casesession

Documentation

Overview

Package casesession implements the device (responder) side of Matter CASE — the certificate-authenticated session the commissioner opens over the operational network after AddNOC (spec §4.14):

commissioner → Sigma1 (random, ephemeral pubkey, destinationId)
we           → Sigma2 (random, ephemeral pubkey, encrypted{our NOC + signature})
commissioner → Sigma3 (encrypted{their NOC + signature})
we           → StatusReport(success)

Both sides prove identity with their operational certs and agree on the operational session keys via ephemeral ECDH. All crypto is stdlib + our ccm.

Index

• Constants
• type Established
• type Fabric
• type Responder
  • func New(log *logger.Logger, fab *Fabric) *Responder
  • func (r *Responder) Handle(in *message.Inbound) []message.Outbound
  • func (r *Responder) TakeEstablished() (*Established, bool)

Constants

const (
	OpSigma1 = 0x30
	OpSigma2 = 0x31
	OpSigma3 = 0x32
)

Secure Channel CASE opcodes.

Types

type Established

type Established struct {
	I2R, R2I       []byte
	LocalSessionID uint16
	PeerSessionID  uint16
	LocalNodeID    uint64 // our operational node id
	PeerNodeID     uint64 // the commissioner's operational node id
}

Established carries the operational session keys + node ids after CASE.

type Fabric

type Fabric struct {
	OpKey              *ecdsa.PrivateKey
	NOC                []byte
	ICAC               []byte
	IPKEpochKey        []byte
	RootPubKey         []byte
	CompressedFabricID []byte
	NodeID, FabricID   uint64
}

Fabric is the device's operational context (captured at AddNOC).

type Responder

type Responder struct {
	// contains filtered or unexported fields
}

Responder runs one CASE handshake.

func New

func New(log *logger.Logger, fab *Fabric) *Responder

func (*Responder) Handle

func (r *Responder) Handle(in *message.Inbound) []message.Outbound

Handle processes a CASE message and returns the reply.

func (*Responder) TakeEstablished

func (r *Responder) TakeEstablished() (*Established, bool)

TakeEstablished returns (and clears) the operational session, if CASE just completed.