Skip to content

Latest commit

 

History

History
52 lines (36 loc) · 3.28 KB

device-attestation-revocation-guide.md

File metadata and controls

52 lines (36 loc) · 3.28 KB

Device Attestation Revocation Testing Guide

Overview

The device attestation revocation tests help identify the devices with revoked DACs (Device Attestation Certificates) and PAIs (Product Attestation Intermediates) during commissioning.

This guide demonstrates how to use a sample application and chip-tool to test the device attestation revocation functionality.

The sample application is injected with revoked DAC and/or PAI certificates.

During commissioning, chip-tool is provided with a revocation set that is pre-generated using the generate_revocation_set.py script.

Prerequisites

  • Matter application for Linux platform (e.g., examples/lighting-app/linux)
  • DAC provider JSON file containing revoked DAC and/or PAI certificates
  • chip-tool
  • Device attestation revocation set for the respective DAC and/or PAI

Test Setup

  • Build the lighting-app/linux and chip-tool:
./scripts/examples/gn_build_example.sh examples/lighting-app/linux out/host
./scripts/examples/gn_build_example.sh examples/chip-tool out/host
  • Run the lighting-app/linux:
./out/host/chip-lighting-app --dac_provider <json-file-with-attestation-information>
  • Run the chip-tool with the revocation set:
./out/host/chip-tool pairing onnetwork 11 20202021 --dac-revocation-set-path <revocation-set-file>

Test Vectors

Description DAC Provider Revocation Set Expected Result
PAI revoked by PAA revoked-pai.json revocation-set-for-paa.json Commissioning fails with kPaiRevoked (202)
DAC-01 revoked by PAI revoked-dac-01.json revocation-set-for-pai.json Commissioning fails with kDacRevoked (302)
DAC-02 revoked by PAI revoked-dac-02.json revocation-set-for-pai.json Commissioning fails with kDacRevoked (302)
DAC-03 revoked by PAI revoked-dac-03.json revocation-set-for-pai.json Commissioning fails with kDacRevoked (302)