aliro_prov.h

Cstruct aliro_reader_identity

The reader's provisioned identity. reader_id rides AUTH0 and both ECDSA transcripts (tag 0x4D); sign_priv signs the reader-usage transcript. is_dev marks the built-in bench identity, never a real deployment.

Cstruct aliro_trust_store

Trusted credential public keys. A presented credential authenticates only if its key is in here (or the store is empty and dev policy allows it). A raw-key allowlist is the interim seam; real issuer-chain validation is the Phase-4 refinement that plugs in at aliro_prov_trust_check.

##define ALIRO_READER_ID_LEN 32u

##define ALIRO_READER_PRIV_LEN 32u

##define ALIRO_CRED_PUB_LEN 65u

##define ALIRO_TRUST_MAX 6u

##define ALIRO_GRK_LEN 16u

##define ALIRO_KPERSISTENT_LEN 32u

##define ALIRO_PROV_BLOB_HDR 6u

Fvoid aliro_prov_dev_default(struct aliro_reader_identity *id, struct aliro_trust_store *ts)

Fint aliro_prov_serialize(const struct aliro_reader_identity *id, const struct aliro_trust_store *ts, uint8_t *out, size_t cap, size_t *out_len)

Fint aliro_prov_deserialize(const uint8_t *buf, size_t len, struct aliro_reader_identity *id, struct aliro_trust_store *ts)

Fint aliro_prov_trust_check(const struct aliro_trust_store *ts, const uint8_t cred_pub[ALIRO_CRED_PUB_LEN])

Fint aliro_prov_trust_add(struct aliro_trust_store *ts, const uint8_t cred_pub[ALIRO_CRED_PUB_LEN])

Fint aliro_prov_trust_find(const struct aliro_trust_store *ts, const uint8_t cred_pub[ALIRO_CRED_PUB_LEN])

Fint aliro_prov_kpersistent_set(struct aliro_trust_store *ts, int idx, const uint8_t kp[ALIRO_KPERSISTENT_LEN])

Fint aliro_prov_load(struct aliro_reader_identity *id, struct aliro_trust_store *ts)

Fint aliro_prov_store(const struct aliro_reader_identity *id, const struct aliro_trust_store *ts)

Fint aliro_prov_erase(void)

Forget the stored identity and every trust anchor. Half of a factory reset; the Matter fabrics are the other half and belong to whoever owns that store. Deliberately NOT an erase of the whole settings partition: OpenThread keeps its SRP client key there, the SRP host name is the factory EUI-64 and outlives any erase, and name ownership on the border router is first-come-first-served by key -- so wiping the key asks for the same name with a new one and is refused until the lease expires, up to 14 days, during which the node attaches to Thread and is unreachable on it. @return 0, or a negative errno from the settings backend.