| <?xml version="1.0"?> | |
| <!-- | |
| Copyright (C) Connectivity Standards Alliance (2026). All rights reserved. | |
| The information within this document is the property of the Connectivity | |
| Standards Alliance and its use and disclosure are restricted, except as | |
| expressly set forth herein. | |
| Connectivity Standards Alliance hereby grants you a fully-paid, non-exclusive, | |
| nontransferable, worldwide, limited and revocable license (without the right to | |
| sublicense), under Connectivity Standards Alliance's applicable copyright | |
| rights, to view, download, save, reproduce and use the document solely for your | |
| own internal purposes and in accordance with the terms of the license set forth | |
| herein. This license does not authorize you to, and you expressly warrant that | |
| you shall not: (a) permit others (outside your organization) to use this | |
| document; (b) post or publish this document; (c) modify, adapt, translate, or | |
| otherwise change this document in any manner or create any derivative work | |
| based on this document; (d) remove or modify any notice or label on this | |
| document, including this Copyright Notice, License and Disclaimer. The | |
| Connectivity Standards Alliance does not grant you any license hereunder other | |
| than as expressly stated herein. | |
| Elements of this document may be subject to third party intellectual property | |
| rights, including without limitation, patent, copyright or trademark rights, | |
| and any such third party may or may not be a member of the Connectivity | |
| Standards Alliance. Connectivity Standards Alliance members grant other | |
| Connectivity Standards Alliance members certain intellectual property rights as | |
| set forth in the Connectivity Standards Alliance IPR Policy. Connectivity | |
| Standards Alliance members do not grant you any rights under this license. The | |
| Connectivity Standards Alliance is not responsible for, and shall not be held | |
| responsible in any manner for, identifying or failing to identify any or all | |
| such third party intellectual property rights. Please visit www.csa-iot.org for | |
| more information on how to become a member of the Connectivity Standards | |
| Alliance. | |
| This document and the information contained herein are provided on an “AS IS” | |
| basis and the Connectivity Standards Alliance DISCLAIMS ALL WARRANTIES EXPRESS | |
| OR IMPLIED, INCLUDING BUT NOT LIMITED TO (A) ANY WARRANTY THAT THE USE OF THE | |
| INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OF THIRD PARTIES (INCLUDING | |
| WITHOUT LIMITATION ANY INTELLECTUAL PROPERTY RIGHTS INCLUDING PATENT, COPYRIGHT | |
| OR TRADEMARK RIGHTS); OR (B) ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS | |
| FOR A PARTICULAR PURPOSE, TITLE OR NONINFRINGEMENT. IN NO EVENT WILL THE | |
| CONNECTIVITY STANDARDS ALLIANCE BE LIABLE FOR ANY LOSS OF PROFITS, LOSS OF | |
| BUSINESS, LOSS OF USE OF DATA, INTERRUPTION OF BUSINESS, OR FOR ANY OTHER | |
| DIRECT, INDIRECT, SPECIAL OR EXEMPLARY, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL | |
| DAMAGES OF ANY KIND, IN CONTRACT OR IN TORT, IN CONNECTION WITH THIS DOCUMENT | |
| OR THE INFORMATION CONTAINED HEREIN, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH | |
| LOSS OR DAMAGE. | |
| All company, brand and product names in this document may be trademarks that | |
| are the sole property of their respective owners. | |
| This notice and disclaimer must be included on all copies of this document. | |
| Connectivity Standards Alliance | |
| 508 Second Street, Suite 206 | |
| Davis, CA 95616, USA | |
| :xrefstyle: basic | |
| --> | |
| <cluster xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="types types.xsd cluster cluster.xsd" id="0x003E" name="Operational Credentials Cluster" revision="3"> | |
| <revisionHistory> | |
| <revision revision="1" summary="Initial revision"/> | |
| <revision revision="2" summary="Introduction of command, attributes and fields to support the Fabric Table Vendor ID Verification Procedure and the procedure increased flash storage cost by approximately 90 bytes per fabric"/> | |
| <revision revision="3" summary="PQC for Device Attestation supported"/> | |
| </revisionHistory> | |
| <clusterIds> | |
| <clusterId id="0x003E" name="Operational Credentials"/> | |
| </clusterIds> | |
| <classification hierarchy="base" role="utility" picsCode="OPCREDS" scope="Node"/> | |
| <features> | |
| <feature bit="0" code="PQCDA" name="PQCDeviceAttestation" summary="Support for PQC profiles in Device Attestation procedure"> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <optionalConform/> | |
| </otherwiseConform> | |
| </feature> | |
| </features> | |
| <dataTypes> | |
| <enum name="AttestationCryptoProfileEnum"> | |
| <item value="0" name="EcdsaMatterLegacy" summary="ECDSA-P256 per Matter legacy (Device Attestation)"> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </item> | |
| <item value="1" name="MlDsa44" summary="ML-DSA-44 (Post-Quantum Cryptography Signature Algorithms)"> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </item> | |
| <item value="2" name="MlDsa65" summary="ML-DSA-65 (Post-Quantum Cryptography Signature Algorithms)"> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </item> | |
| </enum> | |
| <enum name="CertificateChainTypeEnum"> | |
| <item value="1" name="DACCertificate" summary="Request the DER-encoded DAC certificate"> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="2" name="PAICertificate" summary="Request the DER-encoded PAI certificate"> | |
| <mandatoryConform/> | |
| </item> | |
| </enum> | |
| <enum name="NodeOperationalCertStatusEnum"> | |
| <item value="0" name="OK" summary="OK, no error"> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="1" name="InvalidPublicKey" summary="Public Key in the NOC does not match the public key in the NOCSR"> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="2" name="InvalidNodeOpId" summary="The Node Operational ID in the NOC is not formatted correctly."> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="3" name="InvalidNOC" summary="Any other validation error in NOC chain"> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="4" name="MissingCsr" summary="No record of prior CSR for which this NOC could match"> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="5" name="TableFull" summary="NOCs table full, cannot add another one"> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="6" name="InvalidAdminSubject" summary="Invalid CaseAdminSubject field for an AddNOC command."> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="9" name="FabricConflict" summary="Trying to AddNOC instead of UpdateNOC against an existing Fabric."> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="10" name="LabelConflict" summary="Label already exists on another Fabric."> | |
| <mandatoryConform/> | |
| </item> | |
| <item value="11" name="InvalidFabricIndex" summary="FabricIndex argument is invalid."> | |
| <mandatoryConform/> | |
| </item> | |
| </enum> | |
| <bitmap name="AttestationCryptoProfileBitmap"> | |
| <bitfield name="SupportsEcdsaMatterLegacy" bit="0" summary="Supports EcdsaMatterLegacy"> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </bitfield> | |
| <bitfield name="SupportsMlDsa44" bit="1" summary="Supports MlDsa44"> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </bitfield> | |
| <bitfield name="SupportsMlDsa65" bit="2" summary="Supports MlDsa65"> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </bitfield> | |
| </bitmap> | |
| <struct name="FabricDescriptorStruct"> | |
| <field id="1" name="RootPublicKey" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="65"/> | |
| </constraint> | |
| </field> | |
| <field id="2" name="VendorID" type="vendor-id"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <desc/> | |
| </constraint> | |
| </field> | |
| <field id="3" name="FabricID" type="fabric-id"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="4" name="NodeID" type="node-id"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="5" name="Label" type="string"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="32"/> | |
| </constraint> | |
| </field> | |
| <field id="6" name="VIDVerificationStatement" type="octstr"> | |
| <optionalConform/> | |
| <constraint> | |
| <allowed value="85"/> | |
| </constraint> | |
| </field> | |
| <access fabricScoped="true"/> | |
| </struct> | |
| <struct name="NOCStruct"> | |
| <field id="1" name="NOC" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| <field id="2" name="ICAC" type="octstr"> | |
| <quality nullable="true"/> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| <field id="3" name="VVSC" type="octstr"> | |
| <describedConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| <access fabricScoped="true"/> | |
| </struct> | |
| <struct name="PQCDeviceAttestationProfileStruct"> | |
| <field id="0" name="PAASupportedProfiles" type="AttestationCryptoProfileBitmap"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="1" name="PAISupportedProfiles" type="AttestationCryptoProfileBitmap"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="2" name="DACSupportedProfiles" type="AttestationCryptoProfileBitmap"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="3" name="CDSupportedProfiles" type="AttestationCryptoProfileBitmap"> | |
| <mandatoryConform/> | |
| </field> | |
| </struct> | |
| </dataTypes> | |
| <attributes> | |
| <attribute id="0x0000" name="NOCs" type="list"> | |
| <entry type="NOCStruct"/> | |
| <access read="true" readPrivilege="admin" fabricScoped="true"/> | |
| <quality changeOmitted="true" persistence="nonVolatile"/> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxCount> | |
| <attribute name="SupportedFabrics"/> | |
| </maxCount> | |
| </constraint> | |
| </attribute> | |
| <attribute id="0x0001" name="Fabrics" type="list"> | |
| <entry type="FabricDescriptorStruct"/> | |
| <access read="true" readPrivilege="view" fabricScoped="true"/> | |
| <quality persistence="nonVolatile"/> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxCount> | |
| <attribute name="SupportedFabrics"/> | |
| </maxCount> | |
| </constraint> | |
| </attribute> | |
| <attribute id="0x0002" name="SupportedFabrics" type="uint8"> | |
| <access read="true" readPrivilege="view"/> | |
| <quality persistence="fixed"/> | |
| <mandatoryConform/> | |
| <constraint> | |
| <between> | |
| <from value="5"/> | |
| <to value="254"/> | |
| </between> | |
| </constraint> | |
| </attribute> | |
| <attribute id="0x0003" name="CommissionedFabrics" type="uint8"> | |
| <access read="true" readPrivilege="view"/> | |
| <quality persistence="nonVolatile"/> | |
| <mandatoryConform/> | |
| <constraint> | |
| <max> | |
| <attribute name="SupportedFabrics"/> | |
| </max> | |
| </constraint> | |
| </attribute> | |
| <attribute id="0x0004" name="TrustedRootCertificates" type="list"> | |
| <entry type="octstr"> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </entry> | |
| <access read="true" readPrivilege="view"/> | |
| <quality changeOmitted="true" persistence="nonVolatile"/> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxCount> | |
| <attribute name="SupportedFabrics"/> | |
| </maxCount> | |
| </constraint> | |
| </attribute> | |
| <attribute id="0x0005" name="CurrentFabricIndex" type="uint8" default="0"> | |
| <access read="true" readPrivilege="view"/> | |
| <mandatoryConform/> | |
| </attribute> | |
| <attribute id="0x0006" name="PQCDeviceAttestationProfile" type="PQCDeviceAttestationProfileStruct"> | |
| <access read="true" readPrivilege="view"/> | |
| <quality changeOmitted="true"/> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <mandatoryConform> | |
| <feature name="PQCDA"/> | |
| </mandatoryConform> | |
| </otherwiseConform> | |
| </attribute> | |
| </attributes> | |
| <commands> | |
| <command id="0x00" name="AttestationRequest" direction="commandToServer" response="AttestationResponse"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="AttestationNonce" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="32"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x01" name="AttestationResponse" direction="responseFromServer"> | |
| <mandatoryConform/> | |
| <field id="0" name="AttestationElements" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength> | |
| <constant name="RESP_MAX" value="900"/> | |
| </maxLength> | |
| </constraint> | |
| </field> | |
| <field id="1" name="AttestationSignature" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="64"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x02" name="CertificateChainRequest" direction="commandToServer" response="CertificateChainResponse"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="CertificateType" type="CertificateChainTypeEnum"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <desc/> | |
| </constraint> | |
| </field> | |
| <field id="1" name="CryptoProfile" type="AttestationCryptoProfileEnum"> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <optionalConform> | |
| <feature name="PQCDA"/> | |
| </optionalConform> | |
| </otherwiseConform> | |
| </field> | |
| <field id="2" name="SegmentID" type="uint16"> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <optionalConform> | |
| <feature name="PQCDA"/> | |
| </optionalConform> | |
| </otherwiseConform> | |
| <constraint> | |
| <max value="100"/> | |
| </constraint> | |
| </field> | |
| <field id="3" name="MaxSegmentSize" type="uint16" default="600"> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <optionalConform> | |
| <feature name="PQCDA"/> | |
| </optionalConform> | |
| </otherwiseConform> | |
| <constraint> | |
| <min value="600"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x03" name="CertificateChainResponse" direction="responseFromServer"> | |
| <mandatoryConform/> | |
| <field id="0" name="Certificate" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <desc/> | |
| </constraint> | |
| </field> | |
| <field id="1" name="TotalDocumentSize" type="uint16"> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <optionalConform> | |
| <feature name="PQCDA"/> | |
| </optionalConform> | |
| </otherwiseConform> | |
| <constraint> | |
| <max value="65535"/> | |
| </constraint> | |
| </field> | |
| <field id="2" name="NextSegmentID" type="uint16"> | |
| <otherwiseConform> | |
| <provisionalConform/> | |
| <optionalConform> | |
| <feature name="PQCDA"/> | |
| </optionalConform> | |
| </otherwiseConform> | |
| <constraint> | |
| <min value="0"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x04" name="CSRRequest" direction="commandToServer" response="CSRResponse"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="CSRNonce" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="32"/> | |
| </constraint> | |
| </field> | |
| <field id="1" name="IsForUpdateNOC" type="bool"> | |
| <optionalConform/> | |
| </field> | |
| </command> | |
| <command id="0x05" name="CSRResponse" direction="responseFromServer"> | |
| <mandatoryConform/> | |
| <field id="0" name="NOCSRElements" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength> | |
| <constant name="RESP_MAX" value="900"/> | |
| </maxLength> | |
| </constraint> | |
| </field> | |
| <field id="1" name="AttestationSignature" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="64"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x06" name="AddNOC" direction="commandToServer" response="NOCResponse"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="NOCValue" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| <field id="1" name="ICACValue" type="octstr"> | |
| <optionalConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| <field id="2" name="IPKValue" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="16"/> | |
| </constraint> | |
| </field> | |
| <field id="3" name="CaseAdminSubject" type="subject-id"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="4" name="AdminVendorId" type="vendor-id"> | |
| <mandatoryConform/> | |
| </field> | |
| </command> | |
| <command id="0x07" name="UpdateNOC" direction="commandToServer" response="NOCResponse"> | |
| <access invokePrivilege="admin" fabricScoped="true"/> | |
| <mandatoryConform/> | |
| <field id="0" name="NOCValue" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| <field id="1" name="ICACValue" type="octstr"> | |
| <optionalConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x08" name="NOCResponse" direction="responseFromServer"> | |
| <mandatoryConform/> | |
| <field id="0" name="StatusCode" type="NodeOperationalCertStatusEnum"> | |
| <mandatoryConform/> | |
| </field> | |
| <field id="1" name="FabricIndex" type="fabric-idx"> | |
| <otherwiseConform> | |
| <mandatoryConform> | |
| <equalTerm> | |
| <field name="StatusCode"/> | |
| <status name="SUCCESS"/> | |
| </equalTerm> | |
| </mandatoryConform> | |
| <optionalConform/> | |
| </otherwiseConform> | |
| <constraint> | |
| <between> | |
| <from value="1"/> | |
| <to value="254"/> | |
| </between> | |
| </constraint> | |
| </field> | |
| <field id="2" name="DebugText" type="string"> | |
| <optionalConform/> | |
| <constraint> | |
| <maxLength value="128"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x09" name="UpdateFabricLabel" direction="commandToServer" response="NOCResponse"> | |
| <access invokePrivilege="admin" fabricScoped="true"/> | |
| <mandatoryConform/> | |
| <field id="0" name="Label" type="string"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="32"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x0A" name="RemoveFabric" direction="commandToServer" response="NOCResponse"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="FabricIndex" type="fabric-idx"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <between> | |
| <from value="1"/> | |
| <to value="254"/> | |
| </between> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x0B" name="AddTrustedRootCertificate" direction="commandToServer" response="Y"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="RootCACertificate" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x0C" name="SetVIDVerificationStatement" direction="commandToServer" response="Y"> | |
| <access invokePrivilege="admin" fabricScoped="true"/> | |
| <mandatoryConform/> | |
| <field id="0" name="VendorID" type="vendor-id"> | |
| <optionalConform choice="a" more="true" min="1"/> | |
| </field> | |
| <field id="1" name="VIDVerificationStatement" type="octstr"> | |
| <optionalConform choice="a" more="true" min="1"/> | |
| <constraint> | |
| <maxLength value="85"/> | |
| </constraint> | |
| </field> | |
| <field id="2" name="VVSC" type="octstr"> | |
| <optionalConform choice="a" more="true" min="1"/> | |
| <constraint> | |
| <maxLength value="400"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x0D" name="SignVIDVerificationRequest" direction="commandToServer" response="SignVIDVerificationResponse"> | |
| <access invokePrivilege="admin"/> | |
| <mandatoryConform/> | |
| <field id="0" name="FabricIndex" type="fabric-idx"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <between> | |
| <from value="1"/> | |
| <to value="254"/> | |
| </between> | |
| </constraint> | |
| </field> | |
| <field id="1" name="ClientChallenge" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <allowed value="32"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| <command id="0x0E" name="SignVIDVerificationResponse" direction="responseFromServer"> | |
| <mandatoryConform/> | |
| <field id="0" name="FabricIndex" type="fabric-idx"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <between> | |
| <from value="1"/> | |
| <to value="254"/> | |
| </between> | |
| </constraint> | |
| </field> | |
| <field id="1" name="FabricBindingVersion" type="uint8"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <between> | |
| <from value="1"/> | |
| <to value="255"/> | |
| </between> | |
| </constraint> | |
| </field> | |
| <field id="2" name="Signature" type="octstr"> | |
| <mandatoryConform/> | |
| <constraint> | |
| <minLength value="1"/> | |
| </constraint> | |
| </field> | |
| </command> | |
| </commands> | |
| </cluster> |