Struct CertificationElements 

pub struct CertificationElements {

    pub format_version: u16,
    pub vendor_id: u16,
    pub product_ids: [u16; 100],
    pub product_ids_count: usize,
    pub device_type_id: u32,
    pub certificate_id: [u8; 19],
    pub security_level: u8,
    pub security_information: u16,
    pub version_number: u16,
    pub certification_type: CertificationType,
    pub dac_origin_vendor_id: u16,
    pub dac_origin_product_id: u16,
    pub dac_origin_vid_pid_present: bool,
    pub authorized_paa_list: [[u8; 20]; 10],
    pub authorized_paa_list_count: usize,
}

Decoded Certification Declaration payload (Matter Spec.)

Fields

format_version: u16

vendor_id: u16

product_ids: [u16; 100]

product_ids_count: usize

device_type_id: u32

certificate_id: [u8; 19]

security_level: u8

security_information: u16

version_number: u16

certification_type: CertificationType

dac_origin_vendor_id: u16

DAC origin vendor ID (present only if dac_origin_vid_pid_present is true).

dac_origin_product_id: u16

DAC origin product ID (present only if dac_origin_vid_pid_present is true).

dac_origin_vid_pid_present: bool

Whether dac_origin_vendor_id and dac_origin_product_id are present.

authorized_paa_list: [[u8; 20]; 10]

Authorized PAA Subject Key Identifiers.

authorized_paa_list_count: usize

Number of entries in authorized_paa_list.

Implementations

impl CertificationElements

pub fn decode(cd_content: &[u8]) -> Result<CertificationElements, Error>

Decode a TLV-encoded CD payload into CertificationElements.

Validates the TLV structure, field types, and constraints per the Matter spec:

• Tags 0-8 are mandatory and must appear in order.
• Tags 9-10 (DAC origin) are optional but must appear together.
• Tag 11 (authorized PAA list) is optional.
• Product IDs array must have 1..=100 entries.
• Certificate ID must be exactly 19 bytes.
• Authorized PAA entries must each be exactly 20 bytes.

pub fn verify<C>( crypto: C, cms_message: &[u8], allow_test_cd_signing_key: bool, ) -> Result<CertificationElements, Error>

where C: Crypto,

Verify a CMS-signed Certification Declaration.

1. Parses the CMS envelope
2. Looks up the signing key by Key ID in the well-known trust store
3. Enforces test key policy (test keys only for DevelopmentAndTest/Provisional)
4. Verifies the ECDSA-SHA256 signature over the CD content
5. Decodes the CD TLV payload

Arguments

• crypto: Cryptographic backend for ECDSA verification.
• cms_message: The complete CMS-signed CD message bytes.
• allow_test_cd_signing_key: If false, CDs signed with the test key are rejected.

Returns

The decoded CertificationElements on success.

pub fn validate( &self, device_info: &DeviceInfoForAttestation, ) -> Result<(), Error>

Validate CD content against device identity.

Implements the CD validation rules (Matter Spec).

Validation rules

1. format_version must be 1.
2. certification_type must be valid (0, 1, or 2) – already enforced by decoding.
3. CD vendor_id must match device’s BasicInformation VendorID.
4. Device’s BasicInformation ProductID must be in CD’s product_id_array.
5. If dac_origin_vid_pid_present:
   • DAC VID must match dac_origin_vendor_id
   • PAI VID must match dac_origin_vendor_id
   • DAC PID must match dac_origin_product_id
   • If PAI has PID, it must match dac_origin_product_id
6. If NOT dac_origin_vid_pid_present:
   • DAC VID must match CD vendor_id
   • PAI VID must match CD vendor_id
   • DAC PID must be in CD product_id_array
   • If PAI has PID, it must be in CD product_id_array
7. If authorized_paa_list is present, PAA’s SKID must be in the list.

Note: security_level, security_information, and version_number are explicitly ignored per the specification.

Trait Implementations

impl Debug for CertificationElements

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CertificationElements

fn default() -> CertificationElements

Returns the “default value” for a type.

impl Eq for CertificationElements

impl PartialEq for CertificationElements

fn eq(&self, other: &CertificationElements) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CertificationElements