Device Attestation Revocation Testing Guide

Overview

The device attestation revocation tests help identify the devices with revoked DACs (Device Attestation Certificates) and PAIs (Product Attestation Intermediates) during commissioning.

This guide demonstrates how to use a sample application and chip-tool to test the device attestation revocation functionality.

The sample application is injected with revoked DAC and/or PAI certificates.

During commissioning, chip-tool is provided with a revocation set that is pre-generated using the generate_revocation_set.py script.

Prerequisites

  • Matter application for Linux platform (e.g., examples/lighting-app/linux)
  • DAC provider JSON file containing revoked DAC and/or PAI certificates
  • chip-tool
  • Device attestation revocation set for the respective DAC and/or PAI

Test Setup

  • Build the lighting-app/linux and chip-tool:
./scripts/examples/gn_build_example.sh examples/lighting-app/linux out/host
./scripts/examples/gn_build_example.sh examples/chip-tool out/host
  • Run the lighting-app/linux:
./out/host/chip-lighting-app --dac_provider <json-file-with-attestation-information>
  • Run the chip-tool with the revocation set:
./out/host/chip-tool pairing onnetwork 11 20202021 --dac-revocation-set-path <revocation-set-file>

Test Vectors

Please use credentials/test/revoked-attestation-certificates/revocation-sets/revocation-set.json as revocation set

DescriptionDAC ProviderExpected Result
PAI revoked by PAArevoked-pai.jsonCommissioning fails with kPaiRevoked (202)
DAC-01 revoked by PAIrevoked-dac-01.jsonCommissioning fails with kDacRevoked (302)
DAC-02 revoked by PAIrevoked-dac-02.jsonCommissioning fails with kDacRevoked (302)
DAC-03 revoked by PAIrevoked-dac-03.jsonCommissioning fails with kDacRevoked (302)
DAC and PAI revokedrevoked-dac-and-pai.jsonCommissioning fails with kPaiAndDacRevoked (208)