• State Verified Answer
  • Replies 5 replies
  • Subscribers 86 subscribers
  • Views 445 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 352081
Options

TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

BilalAliAhmad

[MatterTest] 09-25 08:50:35.568 INFO ***** Test Step 2.3 : TH extracts the Authority Key Identifier from the PAI certificate
[MatterTest] 09-25 08:50:35.568 INFO ***** Test Step 2.3 : TH extracts the Authority Key Identifier from the PAI certificate
[MatterTest] 09-25 08:50:35.569 INFO DUT 2 Step 3 check 1: Ensure PAI's AKID matches a PAA and signature is valid
[MatterTest] 09-25 08:50:35.569 INFO Matched PAA file Chip-PAA-Cert.der, subject: <Name(CN=Matter Development PAA 01,1.3.6.1.4.1.37244.2.1=1568)>
[MatterTest] 09-25 08:50:35.570 INFO Validated PAI signature against PAA
[MatterTest] 09-25 08:50:35.571 INFO DUT 2 Step 3 check 2: Verify PAI AKID not in denylist of SDK PAIs
[MatterTest] 09-25 08:50:35.571 INFO ***** Test Step 2.4 : TH extracts ASN.1 DER bytes for the entire issuer field of `dac_cert` and subject field of `pai_cert`.
[MatterTest] 09-25 08:50:35.572 INFO ***** Test Step 2.4 : TH extracts ASN.1 DER bytes for the entire issuer field of `dac_cert` and subject field of `pai_cert`.
[MatterTest] 09-25 08:50:35.572 INFO ***** Test Step 2.5 : TH extracts ASN.1 DER bytes for the entire issuer field of `pai_cert` and subject field of `paa_cert`.
[MatterTest] 09-25 08:50:35.573 INFO ***** Test Step 2.5 : TH extracts ASN.1 DER bytes for the entire issuer field of `pai_cert` and subject field of `paa_cert`.
[MatterTest] 09-25 08:50:35.573 INFO ***** Test Step 2.6 : TH extracts the public key from the DAC and saves as `pk_2`.
[MatterTest] 09-25 08:50:35.574 INFO ***** Test Step 2.6 : TH extracts the public key from the DAC and saves as `pk_2`.
[MatterTest] 09-25 08:50:35.574 INFO Subject public key pk: 04f848099562c49204e8361b57f245f8b73ea7dc3e3c51b8625f882c1a9e58770c57c3a23b9eac9d78ba87a6fb28ac53d946a00d962e61e298d88b270451f5a9e9
[MatterTest] 09-25 08:50:35.577 INFO ***** Test Step 3 : Verify that `pk_1` is not equal to `pk_2
[MatterTest] 09-25 08:50:35.577 INFO ***** Test Step 3 : Verify that `pk_1` is not equal to `pk_2
[MatterTest] 09-25 08:50:35.578 ERROR Exception occurred in test_TC_DA_1_7.
Traceback (most recent call last):
File "/usr/local/lib/python3.12/dist-packages/mobly/base_test.py", line 818, in exec_one_test
test_method()
File "/root/python_testing/scripts/sdk/matter_testing_support.py", line 2134, in async_runner
return _async_runner(body, self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/python_testing/scripts/sdk/matter_testing_support.py", line 2122, in _async_runner
return asyncio.run(runner_with_timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/runners.py", line 194, in run
return runner.run(main)
^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/runners.py", line 118, in run
return self._loop.run_until_complete(task)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/base_events.py", line 687, in run_until_complete
return future.result()
^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/tasks.py", line 520, in wait_for
return await fut
^^^^^^^^^
File "/root/python_testing/scripts/sdk/TC_DA_1_7.py", line 186, in test_TC_DA_1_7
asserts.assert_equal(len(pk), len(set(pk)), "Found matching public keys in different DUTs")
File "/usr/local/lib/python3.12/dist-packages/mobly/asserts.py", line 66, in assert_equal
_call_unittest_assertion(
File "/usr/local/lib/python3.12/dist-packages/mobly/asserts.py", line 50, in _call_unittest_assertion
raise signals.TestFailure(my_msg, extras=extras)
mobly.signals.TestFailure: Details=2 != 1 Found matching public keys in different DUTs, Extras=None
[MatterTest] 09-25 08:50:35.589 INFO ***** Test Failure :
[MatterTest] 09-25 08:50:35.589 INFO Finished test in 2936246.0ms

How to generate unique keys for different devices using same certs:

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT="C:/Econet-gatelock-matter/certs/Chip-DAC-Cert.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY="C:/Econet-gatelock-matter/certs/Chip-DAC-Key.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT="C:/Econet-gatelock-matter/certs/Chip-PAI-Cert.der"
We have used unique for all devices: 
CONFIG_CHIP_DEVICE_DISCRIMINATOR=0xF00
CONFIG_CHIP_DEVICE_SPAKE2_PASSCODE=20202021
Parents
  • 0

    Hi,

    The error indicates that all your devices use the same DAC and private key.

    You can use the CHIP Certificate Tool to generate unique DACs for each device with the gen-att-cert command:

    ./chip-cert gen-att-cert \
  --type d \
  --subject-cn "Matter Development DAC <serial>" \
  --subject-vid <VID> \
  --subject-pid <PID> \
  --valid-from "YYYY-MM-DD HH:MM:SS" \
  --lifetime 7305 \
  --ca-key Chip-PAI-Key.pem \
  --ca-cert Chip-PAI-Cert.pem \
  --out-key Chip-DAC-Key-<serial>.pem \
  --out Chip-DAC-Cert-<serial>.pem

    Replace <serial> with a unique identifier for each device.

    After you have generated DACs, you can convert the generated PEM files to DER format if needed using the convert-cert and convert-key commands:

    ./chip-cert convert-cert -d Chip-DAC-Cert-<serial>.pem Chip-DAC-Cert-<serial>.der

    ./chip-cert convert-key -d Chip-DAC-Key-<serial>.pem Chip-DAC-Key-<serial>.der

    Best regards,
    Marte

Reply
  • 0

    Hi,

    The error indicates that all your devices use the same DAC and private key.

    You can use the CHIP Certificate Tool to generate unique DACs for each device with the gen-att-cert command:

    ./chip-cert gen-att-cert \
  --type d \
  --subject-cn "Matter Development DAC <serial>" \
  --subject-vid <VID> \
  --subject-pid <PID> \
  --valid-from "YYYY-MM-DD HH:MM:SS" \
  --lifetime 7305 \
  --ca-key Chip-PAI-Key.pem \
  --ca-cert Chip-PAI-Cert.pem \
  --out-key Chip-DAC-Key-<serial>.pem \
  --out Chip-DAC-Cert-<serial>.pem

    Replace <serial> with a unique identifier for each device.

    After you have generated DACs, you can convert the generated PEM files to DER format if needed using the convert-cert and convert-key commands:

    ./chip-cert convert-cert -d Chip-DAC-Cert-<serial>.pem Chip-DAC-Cert-<serial>.der

    ./chip-cert convert-key -d Chip-DAC-Key-<serial>.pem Chip-DAC-Key-<serial>.der

    Best regards,
    Marte

Children
  • 0 in reply to Marte Myrvold

    Hi  we are using configs to build factory data. Can we use settings like this to generate unique data for at least two device required for testing:

    CONFIG_CHIP=y
    CONFIG_CHIP_DEVICE_VENDOR_ID=1233
    CONFIG_CHIP_DEVICE_VENDOR_NAME="vedorInc"
    CONFIG_CHIP_DEVICE_PRODUCT_ID=3
    CONFIG_CHIP_DEVICE_PRODUCT_NAME="device"
    CONFIG_CHIP_DEVICE_HARDWARE_VERSION=0
    CONFIG_CHIP_DEVICE_HARDWARE_VERSION_STRING="prerelease"
    CONFIG_CHIP_DEVICE_SOFTWARE_VERSION=0
    CONFIG_CHIP_DEVICE_SOFTWARE_VERSION_STRING="prerelease"
    CONFIG_CHIP_DEVICE_MANUFACTURING_DATE="2025-05-15"
    CONFIG_CHIP_DEVICE_SERIAL_NUMBER="11223344556677889900"
    CONFIG_CHIP_DEVICE_ROTATING_DEVICE_UID="592f5a8aaaa8615def3d9eaaba0a67ae"
    CONFIG_CHIP_ROTATING_DEVICE_ID=n
    CONFIG_CHIP_DEVICE_TYPE=10
    CONFIG_CHIP_DEVICE_DISCRIMINATOR=0xF00
    CONFIG_CHIP_DEVICE_SPAKE2_PASSCODE=20202021
    CONFIG_CHIP_DEVICE_SPAKE2_IT=1000
    CONFIG_CHIP_DEVICE_SPAKE2_SALT="U1BBS0UyUCBLZXkgU2FsdA=="
    CONFIG_CHIP_DEVICE_SPAKE2_TEST_VERIFIER="uWFwqugDNGiEck/po7KHwwMwwqZgN10XuyBajPGuyzUEV/iree4lOrao5GuwnlQ65CJzbeUB49s31EH+NEkg0JVI5MGCQGMMT/SRPFNRODm3wH/MBiehuFc6FJ/NH6Rmzw=="
    CONFIG_CHIP_DEVICE_ENABLE_KEY="00112233445566778899AABBCCDDEEFF"
    CONFIG_CHIP_DEVICE_PRODUCT_FINISH="other"
    CONFIG_CHIP_ENABLE_PAIRING_AUTOSTART=n
    CONFIG_CHIP_OPERATIONAL_TIME_SAVE_INTERVAL=10
    CONFIG_CHIP_PROJECT_CONFIG="src/chip_project_config.h"
    #CONFIG_CHIP_FACTORY_RESET_ERASE_SETTINGS =y
    CONFIG_CHIP_FACTORY_DATA=y
    CONFIG_CHIP_FACTORY_DATA_BUILD=y
    CONFIG_CHIP_FACTORY_DATA_MERGE_WITH_FIRMWARE=y
    CONFIG_CHIP_FACTORY_DATA_USE_DEFAULT_CERTS=n
    CONFIG_CHIP_FACTORY_DATA_GENERATE_ONBOARDING_CODES=y
    CONFIG_CHIP_FACTORY_DATA_CERT_SOURCE_USER=y
    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT="C:/Econet-gatelock-matter/certs/Chip-DAC-Cert.der"
    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY="C:/Econet-gatelock-matter/certs/Chip-DAC-Key.der"
    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT="C:/Econet-gatelock-matter/certs/Chip-PAI-Cert.der"
    Additionally do we need a unique CD for every device and store it into 
    CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file? 
  • 0 in reply to BilalAliAhmad

    Hi,

    You still need to use the CHIP certificate tool to generate the certificates themselves, then include the certificates in prj.conf with

    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT=".../Chip-DAC-Cert-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY=".../Chip-DAC-Key-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT=".../Chip-PAI-Cert.der"

    Replace ... with the actual path to the certificates.

    Best regards,
    Marte

  • 0 in reply to Marte Myrvold

    Hi,

    will all these three will be unique or only DAC key and DAC cert will be unique per device?

    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT=".../Chip-DAC-Cert-<serial>.der"
    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY=".../Chip-DAC-Key-<serial>.der"
    CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT=".../Chip-PAI-Cert.der"

    Additionally do we need a unique CD for every device and store it into 

    CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file? 
  • +1 in reply to BilalAliAhmad

    Hi,

    Only the DAC key and cert will be unique. Make sure to replace <serial> with the unique identifier for the device, both when generating the certificates and in the Kconfig options in prj.conf.

    BilalAliAhmad said:

    Additionally do we need a unique CD for every device and store it into 

    CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file? 

    No, the CD does not need to be unique for each device. 

    Best regards,
    Marte

Related
Terms of service