matter_attest.c
depends on matter_attest.h matter_tlv.h
API
Fint matter_attest_cert(uint8_t type, const uint8_t **out, size_t *len)
Retrieve a prepacked attestation certificate (DAC or PAI) by type. Returns MATTER_OK and fills out and len on success, or MATTER_E_INVAL if type is not recognized or arguments are NULL.
Fint matter_attest_elements_encode(const uint8_t *nonce, size_t nonce_len, uint32_t timestamp, uint8_t *out, size_t cap, size_t *out_len)
Encode and return the attestation elements (nonce, timestamp, certification declaration) as a TLV structure. Validates nonce, timestamp, out, and out_len pointers. Returns MATTER_OK on success or MATTER_E_INVAL if any pointer is NULL.
Fint matter_attest_nocsr_encode(const uint8_t *csr, size_t csr_len, const uint8_t *nonce, size_t nonce_len, uint8_t *out, size_t cap, size_t *out_len)
Encode the CSR and nonce as a TLV-encoded CertificateChainResponse payload. Validates all input pointers. Returns MATTER_OK on success or MATTER_E_INVAL if any pointer is NULL.
Fint matter_attest_sign_with_challenge(uint8_t *buf, size_t payload_len, size_t cap, const uint8_t *challenge, size_t challenge_len, uint8_t sig[MATTER_ATTEST_SIG_LEN])
Sign a payload plus challenge with the DAC private key. Appends the challenge to the buffer, signs the combined data, and clears the challenge bytes before returning. Returns MATTER_OK on success, MATTER_E_INVAL if any pointer is NULL, MATTER_E_NOSPACE if the buffer has insufficient room, or MATTER_E_STATE if the signature operation fails.
Cstruct der
A backwards DER writer: @ref pos walks down from the end of the buffer, and everything already written lives in buf[pos..cap).
Fstatic void der_raw(struct der *d, const uint8_t *src, size_t len)
Prepend raw bytes to the DER encoding buffer. Marks the buffer bad if there is insufficient space.
der_byte, der_cri, der_int, matter_attest_csrFstatic void der_byte(struct der *d, uint8_t b)
Append one byte to the DER encoding buffer by prepending it to the existing bytes. Marks buffer bad if insufficient space.
der_cri, der_hdr, der_int, matter_attest_csr · calls der_rawFstatic void der_hdr(struct der *d, uint8_t tag, size_t len)
Prepend a tag and the length of the @p len bytes already written.
der_cri, der_int, matter_attest_csr · calls der_byteFstatic size_t der_len(const struct der *d)
How many bytes are written so far, for computing the enclosing length.
der_cri, matter_attest_csrFstatic void der_int(struct der *d, const uint8_t *v, size_t len)
Prepend one of the signature's two integers. DER integers are SIGNED, so a 32-byte value whose top bit is set needs a leading zero or it reads as negative -- and leading zero bytes must otherwise be dropped. Getting either wrong produces a CSR that parses and fails to verify.
matter_attest_csr · calls der_byte, der_hdr, der_rawFstatic void der_cri(struct der *d, const uint8_t pub[65])
CertificationRequestInfo, the part that gets signed, INCLUDING its own SEQUENCE wrapper. Wrapping itself matters: on the second pass this is prepended to a buffer that already holds the signature, so a caller adding the wrapper afterwards would measure the whole buffer and enclose the signature as well.
matter_attest_csr · calls der_byte, der_hdr, der_len, der_rawUndocumented (1)
matter_attest_csr