@matter/protocol 0.16.0-alpha.0-20251220-0bb8d9f89 → 0.16.0-alpha.0-20251221-3dce6fa1b

package/src/fabric/Fabric.ts

@@ -295,6 +295,17 @@ export class Fabric {
     }
 
     async verifyCredentials(operationalCert: Bytes, intermediateCACert?: Bytes) {
+        if (intermediateCACert !== undefined && intermediateCACert.byteLength === 0) {
+            intermediateCACert = undefined;
+        }
+
+        // Workaround for an issue with the Ikea hub where the root certificate was also provided as ICAC
+        // see https://github.com/project-chip/connectedhomeip/issues/42479
+        if (intermediateCACert !== undefined && Bytes.areEqual(this.rootCert, intermediateCACert)) {
+            logger.info("Intermediate CA certificate is identical to root certificate; omitting ICAC");
+            intermediateCACert = undefined;
+        }
+
         const rootCert = Rcac.fromTlv(this.rootCert);
         const nocCert = Noc.fromTlv(operationalCert);
         const icaCert = intermediateCACert !== undefined ? Icac.fromTlv(intermediateCACert) : undefined;
@@ -499,6 +510,13 @@ export class FabricBuilder {
             throw new MatterFlowError("Root certificate needs to be set first");
         }
 
+        // Workaround for an issue with the Ikea hub where the root certificate was also provided as ICAC
+        // see https://github.com/project-chip/connectedhomeip/issues/42479
+        if (intermediateCACert !== undefined && Bytes.areEqual(this.#rootCert, intermediateCACert)) {
+            logger.info("Intermediate CA certificate is identical to root certificate; omitting ICAC");
+            intermediateCACert = undefined;
+        }
+
         const rootCert = Rcac.fromTlv(this.#rootCert);
         const nocCert = Noc.fromTlv(operationalCert);
         const icaCert = intermediateCACert !== undefined ? Icac.fromTlv(intermediateCACert) : undefined;

package/src/fabric/FabricAuthority.ts

@@ -5,6 +5,7 @@
  */
 
 import { CertificateAuthority } from "#certificate/CertificateAuthority.js";
+import { Noc } from "#certificate/kinds/Noc.js";
 import {
     AsyncObservable,
     Bytes,
@@ -53,6 +54,7 @@ export class FabricAuthority {
     #ca: CertificateAuthority;
     #fabrics: FabricManager;
     #fabricAdded = new AsyncObservable<[Fabric]>();
+    #rotatedFabricIndices = new Set<FabricIndex>(); // Remember which we already rotated in this run
 
     constructor({ ca, fabrics }: FabricAuthorityContext) {
         this.#ca = ca;
@@ -76,13 +78,17 @@ export class FabricAuthority {
     }
 
     /**
-     * Obtain the default fabric for this authority.
+     * Get the default fabric for this authority.
+     * When rotateNoc is true (the default), the NOC key pair is rotated once per runtime when the fabric already exists.
      */
-    async defaultFabric(config: FabricAuthorityConfiguration) {
+    async defaultFabric(config: FabricAuthorityConfiguration, rotateNoc = true) {
         // First search for a fabric associated with the CA's root certificate
         const caRootCert = this.#ca.rootCert;
-        const fabric = this.fabrics.find(fabric => Bytes.areEqual(fabric.rootCert, caRootCert));
+        let fabric = this.fabrics.find(fabric => Bytes.areEqual(fabric.rootCert, caRootCert));
         if (fabric !== undefined) {
+            if (rotateNoc) {
+                fabric = await this.#rotateFabricNocKey(fabric);
+            }
             if (fabric.label !== config.adminFabricLabel) {
                 await fabric.setLabel(config.adminFabricLabel);
             }
@@ -118,7 +124,7 @@ export class FabricAuthority {
     }
 
     /**
-     * Create a new fabric under our control.
+     * Create new fabric under our control.
      */
     async createFabric(config: FabricAuthorityConfiguration) {
         const rootNodeId = config.adminNodeId ?? NodeId.randomOperationalNodeId(this.#fabrics.crypto);
@@ -162,6 +168,35 @@ export class FabricAuthority {
         return fabric;
     }
 
+    async #rotateFabricNocKey(fabric: Fabric) {
+        if (this.#rotatedFabricIndices.has(fabric.fabricIndex)) {
+            // We only rotate once per runtime
+            return fabric;
+        }
+
+        const builder = await FabricBuilder.create(this.#fabrics.crypto);
+        builder.initializeFromFabricForUpdate(fabric);
+        const {
+            subject: { nodeId, fabricId, caseAuthenticatedTags },
+        } = Noc.fromTlv(fabric.operationalCert).cert;
+        if (nodeId !== fabric.rootNodeId) {
+            throw new ImplementationError(
+                `Cannot rotate NOC for fabric ${fabric.fabricIndex} because root node ID changed`,
+            );
+        }
+        await builder.setOperationalCert(
+            await this.#ca.generateNoc(builder.publicKey, fabricId, nodeId, caseAuthenticatedTags),
+            fabric.intermediateCACert,
+        );
+        const newFabric = await builder.build(fabric.fabricIndex);
+        logger.info(`Rotated NOC for fabric ${fabric.fabricIndex}`);
+
+        await this.#fabrics.replaceFabric(newFabric);
+
+        this.#rotatedFabricIndices.add(fabric.fabricIndex);
+        return newFabric;
+    }
+
     static [Environmental.create](env: Environment) {
         const instance = new FabricAuthority({
             ca: env.get(CertificateAuthority),

package/src/session/case/CaseServer.ts

@@ -78,7 +78,7 @@ export class CaseServer implements ProtocolHandler {
     async #handleSigma1(messenger: CaseServerMessenger) {
         logger.info("Received pairing request", Mark.INBOUND, Diagnostic.via(messenger.channelName));
 
-        // Initialize context with information from peer
+        // Initialize context with information from a peer
         const { sigma1Bytes, sigma1 } = await messenger.readSigma1();
         const resumptionRecord =
             sigma1.resumptionId !== undefined && sigma1.initiatorResumeMic !== undefined
@@ -268,7 +268,7 @@ export class CaseServer implements ProtocolHandler {
 
         await crypto.verifyEcdsa(PublicKey(peerPublicKey), peerSignatureData, new EcdsaSignature(peerSignature));
 
-        // All good! Create secure session
+        // All good! Create a secure session
         const secureSessionSalt = Bytes.concat(
             operationalIdentityProtectionKey,
             await crypto.computeHash([cx.bytes, sigma2Bytes, sigma3Bytes]),