +890,7 @@ version = "0.3.2"
 dependencies = [
  "bitflags 1.3.2",
  "cbor-smol",
+ "cfg-if",
  "cosey",
  "delog",
  "heapless",
@@ -899,17 +902,26 @@ dependencies = [
  "serde_repr",
 ]
 
+[[package]]
+name = "ctaphid-app"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fe93489fe96c998488d0843dffea35c02ed9add2585e55228e1d45988727ecc"
+dependencies = [
+ "heapless-bytes",
+ "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "ctaphid-dispatch"
 version = "0.1.1"
-source = "git+https://github.com/Nitrokey/ctaphid-dispatch.git?tag=v0.1.1-nitrokey.3#7f08ac0229ca49a5e2cd69e001658e1b43bc0a2b"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9e775f67c3a82a134a9e23e0771d3fb3808612ab03843cd31a9b0312004bdde"
 dependencies = [
  "delog",
  "heapless",
  "heapless-bytes",
- "interchange",
- "ref-swap",
- "trussed",
+ "interchange 0.2.2",
 ]
 
 [[package]]
@@ -1098,7 +1110,7 @@ dependencies = [
  "ctaphid-dispatch",
  "delog",
  "embedded-hal",
- "interchange",
+ "interchange 0.3.1",
  "littlefs2-core",
  "littlefs2-sys",
  "lpc55-hal",
@@ -1196,19 +1208,20 @@ dependencies = [
  "cbor-smol",
  "cosey",
  "ctap-types",
- "ctaphid-dispatch",
+ "ctaphid-app",
  "delog",
  "heapless",
+ "heapless-bytes",
  "iso7816",
  "littlefs2-core",
  "serde",
  "serde-indexed",
  "serde_bytes",
  "sha2",
- "trussed",
- "trussed-chunked",
- "trussed-fs-info",
- "trussed-hkdf",
+ "trussed-chunked 0.2.0",
+ "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "trussed-fs-info 0.2.0",
+ "trussed-hkdf 0.3.0",
 ]
 
 [[package]]
@@ -1639,6 +1652,12 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "interchange"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "310d743c23f798f10d5ba2f77fdd3eff06aaf2d8f8b9d78beba7fb1167f4ccbf"
+
 [[package]]
 name = "interchange"
 version = "0.3.1"
@@ -1935,7 +1954,7 @@ dependencies = [
  "delog",
  "embedded-time",
  "heapless",
- "interchange",
+ "interchange 0.3.1",
  "iso7816",
  "nb 1.1.0",
 ]
@@ -1953,7 +1972,7 @@ dependencies = [
  "cortex-m-rtic",
  "ctaphid-dispatch",
  "delog",
- "interchange",
+ "interchange 0.3.1",
  "memory-regions",
  "nrf52840-hal",
  "nrf52840-pac",
@@ -2148,7 +2167,7 @@ dependencies = [
  "subtle",
  "trussed",
  "trussed-auth",
- "trussed-chunked",
+ "trussed-chunked 0.1.0",
  "trussed-rsa-alloc",
  "trussed-wrap-key-to-file",
 ]
@@ -2219,6 +2238,12 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -2256,7 +2281,7 @@ dependencies = [
  "subtle",
  "trussed",
  "trussed-auth",
- "trussed-chunked",
+ "trussed-chunked 0.1.0",
  "trussed-hpke",
  "trussed-rsa-alloc",
  "trussed-wrap-key-to-file",
@@ -2421,6 +2446,20 @@ dependencies = [
  "pqcrypto-traits",
 ]
 
+[[package]]
+name = "pqcrypto-mldsa"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5439d511d79dcacbc91a11e9e78013aec955e399669bfae3955442d2f724b140"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "paste",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
 [[package]]
 name = "pqcrypto-sphincsplus"
 version = "0.7.0"
@@ -3334,20 +3373,20 @@ dependencies = [
  "heapless-bytes",
  "hex-literal 0.4.1",
  "hmac",
- "interchange",
+ "interchange 0.3.1",
  "littlefs2",
  "littlefs2-core",
  "nb 1.1.0",
  "p256-cortex-m4",
  "postcard 0.7.3",
- "pqcrypto-dilithium",
+ "pqcrypto-mldsa",
  "rand_chacha",
  "rand_core",
  "salty",
  "serde",
- "serde-indexed",
  "sha-1",
  "sha2",
+ "trussed-core 0.1.0",
  "zeroize",
 ]
 
@@ -3378,6 +3417,45 @@ dependencies = [
  "trussed",
 ]
 
+[[package]]
+name = "trussed-chunked"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9268d9d812440965ce31684e0115ceafa2636b7a8cc04dc117594567c53ff75e"
+dependencies = [
+ "serde",
+ "serde-byte-array",
+ "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
+name = "trussed-core"
+version = "0.1.0"
+dependencies = [
+ "cfg-if",
+ "heapless",
+ "heapless-bytes",
+ "littlefs2-core",
+ "postcard 0.7.3",
+ "rand_core",
+ "serde",
+ "serde-indexed",
+]
+
+[[package]]
+name = "trussed-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afddad280ae8a5235e1b06408cca909ce9454cdd89f941b94b024c580732b3ce"
+dependencies = [
+ "heapless-bytes",
+ "littlefs2-core",
+ "postcard 0.7.3",
+ "rand_core",
+ "serde",
+ "serde-indexed",
+]
+
 [[package]]
 name = "trussed-fs-info"
 version = "0.1.0"
@@ -3388,6 +3466,17 @@ dependencies = [
  "trussed",
 ]
 
+[[package]]
+name = "trussed-fs-info"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44822e0abc5a32b3f370f82644ee9cb08aa693847aac0d48f6dc115389157aea"
+dependencies = [
+ "serde",
+ "serde-byte-array",
+ "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "trussed-hkdf"
 version = "0.2.0"
@@ -3397,6 +3486,16 @@ dependencies = [
  "trussed",
 ]
 
+[[package]]
+name = "trussed-hkdf"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17884daee9214e24c7bb9cf2429d0f53c569cfa4a8d728106e459e60aed5be69"
+dependencies = [
+ "serde",
+ "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "trussed-hpke"
 version = "0.1.0"
@@ -3420,10 +3519,11 @@ dependencies = [
 name = "trussed-pqc-backend"
 version = "0.1.0"
 dependencies = [
+ "cosey",
  "der",
  "pkcs8",
  "pqcrypto",
- "pqcrypto-dilithium",
+ "pqcrypto-mldsa",
  "serde",
  "serde-big-array",
  "trussed",
@@ -3506,9 +3606,9 @@ dependencies = [
  "serde-byte-array",
  "sha2",
  "trussed",
- "trussed-chunked",
- "trussed-fs-info",
- "trussed-hkdf",
+ "trussed-chunked 0.1.0",
+ "trussed-fs-info 0.1.0",
+ "trussed-hkdf 0.2.0",
  "trussed-hpke",
  "trussed-manage",
  "trussed-wrap-key-to-file",
@@ -3521,7 +3621,7 @@ source = "git+https://github.com/Nitrokey/pc-usbip-runner.git?tag=v0.0.1-nitroke
 dependencies = [
  "apdu-dispatch",
  "ctaphid-dispatch",
- "interchange",
+ "interchange 0.3.1",
  "log",
  "trussed",
  "usb-device",
@@ -3654,7 +3754,7 @@ dependencies = [
  "delog",
  "embedded-time",
  "heapless",
- "interchange",
+ "interchange 0.3.1",
  "iso7816",
  "usb-device",
 ]
@@ -3668,7 +3768,7 @@ dependencies = [
  "delog",
  "embedded-time",
  "heapless",
- "interchange",
+ "interchange 0.3.1",
  "iso7816",
  "usb-device",
 ]
@@ -3676,14 +3776,14 @@ dependencies = [
 [[package]]
 name = "usbd-ctaphid"
 version = "0.1.0"
-source = "git+https://github.com/trussed-dev/usbd-ctaphid.git?rev=dcff9009c3cd1ef9e5b09f8f307aca998fc9a8c8#dcff9009c3cd1ef9e5b09f8f307aca998fc9a8c8"
 dependencies = [
+ "ctap-types",
  "ctaphid-dispatch",
  "delog",
  "embedded-time",
  "heapless",
  "heapless-bytes",
- "interchange",
+ "interchange 0.3.1",
  "ref-swap",
  "serde",
  "trussed",
@@ -4044,6 +4144,26 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "with_builtin_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24deb3cd6e530e7617b12b1f0f1ce160a3a71d92feb351c4db5156d1d10e398a"
+dependencies = [
+ "with_builtin_macros-proc_macros",
+]
+
+[[package]]
+name = "with_builtin_macros-proc_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2259ae9b1285596f1ee52ce8f627013c65853d4d7f271cb10bfe2d048769804a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.8.1"
@@ -4063,3 +4183,7 @@ dependencies = [
  "quote",
  "syn 2.0.85",
 ]
+
+[[patch.unused]]
+name = "ctaphid-dispatch"
+version = "0.2.0"
diff --git a/Cargo.toml b/Cargo.toml
index e826890e..9d331677 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,8 +22,8 @@ admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-n
 #trussed = { git = "https://github.com/nitrokey/trussed.git", tag = "v0.1.0-nitrokey.23" }
 
 # unreleased upstream changes
-ctaphid-dispatch = { git = "https://github.com/Nitrokey/ctaphid-dispatch.git", tag = "v0.1.1-nitrokey.3" }
-usbd-ctaphid = { git = "https://github.com/trussed-dev/usbd-ctaphid.git", rev = "dcff9009c3cd1ef9e5b09f8f307aca998fc9a8c8" }
+#TODO: revert ctaphid-dispatch = { git = "https://github.com/Nitrokey/ctaphid-dispatch.git", tag = "v0.1.1-nitrokey.3" }
+#TODO: revert usbd-ctaphid = { git = "https://github.com/trussed-dev/usbd-ctaphid.git", rev = "dcff9009c3cd1ef9e5b09f8f307aca998fc9a8c8" }
 usbd-ccid = { git = "https://github.com/Nitrokey/usbd-ccid", tag = "v0.2.0-nitrokey.1" }
 p256-cortex-m4  = { git = "https://github.com/ycrypto/p256-cortex-m4.git", rev = "cdb31e12594b4dc1f045b860a885fdc94d96aee2" }
 
@@ -46,11 +46,14 @@ trussed-se050-manage = { git = "https://github.com/Nitrokey/trussed-se050-backen
 trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", rev = "f4ff60b8aa0f322a424613165f66ed9112c7a94f" }
 
 trussed-pqc-backend = { path = "../trussed-pqc-backend" }
+trussed-core = { path = "../trussed/core" }
 trussed = { path = "../trussed" }
 fido-authenticator = { path = "../fido-authenticator" }
 ctap-types = { path = "../ctap-types" }
 cosey = { path = "../cosey" }
 trussed-rsa-alloc = { path = "../trussed-rsa-backend" }
+ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
+usbd-ctaphid = { path = "../usbd-ctaphid" }
 
 [profile.release]
 codegen-units = 1
diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index ef9530cd..0fec7926 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -81,10 +81,10 @@ backend-software-hpke = ["trussed-staging/hpke"]
 # If any of the PQC algorithms are selected for compilation, then the
 # PQC backend must be included and the corresponding algorithm features
 # there must be set.
-backend-dilithium = ["dep:trussed-pqc-backend"]
-backend-dilithium2 = ["backend-dilithium", "trussed-pqc-backend/dilithium2", "fido-authenticator/backend-dilithium2"]
-backend-dilithium3 = ["backend-dilithium", "trussed-pqc-backend/dilithium3", "fido-authenticator/backend-dilithium3"]
-backend-dilithium5 = ["backend-dilithium", "trussed-pqc-backend/dilithium5", "fido-authenticator/backend-dilithium5"]
+backend-mldsa = ["dep:trussed-pqc-backend"]
+backend-mldsa-44 = ["backend-mldsa", "trussed-pqc-backend/mldsa-44", "fido-authenticator/backend-mldsa-44"]
+backend-mldsa-65 = ["backend-mldsa", "trussed-pqc-backend/mldsa-65", "fido-authenticator/backend-mldsa-65"]
+backend-mldsa-87 = ["backend-mldsa", "trussed-pqc-backend/mldsa-87", "fido-authenticator/backend-mldsa-87"]
 
 log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 
diff --git a/runners/usbip/Cargo.toml b/runners/usbip/Cargo.toml
index 8b4e1912..aca772a2 100644
--- a/runners/usbip/Cargo.toml
+++ b/runners/usbip/Cargo.toml
@@ -28,6 +28,6 @@ provisioner = ["apps/nk3-provisioner"]
 ccid = ["apps/trussed-usbip-ccid", "trussed-usbip/ccid"]
 
 # PQC
-backend-dilithium2 = ["apps/backend-dilithium2"]
-backend-dilithium3 = ["apps/backend-dilithium3"]
-backend-dilithium5 = ["apps/backend-dilithium5"]
\ No newline at end of file
+backend-mldsa-44 = ["apps/backend-mldsa-44"]
+backend-mldsa-65 = ["apps/backend-mldsa-65"]
+backend-mldsa-87 = ["apps/backend-mldsa-87"]

From 46062a790e1826d7b874c603e9f9a5fd773941d5 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Thu, 27 Feb 2025 14:06:23 -0500
Subject: [PATCH 19/27] Fixes for upstream changes

---
 .vscode/launch.json             |    2 +-
 Cargo.lock                      | 1024 +++++++++++++++++--------------
 Cargo.toml                      |   10 +-
 components/apps/Cargo.toml      |   16 +-
 components/apps/src/dispatch.rs |   18 +-
 components/apps/src/lib.rs      |   12 +-
 runners/usbip/Cargo.toml        |    8 +-
 7 files changed, 606 insertions(+), 484 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index f2ac65a6..a35e391c 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -12,7 +12,7 @@
                 "args": [
                     "build",
                     "--features",
-                    "provisioner,backend-dilithium2,backend-dilithium3",
+                    "provisioner,backend-mldsa44,backend-mldsa65",
                     "--bin=usbip-runner",
                 ],
                 "filter": {
diff --git a/Cargo.lock b/Cargo.lock
index da184a01..a92d0f78 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -91,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.14"
+version = "0.6.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -106,43 +106,44 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.7"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.4"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
 dependencies = [
  "windows-sys",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.3"
+version = "3.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
+checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
 dependencies = [
  "anstyle",
+ "once_cell",
  "windows-sys",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.86"
+version = "1.0.96"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
+checksum = "6b964d184e89d9b6b67dd2715bc8e74cf3107fb2b529990c90cf517326150bf4"
 
 [[package]]
 name = "apdu-app"
@@ -155,14 +156,14 @@ dependencies = [
 
 [[package]]
 name = "apdu-dispatch"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4063bce5a221fcef21017ead889f26468dbee476649d6a2181b0931197082904"
+checksum = "2d6e6883b2c23b9fe1a488913705c7b68f751bdb73da036ff8191da729337a5d"
 dependencies = [
  "apdu-app",
  "delog",
  "heapless",
- "interchange 0.3.1",
+ "interchange",
  "iso7816",
 ]
 
@@ -172,7 +173,7 @@ version = "1.8.0"
 dependencies = [
  "admin-app",
  "apdu-dispatch",
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cbor-smol",
  "ctaphid-dispatch",
  "delog",
@@ -265,14 +266,14 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
 dependencies = [
- "critical-section 1.1.2",
+ "critical-section",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "az"
@@ -309,11 +310,11 @@ checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
 
 [[package]]
 name = "bindgen"
-version = "0.69.4"
+version = "0.69.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cexpr",
  "clang-sys",
  "itertools",
@@ -324,7 +325,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
@@ -341,9 +342,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.6.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
 
 [[package]]
 name = "block-buffer"
@@ -389,7 +390,7 @@ dependencies = [
  "embedded-time",
  "fm11nc08",
  "generic-array",
- "interchange 0.3.1",
+ "interchange",
  "lfs-backup",
  "littlefs2",
  "lpc55-hal",
@@ -415,15 +416,15 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.16.0"
+version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
 
 [[package]]
 name = "bytemuck"
-version = "1.16.1"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b236fc92302c97ed75b38da1f4917b5cdda4984745740f153a5d3059e48d725e"
+checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
 
 [[package]]
 name = "byteorder"
@@ -433,9 +434,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "camino"
-version = "1.1.7"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0ec6b951b160caa93cc0c7b209e5a3bff7aae9062213451ac99493cd844c239"
+checksum = "8b96ec4966b5813e2c0507c1f86115c8c5abaadc3980879c3424042a02fd1ad3"
 dependencies = [
  "serde",
 ]
@@ -453,12 +454,12 @@ dependencies = [
  "csv",
  "getopts",
  "itertools",
- "semver 1.0.23",
+ "semver 1.0.25",
  "serde",
  "serde_derive",
  "serde_json",
- "spdx 0.10.6",
- "toml 0.8.14",
+ "spdx 0.10.8",
+ "toml 0.8.20",
 ]
 
 [[package]]
@@ -467,7 +468,7 @@ version = "7.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c408da54db4c50d4693f7e649c299bc9de9c23ead86249e5368830bb32a734b"
 dependencies = [
- "semver 1.0.23",
+ "semver 1.0.25",
  "serde",
  "toml 0.5.11",
  "url",
@@ -475,9 +476,9 @@ dependencies = [
 
 [[package]]
 name = "cargo-platform"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
+checksum = "e35af189006b9c0f00a064685c727031e3ed2d8020f7ba284d78cc2671bd36ea"
 dependencies = [
  "serde",
 ]
@@ -490,7 +491,7 @@ checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
 dependencies = [
  "camino",
  "cargo-platform",
- "semver 1.0.23",
+ "semver 1.0.25",
  "serde",
  "serde_json",
  "thiserror",
@@ -525,13 +526,13 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.106"
+version = "1.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "066fce287b1d4eafef758e89e09d724a24808a9196fe9756b8ca90e86d0719a2"
+checksum = "c736e259eea577f443d5c86c304f9f4ae0295c43f3ba05c21f1d66b5f06001af"
 dependencies = [
  "jobserver",
  "libc",
- "once_cell",
+ "shlex",
 ]
 
 [[package]]
@@ -575,14 +576,14 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -618,9 +619,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.8"
+version = "4.5.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b3edb18336f4df585bc9aa31dd99c036dfa5dc5e9a2939a722a188f3a8970d"
+checksum = "027bb0d98429ae334a8698531da7077bdf906419543a35a55c2cb1b66437d767"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -628,18 +629,18 @@ dependencies = [
 
 [[package]]
 name = "clap-num"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e063d263364859dc54fb064cedb7c122740cd4733644b14b176c097f51e8ab7"
+checksum = "822c4000301ac390e65995c62207501e3ef800a1fc441df913a5e8e4dc374816"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.8"
+version = "4.5.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1c09dd5ada6c6c78075d6fd0da3f90d8080651e2d6cc8eb2f1aaa4034ced708"
+checksum = "5589e0cba072e0f3d23791efac0fd8627b49c829c196a492e88168e6a669d863"
 dependencies = [
  "anstream",
  "anstyle",
@@ -649,21 +650,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.8"
+version = "4.5.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bac35c6dafb060fd4d275d9a4ffae97917c13a6327903a8be2153cd964f7085"
+checksum = "bf4ced95c6f4a675af3da73304b9ac4ed991640c36374e4b46795c49e17cf1ed"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.1"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
 name = "cmac"
@@ -695,20 +696,20 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "console"
-version = "0.15.8"
+version = "0.15.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
+checksum = "ea3c6ecd8059b57859df5c69830340ed3c41d30e3da0c1cbed90a96ac853041b"
 dependencies = [
  "encode_unicode",
- "lazy_static",
  "libc",
- "unicode-width",
+ "once_cell",
+ "unicode-width 0.2.0",
  "windows-sys",
 ]
 
@@ -720,9 +721,9 @@ checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cortex-m"
@@ -732,7 +733,7 @@ checksum = "8ec610d8f49840a5b376c69663b6369e71f4b34484b9b2eb29fb918d92516cb9"
 dependencies = [
  "bare-metal 0.2.5",
  "bitfield",
- "critical-section 1.1.2",
+ "critical-section",
  "embedded-hal",
  "volatile-register",
 ]
@@ -811,9 +812,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.12"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
  "libc",
 ]
@@ -826,25 +827,15 @@ checksum = "338089f42c427b86394a5ee60ff321da23a5c89c9d89514c829687b26359fcff"
 
 [[package]]
 name = "critical-section"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1706d332edc22aef4d9f23a6bb1c92360a403013c291af51247a737472dcae6"
-dependencies = [
- "bare-metal 1.0.0",
- "critical-section 1.1.2",
-]
-
-[[package]]
-name = "critical-section"
-version = "1.1.2"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
 [[package]]
 name = "crunchy"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+checksum = "43da5946c66ffcc7745f48db692ffbb10a83bfe0afd96235c5c2a4fb23994929"
 
 [[package]]
 name = "crypto-bigint"
@@ -870,9 +861,9 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.3.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
+checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
 dependencies = [
  "csv-core",
  "itoa",
@@ -882,9 +873,9 @@ dependencies = [
 
 [[package]]
 name = "csv-core"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+checksum = "7d02f3b0da4c6504f86e9cd789d8dbafab48c2321be74e9987593de5a894d93d"
 dependencies = [
  "memchr",
 ]
@@ -920,8 +911,6 @@ dependencies = [
 [[package]]
 name = "ctaphid-dispatch"
 version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27caf0a07de6b0af58ba69562c1834ddf7aa27bc1d1687fed3b18fea1501e59e"
 dependencies = [
  "ctaphid-app",
  "delog",
@@ -981,13 +970,13 @@ dependencies = [
 
 [[package]]
 name = "der_derive"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fe87ce4529967e0ba1dcf8450bab64d97dfd5010a6256187ffe2e43e6f0e049"
+checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
@@ -1030,6 +1019,17 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.98",
+]
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -1060,9 +1060,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "b7914353092ddf589ad78f25c5c1c21b7f80b0ff8621e7c814c3485b5306da9d"
 
 [[package]]
 name = "elliptic-curve"
@@ -1117,7 +1117,7 @@ dependencies = [
  "ctaphid-dispatch",
  "delog",
  "embedded-hal",
- "interchange 0.3.1",
+ "interchange",
  "littlefs2-core",
  "littlefs2-sys",
  "lpc55-hal",
@@ -1151,9 +1151,9 @@ dependencies = [
 
 [[package]]
 name = "encode_unicode"
-version = "0.3.6"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
 [[package]]
 name = "encrypted_container"
@@ -1193,9 +1193,9 @@ dependencies = [
 
 [[package]]
 name = "equivalent"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "ff"
@@ -1210,7 +1210,6 @@ dependencies = [
 [[package]]
 name = "fido-authenticator"
 version = "0.1.1"
-source = "git+https://github.com/Nitrokey/fido-authenticator.git?tag=v0.1.1-nitrokey.25#c9512c7bdff055a5fd9373f1c60c2a14d05ef3ce"
 dependencies = [
  "apdu-app",
  "cbor-smol",
@@ -1234,9 +1233,9 @@ dependencies = [
 
 [[package]]
 name = "fixed"
-version = "1.27.0"
+version = "1.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fc715d38bea7b5bf487fcd79bcf8c209f0b58014f3018a7a19c2b855f472048"
+checksum = "707070ccf8c4173548210893a0186e29c266901b71ed20cd9e2ca0193dfe95c3"
 dependencies = [
  "az",
  "bytemuck",
@@ -1246,9 +1245,9 @@ dependencies = [
 
 [[package]]
 name = "flexiber"
-version = "0.1.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f72c28a2ada3f3db32168659a9322b13e88bced18d8c9e5aeb217e56515cffce"
+checksum = "a2510a9088d9557aab93401404fc6786fad82f55705dedf4ee5884a3ace9be9b"
 dependencies = [
  "delog",
  "flexiber_derive",
@@ -1257,13 +1256,13 @@ dependencies = [
 
 [[package]]
 name = "flexiber_derive"
-version = "0.1.0"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500c147f43e74e711720769dd7f37bc90dc6e0798621bfe5e3acb8239fd2f826"
+checksum = "e9985657bc39bae5cb7f4e686b46c67b1ea37390d82fe4bab56d7cd1933429d7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.98",
  "synstructure",
 ]
 
@@ -1298,9 +1297,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1313,9 +1312,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1323,15 +1322,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1340,27 +1339,27 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
 [[package]]
 name = "futures-sink"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
 
 [[package]]
 name = "futures-task"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
 
 [[package]]
 name = "futures-util"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1418,7 +1417,7 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
 dependencies = [
- "unicode-width",
+ "unicode-width 0.1.14",
 ]
 
 [[package]]
@@ -1434,9 +1433,9 @@ dependencies = [
 
 [[package]]
 name = "glob"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "group"
@@ -1500,6 +1499,12 @@ version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
+[[package]]
+name = "hashbrown"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+
 [[package]]
 name = "heapless"
 version = "0.7.17"
@@ -1508,7 +1513,7 @@ checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
 dependencies = [
  "atomic-polyfill",
  "hash32",
- "rustc_version 0.4.0",
+ "rustc_version 0.4.1",
  "serde",
  "spin",
  "stable_deref_trait",
@@ -1539,9 +1544,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.9"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
 
 [[package]]
 name = "hex"
@@ -1593,9 +1598,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.60"
+version = "0.1.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -1614,14 +1619,143 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.98",
+]
+
 [[package]]
 name = "idna"
-version = "0.5.0"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
 dependencies = [
- "unicode-bidi",
- "unicode-normalization",
+ "icu_normalizer",
+ "icu_properties",
 ]
 
 [[package]]
@@ -1642,19 +1776,19 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "8c9c992b02b5b4c94ea26e32fe5bccb7aa7d9f390ab5c1221ff895bc7ea8b652"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.5",
+ "hashbrown 0.15.2",
 ]
 
 [[package]]
 name = "inout"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
  "block-padding",
  "generic-array",
@@ -1662,24 +1796,18 @@ dependencies = [
 
 [[package]]
 name = "interchange"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "310d743c23f798f10d5ba2f77fdd3eff06aaf2d8f8b9d78beba7fb1167f4ccbf"
-
-[[package]]
-name = "interchange"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88dbb1ed0e8ee048061aa628677fd30712e76635fa51b3987693a93fa3dc23b2"
+checksum = "2cc2a6b02f14a47afb0dbccdf96ae4f527ab32b05f78918d9da92e336bcbc222"
 dependencies = [
  "loom",
 ]
 
 [[package]]
 name = "is-terminal"
-version = "0.4.12"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
+checksum = "e19b23d53f35ce9f56aebc7d1bb4e6ac1e9c0db7ac85c8d1760c04379edced37"
 dependencies = [
  "hermit-abi",
  "libc",
@@ -1688,9 +1816,9 @@ dependencies = [
 
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.0"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "iso7816"
@@ -1713,9 +1841,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.11"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
 
 [[package]]
 name = "jobserver"
@@ -1728,10 +1856,11 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.69"
+version = "0.3.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
 dependencies = [
+ "once_cell",
  "wasm-bindgen",
 ]
 
@@ -1758,7 +1887,7 @@ dependencies = [
  "heapless",
  "heapless-bytes",
  "littlefs2",
- "postcard 1.0.8",
+ "postcard 1.1.1",
  "rand",
  "serde",
  "serial_test",
@@ -1768,15 +1897,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.170"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "875b3680cb2f8f71bdcf9a30f38d48282f5d3c95cbf9b3fa57269bb5d5c06828"
 
 [[package]]
 name = "libloading"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e310b3a6b5907f99202fcdb4960ff45b93735d7c7d96b760fcff8db2dc0e103d"
+checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
 dependencies = [
  "cfg-if",
  "windows-targets 0.52.6",
@@ -1784,9 +1913,9 @@ dependencies = [
 
 [[package]]
 name = "libm"
-version = "0.2.8"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
+checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
 
 [[package]]
 name = "linked_list_allocator"
@@ -1794,6 +1923,12 @@ version = "0.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9afa463f5405ee81cdb9cc2baf37e08ec7e4c8209442b5d72c04cfb2cd6e6286"
 
+[[package]]
+name = "litemap"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
+
 [[package]]
 name = "littlefs2"
 version = "0.5.0"
@@ -1809,11 +1944,11 @@ dependencies = [
 
 [[package]]
 name = "littlefs2-core"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "250ec1e3017a4540932dc8b33daca325cb6195cded097e1addd9111d9ea2c48f"
+checksum = "9a81a4745d38b288b7583fe8ea3736897628df81f4d0f1d0314fa5a3af570de4"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "heapless-bytes",
  "serde",
 ]
@@ -1840,9 +1975,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "30bde2b3dc3671ae49d8e2e9f044c7c005836e7a023ee57cffa25ab82764bb9e"
 
 [[package]]
 name = "loom"
@@ -1962,7 +2097,7 @@ dependencies = [
  "delog",
  "embedded-time",
  "heapless",
- "interchange 0.3.1",
+ "interchange",
  "iso7816",
  "nb 1.1.0",
 ]
@@ -1980,7 +2115,7 @@ dependencies = [
  "cortex-m-rtic",
  "ctaphid-dispatch",
  "delog",
- "interchange 0.3.1",
+ "interchange",
  "memory-regions",
  "nrf52840-hal",
  "nrf52840-pac",
@@ -2019,13 +2154,11 @@ dependencies = [
 
 [[package]]
 name = "nrf-usbd"
-version = "0.1.1"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "640e88d4c108743c667f03320d0c9ab24a20f183a7a1b18bde7891ee13fd92c5"
+checksum = "945a178131ac5f69941dadb0d51c8e17cbe34cc09a0e2d51c099160a463751b8"
 dependencies = [
- "bare-metal 1.0.0",
  "cortex-m",
- "critical-section 0.2.8",
  "usb-device",
  "vcell",
 ]
@@ -2144,9 +2277,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
 
 [[package]]
 name = "opaque-debug"
@@ -2161,7 +2294,7 @@ source = "git+https://github.com/Nitrokey/opcard-rs?rev=39ec4c37f808c0cfeb84e0a8
 dependencies = [
  "admin-app",
  "apdu-app",
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cbor-smol",
  "cfg-if",
  "delog",
@@ -2261,9 +2394,9 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.14"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
 [[package]]
 name = "pin-utils"
@@ -2343,9 +2476,9 @@ dependencies = [
 
 [[package]]
 name = "postcard"
-version = "1.0.8"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a55c51ee6c0db07e68448e336cf8ea4131a620edefebf9893e759b2d793420f8"
+checksum = "170a2601f67cc9dba8edd8c4870b15f71a6a2dc196daec8c83f72b59dff628a8"
 dependencies = [
  "cobs",
  "heapless",
@@ -2360,82 +2493,18 @@ checksum = "7c68cb38ed13fd7bc9dd5db8f165b7c8d9c1a315104083a2b10f11354c2af97f"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
-
-[[package]]
-name = "pqcrypto"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ac15ee741fa95113ea76e7b08ce966e55c7e725621119ec1a59cf88a96e94b4"
-dependencies = [
- "pqcrypto-classicmceliece",
- "pqcrypto-dilithium",
- "pqcrypto-falcon",
- "pqcrypto-hqc",
- "pqcrypto-kyber",
- "pqcrypto-sphincsplus",
- "pqcrypto-traits",
-]
-
-[[package]]
-name = "pqcrypto-classicmceliece"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020d75adba68e21bcd1a6268a7145bff549fe7559e75a122e19f6f00bfb896d7"
-dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
-]
-
-[[package]]
-name = "pqcrypto-dilithium"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "685de0fa68c6786559d5fcdaa414f0cd68ef3f5d162f61823bd7424cd276726f"
-dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
-]
-
-[[package]]
-name = "pqcrypto-falcon"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35d1d53b8392f416aa11943f83c0372d88090d9c236b21a7f19352e61542119d"
-dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
-]
-
-[[package]]
-name = "pqcrypto-hqc"
-version = "0.2.0"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e945bdfba5a47894067969abaa04d773c8dae56d1f33efa93fc5b84636b85bf"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
 dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
+ "zerocopy",
 ]
 
 [[package]]
 name = "pqcrypto-internals"
-version = "0.2.6"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10cdd9eee50fe65bbd4f40211f1a492f1ee52e97a51100950b6f1fa319ab7cd"
+checksum = "4ad4cd1b8413da8217c3bcb04b10fa728faa9bd77067e8314ca5d363ca0a37d4"
 dependencies = [
  "cc",
  "dunce",
@@ -2443,19 +2512,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "pqcrypto-kyber"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c00293cf898859d0c771455388054fd69ab712263c73fdc7f287a39b1ba000"
-dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
-]
-
 [[package]]
 name = "pqcrypto-mldsa"
 version = "0.1.0"
@@ -2470,19 +2526,6 @@ dependencies = [
  "pqcrypto-traits",
 ]
 
-[[package]]
-name = "pqcrypto-sphincsplus"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82ea17a14b7623f262460f07e2773ae62b25c65e935db87581addd60cc9316c3"
-dependencies = [
- "cc",
- "glob",
- "libc",
- "pqcrypto-internals",
- "pqcrypto-traits",
-]
-
 [[package]]
 name = "pqcrypto-traits"
 version = "0.3.5"
@@ -2534,9 +2577,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
 dependencies = [
  "unicode-ident",
 ]
@@ -2570,9 +2613,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
 dependencies = [
  "proc-macro2",
 ]
@@ -2615,11 +2658,11 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.2"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c82cf8cff14456045f55ec4241383baeff27af886adb72ffb2162f99911de0fd"
+checksum = "82b568323e98e49e2a0899dcee453dd679fae22d69adf9b11dd508d1549b7e2f"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
 ]
 
 [[package]]
@@ -2630,14 +2673,14 @@ checksum = "09c30c54dffee5b40af088d5d50aa3455c91a0127164b51f0215efc4cb28fb3c"
 
 [[package]]
 name = "regex"
-version = "1.10.5"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.7",
- "regex-syntax 0.8.4",
+ "regex-automata 0.4.9",
+ "regex-syntax 0.8.5",
 ]
 
 [[package]]
@@ -2651,13 +2694,13 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.4",
+ "regex-syntax 0.8.5",
 ]
 
 [[package]]
@@ -2668,9 +2711,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "rfc6979"
@@ -2684,9 +2727,9 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.6"
+version = "0.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc"
+checksum = "47c75d7c5c6b673e58bf54d8544a9f432e3a925b0e80f7cd3602ab5c50c55519"
 dependencies = [
  "const-oid",
  "digest 0.10.7",
@@ -2754,24 +2797,24 @@ dependencies = [
 
 [[package]]
 name = "rustc_version"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.23",
+ "semver 1.0.25",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.17"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
+checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
 
 [[package]]
 name = "ryu"
-version = "1.0.18"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+checksum = "6ea1a2d0a644769cc99faa24c3ad26b379b786fe7c36fd3c546254801650e6dd"
 
 [[package]]
 name = "salty"
@@ -2804,7 +2847,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3ad92298f6eb2377e187610511550737cf2434cb36b177cdc1bd468abb44533"
 dependencies = [
  "aes",
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cmac",
  "crc16",
  "delog",
@@ -2839,7 +2882,7 @@ version = "0.13.0"
 source = "git+https://github.com/Nitrokey/trussed-secrets-app?rev=700863bdfa90a3616cbb695d6638c7aea7730c03#700863bdfa90a3616cbb695d6638c7aea7730c03"
 dependencies = [
  "apdu-app",
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "block-padding",
  "cbor-smol",
  "ctaphid-app",
@@ -2867,9 +2910,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.23"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+checksum = "f79dfe2d285b0488816f30e700a7438c5a73d816b5b7d3ac72fbc48b0d185e03"
 dependencies = [
  "serde",
 ]
@@ -2882,9 +2925,9 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.213"
+version = "1.0.218"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ea7893ff5e2466df8d720bb615088341b295f849602c6956047f8f80f0e9bc1"
+checksum = "e8dfc9d19bdbf6d17e22319da49161d5d0108e4188e8b680aef6299eed22df60"
 dependencies = [
  "serde_derive",
 ]
@@ -2915,7 +2958,7 @@ checksum = "fca2da10b1f1623f47130256065e05e94fd7a98dbd26a780a4c5de831b21e5c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
@@ -2929,22 +2972,23 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.213"
+version = "1.0.218"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e85ad2009c50b58e87caa8cd6dac16bdf511bbfb7af6c33df902396aa480fa5"
+checksum = "f09503e191f4e797cb8aac08e9a4a4695c5edf6a2e70e376d961ddd5c969f82b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.120"
+version = "1.0.139"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
+checksum = "44f86c3acccc9c65b153fe1b85a3be07fe5515274ec9f0653b4a0875731c72a6"
 dependencies = [
  "itoa",
+ "memchr",
  "ryu",
  "serde",
 ]
@@ -2957,14 +3001,14 @@ checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79e674e01f999af37c49f70a6ede167a8a60b2503e56c5599532a65baa5969a0"
+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
 dependencies = [
  "serde",
 ]
@@ -3077,9 +3121,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
 
 [[package]]
 name = "spdx"
@@ -3092,9 +3136,9 @@ dependencies = [
 
 [[package]]
 name = "spdx"
-version = "0.10.6"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47317bbaf63785b53861e1ae2d11b80d6b624211d42cb20efcd210ee6f8a14bc"
+checksum = "58b69356da67e2fc1f542c71ea7e654a361a79c938e4424392ecf4fa065d2193"
 dependencies = [
  "smallvec",
 ]
@@ -3150,7 +3194,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
@@ -3172,9 +3216,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.85"
+version = "2.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
+checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3183,14 +3227,13 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.12.6"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
- "unicode-xid",
+ "syn 2.0.98",
 ]
 
 [[package]]
@@ -3215,22 +3258,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.61"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.61"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
@@ -3244,20 +3287,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "tinyvec"
-version = "1.8.0"
+name = "tinystr"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
 dependencies = [
- "tinyvec_macros",
+ "displaydoc",
+ "zerovec",
 ]
 
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "toml"
 version = "0.5.11"
@@ -3269,9 +3307,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.14"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f49eb2ab21d2f26bd6db7bf383edc527a7ebaee412d17af4d40fdccd442f335"
+checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -3281,20 +3319,20 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
+checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.14"
+version = "0.22.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f21c7aaf97f1bd9ca9d4f9e73b0a6c74bd5afef56f2bc931943a6e1c37e04e38"
+checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.7.1",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -3303,9 +3341,9 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.40"
+version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
  "pin-project-lite",
  "tracing-attributes",
@@ -3314,20 +3352,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.32"
+version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
 dependencies = [
  "once_cell",
  "valuable",
@@ -3346,9 +3384,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.18"
+version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -3365,10 +3403,9 @@ dependencies = [
 [[package]]
 name = "trussed"
 version = "0.1.0"
-source = "git+https://github.com/trussed-dev/trussed.git?rev=6bba8fde36d05c0227769eb63345744e87d84b2b#6bba8fde36d05c0227769eb63345744e87d84b2b"
 dependencies = [
  "aes",
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cbc",
  "cbor-smol",
  "cfg-if",
@@ -3377,14 +3414,13 @@ dependencies = [
  "cosey",
  "delog",
  "des",
- "embedded-hal",
  "flexiber",
  "generic-array",
  "heapless",
  "heapless-bytes",
  "hex-literal 0.4.1",
  "hmac",
- "interchange 0.3.1",
+ "interchange",
  "littlefs2",
  "littlefs2-core",
  "nb 1.1.0",
@@ -3444,12 +3480,12 @@ dependencies = [
 [[package]]
 name = "trussed-core"
 version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afddad280ae8a5235e1b06408cca909ce9454cdd89f941b94b024c580732b3ce"
 dependencies = [
+ "cfg-if",
  "heapless-bytes",
  "littlefs2-core",
  "postcard 0.7.3",
+ "pqcrypto-mldsa",
  "rand_core",
  "serde",
  "serde-indexed",
@@ -3466,17 +3502,6 @@ dependencies = [
  "trussed-core",
 ]
 
-[[package]]
-name = "trussed-fs-info"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44822e0abc5a32b3f370f82644ee9cb08aa693847aac0d48f6dc115389157aea"
-dependencies = [
- "serde",
- "serde-byte-array",
- "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
 [[package]]
 name = "trussed-hkdf"
 version = "0.3.0"
@@ -3487,16 +3512,6 @@ dependencies = [
  "trussed-core",
 ]
 
-[[package]]
-name = "trussed-hkdf"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17884daee9214e24c7bb9cf2429d0f53c569cfa4a8d728106e459e60aed5be69"
-dependencies = [
- "serde",
- "trussed-core 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
 [[package]]
 name = "trussed-hpke"
 version = "0.2.0"
@@ -3526,17 +3541,17 @@ dependencies = [
  "cosey",
  "der",
  "pkcs8",
- "pqcrypto",
  "pqcrypto-mldsa",
+ "pqcrypto-traits",
  "serde",
  "serde-big-array",
  "trussed",
+ "trussed-core",
 ]
 
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
-source = "git+https://github.com/trussed-dev/trussed-rsa-backend.git?rev=743d9aaa3d8a17d7dbf492bd54dc18ab8fca3dc0#743d9aaa3d8a17d7dbf492bd54dc18ab8fca3dc0"
 dependencies = [
  "delog",
  "heapless-bytes",
@@ -3553,7 +3568,7 @@ name = "trussed-se050-backend"
 version = "0.3.6"
 source = "git+https://github.com/Nitrokey/trussed-se050-backend.git?rev=131c973fbe74d677fb8c8df97c210f78608994f0#131c973fbe74d677fb8c8df97c210f78608994f0"
 dependencies = [
- "bitflags 2.6.0",
+ "bitflags 2.8.0",
  "cbor-smol",
  "chacha20poly1305",
  "crypto-bigint",
@@ -3614,9 +3629,9 @@ dependencies = [
  "serde-byte-array",
  "sha2",
  "trussed",
- "trussed-chunked 0.1.0",
- "trussed-fs-info 0.1.0",
- "trussed-hkdf 0.2.0",
+ "trussed-chunked",
+ "trussed-fs-info",
+ "trussed-hkdf",
  "trussed-hpke",
  "trussed-manage",
  "trussed-wrap-key-to-file",
@@ -3625,11 +3640,11 @@ dependencies = [
 [[package]]
 name = "trussed-usbip"
 version = "0.0.1"
-source = "git+https://github.com/trussed-dev/pc-usbip-runner.git?rev=4fe4e4e287dac1d92fcd4f97e8926497bfa9d7a9#4fe4e4e287dac1d92fcd4f97e8926497bfa9d7a9"
+source = "git+https://github.com/trussed-dev/pc-usbip-runner.git#a0e9b855809577f0067a93e08c716aa285b03700"
 dependencies = [
  "apdu-dispatch",
  "ctaphid-dispatch",
- "interchange 0.3.1",
+ "interchange",
  "log",
  "trussed",
  "usb-device",
@@ -3665,14 +3680,14 @@ checksum = "560b82d656506509d43abe30e0ba64c56b1953ab3d4fe7ba5902747a7a3cedd5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
 [[package]]
 name = "ufmt-write"
@@ -3682,45 +3697,27 @@ checksum = "e87a2ed6b42ec5e28cc3b94c09982969e9227600b2e3dcbc1db927a84c06bd69"
 
 [[package]]
 name = "unicase"
-version = "2.7.0"
+version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7d2d4dafb69621809a81864c9c1b864479e1235c0dd4e199924b9742439ed89"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.23"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
-dependencies = [
- "tinyvec",
-]
+checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
 
 [[package]]
 name = "unicode-width"
-version = "0.1.13"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
 [[package]]
-name = "unicode-xid"
-version = "0.2.4"
+name = "unicode-width"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
 
 [[package]]
 name = "universal-hash"
@@ -3740,9 +3737,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.2"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -3764,7 +3761,7 @@ dependencies = [
  "delog",
  "embedded-time",
  "heapless",
- "interchange 0.3.1",
+ "interchange",
  "iso7816",
  "usb-device",
 ]
@@ -3772,15 +3769,12 @@ dependencies = [
 [[package]]
 name = "usbd-ctaphid"
 version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "092fad7bf817001ecade9272fe6ccbea4e5d0c02f99ca24c4c5ce97fbbff5371"
 dependencies = [
- "ctap-types",
  "ctaphid-dispatch",
  "delog",
  "embedded-time",
  "heapless-bytes",
- "interchange 0.3.1",
+ "interchange",
  "ref-swap",
  "serde",
  "trussed-core",
@@ -3818,6 +3812,18 @@ dependencies = [
  "utils",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -3833,14 +3839,14 @@ dependencies = [
  "littlefs2",
  "quickcheck",
  "regex",
- "semver 1.0.23",
+ "semver 1.0.25",
 ]
 
 [[package]]
 name = "valuable"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "vcell"
@@ -3850,9 +3856,9 @@ checksum = "77439c1b53d2303b20d9459b1ade71a83c716e3f9c34f3228c00e6f185d6c002"
 
 [[package]]
 name = "version_check"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "void"
@@ -3877,34 +3883,35 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
 dependencies = [
  "cfg-if",
+ "once_cell",
+ "rustversion",
  "wasm-bindgen-macro",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3912,22 +3919,25 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+dependencies = [
+ "unicode-ident",
+]
 
 [[package]]
 name = "webcrypt"
@@ -3973,9 +3983,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
  "windows-sys",
 ]
@@ -4004,11 +4014,17 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dccfd733ce2b1753b03b6d3c65edf020262ea35e20ccdf3e288043e6dd620e3"
+
 [[package]]
 name = "windows-sys"
-version = "0.52.0"
+version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
  "windows-targets 0.52.6",
 ]
@@ -4136,9 +4152,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.6.13"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59b5e5f6c299a3c7890b876a2a587f3115162487e704907d9b6cd29473052ba1"
+checksum = "0e7f4ea97f6f78012141bcdb6a216b2609f0979ada50b20ca5b52dde2eac2bb1"
 dependencies = [
  "memchr",
 ]
@@ -4163,6 +4179,84 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
+[[package]]
+name = "yoke"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.98",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.98",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.98",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.8.1"
@@ -4180,9 +4274,27 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.98",
 ]
 
-[[patch.unused]]
-name = "ctaphid-dispatch"
-version = "0.2.0"
+[[package]]
+name = "zerovec"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.98",
+]
diff --git a/Cargo.toml b/Cargo.toml
index 46f71b63..ce87385b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,13 +18,13 @@ memory-regions = { path = "components/memory-regions" }
 
 # unreleased libraries
 p256-cortex-m4  = { git = "https://github.com/ycrypto/p256-cortex-m4.git", rev = "cdb31e12594b4dc1f045b860a885fdc94d96aee2" }
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "6bba8fde36d05c0227769eb63345744e87d84b2b" }
-trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "4fe4e4e287dac1d92fcd4f97e8926497bfa9d7a9" }
+#trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "6bba8fde36d05c0227769eb63345744e87d84b2b" }
+#trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "4fe4e4e287dac1d92fcd4f97e8926497bfa9d7a9" }
 lpc55-hal = { git = "https://github.com/lpc55/lpc55-hal.git", rev ="1a25fc366013503b46af938646c88aed4e36d74c" }
 
 # applications
 admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.19" }
-fido-authenticator = { git = "https://github.com/Nitrokey/fido-authenticator.git",tag = "v0.1.1-nitrokey.25" }
+#fido-authenticator = { git = "https://github.com/Nitrokey/fido-authenticator.git",tag = "v0.1.1-nitrokey.25" }
 opcard = { git = "https://github.com/Nitrokey/opcard-rs", rev = "39ec4c37f808c0cfeb84e0a8493bbee06f02c8e2" }
 piv-authenticator = { git = "https://github.com/Nitrokey/piv-authenticator.git", rev = "65552820b4f931c21e1c7675b1bd6072cb872531" }
 secrets-app = { git = "https://github.com/Nitrokey/trussed-secrets-app", rev = "700863bdfa90a3616cbb695d6638c7aea7730c03" }
@@ -32,10 +32,11 @@ webcrypt = { git = "https://github.com/nitrokey/nitrokey-websmartcard-rust", tag
 
 # backends
 trussed-auth-backend = { git = "https://github.com/trussed-dev/trussed-auth", tag = "v0.4.0" }
-trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", rev = "743d9aaa3d8a17d7dbf492bd54dc18ab8fca3dc0" }
+#trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", rev = "743d9aaa3d8a17d7dbf492bd54dc18ab8fca3dc0" }
 trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", rev = "131c973fbe74d677fb8c8df97c210f78608994f0" }
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "1e1ca03a3a62ea9b802f4070ea4bce002eeb4bec" }
 
+# TODO: revert these to Git versions
 trussed-pqc-backend = { path = "../trussed-pqc-backend" }
 trussed-core = { path = "../trussed/core" }
 trussed = { path = "../trussed" }
@@ -45,6 +46,7 @@ cosey = { path = "../cosey" }
 trussed-rsa-alloc = { path = "../trussed-rsa-backend" }
 ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
 usbd-ctaphid = { path = "../usbd-ctaphid" }
+trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git"}
 
 [profile.release]
 codegen-units = 1
diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index be3bbcfb..047e9a44 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -60,13 +60,13 @@ hex = "0.4"
 # - all other optional apps require a Trussed client (+n)
 
 # nk3
-nk3 = ["fido-authenticator", "ndef-app", "secrets-app", "opcard", "piv-authenticator", "factory-reset", "trussed/clients-5"]
-nk3-test = ["nk3", "trussed/clients-5"]
-nk3-provisioner = ["nk3", "provisioner-app", "trussed/clients-6"]
+nk3 = ["fido-authenticator", "ndef-app", "secrets-app", "opcard", "piv-authenticator", "factory-reset"]
+nk3-test = ["nk3"]
+nk3-provisioner = ["nk3", "provisioner-app"]
 
 # nkpk
-nkpk = ["fido-authenticator", "factory-reset", "trussed/clients-2"]
-nkpk-provisioner = ["nkpk", "provisioner-app", "trussed/clients-3"]
+nkpk = ["fido-authenticator", "factory-reset"]
+nkpk-provisioner = ["nkpk", "provisioner-app"]
 
 # apps
 secrets-app = ["dep:secrets-app", "backend-auth", "trussed/chacha8-poly1305", "trussed/hmac-sha1", "trussed/hmac-sha256", "trussed/sha256"]
@@ -84,9 +84,9 @@ backend-software-hpke = ["trussed-staging/hpke"]
 # PQC backend must be included and the corresponding algorithm features
 # there must be set.
 backend-mldsa = ["dep:trussed-pqc-backend"]
-backend-mldsa-44 = ["backend-mldsa", "trussed-pqc-backend/mldsa-44", "fido-authenticator/backend-mldsa-44"]
-backend-mldsa-65 = ["backend-mldsa", "trussed-pqc-backend/mldsa-65", "fido-authenticator/backend-mldsa-65"]
-backend-mldsa-87 = ["backend-mldsa", "trussed-pqc-backend/mldsa-87", "fido-authenticator/backend-mldsa-87"]
+backend-mldsa44 = ["backend-mldsa", "trussed-pqc-backend/mldsa44", "fido-authenticator/mldsa44"]
+backend-mldsa65 = ["backend-mldsa", "trussed-pqc-backend/mldsa65", "fido-authenticator/mldsa65"]
+backend-mldsa87 = ["backend-mldsa", "trussed-pqc-backend/mldsa87", "fido-authenticator/mldsa87"]
 
 log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 log-error = []
diff --git a/components/apps/src/dispatch.rs b/components/apps/src/dispatch.rs
index c1b9d0f7..1b550ca2 100644
--- a/components/apps/src/dispatch.rs
+++ b/components/apps/src/dispatch.rs
@@ -38,8 +38,8 @@ use trussed_auth_backend::{AuthBackend, AuthContext, MAX_HW_KEY_LEN};
 #[cfg(feature = "backend-rsa")]
 use trussed_rsa_alloc::SoftwareRsa;
 
-#[cfg(feature = "backend-dilithium")]
-use trussed_pqc_backend::SoftwareDilithium;
+#[cfg(feature = "backend-mldsa")]
+use trussed_pqc_backend::SoftwareMldsa;
 
 use trussed_chunked::ChunkedExtension;
 use trussed_fs_info::FsInfoExtension;
@@ -237,9 +237,9 @@ impl<T: Twi, D: Delay> ExtensionDispatch for Dispatch<T, D> {
             Backend::HmacSha256P256 => Err(TrussedError::RequestNotAvailable),
             #[cfg(feature = "backend-rsa")]
             Backend::SoftwareRsa => SoftwareRsa.request(&mut ctx.core, &mut (), request, resources),
-            #[cfg(feature = "backend-dilithium")]
-            Backend::SoftwareDilithium => {
-                SoftwareDilithium.request(&mut ctx.core, &mut (), request, resources)
+            #[cfg(feature = "backend-mldsa")]
+            Backend::SoftwareMldsa => {
+                SoftwareMldsa.request(&mut ctx.core, &mut (), request, resources)
             }
             Backend::Staging => {
                 self.staging
@@ -290,8 +290,8 @@ impl<T: Twi, D: Delay> ExtensionDispatch for Dispatch<T, D> {
             },
             #[cfg(feature = "backend-rsa")]
             Backend::SoftwareRsa => Err(TrussedError::RequestNotAvailable),
-            #[cfg(feature = "backend-dilithium")]
-            Backend::SoftwareDilithium => Err(TrussedError::RequestNotAvailable),
+            #[cfg(feature = "backend-mldsa")]
+            Backend::SoftwareMldsa => Err(TrussedError::RequestNotAvailable),
             Backend::Staging => match extension {
                 Extension::Chunked => {
                     ExtensionImpl::<ChunkedExtension>::extension_request_serialized(
@@ -414,8 +414,8 @@ pub enum Backend {
     HmacSha256P256,
     #[cfg(feature = "backend-rsa")]
     SoftwareRsa,
-    #[cfg(feature = "backend-dilithium")]
-    SoftwareDilithium,
+    #[cfg(feature = "backend-mldsa")]
+    SoftwareMldsa,
     Staging,
     /// Separate BackendId to prevent non-priviledged apps from accessing the manage Extension
     StagingManage,
diff --git a/components/apps/src/lib.rs b/components/apps/src/lib.rs
index 4d547eca..1ca5b3da 100644
--- a/components/apps/src/lib.rs
+++ b/components/apps/src/lib.rs
@@ -30,6 +30,7 @@ use trussed::{
     backend::BackendId,
     client::ClientBuilder,
     interrupt::InterruptFlag,
+    pipe::ServiceEndpoint,
     platform::Syscall,
     store::filestore::ClientFilestore,
     types::{Location, Mechanism, Path},
@@ -788,6 +789,13 @@ where
 
     fn new(
         trussed_service: &mut Service<trussed::virt::Platform<S>, Dispatch<R::Twi, R::Se050Timer>>,
+        endpoints: &mut Vec<
+            ServiceEndpoint<
+                'static,
+                <dispatch::Dispatch<<R as Runner>::Twi, <R as Runner>::Se050Timer> as trussed::backend::Dispatch>::BackendId,
+                <dispatch::Dispatch<<R as Runner>::Twi, <R as Runner>::Se050Timer> as trussed::backend::Dispatch>::Context,
+            >,
+        >,
         syscall: trussed_usbip::Syscall,
         (runner, data): (R, Data<R>),
     ) -> Self {
@@ -1047,8 +1055,8 @@ impl<R: Runner> App<R> for FidoApp<R> {
 
     fn backends(_runner: &R, _config: &Self::Config) -> &'static [BackendId<Backend>] {
         &[
-            #[cfg(feature = "backend-dilithium")]
-            BackendId::Custom(Backend::SoftwareDilithium),
+            #[cfg(feature = "backend-mldsa")]
+            BackendId::Custom(Backend::SoftwareMldsa),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
         ]
diff --git a/runners/usbip/Cargo.toml b/runners/usbip/Cargo.toml
index dd35a398..cd275bfe 100644
--- a/runners/usbip/Cargo.toml
+++ b/runners/usbip/Cargo.toml
@@ -15,7 +15,7 @@ log = { version = "0.4.14", default-features = false }
 pretty_env_logger = "0.5.0"
 rand_core = { version = "0.6.4", features = ["getrandom"] }
 signal-hook = { version = "0.3.17", default-features = false }
-trussed = { version = "0.1", default-features = false, features = ["clients-3"] }
+trussed = { version = "0.1", default-features = false, features = [] }
 trussed-usbip = { version = "0.0.1", default-features = false, features = ["ctaphid"] }
 utils = { path = "../../components/utils", features = ["log-all"] }
 
@@ -28,6 +28,6 @@ provisioner = ["apps/nk3-provisioner"]
 ccid = ["apps/trussed-usbip-ccid", "trussed-usbip/ccid"]
 
 # PQC
-backend-mldsa-44 = ["apps/backend-mldsa-44"]
-backend-mldsa-65 = ["apps/backend-mldsa-65"]
-backend-mldsa-87 = ["apps/backend-mldsa-87"]
+backend-mldsa44 = ["apps/backend-mldsa44"]
+backend-mldsa65 = ["apps/backend-mldsa65"]
+backend-mldsa87 = ["apps/backend-mldsa87"]

From d6cdacaa3be61788cf6e756e94f76bc290a01b68 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Thu, 27 Feb 2025 15:35:47 -0500
Subject: [PATCH 20/27] Merge in changes from upstream PR

---
 components/apps/src/lib.rs | 264 +++++++++++++++++++------------------
 1 file changed, 138 insertions(+), 126 deletions(-)

diff --git a/components/apps/src/lib.rs b/components/apps/src/lib.rs
index 1ca5b3da..daa68754 100644
--- a/components/apps/src/lib.rs
+++ b/components/apps/src/lib.rs
@@ -1,5 +1,8 @@
 #![no_std]
 
+#[cfg(feature = "trussed-usbip")]
+extern crate alloc;
+
 #[cfg(feature = "secrets-app")]
 const SECRETS_APP_CREDENTIALS_COUNT_LIMIT: u16 = 50;
 #[cfg(feature = "webcrypt")]
@@ -28,12 +31,11 @@ use serde::{Deserialize, Serialize};
 use trussed::{api::NotBefore, service::Filestore};
 use trussed::{
     backend::BackendId,
-    client::ClientBuilder,
     interrupt::InterruptFlag,
-    pipe::ServiceEndpoint,
+    pipe::{ServiceEndpoint, TrussedChannel},
     platform::Syscall,
     store::filestore::ClientFilestore,
-    types::{Location, Mechanism, Path},
+    types::{CoreContext, Location, Mechanism, Path},
     ClientImplementation, Platform, Service,
 };
 
@@ -46,8 +48,7 @@ use admin_app::{ConfigValueMut, ResetSignalAllocation};
 use webcrypt::{PeekingBypass, Webcrypt};
 
 mod dispatch;
-use dispatch::Backend;
-pub use dispatch::Dispatch;
+pub use dispatch::{Backend, Dispatch, DispatchContext};
 
 #[cfg(any(feature = "backend-auth", feature = "se050"))]
 pub use dispatch::AUTH_LOCATION;
@@ -315,7 +316,7 @@ pub struct PivConfig {
 }
 
 pub trait Runner {
-    type Syscall: Syscall + 'static;
+    type Syscall: Syscall + Clone + 'static;
 
     type Reboot: Reboot;
     type Store: trussed::store::Store;
@@ -344,6 +345,7 @@ pub struct Data<R: Runner> {
 }
 
 type Client<R> = ClientImplementation<
+    'static,
     <R as Runner>::Syscall,
     Dispatch<<R as Runner>::Twi, <R as Runner>::Se050Timer>,
 >;
@@ -410,6 +412,62 @@ pub struct Apps<R: Runner> {
     webcrypt: Option<PeekingBypass<'static, FidoApp<R>, WebcryptApp<R>>>,
 }
 
+const CLIENT_COUNT: usize = const {
+    // ndef is not listed here because it does not need a client
+    let clients = [
+        cfg!(feature = "fido-authenticator"),
+        cfg!(feature = "opcard"),
+        cfg!(feature = "piv-authenticator"),
+        cfg!(feature = "provisioner-app"),
+        cfg!(feature = "secrets-app"),
+        cfg!(feature = "webcrypt"),
+    ];
+
+    let mut n = 0;
+    let mut i = 0;
+    while i < clients.len() {
+        if clients[i] {
+            n += 1;
+        }
+        i += 1;
+    }
+    // admin-app is always enabled
+    n + 1
+};
+
+pub type Endpoint = ServiceEndpoint<'static, Backend, DispatchContext>;
+pub type Endpoints = Vec<Endpoint, CLIENT_COUNT>;
+
+pub struct ClientBuilder<R: Runner> {
+    syscall: R::Syscall,
+    endpoints: Endpoints,
+}
+
+impl<R: Runner> ClientBuilder<R> {
+    pub fn new(syscall: R::Syscall) -> Self {
+        Self {
+            syscall,
+            endpoints: Default::default(),
+        }
+    }
+
+    fn client<A: App<R>>(&mut self, runner: &R, config: &A::Config) -> Client<R> {
+        let interrupt = A::interrupt();
+        let backends = A::backends(runner, config);
+        let (requester, responder) = A::channel().split().unwrap();
+        let context = CoreContext::with_interrupt(A::CLIENT_ID.into(), interrupt);
+        self.endpoints
+            .push(Endpoint::new(responder, context, backends))
+            .ok()
+            .unwrap();
+        Client::<R>::new(requester, self.syscall.clone(), interrupt)
+    }
+
+    pub fn into_endpoints(self) -> Endpoints {
+        self.endpoints
+    }
+}
+
 const fn contains(data: &[Mechanism], item: Mechanism) -> bool {
     let mut i = 0;
     while i < data.len() {
@@ -442,32 +500,15 @@ const fn validate_mechanisms() {
         if contains(trussed_se050_backend::MECHANISMS, mechanism) {
             continue;
         }
-        // The usbip runner does not have the mechanisms normally provided by the se050 backend.
-        // Until there is a backend implementing them in software, we ignore them and return an
-        // error at runtime.
-        #[cfg(feature = "trussed-usbip")]
-        if contains(
-            &[
-                Mechanism::BrainpoolP256R1,
-                Mechanism::BrainpoolP256R1Prehashed,
-                Mechanism::BrainpoolP384R1,
-                Mechanism::BrainpoolP384R1Prehashed,
-                Mechanism::BrainpoolP512R1,
-                Mechanism::BrainpoolP512R1Prehashed,
-                Mechanism::P384,
-                Mechanism::P384Prehashed,
-                Mechanism::P521,
-                Mechanism::P521Prehashed,
-                Mechanism::Secp256k1,
-                Mechanism::Secp256k1Prehashed,
-            ],
-            mechanism,
-        ) {
+        #[cfg(feature = "backend-mldsa")]
+        if contains(trussed_pqc_backend::MECHANISMS, mechanism) {
             continue;
         }
 
         // This mechanism is not implemented by Trussed or any of the backends.
-        mechanism.panic();
+        // TODO: re-enable after fixing a bug that is including trussed-core features
+        // that aren't used elsewhere.
+        //mechanism.panic();
     }
 }
 
@@ -475,19 +516,13 @@ impl<R: Runner> Apps<R> {
     pub fn new<P: Platform>(
         runner: &R,
         trussed_service: &mut Service<P, Dispatch<R::Twi, R::Se050Timer>>,
-        mut make_client: impl FnMut(
-            &mut Service<P, Dispatch<R::Twi, R::Se050Timer>>,
-            &'static Path,
-            &'static [BackendId<Backend>],
-            Option<&'static InterruptFlag>,
-        ) -> Client<R>,
+        client_builder: &mut ClientBuilder<R>,
         data: Data<R>,
     ) -> Self {
         const {
             validate_mechanisms();
         }
 
-        let _ = (runner, &mut make_client);
         let Data {
             admin,
             #[cfg(feature = "fido-authenticator")]
@@ -497,11 +532,8 @@ impl<R: Runner> Apps<R> {
             ..
         } = data;
 
-        let (admin, init_status) =
-            Self::admin_app(runner, trussed_service, &mut make_client, admin);
+        let (admin, init_status) = Self::admin_app(runner, trussed_service, client_builder, admin);
 
-        let mut make_client =
-            |ids, backends, interrupt| make_client(trussed_service, ids, backends, interrupt);
         let migrated_successfully = !init_status.contains(InitStatus::MIGRATION_ERROR);
         #[cfg(feature = "opcard")]
         let config_has_error = init_status.contains(InitStatus::CONFIG_ERROR);
@@ -511,27 +543,27 @@ impl<R: Runner> Apps<R> {
         // error occured.
         #[cfg(feature = "opcard")]
         let opcard = (!config_has_error && migrated_successfully)
-            .then(|| App::new(runner, &mut make_client, (), &admin.config().opcard));
+            .then(|| App::new(runner, client_builder, (), &admin.config().opcard));
         #[cfg(all(feature = "fido-authenticator", not(feature = "webcrypt")))]
         let fido = migrated_successfully
-            .then(|| App::new(runner, &mut make_client, fido, &admin.config().fido));
+            .then(|| App::new(runner, client_builder, fido, &admin.config().fido));
 
         #[cfg(feature = "webcrypt")]
         let webcrypt_fido_bypass = migrated_successfully.then(|| {
             PeekingBypass::new(
-                App::new(runner, &mut make_client, fido, &admin.config().fido),
-                App::new(runner, &mut make_client, (), &()),
+                App::new(runner, client_builder, fido, &admin.config().fido),
+                App::new(runner, client_builder, (), &()),
             )
         });
 
         #[cfg(feature = "secrets-app")]
-        let oath = migrated_successfully.then(|| App::new(runner, &mut make_client, (), &()));
+        let oath = migrated_successfully.then(|| App::new(runner, client_builder, (), &()));
 
         #[cfg(feature = "piv-authenticator")]
-        let piv = migrated_successfully.then(|| App::new(runner, &mut make_client, (), &()));
+        let piv = migrated_successfully.then(|| App::new(runner, client_builder, (), &()));
 
         #[cfg(feature = "provisioner-app")]
-        let provisioner = App::new(runner, &mut make_client, provisioner, &());
+        let provisioner = App::new(runner, client_builder, provisioner, &());
 
         Self {
             #[cfg(all(feature = "fido-authenticator", not(feature = "webcrypt")))]
@@ -555,19 +587,13 @@ impl<R: Runner> Apps<R> {
     fn admin_app<P: Platform>(
         runner: &R,
         trussed_service: &mut Service<P, Dispatch<R::Twi, R::Se050Timer>>,
-        make_client: impl FnOnce(
-            &mut Service<P, Dispatch<R::Twi, R::Se050Timer>>,
-            &'static Path,
-            &'static [BackendId<Backend>],
-            Option<&'static InterruptFlag>,
-        ) -> Client<R>,
+        client_builder: &mut ClientBuilder<R>,
         mut data: AdminData<R>,
     ) -> (AdminApp<R>, InitStatus) {
-        let trussed = AdminApp::<R>::client(
-            runner,
-            |id, backends, interrupt| make_client(trussed_service, id, backends, interrupt),
-            &(),
-        );
+        #[cfg(not(feature = "se050"))]
+        let _ = trussed_service;
+
+        let trussed = client_builder.client::<AdminApp<R>>(runner, &());
         // TODO: use CLIENT_ID directly
         let mut filestore = ClientFilestore::new(ADMIN_APP_CLIENT_ID.into(), data.store);
         let version = data.version.encode();
@@ -606,8 +632,8 @@ impl<R: Runner> Apps<R> {
             && !app.config().opcard.use_se050_backend
         {
             use core::mem;
-            let opcard_trussed_auth_used = trussed_auth_backend::AuthBackend::is_client_active(
-                trussed_auth_backend::FilesystemLayout::V0,
+            let opcard_trussed_auth_used = trussed_auth::AuthBackend::is_client_active(
+                trussed_auth::FilesystemLayout::V0,
                 dispatch::AUTH_LOCATION,
                 path!("opcard"),
                 data.store,
@@ -677,29 +703,6 @@ impl<R: Runner> Apps<R> {
         (app, data.init_status)
     }
 
-    pub fn with_service<P: Platform>(
-        runner: &R,
-        trussed_service: &mut Service<P, Dispatch<R::Twi, R::Se050Timer>>,
-        data: Data<R>,
-    ) -> Self
-    where
-        R::Syscall: Default,
-    {
-        Self::new(
-            runner,
-            trussed_service,
-            |trussed_service, id, backends, interrupt| {
-                ClientBuilder::new(id)
-                    .backends(backends)
-                    .interrupt(interrupt)
-                    .prepare(trussed_service)
-                    .unwrap()
-                    .build(R::Syscall::default())
-            },
-            data,
-        )
-    }
-
     pub fn apdu_dispatch<F, T>(&mut self, f: F) -> T
     where
         F: FnOnce(&mut [&mut dyn ApduApp<ApduResponseSize>]) -> T,
@@ -789,28 +792,14 @@ where
 
     fn new(
         trussed_service: &mut Service<trussed::virt::Platform<S>, Dispatch<R::Twi, R::Se050Timer>>,
-        endpoints: &mut Vec<
-            ServiceEndpoint<
-                'static,
-                <dispatch::Dispatch<<R as Runner>::Twi, <R as Runner>::Se050Timer> as trussed::backend::Dispatch>::BackendId,
-                <dispatch::Dispatch<<R as Runner>::Twi, <R as Runner>::Se050Timer> as trussed::backend::Dispatch>::Context,
-            >,
-        >,
+        endpoints: &mut alloc::vec::Vec<Endpoint>,
         syscall: trussed_usbip::Syscall,
         (runner, data): (R, Data<R>),
     ) -> Self {
-        Self::new(
-            &runner,
-            trussed_service,
-            move |trussed_service, id, backends, _| {
-                ClientBuilder::new(id)
-                    .backends(backends)
-                    .prepare(trussed_service)
-                    .unwrap()
-                    .build(syscall.clone())
-            },
-            data,
-        )
+        let mut client_builder = ClientBuilder::new(syscall);
+        let apps = Self::new(&runner, trussed_service, &mut client_builder, data);
+        endpoints.extend(client_builder.into_endpoints());
+        apps
     }
 
     fn with_ctaphid_apps<T>(
@@ -839,37 +828,19 @@ trait App<R: Runner>: Sized {
 
     fn new(
         runner: &R,
-        make_client: impl FnOnce(
-            &'static Path,
-            &'static [BackendId<Backend>],
-            Option<&'static InterruptFlag>,
-        ) -> Client<R>,
+        client_builder: &mut ClientBuilder<R>,
         data: Self::Data,
         config: &Self::Config,
     ) -> Self {
-        let client = Self::client(runner, make_client, config);
+        let client = client_builder.client::<Self>(runner, config);
         Self::with_client(runner, client, data, config)
     }
 
-    fn client(
-        runner: &R,
-        make_client: impl FnOnce(
-            &'static Path,
-            &'static [BackendId<Backend>],
-            Option<&'static InterruptFlag>,
-        ) -> Client<R>,
-        config: &Self::Config,
-    ) -> Client<R> {
-        make_client(
-            Self::CLIENT_ID,
-            Self::backends(runner, config),
-            Self::interrupt(),
-        )
-    }
-
     fn with_client(runner: &R, trussed: Client<R>, data: Self::Data, config: &Self::Config)
         -> Self;
 
+    fn channel() -> &'static TrussedChannel;
+
     fn backends(runner: &R, config: &Self::Config) -> &'static [BackendId<Backend>] {
         let _ = (runner, config);
         const BACKENDS_DEFAULT: &[BackendId<Backend>] = &[];
@@ -993,6 +964,11 @@ impl<R: Runner> App<R> for AdminApp<R> {
         unimplemented!();
     }
 
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn interrupt() -> Option<&'static InterruptFlag> {
         static INTERRUPT: InterruptFlag = InterruptFlag::new();
         Some(&INTERRUPT)
@@ -1048,6 +1024,12 @@ impl<R: Runner> App<R> for FidoApp<R> {
             },
         )
     }
+
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn interrupt() -> Option<&'static InterruptFlag> {
         static INTERRUPT: InterruptFlag = InterruptFlag::new();
         Some(&INTERRUPT)
@@ -1081,6 +1063,12 @@ impl<R: Runner> App<R> for WebcryptApp<R> {
             ),
         )
     }
+
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn backends(runner: &R, _: &()) -> &'static [BackendId<Backend>] {
         const BACKENDS_WEBCRYPT: &[BackendId<Backend>] = &[
             BackendId::Custom(Backend::SoftwareRsa),
@@ -1111,12 +1099,19 @@ impl<R: Runner> App<R> for SecretsApp<R> {
         );
         Self::new(trussed, options)
     }
+
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn backends(runner: &R, _: &()) -> &'static [BackendId<Backend>] {
         const BACKENDS_OATH: &[BackendId<Backend>] =
             &[BackendId::Custom(Backend::Auth), BackendId::Core];
         let _ = runner;
         BACKENDS_OATH
     }
+
     fn interrupt() -> Option<&'static InterruptFlag> {
         static INTERRUPT: InterruptFlag = InterruptFlag::new();
         Some(&INTERRUPT)
@@ -1184,9 +1179,16 @@ impl<R: Runner> App<R> for OpcardApp<R> {
         }
         Self::new(trussed, options)
     }
+
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn backends(_runner: &R, config: &OpcardConfig) -> &'static [BackendId<Backend>] {
         config.backends()
     }
+
     fn interrupt() -> Option<&'static InterruptFlag> {
         static INTERRUPT: InterruptFlag = InterruptFlag::new();
         Some(&INTERRUPT)
@@ -1206,19 +1208,23 @@ impl<R: Runner> App<R> for PivApp<R> {
             piv_authenticator::Options::default().uuid(Some(runner.uuid())),
         )
     }
+
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn backends(runner: &R, _: &()) -> &'static [BackendId<Backend>] {
         const BACKENDS_PIV: &[BackendId<Backend>] = &[
             #[cfg(feature = "se050")]
             BackendId::Custom(Backend::Se050),
-            #[cfg(feature = "backend-rsa")]
-            BackendId::Custom(Backend::SoftwareRsa),
-            BackendId::Custom(Backend::Auth),
             BackendId::Custom(Backend::Staging),
             BackendId::Core,
         ];
         let _ = runner;
         BACKENDS_PIV
     }
+
     fn interrupt() -> Option<&'static InterruptFlag> {
         static INTERRUPT: InterruptFlag = InterruptFlag::new();
         Some(&INTERRUPT)
@@ -1251,6 +1257,12 @@ impl<R: Runner> App<R> for ProvisionerApp<R> {
             data.rebooter,
         )
     }
+
+    fn channel() -> &'static TrussedChannel {
+        static CHANNEL: TrussedChannel = TrussedChannel::new();
+        &CHANNEL
+    }
+
     fn interrupt() -> Option<&'static InterruptFlag> {
         static INTERRUPT: InterruptFlag = InterruptFlag::new();
         Some(&INTERRUPT)

From a9d2550b6c17099968914d8463081a617ec3678b Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Fri, 28 Feb 2025 17:48:14 -0500
Subject: [PATCH 21/27] Fix to use the right features in dependencies

---
 .vscode/launch.json        | 2 +-
 Cargo.lock                 | 1 +
 Cargo.toml                 | 6 ++----
 components/apps/Cargo.toml | 6 +++---
 4 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index a35e391c..a3830c08 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -29,7 +29,7 @@
             ],
             "env": {
                 "RUST_BACKTRACE": "1",
-                //"RUST_LOG": "debug",
+                "RUST_LOG": "debug",
             },
             "cwd": "${workspaceFolder}/runners/usbip",
         },
diff --git a/Cargo.lock b/Cargo.lock
index a3c02328..72e50ac7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3641,6 +3641,7 @@ dependencies = [
 [[package]]
 name = "trussed-usbip"
 version = "0.0.1"
+source = "git+https://github.com/trussed-dev/pc-usbip-runner.git#a0e9b855809577f0067a93e08c716aa285b03700"
 dependencies = [
  "apdu-dispatch",
  "ctaphid-dispatch",
diff --git a/Cargo.toml b/Cargo.toml
index fa944835..96272339 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,11 +18,9 @@ memory-regions = { path = "components/memory-regions" }
 
 # unreleased libraries
 p256-cortex-m4  = { git = "https://github.com/ycrypto/p256-cortex-m4.git", rev = "cdb31e12594b4dc1f045b860a885fdc94d96aee2" }
-#trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "6bba8fde36d05c0227769eb63345744e87d84b2b" }
-#trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "4fe4e4e287dac1d92fcd4f97e8926497bfa9d7a9" }
 lpc55-hal = { git = "https://github.com/lpc55/lpc55-hal.git", rev ="1a25fc366013503b46af938646c88aed4e36d74c" }
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "805fe7657e79e06b3220324481cd6325b94877d7" }
-trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "a0e9b855809577f0067a93e08c716aa285b03700" }
+#trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "805fe7657e79e06b3220324481cd6325b94877d7" }
+#trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "a0e9b855809577f0067a93e08c716aa285b03700" }
 
 # applications
 admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.19" }
diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index 7442cea5..dcc6a669 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -79,9 +79,9 @@ backend-software-hpke = ["trussed-staging/hpke"]
 # PQC backend must be included and the corresponding algorithm features
 # there must be set.
 backend-mldsa = ["dep:trussed-pqc-backend"]
-backend-mldsa44 = ["backend-mldsa", "trussed-pqc-backend/mldsa44", "fido-authenticator/mldsa44"]
-backend-mldsa65 = ["backend-mldsa", "trussed-pqc-backend/mldsa65", "fido-authenticator/mldsa65"]
-backend-mldsa87 = ["backend-mldsa", "trussed-pqc-backend/mldsa87", "fido-authenticator/mldsa87"]
+backend-mldsa44 = ["backend-mldsa", "trussed-pqc-backend/mldsa44", "fido-authenticator/mldsa44", "usbd-ctaphid/mldsa44", "ctaphid-dispatch/mldsa44"]
+backend-mldsa65 = ["backend-mldsa", "trussed-pqc-backend/mldsa65", "fido-authenticator/mldsa65", "usbd-ctaphid/mldsa65", "ctaphid-dispatch/mldsa65"]
+backend-mldsa87 = ["backend-mldsa", "trussed-pqc-backend/mldsa87", "fido-authenticator/mldsa87", "usbd-ctaphid/mldsa87", "ctaphid-dispatch/mldsa87"]
 
 log-all = ["admin-app/log-all", "fido-authenticator?/log-all", "secrets-app?/log-all", "webcrypt?/log-all", "opcard?/log-all", "provisioner-app?/log-all"]
 log-error = []

From 03305d120b1ea333827f32fa14abd7c1cd398dc2 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Tue, 11 Mar 2025 12:21:20 -0400
Subject: [PATCH 22/27] Update dependency references

---
 Cargo.lock | 151 ++++++++++++++++++++++++++---------------------------
 Cargo.toml |  26 +++++----
 2 files changed, 92 insertions(+), 85 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 72e50ac7..5a4fa97a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -141,9 +141,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.96"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b964d184e89d9b6b67dd2715bc8e74cf3107fb2b529990c90cf517326150bf4"
+checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
 
 [[package]]
 name = "apdu-app"
@@ -173,7 +173,7 @@ version = "1.8.0"
 dependencies = [
  "admin-app",
  "apdu-dispatch",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cbor-smol",
  "ctaphid-dispatch",
  "delog",
@@ -315,7 +315,7 @@ version = "0.69.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cexpr",
  "clang-sys",
  "itertools",
@@ -326,7 +326,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -343,9 +343,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
 
 [[package]]
 name = "block-buffer"
@@ -423,9 +423,9 @@ checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
 
 [[package]]
 name = "bytemuck"
-version = "1.21.0"
+version = "1.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
+checksum = "b6b1fc10dbac614ebc03540c9dbd60e83887fda27794998c6528f1782047d540"
 
 [[package]]
 name = "byteorder"
@@ -455,7 +455,7 @@ dependencies = [
  "csv",
  "getopts",
  "itertools",
- "semver 1.0.25",
+ "semver 1.0.26",
  "serde",
  "serde_derive",
  "serde_json",
@@ -469,7 +469,7 @@ version = "7.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c408da54db4c50d4693f7e649c299bc9de9c23ead86249e5368830bb32a734b"
 dependencies = [
- "semver 1.0.25",
+ "semver 1.0.26",
  "serde",
  "toml 0.5.11",
  "url",
@@ -492,7 +492,7 @@ checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
 dependencies = [
  "camino",
  "cargo-platform",
- "semver 1.0.25",
+ "semver 1.0.26",
  "serde",
  "serde_json",
  "thiserror",
@@ -527,9 +527,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.15"
+version = "1.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c736e259eea577f443d5c86c304f9f4ae0295c43f3ba05c21f1d66b5f06001af"
+checksum = "be714c154be609ec7f5dad223a33bf1482fff90472de28f7362806e6d4832b8c"
 dependencies = [
  "jobserver",
  "libc",
@@ -658,7 +658,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -703,9 +703,9 @@ checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "console"
-version = "0.15.10"
+version = "0.15.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea3c6ecd8059b57859df5c69830340ed3c41d30e3da0c1cbed90a96ac853041b"
+checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
 dependencies = [
  "encode_unicode",
  "libc",
@@ -977,7 +977,7 @@ checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -1028,7 +1028,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -1263,7 +1263,7 @@ checksum = "e9985657bc39bae5cb7f4e686b46c67b1ea37390d82fe4bab56d7cd1933429d7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
  "synstructure",
 ]
 
@@ -1735,7 +1735,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -1823,11 +1823,10 @@ checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "iso7816"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75f5d3f2d959c5d37b382ed9b5a32d0a0e6112ab6ac9eb8fce82359db6f2367"
+checksum = "cd3c7e91da489667bb054f9cd2f1c60cc2ac4478a899f403d11dbc62189215b0"
 dependencies = [
- "delog",
  "heapless",
 ]
 
@@ -1842,9 +1841,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "jobserver"
@@ -1949,7 +1948,7 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a81a4745d38b288b7583fe8ea3736897628df81f4d0f1d0314fa5a3af570de4"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "heapless-bytes",
  "serde",
 ]
@@ -2295,7 +2294,7 @@ source = "git+https://github.com/Nitrokey/opcard-rs?rev=39ec4c37f808c0cfeb84e0a8
 dependencies = [
  "admin-app",
  "apdu-app",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cbor-smol",
  "cfg-if",
  "delog",
@@ -2503,9 +2502,9 @@ dependencies = [
 
 [[package]]
 name = "pqcrypto-internals"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad4cd1b8413da8217c3bcb04b10fa728faa9bd77067e8314ca5d363ca0a37d4"
+checksum = "5f408e9e302fffe05f781c95777cb36bbfc51daccf518c28c5829d49a989df22"
 dependencies = [
  "cc",
  "dunce",
@@ -2515,9 +2514,9 @@ dependencies = [
 
 [[package]]
 name = "pqcrypto-mldsa"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5439d511d79dcacbc91a11e9e78013aec955e399669bfae3955442d2f724b140"
+checksum = "6bd3ecb90717f6bda0ad327703be9e899cdfa88f7ce05563bfd7016f8742bad6"
 dependencies = [
  "cc",
  "glob",
@@ -2578,9 +2577,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.93"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
 dependencies = [
  "unicode-ident",
 ]
@@ -2614,9 +2613,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "c1f1914ce909e1658d9907913b4b91947430c7d9be598b15a1912935b8c04801"
 dependencies = [
  "proc-macro2",
 ]
@@ -2659,11 +2658,11 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.9"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b568323e98e49e2a0899dcee453dd679fae22d69adf9b11dd508d1549b7e2f"
+checksum = "0b8c0c260b63a8219631167be35e6a988e9554dbd323f8bd08439c8ed1302bd1"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
 ]
 
 [[package]]
@@ -2802,20 +2801,20 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.25",
+ "semver 1.0.26",
 ]
 
 [[package]]
 name = "rustversion"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
 
 [[package]]
 name = "ryu"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea1a2d0a644769cc99faa24c3ad26b379b786fe7c36fd3c546254801650e6dd"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "salty"
@@ -2848,7 +2847,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3ad92298f6eb2377e187610511550737cf2434cb36b177cdc1bd468abb44533"
 dependencies = [
  "aes",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cmac",
  "crc16",
  "delog",
@@ -2883,7 +2882,7 @@ version = "0.13.0"
 source = "git+https://github.com/Nitrokey/trussed-secrets-app?rev=700863bdfa90a3616cbb695d6638c7aea7730c03#700863bdfa90a3616cbb695d6638c7aea7730c03"
 dependencies = [
  "apdu-app",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "block-padding",
  "cbor-smol",
  "ctaphid-app",
@@ -2911,9 +2910,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79dfe2d285b0488816f30e700a7438c5a73d816b5b7d3ac72fbc48b0d185e03"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 dependencies = [
  "serde",
 ]
@@ -2959,14 +2958,14 @@ checksum = "fca2da10b1f1623f47130256065e05e94fd7a98dbd26a780a4c5de831b21e5c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.15"
+version = "0.11.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "387cc504cb06bb40a96c8e04e951fe01854cf6bc921053c954e4a606d9675c6a"
+checksum = "364fec0df39c49a083c9a8a18a23a6bcfd9af130fe9fe321d18520a0d113e09e"
 dependencies = [
  "serde",
 ]
@@ -2979,14 +2978,14 @@ checksum = "f09503e191f4e797cb8aac08e9a4a4695c5edf6a2e70e376d961ddd5c969f82b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.139"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44f86c3acccc9c65b153fe1b85a3be07fe5515274ec9f0653b4a0875731c72a6"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
  "itoa",
  "memchr",
@@ -2996,13 +2995,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -3195,7 +3194,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -3217,9 +3216,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.98"
+version = "2.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
+checksum = "e02e925281e18ffd9d640e234264753c43edc62d64b2d4cf898f1bc5e75f3fc2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3234,7 +3233,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -3274,7 +3273,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -3359,7 +3358,7 @@ checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -3406,7 +3405,7 @@ name = "trussed"
 version = "0.1.0"
 dependencies = [
  "aes",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cbc",
  "cbor-smol",
  "cfg-if",
@@ -3569,7 +3568,7 @@ name = "trussed-se050-backend"
 version = "0.3.6"
 source = "git+https://github.com/Nitrokey/trussed-se050-backend.git?rev=131c973fbe74d677fb8c8df97c210f78608994f0#131c973fbe74d677fb8c8df97c210f78608994f0"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cbor-smol",
  "chacha20poly1305",
  "crypto-bigint",
@@ -3681,7 +3680,7 @@ checksum = "560b82d656506509d43abe30e0ba64c56b1953ab3d4fe7ba5902747a7a3cedd5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -3704,9 +3703,9 @@ checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "unicode-width"
@@ -3840,7 +3839,7 @@ dependencies = [
  "littlefs2",
  "quickcheck",
  "regex",
- "semver 1.0.25",
+ "semver 1.0.26",
 ]
 
 [[package]]
@@ -3904,7 +3903,7 @@ dependencies = [
  "log",
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
  "wasm-bindgen-shared",
 ]
 
@@ -3926,7 +3925,7 @@ checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -4212,7 +4211,7 @@ checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
  "synstructure",
 ]
 
@@ -4234,7 +4233,7 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -4254,7 +4253,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
  "synstructure",
 ]
 
@@ -4275,7 +4274,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
 
 [[package]]
@@ -4297,5 +4296,5 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.99",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 96272339..1274138d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -37,15 +37,23 @@ trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backe
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "1e1ca03a3a62ea9b802f4070ea4bce002eeb4bec" }
 
 # TODO: revert these to Git versions
-trussed-pqc-backend = { path = "../trussed-pqc-backend" }
-trussed-core = { path = "../trussed/core" }
-trussed = { path = "../trussed" }
-fido-authenticator = { path = "../fido-authenticator" }
-ctap-types = { path = "../ctap-types" }
-cosey = { path = "../cosey" }
-trussed-rsa-alloc = { path = "../trussed-rsa-backend" }
-ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
-usbd-ctaphid = { path = "../usbd-ctaphid" }
+#trussed-pqc-backend = { path = "../trussed-pqc-backend" }
+#trussed-core = { path = "../trussed/core" }
+#trussed = { path = "../trussed" }
+#fido-authenticator = { path = "../fido-authenticator" }
+#ctap-types = { path = "../ctap-types" }
+#cosey = { path = "../cosey" }
+#ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
+#usbd-ctaphid = { path = "../usbd-ctaphid" }
+trussed-core = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
+trussed = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
+trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-backend.git", branch = "dev"}
+fido-authenticator = { git = "https://github.com/sandbox-quantum/fido-authenticator.git", branch = "feat/pqc"}
+ctap-types = { git =  "https://github.com/sandbox-quantum/ctap-types.git", branch = "feat/pqc-v2" }
+cosey = { git = "https://github.com/sandbox-quantum/cosey.git", branch = "feat/pqc-v2" }
+trussed-rsa-alloc = { git = "https://github.com/sandbox-quantum/trussed-rsa-backend.git", branch = "feat/pqc" }
+ctaphid-dispatch = { git = "https://github.com/sandbox-quantum/ctaphid-dispatch.git", branch = "feat/pqc"}
+usbd-ctaphid = { git = "https://github.com/sandbox-quantum/usbd-ctaphid.git", branch = "feat/pqc" }
 trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git"}
 
 [profile.release]

From 34e18135ece1a59f3a4d3995172dbe88bdb833e1 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Tue, 11 Mar 2025 14:25:16 -0400
Subject: [PATCH 23/27] Update patch references

---
 Cargo.lock | 153 +++++++++++++++++++++++++++++------------------------
 Cargo.toml |   6 +--
 2 files changed, 87 insertions(+), 72 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 59e9be9b..2a71c98b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -301,9 +301,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64ct"
-version = "1.6.0"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+checksum = "bb97d56060ee67d285efb8001fec9d2a4c710c32efd2e14b5cbb5ba71930fc2d"
 
 [[package]]
 name = "bindgen"
@@ -314,13 +314,13 @@ dependencies = [
  "bitflags 2.9.0",
  "cexpr",
  "clang-sys",
- "itertools",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -447,13 +447,13 @@ dependencies = [
  "clap",
  "csv",
  "getopts",
- "itertools",
+ "itertools 0.12.1",
  "semver 1.0.26",
  "serde",
  "serde_derive",
  "serde_json",
  "spdx",
- "toml 0.8.14",
+ "toml 0.8.20",
 ]
 
 [[package]]
@@ -613,9 +613,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.31"
+version = "4.5.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "027bb0d98429ae334a8698531da7077bdf906419543a35a55c2cb1b66437d767"
+checksum = "6088f3ae8c3608d19260cd7445411865a485688711b78b5be70d78cd96136f83"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -632,9 +632,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.31"
+version = "4.5.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5589e0cba072e0f3d23791efac0fd8627b49c829c196a492e88168e6a669d863"
+checksum = "22a7ef7f676155edfb82daa97f99441f3ebf4a58d5e32f295a56259f1b6facc8"
 dependencies = [
  "anstream",
  "anstyle",
@@ -644,14 +644,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.28"
+version = "4.5.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ced95c6f4a675af3da73304b9ac4ed991640c36374e4b46795c49e17cf1ed"
+checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -798,7 +798,8 @@ dependencies = [
 
 [[package]]
 name = "cosey"
-version = "0.3.1"
+version = "0.3.2"
+source = "git+https://github.com/sandbox-quantum/cosey.git?branch=feat/pqc-v2#d31b98ddb7712f4b1964310a3d0ae6aa04004ce1"
 dependencies = [
  "cfg-if",
  "heapless-bytes",
@@ -883,6 +884,7 @@ dependencies = [
 [[package]]
 name = "ctap-types"
 version = "0.3.2"
+source = "git+https://github.com/sandbox-quantum/ctap-types.git?branch=feat/pqc-v2#b9462b2e2dedc104d53aab688fc0e7bb33996256"
 dependencies = [
  "bitflags 1.3.2",
  "cbor-smol",
@@ -911,6 +913,7 @@ dependencies = [
 [[package]]
 name = "ctaphid-dispatch"
 version = "0.2.0"
+source = "git+https://github.com/sandbox-quantum/ctaphid-dispatch.git?branch=feat/pqc#79246f048064a7362bea108da2ed31d960f3b887"
 dependencies = [
  "ctaphid-app",
  "delog",
@@ -976,7 +979,7 @@ checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -1027,7 +1030,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -1060,9 +1063,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7914353092ddf589ad78f25c5c1c21b7f80b0ff8621e7c814c3485b5306da9d"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "elliptic-curve"
@@ -1090,7 +1093,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f2de9133f68db0d4627ad69db767726c99ff8585272716708227008d3f1bddd"
 dependencies = [
  "const-default",
- "critical-section 1.1.2",
+ "critical-section",
  "linked_list_allocator",
  "rlsf",
 ]
@@ -1211,9 +1214,9 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "ff"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
  "rand_core",
  "subtle",
@@ -1222,7 +1225,7 @@ dependencies = [
 [[package]]
 name = "fido-authenticator"
 version = "0.1.1"
-source = "git+https://github.com/Nitrokey/fido-authenticator.git?tag=v0.1.1-nitrokey.26#443eca178726f6de29ec86cbf70a92f47d385853"
+source = "git+https://github.com/sandbox-quantum/fido-authenticator.git?branch=feat/pqc#137bceb0b3ed04b9302ceb66008b1198885e7ab1"
 dependencies = [
  "apdu-app",
  "cbor-smol",
@@ -1275,7 +1278,7 @@ checksum = "e9985657bc39bae5cb7f4e686b46c67b1ea37390d82fe4bab56d7cd1933429d7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
  "synstructure",
 ]
 
@@ -1557,9 +1560,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hermit-abi"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+checksum = "fbd780fe5cc30f81464441920d82ac8740e2e46b29a6fad543ddd075229ce37e"
 
 [[package]]
 name = "hex"
@@ -1747,7 +1750,7 @@ checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -1789,9 +1792,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.7.1"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9c992b02b5b4c94ea26e32fe5bccb7aa7d9f390ab5c1221ff895bc7ea8b652"
+checksum = "3954d50fe15b02142bf25d3b8bdadb634ec3948f103d04ffe3031bc8fe9d7058"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.2",
@@ -1818,9 +1821,9 @@ dependencies = [
 
 [[package]]
 name = "is-terminal"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e19b23d53f35ce9f56aebc7d1bb4e6ac1e9c0db7ac85c8d1760c04379edced37"
+checksum = "e04d7f318608d35d4b61ddd75cbdaee86b023ebe2bd5a66ee0915f0bf93095a9"
 dependencies = [
  "hermit-abi",
  "libc",
@@ -1851,6 +1854,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.15"
@@ -1903,9 +1915,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.170"
+version = "0.2.171"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "875b3680cb2f8f71bdcf9a30f38d48282f5d3c95cbf9b3fa57269bb5d5c06828"
+checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
 
 [[package]]
 name = "libloading"
@@ -2283,9 +2295,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.3"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
+checksum = "cde51589ab56b20a6f686b2c68f7a0bd6add753d697abf720d63f8db3ab7b1ad"
 
 [[package]]
 name = "opaque-debug"
@@ -2499,9 +2511,9 @@ checksum = "7c68cb38ed13fd7bc9dd5db8f165b7c8d9c1a315104083a2b10f11354c2af97f"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
  "zerocopy",
 ]
@@ -2860,9 +2872,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "se05x"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3ad92298f6eb2377e187610511550737cf2434cb36b177cdc1bd468abb44533"
+checksum = "2b9e3417bc0bb914db04464566fd6cbf178f9e0937e6de064b44706b4135351c"
 dependencies = [
  "aes",
  "bitflags 2.9.0",
@@ -2943,9 +2955,9 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
 [[package]]
 name = "serde"
-version = "1.0.218"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8dfc9d19bdbf6d17e22319da49161d5d0108e4188e8b680aef6299eed22df60"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
@@ -2976,27 +2988,27 @@ checksum = "fca2da10b1f1623f47130256065e05e94fd7a98dbd26a780a4c5de831b21e5c2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.16"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "364fec0df39c49a083c9a8a18a23a6bcfd9af130fe9fe321d18520a0d113e09e"
+checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.218"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09503e191f4e797cb8aac08e9a4a4695c5edf6a2e70e376d961ddd5c969f82b"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3019,7 +3031,7 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3203,7 +3215,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3222,7 +3234,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 1.0.109",
- "unicode-width",
+ "unicode-width 0.1.14",
 ]
 
 [[package]]
@@ -3238,9 +3250,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.99"
+version = "2.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e02e925281e18ffd9d640e234264753c43edc62d64b2d4cf898f1bc5e75f3fc2"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3255,7 +3267,7 @@ checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3295,7 +3307,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3354,7 +3366,7 @@ version = "0.22.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
 dependencies = [
- "indexmap 2.7.1",
+ "indexmap 2.8.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -3380,7 +3392,7 @@ checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3425,7 +3437,7 @@ dependencies = [
 [[package]]
 name = "trussed"
 version = "0.1.0"
-source = "git+https://github.com/trussed-dev/trussed.git?rev=024e0eca5fb7dbd2457831f7c7bffe4341e08775#024e0eca5fb7dbd2457831f7c7bffe4341e08775"
+source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat/pqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
 dependencies = [
  "aes",
  "bitflags 2.9.0",
@@ -3503,6 +3515,7 @@ dependencies = [
 [[package]]
 name = "trussed-core"
 version = "0.1.0"
+source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat/pqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
 dependencies = [
  "cfg-if",
  "heapless-bytes",
@@ -3560,6 +3573,7 @@ dependencies = [
 [[package]]
 name = "trussed-pqc-backend"
 version = "0.1.0"
+source = "git+https://github.com/sandbox-quantum/trussed-pqc-backend.git?branch=dev#c315350fbafcc1668d0d76d0f9e5c0fd3907ccdf"
 dependencies = [
  "cosey",
  "der",
@@ -3575,6 +3589,7 @@ dependencies = [
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
+source = "git+https://github.com/sandbox-quantum/trussed-rsa-backend.git?branch=feat/pqc#c4b3bc9ff91bfdbf9979364b869c98cc2ce03f3d"
 dependencies = [
  "delog",
  "heapless-bytes",
@@ -3706,7 +3721,7 @@ checksum = "560b82d656506509d43abe30e0ba64c56b1953ab3d4fe7ba5902747a7a3cedd5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -3795,6 +3810,7 @@ dependencies = [
 [[package]]
 name = "usbd-ctaphid"
 version = "0.2.0"
+source = "git+https://github.com/sandbox-quantum/usbd-ctaphid.git?branch=feat/pqc#b062de711acb6b0663a9f37c98d79dac73b961d2"
 dependencies = [
  "ctaphid-dispatch",
  "delog",
@@ -3930,7 +3946,7 @@ dependencies = [
  "log",
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
  "wasm-bindgen-shared",
 ]
 
@@ -3952,7 +3968,7 @@ checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -4238,29 +4254,28 @@ checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.7.35"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+checksum = "fd97444d05a4328b90e75e503a34bad781f14e28a823ad3557f0750df1ebcbc6"
 dependencies = [
- "byteorder",
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.35"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+checksum = "6352c01d0edd5db859a63e2605f4ea3183ddbd15e2c4a9e7d32184df75e4f154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -4280,7 +4295,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
  "synstructure",
 ]
 
@@ -4301,7 +4316,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -4323,5 +4338,5 @@ checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.99",
+ "syn 2.0.100",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index ba713fda..85b8bc4c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,25 +39,25 @@ trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backe
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "7922d67e9637a87e5625aaff9e5111f0d4ec0346" }
 cargo-license = { git = "https://github.com/Nitrokey/cargo-license.git", rev = "d38912dc4b7a10d3cf48f8cf86f49640ff3173ab" }
 
-# TODO: revert these to Git versions
+# TODO: remove these patches and point the dependencies in each crate at the real releases
 #trussed-pqc-backend = { path = "../trussed-pqc-backend" }
 #trussed-core = { path = "../trussed/core" }
 #trussed = { path = "../trussed" }
 #fido-authenticator = { path = "../fido-authenticator" }
 #ctap-types = { path = "../ctap-types" }
 #cosey = { path = "../cosey" }
+#trussed-rsa-alloc = { path = "../trussed-rsa-backend" }
 #ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
 #usbd-ctaphid = { path = "../usbd-ctaphid" }
+trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-backend.git", branch = "dev"}
 trussed-core = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
 trussed = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
-trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-backend.git", branch = "dev"}
 fido-authenticator = { git = "https://github.com/sandbox-quantum/fido-authenticator.git", branch = "feat/pqc"}
 ctap-types = { git =  "https://github.com/sandbox-quantum/ctap-types.git", branch = "feat/pqc-v2" }
 cosey = { git = "https://github.com/sandbox-quantum/cosey.git", branch = "feat/pqc-v2" }
 trussed-rsa-alloc = { git = "https://github.com/sandbox-quantum/trussed-rsa-backend.git", branch = "feat/pqc" }
 ctaphid-dispatch = { git = "https://github.com/sandbox-quantum/ctaphid-dispatch.git", branch = "feat/pqc"}
 usbd-ctaphid = { git = "https://github.com/sandbox-quantum/usbd-ctaphid.git", branch = "feat/pqc" }
-trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git"}
 
 [profile.release]
 codegen-units = 1

From fb3c16b3a487475cc4efe379e22de3494ef29212 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Tue, 11 Mar 2025 14:28:03 -0400
Subject: [PATCH 24/27] Update rust version

---
 rust-toolchain.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index e6972fe0..49f500e0 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.82.0"
+channel = "1.85.0"
 components = ["rustfmt", "llvm-tools-preview", "clippy"]
 targets = ["thumbv7em-none-eabihf", "thumbv8m.main-none-eabi"]

From 8593207289a49045a6c5a22713ae59c97a934770 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Wed, 12 Mar 2025 13:12:15 -0400
Subject: [PATCH 25/27] Update dependencies

---
 Cargo.lock | 24 ++++++++++++------------
 Cargo.toml |  4 ++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f709ef04..fc97d7a9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "admin-app"
@@ -799,7 +799,7 @@ dependencies = [
 [[package]]
 name = "cosey"
 version = "0.3.2"
-source = "git+https://github.com/sandbox-quantum/cosey.git?branch=feat/pqc-v2#d31b98ddb7712f4b1964310a3d0ae6aa04004ce1"
+source = "git+https://github.com/sandbox-quantum/cosey.git?branch=feat%2Fpqc#d31b98ddb7712f4b1964310a3d0ae6aa04004ce1"
 dependencies = [
  "cfg-if",
  "heapless-bytes",
@@ -884,7 +884,7 @@ dependencies = [
 [[package]]
 name = "ctap-types"
 version = "0.3.2"
-source = "git+https://github.com/sandbox-quantum/ctap-types.git?branch=feat/pqc-v2#b9462b2e2dedc104d53aab688fc0e7bb33996256"
+source = "git+https://github.com/sandbox-quantum/ctap-types.git?branch=feat%2Fpqc#b9462b2e2dedc104d53aab688fc0e7bb33996256"
 dependencies = [
  "bitflags 1.3.2",
  "cbor-smol",
@@ -913,7 +913,7 @@ dependencies = [
 [[package]]
 name = "ctaphid-dispatch"
 version = "0.2.0"
-source = "git+https://github.com/sandbox-quantum/ctaphid-dispatch.git?branch=feat/pqc#79246f048064a7362bea108da2ed31d960f3b887"
+source = "git+https://github.com/sandbox-quantum/ctaphid-dispatch.git?branch=feat%2Fpqc#79246f048064a7362bea108da2ed31d960f3b887"
 dependencies = [
  "ctaphid-app",
  "delog",
@@ -1225,7 +1225,7 @@ dependencies = [
 [[package]]
 name = "fido-authenticator"
 version = "0.1.1"
-source = "git+https://github.com/sandbox-quantum/fido-authenticator.git?branch=feat/pqc#137bceb0b3ed04b9302ceb66008b1198885e7ab1"
+source = "git+https://github.com/sandbox-quantum/fido-authenticator.git?branch=feat%2Fpqc#137bceb0b3ed04b9302ceb66008b1198885e7ab1"
 dependencies = [
  "apdu-app",
  "cbor-smol",
@@ -2631,9 +2631,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.39"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1f1914ce909e1658d9907913b4b91947430c7d9be598b15a1912935b8c04801"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
@@ -3437,7 +3437,7 @@ dependencies = [
 [[package]]
 name = "trussed"
 version = "0.1.0"
-source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat/pqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
+source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat%2Fpqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
 dependencies = [
  "aes",
  "bitflags 2.9.0",
@@ -3515,7 +3515,7 @@ dependencies = [
 [[package]]
 name = "trussed-core"
 version = "0.1.0"
-source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat/pqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
+source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat%2Fpqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
 dependencies = [
  "cfg-if",
  "heapless-bytes",
@@ -3573,7 +3573,7 @@ dependencies = [
 [[package]]
 name = "trussed-pqc-backend"
 version = "0.1.0"
-source = "git+https://github.com/sandbox-quantum/trussed-pqc-backend.git?branch=dev#c315350fbafcc1668d0d76d0f9e5c0fd3907ccdf"
+source = "git+https://github.com/sandbox-quantum/trussed-pqc-backend.git?branch=dev#bfb77d46633d627e7c4956bfea2459104dfafaae"
 dependencies = [
  "cosey",
  "der",
@@ -3589,7 +3589,7 @@ dependencies = [
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
-source = "git+https://github.com/sandbox-quantum/trussed-rsa-backend.git?branch=feat/pqc#c4b3bc9ff91bfdbf9979364b869c98cc2ce03f3d"
+source = "git+https://github.com/sandbox-quantum/trussed-rsa-backend.git?branch=feat%2Fpqc#e7085a00931da583d15057eab21d12924dc13bc9"
 dependencies = [
  "delog",
  "heapless-bytes",
@@ -3810,7 +3810,7 @@ dependencies = [
 [[package]]
 name = "usbd-ctaphid"
 version = "0.2.0"
-source = "git+https://github.com/sandbox-quantum/usbd-ctaphid.git?branch=feat/pqc#b062de711acb6b0663a9f37c98d79dac73b961d2"
+source = "git+https://github.com/sandbox-quantum/usbd-ctaphid.git?branch=feat%2Fpqc#b062de711acb6b0663a9f37c98d79dac73b961d2"
 dependencies = [
  "ctaphid-dispatch",
  "delog",
diff --git a/Cargo.toml b/Cargo.toml
index 46d899c1..8586969a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -53,8 +53,8 @@ trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-ba
 trussed-core = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
 trussed = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
 fido-authenticator = { git = "https://github.com/sandbox-quantum/fido-authenticator.git", branch = "feat/pqc"}
-ctap-types = { git =  "https://github.com/sandbox-quantum/ctap-types.git", branch = "feat/pqc-v2" }
-cosey = { git = "https://github.com/sandbox-quantum/cosey.git", branch = "feat/pqc-v2" }
+ctap-types = { git =  "https://github.com/sandbox-quantum/ctap-types.git", branch = "feat/pqc" }
+cosey = { git = "https://github.com/sandbox-quantum/cosey.git", branch = "feat/pqc" }
 trussed-rsa-alloc = { git = "https://github.com/sandbox-quantum/trussed-rsa-backend.git", branch = "feat/pqc" }
 ctaphid-dispatch = { git = "https://github.com/sandbox-quantum/ctaphid-dispatch.git", branch = "feat/pqc"}
 usbd-ctaphid = { git = "https://github.com/sandbox-quantum/usbd-ctaphid.git", branch = "feat/pqc" }

From 8b3ce160d74d2e75315e280dc887db9e00fdab9b Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Wed, 26 Mar 2025 13:00:48 -0400
Subject: [PATCH 26/27] Update crate references

---
 Cargo.lock | 16 +++++-----------
 Cargo.toml |  4 +---
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index fc97d7a9..d98fd220 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -799,14 +799,12 @@ dependencies = [
 [[package]]
 name = "cosey"
 version = "0.3.2"
-source = "git+https://github.com/sandbox-quantum/cosey.git?branch=feat%2Fpqc#d31b98ddb7712f4b1964310a3d0ae6aa04004ce1"
+source = "git+https://github.com/sandbox-quantum/cosey.git?branch=feat%2Fpqc#934ba2511342fd466b6e4af87a4068f9e6b0aece"
 dependencies = [
- "cfg-if",
  "heapless-bytes",
  "paste",
  "pqcrypto-mldsa",
  "serde",
- "serde-big-array",
  "serde_repr",
  "with_builtin_macros",
 ]
@@ -3437,13 +3435,12 @@ dependencies = [
 [[package]]
 name = "trussed"
 version = "0.1.0"
-source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat%2Fpqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
+source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat%2Fpqc#ae5650877a8b29ddc0a0b3e0d65b85e7b82e713d"
 dependencies = [
  "aes",
  "bitflags 2.9.0",
  "cbc",
  "cbor-smol",
- "cfg-if",
  "chacha20",
  "chacha20poly1305",
  "cosey",
@@ -3461,7 +3458,6 @@ dependencies = [
  "nb 1.1.0",
  "p256-cortex-m4",
  "postcard 0.7.3",
- "pqcrypto-mldsa",
  "rand_chacha",
  "rand_core",
  "salty",
@@ -3515,13 +3511,11 @@ dependencies = [
 [[package]]
 name = "trussed-core"
 version = "0.1.0"
-source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat%2Fpqc#12562439b80907c2732a4604e9ffe2848f69bd2b"
+source = "git+https://github.com/sandbox-quantum/trussed.git?branch=feat%2Fpqc#ae5650877a8b29ddc0a0b3e0d65b85e7b82e713d"
 dependencies = [
- "cfg-if",
  "heapless-bytes",
  "littlefs2-core",
  "postcard 0.7.3",
- "pqcrypto-mldsa",
  "rand_core",
  "serde",
  "serde-indexed",
@@ -3573,7 +3567,7 @@ dependencies = [
 [[package]]
 name = "trussed-pqc-backend"
 version = "0.1.0"
-source = "git+https://github.com/sandbox-quantum/trussed-pqc-backend.git?branch=dev#bfb77d46633d627e7c4956bfea2459104dfafaae"
+source = "git+https://github.com/sandbox-quantum/trussed-pqc-backend.git?branch=dev#f045894c01386eb86eacba63e9a5b0c5146e8219"
 dependencies = [
  "cosey",
  "der",
@@ -3589,7 +3583,7 @@ dependencies = [
 [[package]]
 name = "trussed-rsa-alloc"
 version = "0.2.1"
-source = "git+https://github.com/sandbox-quantum/trussed-rsa-backend.git?branch=feat%2Fpqc#e7085a00931da583d15057eab21d12924dc13bc9"
+source = "git+https://github.com/trussed-dev/trussed-rsa-backend.git?rev=53fb6505f505366f6d13dba7d2ae9fe902d0193c#53fb6505f505366f6d13dba7d2ae9fe902d0193c"
 dependencies = [
  "delog",
  "heapless-bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 8586969a..609858bc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,7 +34,7 @@ webcrypt = { git = "https://github.com/nitrokey/nitrokey-websmartcard-rust", tag
 
 # backends
 trussed-auth-backend = { git = "https://github.com/trussed-dev/trussed-auth", tag = "v0.4.0" }
-#trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", rev = "743d9aaa3d8a17d7dbf492bd54dc18ab8fca3dc0" }
+trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", rev = "53fb6505f505366f6d13dba7d2ae9fe902d0193c" }
 trussed-se050-backend = { git = "https://github.com/Nitrokey/trussed-se050-backend.git", rev = "dd30e9f3ad39a062ce9f7cb8e8c525454ceb89af" }
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "7922d67e9637a87e5625aaff9e5111f0d4ec0346" }
 cargo-license = { git = "https://github.com/Nitrokey/cargo-license.git", rev = "d38912dc4b7a10d3cf48f8cf86f49640ff3173ab" }
@@ -46,7 +46,6 @@ cargo-license = { git = "https://github.com/Nitrokey/cargo-license.git", rev = "
 #fido-authenticator = { path = "../fido-authenticator" }
 #ctap-types = { path = "../ctap-types" }
 #cosey = { path = "../cosey" }
-#trussed-rsa-alloc = { path = "../trussed-rsa-backend" }
 #ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
 #usbd-ctaphid = { path = "../usbd-ctaphid" }
 trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-backend.git", branch = "dev"}
@@ -55,7 +54,6 @@ trussed = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "fe
 fido-authenticator = { git = "https://github.com/sandbox-quantum/fido-authenticator.git", branch = "feat/pqc"}
 ctap-types = { git =  "https://github.com/sandbox-quantum/ctap-types.git", branch = "feat/pqc" }
 cosey = { git = "https://github.com/sandbox-quantum/cosey.git", branch = "feat/pqc" }
-trussed-rsa-alloc = { git = "https://github.com/sandbox-quantum/trussed-rsa-backend.git", branch = "feat/pqc" }
 ctaphid-dispatch = { git = "https://github.com/sandbox-quantum/ctaphid-dispatch.git", branch = "feat/pqc"}
 usbd-ctaphid = { git = "https://github.com/sandbox-quantum/usbd-ctaphid.git", branch = "feat/pqc" }
 

From bb3bac222a57796667cf6b66740b40fda02d04a3 Mon Sep 17 00:00:00 2001
From: Kyle Kotowick <kotowick@invictonlabs.com>
Date: Mon, 31 Mar 2025 09:26:32 -0400
Subject: [PATCH 27/27] Update Cargo.toml

---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 609858bc..24fa2aba 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -48,7 +48,7 @@ cargo-license = { git = "https://github.com/Nitrokey/cargo-license.git", rev = "
 #cosey = { path = "../cosey" }
 #ctaphid-dispatch = { path = "../ctaphid-dispatch/dispatch" }
 #usbd-ctaphid = { path = "../usbd-ctaphid" }
-trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-backend.git", branch = "dev"}
+trussed-pqc-backend = { git = "https://github.com/sandbox-quantum/trussed-pqc-backend.git", branch = "main"}
 trussed-core = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
 trussed = { git = "https://github.com/sandbox-quantum/trussed.git", branch = "feat/pqc"}
 fido-authenticator = { git = "https://github.com/sandbox-quantum/fido-authenticator.git", branch = "feat/pqc"}