internal/

Package attest provides Matter device attestation using the public CSA test credentials (route B): the test DAC/PAI for VID 0xFFF1 / PID 0x8000 (which chain to the CSA test PAA that commissioners trust) and a Certification Declaration signed with the CSA test CD-signing key.

Package casesession implements the device (responder) side of Matter CASE — the certificate-authenticated session the commissioner opens over the operational network after AddNOC (spec §4.14):

Package ccm implements AES-CCM as Matter uses it for message encryption: 128-bit key, 13-byte nonce, 16-byte tag (spec §4.7 / RFC 3610 / NIST SP 800-38C).

Package cluster is gomatter's device model engine: the Matter cluster contract and the concrete cluster implementations, plus the Endpoint that holds them.

Package im is a minimal Matter Interaction Model responder — enough of the commissioning surface to answer what a commissioner reads/invokes right after PASE: a ReadRequest for the General Commissioning / Basic Information / Network Commissioning attributes, and the ArmFailSafe command.

Package logger is a thin printf-style adapter over *slog.Logger for the library internals.

Package mdns is a tiny, dependency-free multicast-DNS responder — just enough to advertise a Matter commissionable node (_matterc._udp) so a commissioner can discover the device on the LAN.

Package message encodes/decodes the Matter message + protocol (exchange) headers for the unsecured session used during PASE (spec §4.4).

Package opcreds reads the operational identity Matter assigns at AddNOC and derives the values needed for operational discovery and CASE: the operational Node ID and Fabric ID (from the NOC), the root public key (from the trusted root cert), and the Compressed Fabric ID.

Package pase implements the device (responder) side of Matter PASE — the Secure Channel exchange that turns the setup passcode into an encrypted session, using SPAKE2+ (spec §4.13 / §3.10):

Package session is the Matter secure (encrypted) message layer that takes over once PASE establishes keys.

Package spake2p implements SPAKE2+ over NIST P-256 as used by Matter's PASE (Passcode-Authenticated Session Establishment), spec §3.10 / RFC 9383.

Package state persists the device's commissioning result so it survives restarts — a real Matter device keeps its operational credentials in non-volatile storage so the commissioner can reconnect (CASE) without re-commissioning.

Package tlv is a small Matter TLV (Tag-Length-Value) codec covering the Appendix A element types: signed/unsigned integers (1–8 octet), booleans, single/double floats, UTF-8 and octet strings (1/2/4/8-octet length), null, and the struct/array/list containers.

Package transport is the Matter UDP message layer.