From 3dbrew
Jump to navigation Jump to search


The console-unique CTCert is used for signing CTX files, the DeviceCert used by eShop, and for DSiWare exports. This ECDSA signature, the ECDSA private key for this cert, and the IssuerID is loaded from memory initialized by bootrom instead of NAND. This is the 3DS equivalent of the DSi TWCert.

The CTCert is signed with ECDSA by Nintendo. CTCerts can be verified via a DER stored in NATIVE_FIRM, separate DERs are used for retail and dev/debug.


Offset Size Description
0x00 0x04 Signature Type, 0x010005.
0x04 0x3C ECDSA Signature
0x40 0x40 Padding
0x80 0x40 Cert Issuer ID, for retail this is "Nintendo CA - G3_NintendoCTR2prod", for dev "Nintendo CA - G3_NintendoCTR2dev"
0xC0 0x04 Key Type
0xC4 0x40 Key ID: "CT<DeviceId>-<ConsoleType>", where DeviceId is the hex DeviceId, and ConsoleType is 00 for retail, 01 for dev
0x104 0x04 Expiration time as UNIX Timestamp in big endian.
0x108 0x3C ECDSA Public Key. This is two consecutive u8 arrays (each one of length 0x1E), where the first one corresponds to the ECDSA R coordinate, and the second to ECDSA S coordinate. These are in big endian.
0x144 0x3C Padding

The ECDSA public key for this cert is converted from the ECDSA private key initialized by bootrom. The curve used for ECDSA is sect233r1.