@project-chip/matter.js 0.2.0 → 0.3.0

package/dist/cjs/certificate/CertificateManager.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateManager = exports.TlvCertificationDeclaration = exports.TlvOperationalCertificate = exports.TlvRootCertificate = exports.ProductId_Matter = exports.VendorId_Matter = exports.FabricId_Matter = exports.RcacId_Matter = exports.NodeId_Matter = exports.CommonName_X520 = exports.jsToMatterDate = exports.matterToJsDate = void 0;
+const DerCodec_js_1 = require("../codec/DerCodec.js");
+const Crypto_js_1 = require("../crypto/Crypto.js");
+const ByteArray_js_1 = require("../util/ByteArray.js");
+const NodeId_js_1 = require("../datatype/NodeId.js");
+const VendorId_js_1 = require("../datatype/VendorId.js");
+const TlvObject_js_1 = require("../tlv/TlvObject.js");
+const TlvString_js_1 = require("../tlv/TlvString.js");
+const TlvNumber_js_1 = require("../tlv/TlvNumber.js");
+const TlvArray_js_1 = require("../tlv/TlvArray.js");
+const TlvBoolean_js_1 = require("../tlv/TlvBoolean.js");
+const YEAR_S = 365 * 24 * 60 * 60;
+const EPOCH_OFFSET_S = 10957 * 24 * 60 * 60;
+// TODO replace usage of Date by abstraction
+function matterToJsDate(date) {
+    return new Date((date + EPOCH_OFFSET_S) * 1000);
+}
+exports.matterToJsDate = matterToJsDate;
+function jsToMatterDate(date, addYears = 0) {
+    return Math.floor(date.getTime() / 1000) - EPOCH_OFFSET_S + addYears * YEAR_S;
+}
+exports.jsToMatterDate = jsToMatterDate;
+function intTo16Chars(value) {
+    const byteArray = new ByteArray_js_1.ByteArray(8);
+    const dataView = byteArray.getDataView();
+    dataView.setBigUint64(0, typeof value === "bigint" ? value : BigInt(value));
+    return byteArray.toHex().toUpperCase();
+}
+function uInt16To4Chars(value) {
+    const byteArray = new ByteArray_js_1.ByteArray(2);
+    const dataView = byteArray.getDataView();
+    dataView.setUint16(0, value);
+    return byteArray.toHex().toUpperCase();
+}
+/** commonName = ASN.1 OID 2.5.4.3 */
+const CommonName_X520 = (name) => [(0, DerCodec_js_1.DerObject)("550403", { value: name })];
+exports.CommonName_X520 = CommonName_X520;
+/** matter-node-id = ASN.1 OID 1.3.6.1.4.1.37244.1.1 */
+const NodeId_Matter = (nodeId) => [(0, DerCodec_js_1.DerObject)("2b0601040182a27c0101", { value: intTo16Chars(nodeId.id) })];
+exports.NodeId_Matter = NodeId_Matter;
+/** matter-rcac-id = ASN.1 OID 1.3.6.1.4.1.37244.1.4 */
+const RcacId_Matter = (id) => [(0, DerCodec_js_1.DerObject)("2b0601040182a27c0104", { value: intTo16Chars(id) })];
+exports.RcacId_Matter = RcacId_Matter;
+/** matter-fabric-id = ASN.1 OID 1.3.6.1.4.1.37244.1.5 */
+const FabricId_Matter = (id) => [(0, DerCodec_js_1.DerObject)("2b0601040182a27c0105", { value: intTo16Chars(id) })];
+exports.FabricId_Matter = FabricId_Matter;
+/** matter-oid-vid = ASN.1 OID 1.3.6.1.4.1.37244.2.1 */
+const VendorId_Matter = (vendorId) => [(0, DerCodec_js_1.DerObject)("2b0601040182a27c0201", { value: uInt16To4Chars(vendorId.id) })];
+exports.VendorId_Matter = VendorId_Matter;
+/** matter-oid-pid = ASN.1 OID 1.3.6.1.4.1.3724 4.2.2 */
+const ProductId_Matter = (id) => [(0, DerCodec_js_1.DerObject)("2b0601040182a27c0202", { value: uInt16To4Chars(id) })];
+exports.ProductId_Matter = ProductId_Matter;
+exports.TlvRootCertificate = (0, TlvObject_js_1.TlvObject)({
+    serialNumber: (0, TlvObject_js_1.TlvField)(1, TlvString_js_1.TlvByteString.bound({ maxLength: 20 })),
+    signatureAlgorithm: (0, TlvObject_js_1.TlvField)(2, TlvNumber_js_1.TlvUInt8),
+    issuer: (0, TlvObject_js_1.TlvField)(3, (0, TlvObject_js_1.TlvList)({
+        issuerRcacId: (0, TlvObject_js_1.TlvOptionalField)(20, TlvNumber_js_1.TlvUInt64),
+    })),
+    notBefore: (0, TlvObject_js_1.TlvField)(4, TlvNumber_js_1.TlvUInt32),
+    notAfter: (0, TlvObject_js_1.TlvField)(5, TlvNumber_js_1.TlvUInt32),
+    subject: (0, TlvObject_js_1.TlvField)(6, (0, TlvObject_js_1.TlvList)({
+        rcacId: (0, TlvObject_js_1.TlvField)(20, TlvNumber_js_1.TlvUInt64),
+    })),
+    publicKeyAlgorithm: (0, TlvObject_js_1.TlvField)(7, TlvNumber_js_1.TlvUInt8),
+    ellipticCurveIdentifier: (0, TlvObject_js_1.TlvField)(8, TlvNumber_js_1.TlvUInt8),
+    ellipticCurvePublicKey: (0, TlvObject_js_1.TlvField)(9, TlvString_js_1.TlvByteString),
+    extensions: (0, TlvObject_js_1.TlvField)(10, (0, TlvObject_js_1.TlvList)({
+        basicConstraints: (0, TlvObject_js_1.TlvField)(1, (0, TlvObject_js_1.TlvObject)({
+            isCa: (0, TlvObject_js_1.TlvField)(1, TlvBoolean_js_1.TlvBoolean),
+            pathLen: (0, TlvObject_js_1.TlvOptionalField)(2, TlvNumber_js_1.TlvUInt8),
+        })),
+        keyUsage: (0, TlvObject_js_1.TlvField)(2, TlvNumber_js_1.TlvUInt16),
+        extendedKeyUsage: (0, TlvObject_js_1.TlvOptionalField)(3, (0, TlvArray_js_1.TlvArray)(TlvNumber_js_1.TlvUInt8)),
+        subjectKeyIdentifier: (0, TlvObject_js_1.TlvField)(4, TlvString_js_1.TlvByteString.bound({ length: 20 })),
+        authorityKeyIdentifier: (0, TlvObject_js_1.TlvField)(5, TlvString_js_1.TlvByteString.bound({ length: 20 })),
+        futureExtension: (0, TlvObject_js_1.TlvOptionalField)(6, TlvString_js_1.TlvByteString),
+    })),
+    signature: (0, TlvObject_js_1.TlvField)(11, TlvString_js_1.TlvByteString),
+});
+exports.TlvOperationalCertificate = (0, TlvObject_js_1.TlvObject)({
+    serialNumber: (0, TlvObject_js_1.TlvField)(1, TlvString_js_1.TlvByteString.bound({ maxLength: 20 })),
+    signatureAlgorithm: (0, TlvObject_js_1.TlvField)(2, TlvNumber_js_1.TlvUInt8),
+    issuer: (0, TlvObject_js_1.TlvField)(3, (0, TlvObject_js_1.TlvList)({
+        issuerRcacId: (0, TlvObject_js_1.TlvOptionalField)(20, TlvNumber_js_1.TlvUInt64),
+    })),
+    notBefore: (0, TlvObject_js_1.TlvField)(4, TlvNumber_js_1.TlvUInt32),
+    notAfter: (0, TlvObject_js_1.TlvField)(5, TlvNumber_js_1.TlvUInt32),
+    subject: (0, TlvObject_js_1.TlvField)(6, (0, TlvObject_js_1.TlvList)({
+        fabricId: (0, TlvObject_js_1.TlvField)(21, TlvNumber_js_1.TlvUInt64),
+        nodeId: (0, TlvObject_js_1.TlvField)(17, NodeId_js_1.TlvNodeId),
+    })),
+    publicKeyAlgorithm: (0, TlvObject_js_1.TlvField)(7, TlvNumber_js_1.TlvUInt8),
+    ellipticCurveIdentifier: (0, TlvObject_js_1.TlvField)(8, TlvNumber_js_1.TlvUInt8),
+    ellipticCurvePublicKey: (0, TlvObject_js_1.TlvField)(9, TlvString_js_1.TlvByteString),
+    extensions: (0, TlvObject_js_1.TlvField)(10, (0, TlvObject_js_1.TlvList)({
+        basicConstraints: (0, TlvObject_js_1.TlvField)(1, (0, TlvObject_js_1.TlvObject)({
+            isCa: (0, TlvObject_js_1.TlvField)(1, TlvBoolean_js_1.TlvBoolean),
+            pathLen: (0, TlvObject_js_1.TlvOptionalField)(2, TlvNumber_js_1.TlvUInt8),
+        })),
+        keyUsage: (0, TlvObject_js_1.TlvField)(2, TlvNumber_js_1.TlvUInt16),
+        extendedKeyUsage: (0, TlvObject_js_1.TlvOptionalField)(3, (0, TlvArray_js_1.TlvArray)(TlvNumber_js_1.TlvUInt8)),
+        subjectKeyIdentifier: (0, TlvObject_js_1.TlvField)(4, TlvString_js_1.TlvByteString.bound({ length: 20 })),
+        authorityKeyIdentifier: (0, TlvObject_js_1.TlvField)(5, TlvString_js_1.TlvByteString.bound({ length: 20 })),
+        futureExtension: (0, TlvObject_js_1.TlvOptionalField)(6, TlvString_js_1.TlvByteString),
+    })),
+    signature: (0, TlvObject_js_1.TlvField)(11, TlvString_js_1.TlvByteString),
+});
+exports.TlvCertificationDeclaration = (0, TlvObject_js_1.TlvObject)({
+    formatVersion: (0, TlvObject_js_1.TlvField)(0, TlvNumber_js_1.TlvUInt16),
+    vendorId: (0, TlvObject_js_1.TlvField)(1, VendorId_js_1.TlvVendorId),
+    produceIdArray: (0, TlvObject_js_1.TlvField)(2, (0, TlvArray_js_1.TlvArray)(TlvNumber_js_1.TlvUInt16, { minLength: 1, maxLength: 100 })),
+    deviceTypeId: (0, TlvObject_js_1.TlvField)(3, TlvNumber_js_1.TlvUInt32),
+    certificateId: (0, TlvObject_js_1.TlvField)(4, TlvString_js_1.TlvString.bound({ length: 19 })),
+    securityLevel: (0, TlvObject_js_1.TlvField)(5, TlvNumber_js_1.TlvUInt8),
+    securityInformation: (0, TlvObject_js_1.TlvField)(6, TlvNumber_js_1.TlvUInt16),
+    versionNumber: (0, TlvObject_js_1.TlvField)(7, TlvNumber_js_1.TlvUInt16),
+    certificationType: (0, TlvObject_js_1.TlvField)(8, TlvNumber_js_1.TlvUInt8),
+    dacOriginVendorId: (0, TlvObject_js_1.TlvOptionalField)(9, VendorId_js_1.TlvVendorId),
+    dacOriginProductId: (0, TlvObject_js_1.TlvOptionalField)(10, TlvNumber_js_1.TlvUInt16),
+    authorizedPaaList: (0, TlvObject_js_1.TlvOptionalField)(11, (0, TlvArray_js_1.TlvArray)(TlvString_js_1.TlvByteString.bound({ length: 20 }), { minLength: 1, maxLength: 10 })),
+});
+class CertificateManager {
+    static rootCertToAsn1({ serialNumber, notBefore, notAfter, issuer: { issuerRcacId }, subject: { rcacId }, ellipticCurvePublicKey, extensions: { subjectKeyIdentifier, authorityKeyIdentifier } }) {
+        return DerCodec_js_1.DerCodec.encode({
+            version: (0, DerCodec_js_1.ContextTagged)(0, 2),
+            serialNumber: serialNumber[0],
+            signatureAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            issuer: {
+                issuerRcacId: issuerRcacId === undefined ? undefined : (0, exports.RcacId_Matter)(issuerRcacId),
+            },
+            validity: {
+                notBefore: matterToJsDate(notBefore),
+                notAfter: matterToJsDate(notAfter),
+            },
+            subject: {
+                rcacId: (0, exports.RcacId_Matter)(rcacId),
+            },
+            publicKey: (0, DerCodec_js_1.PublicKeyEcPrime256v1_X962)(ellipticCurvePublicKey),
+            extensions: (0, DerCodec_js_1.ContextTagged)(3, {
+                basicConstraints: (0, DerCodec_js_1.BasicConstraints_X509)({ isCa: true }),
+                keyUsage: DerCodec_js_1.KeyUsage_Signature_ContentCommited_X509,
+                subjectKeyIdentifier: (0, DerCodec_js_1.SubjectKeyIdentifier_X509)(subjectKeyIdentifier),
+                authorityKeyIdentifier: (0, DerCodec_js_1.AuthorityKeyIdentifier_X509)(authorityKeyIdentifier),
+            }),
+        });
+    }
+    static nocCertToAsn1({ serialNumber, notBefore, notAfter, issuer: { issuerRcacId }, subject: { fabricId, nodeId }, ellipticCurvePublicKey, extensions: { subjectKeyIdentifier, authorityKeyIdentifier } }) {
+        return DerCodec_js_1.DerCodec.encode({
+            version: (0, DerCodec_js_1.ContextTagged)(0, 2),
+            serialNumber: serialNumber[0],
+            signatureAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            issuer: {
+                issuerRcacId: issuerRcacId === undefined ? undefined : (0, exports.RcacId_Matter)(issuerRcacId),
+            },
+            validity: {
+                notBefore: matterToJsDate(notBefore),
+                notAfter: matterToJsDate(notAfter),
+            },
+            subject: {
+                fabricId: (0, exports.FabricId_Matter)(fabricId),
+                nodeId: (0, exports.NodeId_Matter)(nodeId),
+            },
+            publicKey: (0, DerCodec_js_1.PublicKeyEcPrime256v1_X962)(ellipticCurvePublicKey),
+            extensions: (0, DerCodec_js_1.ContextTagged)(3, {
+                basicConstraints: (0, DerCodec_js_1.BasicConstraints_X509)({}),
+                keyUsage: DerCodec_js_1.KeyUsage_Signature_X509,
+                extendedKeyUsage: (0, DerCodec_js_1.ExtendedKeyUsage_X509)({ serverAuth: true, clientAuth: true }),
+                subjectKeyIdentifier: (0, DerCodec_js_1.SubjectKeyIdentifier_X509)(subjectKeyIdentifier),
+                authorityKeyIdentifier: (0, DerCodec_js_1.AuthorityKeyIdentifier_X509)(authorityKeyIdentifier),
+            }),
+        });
+    }
+    static daCertToAsn1({ serialNumber, notBefore, notAfter, issuer: { commonName: issuerCommonName, vendorId: issuerVendorId }, subject: { commonName: subjectCommonName, vendorId: subjectVendorId, productId: subjectProductId }, ellipticCurvePublicKey, extensions: { subjectKeyIdentifier, authorityKeyIdentifier } }, keys) {
+        const certificate = {
+            version: (0, DerCodec_js_1.ContextTagged)(0, 2),
+            serialNumber: serialNumber[0],
+            signatureAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            issuer: {
+                commonName: (0, exports.CommonName_X520)(issuerCommonName),
+                vendorId: (0, exports.VendorId_Matter)(issuerVendorId),
+            },
+            validity: {
+                notBefore: matterToJsDate(notBefore),
+                notAfter: matterToJsDate(notAfter),
+            },
+            subject: {
+                commonName: (0, exports.CommonName_X520)(subjectCommonName),
+                vendorId: (0, exports.VendorId_Matter)(subjectVendorId),
+                productId: (0, exports.ProductId_Matter)(subjectProductId),
+            },
+            publicKey: (0, DerCodec_js_1.PublicKeyEcPrime256v1_X962)(ellipticCurvePublicKey),
+            extensions: (0, DerCodec_js_1.ContextTagged)(3, {
+                basicConstraints: (0, DerCodec_js_1.BasicConstraints_X509)({
+                    isCa: false,
+                }),
+                keyUsage: DerCodec_js_1.KeyUsage_Signature_X509,
+                subjectKeyIdentifier: (0, DerCodec_js_1.SubjectKeyIdentifier_X509)(subjectKeyIdentifier),
+                authorityKeyIdentifier: (0, DerCodec_js_1.AuthorityKeyIdentifier_X509)(authorityKeyIdentifier),
+            }),
+        };
+        return DerCodec_js_1.DerCodec.encode({
+            certificate,
+            signAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            signature: (0, DerCodec_js_1.BitByteArray)(Crypto_js_1.Crypto.signPkcs8(keys.privateKey, DerCodec_js_1.DerCodec.encode(certificate), "der")),
+        });
+    }
+    static paiCertToAsn1({ serialNumber, notBefore, notAfter, issuer: { commonName: issuerCommonName, vendorId: issuerVendorId }, subject: { commonName, vendorId, productId }, ellipticCurvePublicKey, extensions: { subjectKeyIdentifier, authorityKeyIdentifier } }, keys) {
+        const certificate = {
+            version: (0, DerCodec_js_1.ContextTagged)(0, 2),
+            serialNumber: serialNumber[0],
+            signatureAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            issuer: {
+                commonName: (0, exports.CommonName_X520)(issuerCommonName),
+                vendorId: issuerVendorId === undefined ? undefined : (0, exports.VendorId_Matter)(issuerVendorId),
+            },
+            validity: {
+                notBefore: matterToJsDate(notBefore),
+                notAfter: matterToJsDate(notAfter),
+            },
+            subject: {
+                commonName: (0, exports.CommonName_X520)(commonName),
+                vendorId: (0, exports.VendorId_Matter)(vendorId),
+                productId: productId === undefined ? undefined : (0, exports.ProductId_Matter)(productId),
+            },
+            publicKey: (0, DerCodec_js_1.PublicKeyEcPrime256v1_X962)(ellipticCurvePublicKey),
+            extensions: (0, DerCodec_js_1.ContextTagged)(3, {
+                basicConstraints: (0, DerCodec_js_1.BasicConstraints_X509)({
+                    isCa: true,
+                    pathLen: 0,
+                }),
+                keyUsage: DerCodec_js_1.KeyUsage_Signature_ContentCommited_X509,
+                subjectKeyIdentifier: (0, DerCodec_js_1.SubjectKeyIdentifier_X509)(subjectKeyIdentifier),
+                authorityKeyIdentifier: (0, DerCodec_js_1.AuthorityKeyIdentifier_X509)(authorityKeyIdentifier),
+            }),
+        };
+        return DerCodec_js_1.DerCodec.encode({
+            certificate,
+            signAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            signature: (0, DerCodec_js_1.BitByteArray)(Crypto_js_1.Crypto.signPkcs8(keys.privateKey, DerCodec_js_1.DerCodec.encode(certificate), "der")),
+        });
+    }
+    static paaCertToAsn1({ serialNumber, notBefore, notAfter, issuer: { commonName: issuerCommonName, vendorId: issuerVendorId }, subject: { commonName, vendorId }, ellipticCurvePublicKey, extensions: { subjectKeyIdentifier, authorityKeyIdentifier } }, keys) {
+        const certificate = {
+            version: (0, DerCodec_js_1.ContextTagged)(0, 2),
+            serialNumber: serialNumber[0],
+            signatureAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            issuer: {
+                commonName: (0, exports.CommonName_X520)(issuerCommonName),
+                vendorId: issuerVendorId === undefined ? undefined : (0, exports.VendorId_Matter)(issuerVendorId),
+            },
+            validity: {
+                notBefore: matterToJsDate(notBefore),
+                notAfter: matterToJsDate(notAfter),
+            },
+            subject: {
+                commonName: (0, exports.CommonName_X520)(commonName),
+                vendorId: vendorId === undefined ? undefined : (0, exports.VendorId_Matter)(vendorId),
+            },
+            publicKey: (0, DerCodec_js_1.PublicKeyEcPrime256v1_X962)(ellipticCurvePublicKey),
+            extensions: (0, DerCodec_js_1.ContextTagged)(3, {
+                basicConstraints: (0, DerCodec_js_1.BasicConstraints_X509)({
+                    isCa: false,
+                }),
+                keyUsage: DerCodec_js_1.KeyUsage_Signature_ContentCommited_X509,
+                subjectKeyIdentifier: (0, DerCodec_js_1.SubjectKeyIdentifier_X509)(subjectKeyIdentifier),
+                authorityKeyIdentifier: authorityKeyIdentifier === undefined ? undefined : (0, DerCodec_js_1.AuthorityKeyIdentifier_X509)(authorityKeyIdentifier),
+            }),
+        };
+        return DerCodec_js_1.DerCodec.encode({
+            certificate,
+            signAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            signature: (0, DerCodec_js_1.BitByteArray)(Crypto_js_1.Crypto.signPkcs8(keys.privateKey, DerCodec_js_1.DerCodec.encode(certificate), "der")),
+        });
+    }
+    static CertificationDeclarationToAsn1(eContent, subjectKeyIdentifier, privateKey) {
+        const certificate = {
+            version: 3,
+            digestAlgorithm: [DerCodec_js_1.SHA256_CMS],
+            encapContentInfo: (0, DerCodec_js_1.Pkcs7Data)(eContent),
+            signerInfo: [{
+                    version: 3,
+                    subjectKeyIdentifier: (0, DerCodec_js_1.ContextTaggedBytes)(0, subjectKeyIdentifier),
+                    digestAlgorithm: DerCodec_js_1.SHA256_CMS,
+                    signatureAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+                    signature: Crypto_js_1.Crypto.signSec1(privateKey, eContent, "der")
+                }]
+        };
+        return DerCodec_js_1.DerCodec.encode((0, DerCodec_js_1.Pkcs7SignedData)(certificate));
+    }
+    static validateRootCertificate(rootCert) {
+        Crypto_js_1.Crypto.verifySpki(rootCert.ellipticCurvePublicKey, this.rootCertToAsn1(rootCert), rootCert.signature);
+    }
+    static validateNocCertificate(rootCert, nocCert) {
+        Crypto_js_1.Crypto.verifySpki(rootCert.ellipticCurvePublicKey, this.nocCertToAsn1(nocCert), nocCert.signature);
+    }
+    static createCertificateSigningRequest(keys) {
+        const request = {
+            version: 0,
+            subject: { organization: (0, DerCodec_js_1.OrganisationName_X520)("CSR") },
+            publicKey: (0, DerCodec_js_1.PublicKeyEcPrime256v1_X962)(keys.publicKey),
+            endSignedBytes: (0, DerCodec_js_1.ContextTagged)(0),
+        };
+        return DerCodec_js_1.DerCodec.encode({
+            request,
+            signAlgorithm: DerCodec_js_1.EcdsaWithSHA256_X962,
+            signature: (0, DerCodec_js_1.BitByteArray)(Crypto_js_1.Crypto.signPkcs8(keys.privateKey, DerCodec_js_1.DerCodec.encode(request), "der")),
+        });
+    }
+    static getPublicKeyFromCsr(csr) {
+        var _a, _b;
+        const { [DerCodec_js_1.ELEMENTS_KEY]: rootElements } = DerCodec_js_1.DerCodec.decode(csr);
+        if ((rootElements === null || rootElements === void 0 ? void 0 : rootElements.length) !== 3)
+            throw new Error("Invalid CSR data");
+        const [requestNode, signAlgorithmNode, signatureNode] = rootElements;
+        // Extract the public key
+        const { [DerCodec_js_1.ELEMENTS_KEY]: requestElements } = requestNode;
+        if ((requestElements === null || requestElements === void 0 ? void 0 : requestElements.length) !== 4)
+            throw new Error("Invalid CSR data");
+        const [versionNode, _subjectNode, publicKeyNode] = requestElements;
+        const requestVersion = versionNode[DerCodec_js_1.BYTES_KEY][0];
+        if (requestVersion !== 0)
+            throw new Error(`Unsupported request version${requestVersion}`);
+        // TODO: verify subject = { OrganisationName: "CSR" }
+        const { [DerCodec_js_1.ELEMENTS_KEY]: publicKeyElements } = publicKeyNode;
+        if ((publicKeyElements === null || publicKeyElements === void 0 ? void 0 : publicKeyElements.length) !== 2)
+            throw new Error("Invalid CSR data");
+        const [_publicKeyTypeNode, publicKeyBytesNode] = publicKeyElements;
+        // TODO: verify publicKey algorithm
+        const publicKey = publicKeyBytesNode[DerCodec_js_1.BYTES_KEY];
+        // Verify the CSR signature
+        if (!DerCodec_js_1.EcdsaWithSHA256_X962[DerCodec_js_1.OBJECT_ID_KEY][DerCodec_js_1.BYTES_KEY].equals((_b = (_a = signAlgorithmNode[DerCodec_js_1.ELEMENTS_KEY]) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b[DerCodec_js_1.BYTES_KEY]))
+            throw new Error("Unsupported signature type");
+        Crypto_js_1.Crypto.verifySpki(publicKey, DerCodec_js_1.DerCodec.encode(requestNode), signatureNode[DerCodec_js_1.BYTES_KEY], "der");
+        return publicKey;
+    }
+}
+exports.CertificateManager = CertificateManager;

package/dist/cjs/certificate/CertificationDeclarationManager.d.ts

@@ -0,0 +1,5 @@
+import { VendorId } from "../datatype/VendorId.js";
+export declare class CertificationDeclarationManager {
+    static generate(vendorId: VendorId, productId: number): Uint8Array;
+}
+//# sourceMappingURL=CertificationDeclarationManager.d.ts.map

package/dist/cjs/certificate/CertificationDeclarationManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertificationDeclarationManager.d.ts","sourceRoot":"","sources":["../../../src/certificate/CertificationDeclarationManager.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAQnD,qBAAa,+BAA+B;IACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;CAexD"}

package/dist/cjs/certificate/CertificationDeclarationManager.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificationDeclarationManager = void 0;
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const CertificateManager_js_1 = require("./CertificateManager.js");
+const ByteArray_js_1 = require("../util/ByteArray.js");
+// CD Signer Certificate and Key taken from Chip-Tool repository
+const TestCMS_SignerPrivateKey = ByteArray_js_1.ByteArray.fromHex("30770201010420aef3484116e9481ec57be0472df41bf499064e5024ad869eca5e889802d48075a00a06082a8648ce3d030107a144034200043c398922452b55caf389c25bd1bca4656952ccb90e8869249ad8474653014cbf95d687965e036b521c51037e6b8cedefca1eb44046694fa08882eed6519decba");
+const TestCMS_SignerSubjectKeyIdentifier = ByteArray_js_1.ByteArray.fromHex("62FA823359ACFAA9963E1CFA140ADDF504F37160");
+class CertificationDeclarationManager {
+    static generate(vendorId, productId) {
+        const certificationElements = CertificateManager_js_1.TlvCertificationDeclaration.encode({
+            formatVersion: 1,
+            vendorId,
+            produceIdArray: [productId],
+            deviceTypeId: 22,
+            certificateId: "CSA00000SWC00000-00",
+            securityLevel: 0,
+            securityInformation: 0,
+            versionNumber: 1,
+            certificationType: 0,
+        });
+        return CertificateManager_js_1.CertificateManager.CertificationDeclarationToAsn1(certificationElements, TestCMS_SignerSubjectKeyIdentifier, TestCMS_SignerPrivateKey);
+    }
+}
+exports.CertificationDeclarationManager = CertificationDeclarationManager;

package/dist/cjs/certificate/ChipPAAuthorities.d.ts

@@ -0,0 +1,9 @@
+export declare const TestCert_PAA_NoVID_PublicKey: Uint8Array;
+export declare const TestCert_PAA_NoVID_PrivateKey: Uint8Array;
+export declare const TestCert_PAA_NoVID_SKID: Uint8Array;
+export declare const TestCert_PAA_NoVID_Cert: Uint8Array;
+export declare const TestCert_PAA_FFF1_PrivateKey: Uint8Array;
+export declare const TestCert_PAA_FFF1_PublicKey: Uint8Array;
+export declare const TestCert_PAA_FFF1_SKID: Uint8Array;
+export declare const TestCert_PAA_FFF1_Cert: Uint8Array;
+//# sourceMappingURL=ChipPAAuthorities.d.ts.map

package/dist/cjs/certificate/ChipPAAuthorities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChipPAAuthorities.d.ts","sourceRoot":"","sources":["../../../src/certificate/ChipPAAuthorities.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,4BAA4B,YAA0J,CAAC;AACpM,eAAO,MAAM,6BAA6B,YAAwF,CAAC;AACnI,eAAO,MAAM,uBAAuB,YAAgE,CAAC;AACrG,eAAO,MAAM,uBAAuB,YAAk0B,CAAC;AAIv2B,eAAO,MAAM,4BAA4B,YAAwF,CAAC;AAClI,eAAO,MAAM,2BAA2B,YAA0J,CAAC;AACnM,eAAO,MAAM,sBAAsB,YAAgE,CAAC;AACpG,eAAO,MAAM,sBAAsB,YAA05B,CAAC"}

package/dist/cjs/certificate/ChipPAAuthorities.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TestCert_PAA_FFF1_Cert = exports.TestCert_PAA_FFF1_SKID = exports.TestCert_PAA_FFF1_PublicKey = exports.TestCert_PAA_FFF1_PrivateKey = exports.TestCert_PAA_NoVID_Cert = exports.TestCert_PAA_NoVID_SKID = exports.TestCert_PAA_NoVID_PrivateKey = exports.TestCert_PAA_NoVID_PublicKey = void 0;
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const ByteArray_js_1 = require("../util/ByteArray.js");
+// from CHIPAttCert_test_vectors.h ...
+// PAA without Vendor ID
+exports.TestCert_PAA_NoVID_PublicKey = ByteArray_js_1.ByteArray.fromHex("0410ef02a81a87b68121fba8d31978f807a317e50aa8a828446828914b933de8edd4a5c39c9ff71a4ce3647fd7f62653b7d2495fcba4c0f47f876880039e07204a");
+exports.TestCert_PAA_NoVID_PrivateKey = ByteArray_js_1.ByteArray.fromHex("e1f073c934853baffb38bf7e8bdad7a0a674107c7769892a0ff2e06c1a2ef7a7");
+exports.TestCert_PAA_NoVID_SKID = ByteArray_js_1.ByteArray.fromHex("785CE705B86B8F4E6FC793AA60CB43EA696882D5");
+exports.TestCert_PAA_NoVID_Cert = ByteArray_js_1.ByteArray.fromHex("3082019130820137a00302010202070b8fbaa8dd86ee300a06082a8648ce3d040302301a3118301606035504030c0f4d61747465722054657374205041413020170d3231303632383134323334335a180f39393939313233313233353935395a301a3118301606035504030c0f4d61747465722054657374205041413059301306072a8648ce3d020106082a8648ce3d0301070342000410ef02a81a87b68121fba8d31978f807a317e50aa8a828446828914b933de8edd4a5c39c9ff71a4ce3647fd7f62653b7d2495fcba4c0f47f876880039e07204aa366306430120603551d130101ff040830060101ff020101300e0603551d0f0101ff040403020106301d0603551d0e04160414785ce705b86b8f4e6fc793aa60cb43ea696882d5301f0603551d23041830168014785ce705b86b8f4e6fc793aa60cb43ea696882d5300a06082a8648ce3d0403020348003045022100b9efdb3ea06a52ec0bf01e61daed2c2d156ddb6cf014101dab798fac05fa47e5022060061d3e35d60d9d4b0d448dad7612f7e85c582e3fc312dc18794dd373715e5d");
+// PAA with Vendor ID 0xFFF1
+exports.TestCert_PAA_FFF1_PrivateKey = ByteArray_js_1.ByteArray.fromHex("6512caecaecfc543d60623161597162f014684c565a129b62fd28c27ab1ccc50");
+exports.TestCert_PAA_FFF1_PublicKey = ByteArray_js_1.ByteArray.fromHex("04b6cb6372887f2928f5bac81aa9d93ae2431cada9d79e242f65177ef9ced932a28ecd03baaf6a8fca184a1a503542960d453f303f1f19421d751e8f8f1a9a9b75");
+exports.TestCert_PAA_FFF1_SKID = ByteArray_js_1.ByteArray.fromHex("6AFD22771F511FECBF1641976710DCDC31A1717E");
+exports.TestCert_PAA_FFF1_Cert = ByteArray_js_1.ByteArray.fromHex("308201bd30820164a00302010202084ea8e83182d41c1c300a06082a8648ce3d04030230303118301606035504030c0f4d617474657220546573742050414131143012060a2b0601040182a27c02010c04464646313020170d3231303632383134323334335a180f39393939313233313233353935395a30303118301606035504030c0f4d617474657220546573742050414131143012060a2b0601040182a27c02010c04464646313059301306072a8648ce3d020106082a8648ce3d03010703420004b6cb6372887f2928f5bac81aa9d93ae2431cada9d79e242f65177ef9ced932a28ecd03baaf6a8fca184a1a503542960d453f303f1f19421d751e8f8f1a9a9b75a366306430120603551d130101ff040830060101ff020101300e0603551d0f0101ff040403020106301d0603551d0e041604146afd22771f511fecbf1641976710dcdc31a1717e301f0603551d230418301680146afd22771f511fecbf1641976710dcdc31a1717e300a06082a8648ce3d0403020347003044022050aa8002f4d932a9a00538f65368ad0fffc8efbbc9beb7da569835cf9aa7510e022023bac8fe0f23e75445b65339081a47994929c72aaf0a1548d40d034d514b25de");

package/dist/cjs/certificate/RootCertificateManager.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2022 The node-matter Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ByteArray } from "../util/ByteArray.js";
+import { NodeId } from "../datatype/NodeId.js";
+import { StorageManager } from "../storage/StorageManager.js";
+export declare class RootCertificateManager {
+    private rootCertId;
+    private rootKeyPair;
+    private rootKeyIdentifier;
+    private rootCertBytes;
+    private nextCertificateId;
+    constructor(storageManager: StorageManager);
+    getRootCert(): Uint8Array;
+    private generateRootCert;
+    generateNoc(publicKey: ByteArray, fabricId: bigint, nodeId: NodeId): Uint8Array;
+}
+//# sourceMappingURL=RootCertificateManager.d.ts.map

package/dist/cjs/certificate/RootCertificateManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RootCertificateManager.d.ts","sourceRoot":"","sources":["../../../src/certificate/RootCertificateManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,qBAAa,sBAAsB;IAC/B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,iBAAiB,CAAwD;IACjF,OAAO,CAAC,aAAa,CAA2B;IAChD,OAAO,CAAC,iBAAiB,CAAK;gBAElB,cAAc,EAAE,cAAc;IA8B1C,WAAW;IAIX,OAAO,CAAC,gBAAgB;IAuBxB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAwBrE"}

package/dist/cjs/certificate/RootCertificateManager.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * @license
+ * Copyright 2022 The node-matter Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RootCertificateManager = void 0;
+const CertificateManager_js_1 = require("./CertificateManager.js");
+const Crypto_js_1 = require("../crypto/Crypto.js");
+const ByteArray_js_1 = require("../util/ByteArray.js");
+const Time_js_1 = require("../time/Time.js");
+class RootCertificateManager {
+    constructor(storageManager) {
+        this.rootCertId = BigInt(0);
+        this.rootKeyPair = Crypto_js_1.Crypto.createKeyPair();
+        this.rootKeyIdentifier = Crypto_js_1.Crypto.hash(this.rootKeyPair.publicKey).slice(0, 20);
+        this.rootCertBytes = this.generateRootCert();
+        this.nextCertificateId = 1;
+        const storage = storageManager.createContext("RootCertificateManager");
+        // Read from storage if we have them stored, else store the just generated data
+        if (storage.has("rootCertId")) {
+            try {
+                // Read and set the values from storage,
+                // if one fail we use the pre-generated values, else we overwrite them
+                const rootCertId = storage.get("rootCertId");
+                const rootKeyPair = storage.get("rootKeyPair");
+                const rootKeyIdentifier = storage.get("rootKeyIdentifier");
+                const rootCertBytes = storage.get("rootCertBytes");
+                const nextCertificateId = storage.get("nextCertificateId");
+                this.rootCertId = rootCertId;
+                this.rootKeyPair = rootKeyPair;
+                this.rootKeyIdentifier = rootKeyIdentifier;
+                this.rootCertBytes = rootCertBytes;
+                this.nextCertificateId = nextCertificateId;
+                return;
+            }
+            catch (error) {
+                console.error("Failed to load root certificate from storage, generating new one", error);
+            }
+        }
+        storage.set("rootCertId", this.rootCertId);
+        storage.set("rootKeyPair", this.rootKeyPair);
+        storage.set("rootKeyIdentifier", this.rootKeyIdentifier);
+        storage.set("rootCertBytes", this.rootCertBytes);
+        storage.set("nextCertificateId", this.nextCertificateId);
+    }
+    getRootCert() {
+        return this.rootCertBytes;
+    }
+    generateRootCert() {
+        const now = Time_js_1.Time.get().now();
+        const unsignedCertificate = {
+            serialNumber: ByteArray_js_1.ByteArray.of(Number(this.rootCertId)),
+            signatureAlgorithm: 1 /* EcdsaWithSHA256 */,
+            publicKeyAlgorithm: 1 /* EC */,
+            ellipticCurveIdentifier: 1 /* P256v1 */,
+            issuer: { issuerRcacId: this.rootCertId },
+            notBefore: (0, CertificateManager_js_1.jsToMatterDate)(now, -1),
+            notAfter: (0, CertificateManager_js_1.jsToMatterDate)(now, 10),
+            subject: { rcacId: this.rootCertId },
+            ellipticCurvePublicKey: this.rootKeyPair.publicKey,
+            extensions: {
+                basicConstraints: { isCa: true },
+                keyUsage: 96,
+                subjectKeyIdentifier: this.rootKeyIdentifier,
+                authorityKeyIdentifier: this.rootKeyIdentifier,
+            },
+        };
+        const signature = Crypto_js_1.Crypto.signPkcs8(this.rootKeyPair.privateKey, CertificateManager_js_1.CertificateManager.rootCertToAsn1(unsignedCertificate));
+        return CertificateManager_js_1.TlvRootCertificate.encode(Object.assign(Object.assign({}, unsignedCertificate), { signature }));
+    }
+    generateNoc(publicKey, fabricId, nodeId) {
+        const now = Time_js_1.Time.get().now();
+        const certId = this.nextCertificateId++;
+        const unsignedCertificate = {
+            serialNumber: ByteArray_js_1.ByteArray.of(certId),
+            signatureAlgorithm: 1 /* EcdsaWithSHA256 */,
+            publicKeyAlgorithm: 1 /* EC */,
+            ellipticCurveIdentifier: 1 /* P256v1 */,
+            issuer: { issuerRcacId: this.rootCertId },
+            notBefore: (0, CertificateManager_js_1.jsToMatterDate)(now, -1),
+            notAfter: (0, CertificateManager_js_1.jsToMatterDate)(now, 10),
+            subject: { fabricId, nodeId },
+            ellipticCurvePublicKey: publicKey,
+            extensions: {
+                basicConstraints: { isCa: false },
+                keyUsage: 1,
+                extendedKeyUsage: [2, 1],
+                subjectKeyIdentifier: Crypto_js_1.Crypto.hash(publicKey).slice(0, 20),
+                authorityKeyIdentifier: this.rootKeyIdentifier,
+            },
+        };
+        const signature = Crypto_js_1.Crypto.signPkcs8(this.rootKeyPair.privateKey, CertificateManager_js_1.CertificateManager.nocCertToAsn1(unsignedCertificate));
+        return CertificateManager_js_1.TlvOperationalCertificate.encode(Object.assign(Object.assign({}, unsignedCertificate), { signature }));
+    }
+}
+exports.RootCertificateManager = RootCertificateManager;

package/dist/cjs/certificate/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export * from "./AttestationCertificateManager.js";
+export * from "./CertificateManager.js";
+export * from "./CertificationDeclarationManager.js";
+export * from "./ChipPAAuthorities.js";
+export * from "./RootCertificateManager.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/certificate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/certificate/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,oCAAoC,CAAC;AACnD,cAAc,yBAAyB,CAAC;AACxC,cAAc,sCAAsC,CAAC;AACrD,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC"}

package/dist/cjs/certificate/index.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AttestationCertificateManager.js"), exports);
+__exportStar(require("./CertificateManager.js"), exports);
+__exportStar(require("./CertificationDeclarationManager.js"), exports);
+__exportStar(require("./ChipPAAuthorities.js"), exports);
+__exportStar(require("./RootCertificateManager.js"), exports);