Struct CaseCredentials 

pub struct CaseCredentials {
    pub noc: MatterCertificate,
    pub icac: Option<MatterCertificate>,
    pub signer: Box<dyn CaseSigner>,
    pub fabric_id: u64,
    pub node_id: u64,
    pub ipk: [u8; 16],
    pub rcac_public_key: [u8; 65],
}

Operational identity for a CASE session.

Packages the things that identify a participant on a fabric: NOC, optional ICAC, signer for the NOC’s private key, the claimed FabricId + NodeId, the fabric-scoped IPK, and the RCAC’s public key (needed for DestinationId computation). Consumed by both CaseInitiator::new and CaseResponder::new.

Secret hygiene

Carries the fabric-scoped IPK (a 16-byte secret). The Debug impl redacts the IPK, and a manual Drop zeroizes the IPK bytes when the credentials are dropped. We cannot derive zeroize::ZeroizeOnDrop on the whole struct because several fields (noc, icac, the boxed signer) are not Zeroize; the NOC private key inside signer is owned and wiped by the signer implementation itself.

Fields

noc: MatterCertificate

Node Operational Certificate. Issued by this fabric’s CA chain.

icac: Option<MatterCertificate>

Optional Intermediate CA Certificate, if NOC was issued by an intermediate rather than directly by the RCAC.

signer: Box<dyn CaseSigner>

Signer for the NOC’s private key.

fabric_id: u64

Fabric ID this identity is associated with. Cross-checked against the FabricId attribute in the NOC’s subject DN.

node_id: u64

Node ID this identity is associated with. Cross-checked against the NodeId attribute in the NOC’s subject DN.

ipk: [u8; 16]

16-byte fabric-scoped Identity Protection Key (IPK).

Used as the HKDF salt in CASE key derivations (DestinationId, S2RK, S3SK, and attestation-challenge). Provides cross-fabric domain separation: two fabrics sharing a NOC but using different IPKs cannot impersonate each other. The IPK is derived during commissioning (M6 fabric storage persists it alongside the NOC).

Pinned from matter.js: operationalIdentityProtectionKey (16 bytes).

rcac_public_key: [u8; 65]

65-byte SEC1-uncompressed public key of this fabric’s Root CA (RCAC).

Required for DestinationId computation (Matter Core Spec §4.13.2.4). The DestinationId salt is HMAC-SHA256(IPK, initiatorRandom || rcacPublicKey || fabricId_le8 || nodeId_le8).

Pinned from matter.js: fabric.rootPublicKey used in Fabric.#generateSalt(nodeId, random).

Trait Implementations

impl Debug for CaseCredentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Redacts the secret ipk; prints the remaining (non-secret) fields.

impl Drop for CaseCredentials

fn drop(&mut self)

Wipe the secret IPK from memory on drop. The other fields are either non-secret or own their own secret material (the boxed signer wipes its private key in its own Drop).

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.