Struct PaseVerifier 

pub struct PaseVerifier { /* private fields */ }

Device-side PASE state machine.

Drives the SPAKE2+ handshake from the device’s (responder’s) perspective. Sans-IO: the caller is responsible for transmitting and receiving bytes.

Construction

• PaseVerifier::new — production path; device stores pre-computed w0 and L (never the PIN after provisioning).
• PaseVerifier::new_from_pin — test/convenience path; derives w0 and L from the PIN via PBKDF2.

Driving the handshake

1. Feed the inbound PBKDFParamRequest bytes into handle_pbkdf_request (negotiation path), or skip to step 3 (known-params path).
2. Call next_message to emit PBKDFParamResponse.
3. Feed the inbound Pake1 bytes into handle_pake1.
4. Call next_message to emit Pake2.
5. Feed the inbound Pake3 bytes into handle_pake3.
6. Call finish to retrieve the PaseSessionKeys.

Use expected_inbound at any point to query which message type the machine is currently waiting for.

Implementations

impl PaseVerifier

pub fn new( w0: [u8; 32], l: [u8; 65], params: PasePbkdfParams, responder_session_id: u16, ) -> Result<Self>

Production constructor: device stores pre-computed verification values.

In production the PIN is hashed to w0 and L once at provisioning time and the raw PIN is discarded. Pass those stored values here.

Validates params against Matter spec §3.10.3 bounds before accepting.

Parameters

• w0: 32-byte big-endian P-256 scalar derived from the PIN.
• l: 65-byte uncompressed P-256 point L = w1·P.
• params: PBKDF2 parameters used when w0/L were derived.
• responder_session_id: the non-zero secured-session id this device advertises (in PBKDFParamResponse) for the peer to address it by.

Errors

• Error::PbkdfIterationsTooLow if params.iterations < 1000.
• Error::PbkdfSaltLengthInvalid if params.salt.len() ∉ [16, 32].
• Error::InvalidScalar if the CSPRNG is broken and a non-zero scalar cannot be sampled after 16 attempts (practically impossible).
• Error::PinDerivationFailed if the nonce fill fails.

pub fn new_from_pin( pin: u32, params: PasePbkdfParams, responder_session_id: u16, ) -> Result<Self>

Test/convenience constructor: derive w0 and L from the PIN.

In production a device never stores the PIN after provisioning — it stores w0 and L instead. This constructor is provided for tests and development use where deriving from a PIN is convenient.

Parameters

• responder_session_id: the non-zero secured-session id this device advertises (in PBKDFParamResponse) for the peer to address it by.

Errors

• Error::PbkdfIterationsTooLow / Error::PbkdfSaltLengthInvalid if params are out of spec.
• Error::PinDerivationFailed if PBKDF2 fails.
• Error::InvalidScalar if the CSPRNG is broken.

pub fn expected_inbound(&self) -> Option<PaseMessageKind>

Returns the message kind the state machine is currently waiting to receive, or None if the machine is in an outbound-only or completed state.

Useful for routing inbound messages in a dispatcher.

pub fn handle_pbkdf_request(&mut self, bytes: &[u8]) -> Result<()>

Process an inbound PBKDFParamRequest message (negotiation path).

Decodes the request, captures the raw bytes for transcript composition, and transitions to ReadyToSendPbkdfResponse. After this call, next_message emits PBKDFParamResponse.

Errors

• Error::UnexpectedMessage if called from any state other than AwaitingFirstMessage.
• Error::Codec on TLV decoding failure.
• Error::InvalidParameter if the request is malformed.

pub fn handle_pake1(&mut self, bytes: &[u8]) -> Result<()>

Process an inbound Pake1 message.

Valid in two states:

• AwaitingFirstMessage — commissioner skipped param negotiation (known-params path); context = SHA-256(SPAKE_CONTEXT).
• AwaitingPake1 — negotiation complete; context already computed.

After this call, next_message emits Pake2.

Cryptography

1. Decode X from Pake1 TLV.
2. Compute Y = y·P + w0·N (verifier’s SPAKE2+ share).
3. Compute Z = y·(X − w0·M) and V = y·L (shared secrets).
4. Compute the SPAKE2+ transcript hash TT_HASH.
5. Split Ka (first 16 bytes) and Ke (last 16 bytes) from TT_HASH.
6. Derive confirmation keys KcA/KcB from Ka.
7. Compute cB = HMAC-SHA256(KcB, X) (our confirmation tag to send).
8. Compute cA_expected = HMAC-SHA256(KcA, Y) (to verify in Pake3).
9. Derive session keys from Ke.

Errors

• Error::UnexpectedMessage if called from the wrong state.
• Error::Codec on TLV decoding failure.
• Error::InvalidParameter if X is not a valid P-256 point.
• Error::PinDerivationFailed on HKDF failure.

pub fn handle_pake3(&mut self, bytes: &[u8]) -> Result<()>

Process an inbound Pake3 message.

Verifies the commissioner’s confirmation tag cA using constant-time comparison (subtle::ConstantTimeEq). If verification succeeds the state machine transitions to Complete and finish may be called.

Security

Tag comparison MUST be constant-time. This is enforced by routing through verify_tag (in pase::spake2plus) which uses subtle::ConstantTimeEq.

Errors

• Error::UnexpectedMessage if called before Pake2 was sent.
• Error::ConfirmationTagMismatch if cA fails constant-time verification (wrong PIN on the commissioner’s side).
• Error::Codec on TLV decoding failure.

pub fn next_message(&mut self) -> Result<Vec<u8>>

Produce the next outbound message.

• After handle_pbkdf_request: emits PBKDFParamResponse (TLV bytes).
• After handle_pake1: emits Pake2 (TLV bytes).

Calling from any other state returns Error::UnexpectedMessage.

Errors

• Error::UnexpectedMessage if called from the wrong state.
• Error::Codec on TLV encoding failure.

pub fn finish(self) -> Result<PaseSessionKeys>

Finalise the session and retrieve the derived session keys.

May only be called after handle_pake3 has successfully verified cA (i.e., the state machine is in Complete).

Errors

• Error::HandshakeIncomplete if called before the handshake has completed all phases.