EFR32: DeviceAttestationCredentialsProvider: Review comments applied.

examples/light-switch-app/efr32/src/AppTask.cpp

@@ -42,7 +42,11 @@
 #include <assert.h>
 
 #include <credentials/DeviceAttestationCredsProvider.h>
+#ifdef EFR32_ATTESTATION_CREDENTIALS
+#include <platform/EFR32/EFR32DeviceAttestationCreds.h>
+#else
 #include <credentials/examples/DeviceAttestationCredsExample.h>
+#endif
 
 #include <setup_payload/QRCodeSetupPayloadGenerator.h>
 #include <setup_payload/SetupPayload.h>
@@ -198,7 +202,11 @@ CHIP_ERROR AppTask::Init()
 
     chip::DeviceLayer::PlatformMgr().LockChipStack();
     // Initialize device attestation config
+#ifdef EFR32_ATTESTATION_CREDENTIALS
+    SetDeviceAttestationCredentialsProvider(EFR32::GetDACProvider());
+#else
     SetDeviceAttestationCredentialsProvider(Examples::GetExampleDACProvider());
+#endif
     chip::DeviceLayer::PlatformMgr().UnlockChipStack();
 
     // Create FreeRTOS sw timer for Function Selection.

examples/lighting-app/efr32/src/AppTask.cpp

@@ -40,7 +40,11 @@
 #include <assert.h>
 
 #include <credentials/DeviceAttestationCredsProvider.h>
+#if EFR32_ATTESTATION_CREDENTIALS
+#include <platform/EFR32/EFR32DeviceAttestationCreds.h>
+#else
 #include <credentials/examples/DeviceAttestationCredsExample.h>
+#endif
 
 #include <setup_payload/QRCodeSetupPayloadGenerator.h>
 #include <setup_payload/SetupPayload.h>
@@ -203,7 +207,11 @@ CHIP_ERROR AppTask::Init()
 
     chip::DeviceLayer::PlatformMgr().LockChipStack();
     // Initialize device attestation config
+#if EFR32_ATTESTATION_CREDENTIALS
+    SetDeviceAttestationCredentialsProvider(EFR32::GetDACProvider());
+#else
     SetDeviceAttestationCredentialsProvider(Examples::GetExampleDACProvider());
+#endif
     chip::DeviceLayer::PlatformMgr().UnlockChipStack();
 
     // Create FreeRTOS sw timer for Function Selection.

examples/lock-app/efr32/src/AppTask.cpp

@@ -44,7 +44,11 @@
 #include <assert.h>
 
 #include <credentials/DeviceAttestationCredsProvider.h>
+#ifdef EFR32_ATTESTATION_CREDENTIALS
+#include <platform/EFR32/EFR32DeviceAttestationCreds.h>
+#else
 #include <credentials/examples/DeviceAttestationCredsExample.h>
+#endif
 
 #include <setup_payload/QRCodeSetupPayloadGenerator.h>
 #include <setup_payload/SetupPayload.h>
@@ -212,7 +216,11 @@ CHIP_ERROR AppTask::Init()
 
     chip::DeviceLayer::PlatformMgr().LockChipStack();
     // Initialize device attestation config
+#ifdef EFR32_ATTESTATION_CREDENTIALS
+    SetDeviceAttestationCredentialsProvider(EFR32::GetDACProvider());
+#else
     SetDeviceAttestationCredentialsProvider(Examples::GetExampleDACProvider());
+#endif
     chip::DeviceLayer::PlatformMgr().UnlockChipStack();
 
     // Create FreeRTOS sw timer for Function Selection.

examples/platform/efr32/BUILD.gn

@@ -37,6 +37,11 @@ config("chip_examples_project_config") {
     "-Wl,--wrap=_free_r",
     "-Wl,--wrap=_calloc_r",
   ]
+
+  defines = [
+    # Set to 1 to enable EFR32 attestation credentials
+    "EFR32_ATTESTATION_CREDENTIALS=0",
+  ]
 }
 
 source_set("openthread_core_config_efr32_chip_examples") {

examples/platform/efr32/efr32_creds.h

@@ -0,0 +1,57 @@
+#ifndef MATTER_DEVICE_CREDENTIALS_EFR32
+#define MATTER_DEVICE_CREDENTIALS_EFR32
+
+//-> format_version = 1
+//-> vendor_id = 0xFFF1
+//-> product_id_array = [ 0x8000, 0x8001, 0x8002, 0x8003, 0x8004, 0x8005, 0x8006, 0x8007, 0x8008, 0x8009, 0x800A, 0x800B,
+// 0x800C, 0x800D, 0x800E, 0x800F, 0x8010, 0x8011, 0x8012, 0x8013, 0x8014, 0x8015, 0x8016, 0x8017, 0x8018, 0x8019, 0x801A,
+// 0x801B, 0x801C, 0x801D, 0x801E, 0x801F, 0x8020, 0x8021, 0x8022, 0x8023, 0x8024, 0x8025, 0x8026, 0x8027, 0x8028, 0x8029,
+// 0x802A, 0x802B, 0x802C, 0x802D, 0x802E, 0x802F, 0x8030, 0x8031, 0x8032, 0x8033, 0x8034, 0x8035, 0x8036, 0x8037, 0x8038,
+// 0x8039, 0x803A, 0x803B, 0x803C, 0x803D, 0x803E, 0x803F, 0x8040, 0x8041, 0x8042, 0x8043, 0x8044, 0x8045, 0x8046, 0x8047,
+// 0x8048, 0x8049, 0x804A, 0x804B, 0x804C, 0x804D, 0x804E, 0x804F, 0x8050, 0x8051, 0x8052, 0x8053, 0x8054, 0x8055, 0x8056,
+// 0x8057, 0x8058, 0x8059, 0x805A, 0x805B, 0x805C, 0x805D, 0x805E, 0x805F, 0x8060, 0x8061, 0x8062, 0x8063 ]
+//-> device_type_id = 0x0016
+//-> certificate_id = "ZIG20142ZB330003-24"
+//-> security_level = 0
+//-> security_information = 0
+//-> version_number = 0x2694
+//-> certification_type = 0
+//-> dac_origin_vendor_id is not present
+//-> dac_origin_product_id is not present
+const uint8_t kCertificationDeclaration[541] = {
+    0x30, 0x82, 0x02, 0x19, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x82, 0x02, 0x0a, 0x30, 0x82,
+    0x02, 0x06, 0x02, 0x01, 0x03, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x30,
+    0x82, 0x01, 0x71, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0xa0, 0x82, 0x01, 0x62, 0x04, 0x82, 0x01,
+    0x5e, 0x15, 0x24, 0x00, 0x01, 0x25, 0x01, 0xf1, 0xff, 0x36, 0x02, 0x05, 0x00, 0x80, 0x05, 0x01, 0x80, 0x05, 0x02, 0x80, 0x05,
+    0x03, 0x80, 0x05, 0x04, 0x80, 0x05, 0x05, 0x80, 0x05, 0x06, 0x80, 0x05, 0x07, 0x80, 0x05, 0x08, 0x80, 0x05, 0x09, 0x80, 0x05,
+    0x0a, 0x80, 0x05, 0x0b, 0x80, 0x05, 0x0c, 0x80, 0x05, 0x0d, 0x80, 0x05, 0x0e, 0x80, 0x05, 0x0f, 0x80, 0x05, 0x10, 0x80, 0x05,
+    0x11, 0x80, 0x05, 0x12, 0x80, 0x05, 0x13, 0x80, 0x05, 0x14, 0x80, 0x05, 0x15, 0x80, 0x05, 0x16, 0x80, 0x05, 0x17, 0x80, 0x05,
+    0x18, 0x80, 0x05, 0x19, 0x80, 0x05, 0x1a, 0x80, 0x05, 0x1b, 0x80, 0x05, 0x1c, 0x80, 0x05, 0x1d, 0x80, 0x05, 0x1e, 0x80, 0x05,
+    0x1f, 0x80, 0x05, 0x20, 0x80, 0x05, 0x21, 0x80, 0x05, 0x22, 0x80, 0x05, 0x23, 0x80, 0x05, 0x24, 0x80, 0x05, 0x25, 0x80, 0x05,
+    0x26, 0x80, 0x05, 0x27, 0x80, 0x05, 0x28, 0x80, 0x05, 0x29, 0x80, 0x05, 0x2a, 0x80, 0x05, 0x2b, 0x80, 0x05, 0x2c, 0x80, 0x05,
+    0x2d, 0x80, 0x05, 0x2e, 0x80, 0x05, 0x2f, 0x80, 0x05, 0x30, 0x80, 0x05, 0x31, 0x80, 0x05, 0x32, 0x80, 0x05, 0x33, 0x80, 0x05,
+    0x34, 0x80, 0x05, 0x35, 0x80, 0x05, 0x36, 0x80, 0x05, 0x37, 0x80, 0x05, 0x38, 0x80, 0x05, 0x39, 0x80, 0x05, 0x3a, 0x80, 0x05,
+    0x3b, 0x80, 0x05, 0x3c, 0x80, 0x05, 0x3d, 0x80, 0x05, 0x3e, 0x80, 0x05, 0x3f, 0x80, 0x05, 0x40, 0x80, 0x05, 0x41, 0x80, 0x05,
+    0x42, 0x80, 0x05, 0x43, 0x80, 0x05, 0x44, 0x80, 0x05, 0x45, 0x80, 0x05, 0x46, 0x80, 0x05, 0x47, 0x80, 0x05, 0x48, 0x80, 0x05,
+    0x49, 0x80, 0x05, 0x4a, 0x80, 0x05, 0x4b, 0x80, 0x05, 0x4c, 0x80, 0x05, 0x4d, 0x80, 0x05, 0x4e, 0x80, 0x05, 0x4f, 0x80, 0x05,
+    0x50, 0x80, 0x05, 0x51, 0x80, 0x05, 0x52, 0x80, 0x05, 0x53, 0x80, 0x05, 0x54, 0x80, 0x05, 0x55, 0x80, 0x05, 0x56, 0x80, 0x05,
+    0x57, 0x80, 0x05, 0x58, 0x80, 0x05, 0x59, 0x80, 0x05, 0x5a, 0x80, 0x05, 0x5b, 0x80, 0x05, 0x5c, 0x80, 0x05, 0x5d, 0x80, 0x05,
+    0x5e, 0x80, 0x05, 0x5f, 0x80, 0x05, 0x60, 0x80, 0x05, 0x61, 0x80, 0x05, 0x62, 0x80, 0x05, 0x63, 0x80, 0x18, 0x24, 0x03, 0x16,
+    0x2c, 0x04, 0x13, 0x5a, 0x49, 0x47, 0x32, 0x30, 0x31, 0x34, 0x32, 0x5a, 0x42, 0x33, 0x33, 0x30, 0x30, 0x30, 0x33, 0x2d, 0x32,
+    0x34, 0x24, 0x05, 0x00, 0x24, 0x06, 0x00, 0x25, 0x07, 0x94, 0x26, 0x24, 0x08, 0x00, 0x18, 0x31, 0x7d, 0x30, 0x7b, 0x02, 0x01,
+    0x03, 0x80, 0x14, 0x62, 0xfa, 0x82, 0x33, 0x59, 0xac, 0xfa, 0xa9, 0x96, 0x3e, 0x1c, 0xfa, 0x14, 0x0a, 0xdd, 0xf5, 0x04, 0xf3,
+    0x71, 0x60, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86,
+    0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x04, 0x47, 0x30, 0x45, 0x02, 0x20, 0x24, 0xe5, 0xd1, 0xf4, 0x7a, 0x7d, 0x7b, 0x0d, 0x20,
+    0x6a, 0x26, 0xef, 0x69, 0x9b, 0x7c, 0x97, 0x57, 0xb7, 0x2d, 0x46, 0x90, 0x89, 0xde, 0x31, 0x92, 0xe6, 0x78, 0xc7, 0x45, 0xe7,
+    0xf6, 0x0c, 0x02, 0x21, 0x00, 0xf8, 0xaa, 0x2f, 0xa7, 0x11, 0xfc, 0xb7, 0x9b, 0x97, 0xe3, 0x97, 0xce, 0xda, 0x66, 0x7b, 0xae,
+    0x46, 0x4e, 0x2b, 0xd3, 0xff, 0xdf, 0xc3, 0xcc, 0xed, 0x7a, 0xa8, 0xca, 0x5f, 0x4c, 0x1a, 0x7c
+};
+
+#define CREATOR_MFG_MATTER_PAI (USERDATA_TOKENS | 0x400) //   4 bytes
+#define CREATOR_MFG_MATTER_DAC (USERDATA_TOKENS | 0x600) //   4 bytes
+
+#define MFG_MATTER_PAI_SIZE 463
+#define MFG_MATTER_DAC_SIZE 492
+#define MFG_MATTER_DAC_KEY_ID PSA_KEY_ID_USER_MIN + 1
+
+#endif // MATTER_DEVICE_CREDENTIALS_EFR32

examples/window-app/common/src/WindowApp.cpp

@@ -22,7 +22,11 @@
 #include <app/server/Server.h>
 #include <app/util/af.h>
 #include <credentials/DeviceAttestationCredsProvider.h>
+#ifdef EFR32_ATTESTATION_CREDENTIALS
+#include <platform/EFR32/EFR32DeviceAttestationCreds.h>
+#else
 #include <credentials/examples/DeviceAttestationCredsExample.h>
+#endif
 #include <lib/support/CodeUtils.h>
 #include <platform/CHIPDeviceLayer.h>
 
@@ -113,7 +117,11 @@ WindowApp::Cover * WindowApp::GetCover(chip::EndpointId endpoint)
 CHIP_ERROR WindowApp::Init()
 {
     // Initialize device attestation config
+#ifdef EFR32_ATTESTATION_CREDENTIALS
+    SetDeviceAttestationCredentialsProvider(EFR32::GetDACProvider());
+#else
     SetDeviceAttestationCredentialsProvider(Examples::GetExampleDACProvider());
+#endif
 
     ConfigurationMgr().LogDeviceConfig();
 

src/credentials/BUILD.gn

@@ -47,21 +47,16 @@ static_library("credentials") {
     "attestation_verifier/DeviceAttestationDelegate.h",
     "attestation_verifier/DeviceAttestationVerifier.cpp",
     "attestation_verifier/DeviceAttestationVerifier.h",
+    "examples/DeviceAttestationCredsExample.cpp",
+    "examples/DeviceAttestationCredsExample.h",
+    "examples/ExampleDACs.cpp",
+    "examples/ExampleDACs.h",
+    "examples/ExamplePAI.cpp",
+    "examples/ExamplePAI.h",
     "examples/LastKnownGoodTimeCertificateValidityPolicyExample.h",
     "examples/StrictCertificateValidityPolicyExample.h",
   ]
 
-  if (!chip_device_attestation_credentials) {
-    sources += [
-      "examples/DeviceAttestationCredsExample.cpp",
-      "examples/DeviceAttestationCredsExample.h",
-      "examples/ExampleDACs.cpp",
-      "examples/ExampleDACs.h",
-      "examples/ExamplePAI.cpp",
-      "examples/ExamplePAI.h",
-    ]
-  }
-
   # TODO: These tests files should be removed after the DeviceAttestationCredsExample implementation
   # is changed to generate it's own credentials instead of using Test credentials.
   # For mbed and nrfconnect test builds, which are bilding monolithic test library these files are not needed.

src/platform/EFR32/BUILD.gn

@@ -25,6 +25,7 @@ if (chip_enable_openthread) {
 
 static_library("EFR32") {
   sources = [
+    "${chip_root}/src/credentials/DeviceAttestationCredsProvider.h",
     "../FreeRTOS/SystemTimeSupport.cpp",
     "../SingletonConfigurationManager.cpp",
     "BLEManagerImpl.cpp",
@@ -43,6 +44,8 @@ static_library("EFR32") {
     "DiagnosticDataProviderImpl.h",
     "EFR32Config.cpp",
     "EFR32Config.h",
+    "EFR32DeviceAttestationCreds.cpp",
+    "EFR32DeviceAttestationCreds.h",
     "InetPlatformConfig.h",
     "KeyValueStoreManagerImpl.cpp",
     "KeyValueStoreManagerImpl.h",
@@ -56,10 +59,6 @@ static_library("EFR32") {
     "gatt_db.h",
   ]
 
-  if (chip_device_attestation_credentials) {
-    sources += [ "DeviceAttestationCredsImpl.cpp" ]
-  }
-
   if (chip_enable_ota_requestor) {
     sources += [
       "OTAImageProcessorImpl.cpp",

src/platform/EFR32/DeviceAttestationCredsImpl.cpp → src/platform/EFR32/EFR32DeviceAttestationCreds.cpp

@@ -14,35 +14,28 @@
  *    See the License for the specific language governing permissions and
  *    limitations under the License.
  */
-#include <credentials/examples/DeviceAttestationCredsExample.h>
+#include "EFR32DeviceAttestationCreds.h"
 #include <crypto/CHIPCryptoPAL.h>
 #include <lib/core/CHIPError.h>
 #include <lib/support/CodeUtils.h>
 #include <lib/support/Span.h>
 
-#include "efr32_certs.h"
+#include "efr32_creds.h"
 #include "psa/crypto.h"
 #include "sl_token_api.h"
-#include "sl_token_manager.h"
 
 namespace chip {
 namespace Credentials {
-namespace Examples {
+namespace EFR32 {
 
 namespace {
 
-class DeviceAttestationCredsImpl : public DeviceAttestationCredentialsProvider
+class DeviceAttestationCredsEFR32 : public DeviceAttestationCredentialsProvider
 {
 public:
     CHIP_ERROR GetCertificationDeclaration(MutableByteSpan & out_buffer) override
     {
-        uint8_t cd_buf[MFG_MATTER_CD_SIZE];
-        ByteSpan cd_span(cd_buf);
-
-        int err = sl_token_get_data(CREATOR_MFG_MATTER_CD, 0, cd_buf, sizeof(cd_buf));
-        ChipLogProgress(DeviceLayer, "~ GetCertificationDeclaration-1.2, size:%u, err:%d\r\n", sizeof(cd_buf), err);
-        VerifyOrReturnError(!err, CHIP_ERROR_INTERNAL);
-        ChipLogByteSpan(DeviceLayer, cd_span);
+        ByteSpan cd_span(kCertificationDeclaration);
         return CopySpanToMutableSpan(cd_span, out_buffer);
     }
 
@@ -59,7 +52,6 @@ class DeviceAttestationCredsImpl : public DeviceAttestationCredentialsProvider
         ByteSpan cert_span(cert_buf);
 
         int err = sl_token_get_data(CREATOR_MFG_MATTER_DAC, 0, cert_buf, sizeof(cert_buf));
-        ChipLogProgress(DeviceLayer, "~ GetDeviceAttestationCert, size:%u, err:%d\r\n", sizeof(cert_buf), err);
         VerifyOrReturnError(!err, CHIP_ERROR_INTERNAL);
         ChipLogByteSpan(DeviceLayer, cert_span);
         return CopySpanToMutableSpan(cert_span, out_buffer);
@@ -71,7 +63,6 @@ class DeviceAttestationCredsImpl : public DeviceAttestationCredentialsProvider
         ByteSpan cert_span(cert_buf);
 
         int err = sl_token_get_data(CREATOR_MFG_MATTER_PAI, 0, cert_buf, sizeof(cert_buf));
-        ChipLogProgress(DeviceLayer, "~ GetProductAttestationIntermediateCert, size:%u, err:%d\r\n", sizeof(cert_buf), err);
         VerifyOrReturnError(!err, CHIP_ERROR_INTERNAL);
         ChipLogByteSpan(DeviceLayer, cert_span);
         return CopySpanToMutableSpan(cert_span, out_pai_buffer);
@@ -93,12 +84,12 @@ class DeviceAttestationCredsImpl : public DeviceAttestationCredentialsProvider
 
 } // namespace
 
-DeviceAttestationCredentialsProvider * GetExampleDACProvider()
+DeviceAttestationCredentialsProvider * GetDACProvider()
 {
-    static DeviceAttestationCredsImpl dac_provider;
+    static DeviceAttestationCredsEFR32 dac_provider;
     return &dac_provider;
 }
 
-} // namespace Examples
+} // namespace EFR32
 } // namespace Credentials
 } // namespace chip

src/platform/EFR32/EFR32DeviceAttestationCreds.h

@@ -0,0 +1,39 @@
+/*
+ *
+ *    Copyright (c) 2022 Project CHIP Authors
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+#pragma once
+
+// The "sl_token_manager.h" include belongs to the .cpp file, but the formatter change the order
+// of the headers, causing a compilation error, so the include had to be added here instead
+#include "sl_token_manager.h"
+#include <credentials/DeviceAttestationCredsProvider.h>
+
+namespace chip {
+namespace Credentials {
+namespace EFR32 {
+
+/**
+ * @brief Get implementation of a sample DAC provider to validate device
+ *        attestation procedure.
+ *
+ * @returns a singleton DeviceAttestationCredentialsProvider that relies on no
+ *          storage abstractions.
+ */
+DeviceAttestationCredentialsProvider * GetDACProvider();
+
+} // namespace EFR32
+} // namespace Credentials
+} // namespace chip

src/platform/device.gni

@@ -23,9 +23,6 @@ declare_args() {
 
   # Substitute fake platform when building with chip_device_platform=auto.
   chip_fake_platform = false
-
-  # Set to true to use actual device attestation credentials
-  chip_device_attestation_credentials = false
 }
 
 if (chip_device_platform == "auto") {