What a device-minted name replaces in a vendor account

What the note is claiming

On October 3, 2026, dldeploy compared rusty_esp_mid with a vendor account. A vendor account answers who may talk to a device by holding a database. The note's alternative is that the ESP32 draws a P-256 key from its hardware random generator on first boot, writes it to an identity partition that reflashes and Wi-Fi changes do not touch, and derives an identifier of the form did:mata plus the base58 encoding of the 33-byte compressed public key. The owner signs an adoption record. The device verifies it, pins that owner, and refuses later adoptions from anyone else. On silicon, the note says, a stranger presenting the owner's own record was refused, and so was an older roster version. The paper filing the comparison isFutureweb.

What has not shipped as a vault

The note says current development firmware runs with flash encryption off and opts into a plaintext partition through a loudly named development feature. Wrapping the key under an eFuse-held key, or moving it to a secure element, is planned and is not what the measured boards are running. A pure-Rust ownership path does not get to imply a hardware vault it has not shipped. The desk isSmart Homes.

What the timings are, and what they are not

On a XIAO ESP32-S3 Sense at 240 MHz, the note says a signature is about 95 milliseconds and a verification about 151 milliseconds. It says that is too slow to sign every reading, so a session is signed and frames use a cheaper check. Signatures match a reference signer byte for byte for the same key, a replay is refused, and a capability check agrees on 144 of 144 cases. Those are the note's host and silicon claims. What local control requires iswhat local control requires.

Why it matters on this desk

The dependency is who can revoke the binding between a person and a camera. A vendor database can. This note's handshake cannot, because the check is on the device and there is no round trip to a login server. The practical test the note offers is to unplug the router from the wider internet and see whether the household can still tell the device who owns it. What a session cannot be iswhat a session cannot be.

What this page will not import

This page does not provide a claim sequence, and it does not hide the open defect the note states: after adoption the device can still advertise itself as free to claim, because that record is composed once at boot. Refusal of a bad update signature is tested on the host so far, not yet as a silicon row. The mechanism note isdldeploy's vendor-account note.

Where the public record sits

The October 3 note is one source. The W3C DID Core recommendation defines a decentralized identifier as an identifier that does not require a central registry. FIPS 186-5 is the federal digital-signature standard that includes P-256. The note's choice of P-256, and its refusal of other curves, is its own compatibility rule with the home computer, not a sentence in those standards. The capability check agrees with a reference on 144 of 144 cases. That is the note's figure, not a certification. Lose the owner key, the note says, and the device keeps the pin it already stored. There is no reset desk. The update path the note describes checks the owner, an ota capability, a trusted maker, the chip, the model, the size, and a signature before it reads the image. A maker-signed update has run on silicon. Rollback has not, as a silicon row.

What to watch next

A silicon row that wraps the key, or a fix for the still-claimable advertisement, would change the record. A password-reset link would be a different product. A content address is a different identifier,what a content address is.

What would change the record

A statement that the measured boards already use a secure element would change it. A stranger who was accepted with the owner's record would change the silicon sentence. A vendor dashboard you prefer for a fleet you do not want to host is the case the note says should stay on an account. The update path the note describes checks the owner, an ota capability, a trusted maker, the chip, the model, the size, and a signature before it reads the image. A maker-signed update has run on silicon. Rollback has not, as a silicon row. The capability check agrees with a reference on 144 of 144 cases. That is the note's figure, not a certification.

What stays a minted key

What stays specific is a P-256 key the device draws, a did:mata derived from the compressed public key, an owner pin, a refused stranger on silicon, a plaintext partition on current development firmware, and signature costs of about 95 and 151 milliseconds on the named board. There is no forgot-password path. That absence is the note's point. Lose the owner key, the note says, and the device keeps the pin it already stored. There is no reset desk. The update path the note describes checks the owner, an ota capability, a trusted maker, the chip, the model, the size, and a signature before it reads the image. A maker-signed update has run on silicon. Rollback has not, as a silicon row.