matter_cert/lib.rs
1//! Matter protocol certificate format — parsing and serialisation.
2//!
3//! Implements Matter Core Specification §6.5: a TLV-encoded variant of
4//! X.509 used for both attestation chains (DAC → PAI → PAA) and
5//! operational chains (NOC → ICAC → RCAC).
6//!
7//! # Scope
8//!
9//! M2.1: types, TLV parser, TLV serialiser. Byte-for-byte round-trip
10//! is enforced by the integration test against captured CSA test
11//! certificates.
12//!
13//! M2.2: public-key extraction + ECDSA-P256-SHA256 signature verification
14//! primitive via `ring`.
15//!
16//! M2.3: Matter-TLV → X.509-DER `TBSCertificate` conversion that
17//! lets `MatterCertificate::verify_signed_by` work on signatures
18//! produced by matter.js (and the broader Matter ecosystem). Byte parity
19//! against matter.js's `asUnsignedDer()` is the correctness gate.
20//!
21//! M2.4 (current): `CertificateChain::validate` against trusted roots,
22//! plus `TrustAnchor` / `TrustedRoots`. Per-cert checks: time bounds,
23//! CA bit (above the leaf), DN linkage, path-length constraint, and
24//! signature verification via M2.3's `verify_signed_by`.
25//!
26//! crates.io publish remains user-driven (the crate is feature-complete
27//! at `0.1.0-pre` after M2.4).
28//!
29//! Cryptographic verification is delegated to `ring`. This crate
30//! never implements the underlying maths.
31
32#![forbid(unsafe_code)]
33
34mod tlv_tags;
35mod x509;
36
37pub mod builder;
38pub mod certificate;
39pub mod chain;
40pub mod error;
41pub mod extensions;
42pub mod name;
43pub mod operational;
44pub mod public_key;
45pub mod signature;
46#[cfg(feature = "test-support")]
47pub mod test_support;
48pub mod time;
49
50pub use builder::{Builder, UnsignedCertificate};
51pub use certificate::MatterCertificate;
52pub use chain::{CertificateChain, TrustAnchor, TrustedRoots};
53pub use error::{Error, Result};
54pub use extensions::{BasicConstraints, Extensions, ExtensionsBuilder, KeyIdentifier, KeyUsage};
55pub use name::{DistinguishedName, DnAttribute, DnAttributeValue};
56pub use public_key::PublicKey;
57pub use signature::Signature;
58pub use time::MatterTime;