Follow Matter's attestation and commissioning in full

How to do it

Matter controllers check the device's attestation chain and its certification declaration before they add it to a home. A cloned or uncertified device then fails at the door. Generate each device attestation key on the chip, as keep each device's private key in secure hardware says. Publish the product's certification on the Distributed Compliance Ledger before the first unit ships. The passcode is the setup code from claim a device with a one-time code, so generate it at random per unit. Never use 12345678, 87654321 or eight repeated digits. Close the commissioning window after the time the specification allows.

Examples

Python example

FORBIDDEN_PASSCODES = {12345678, 87654321} | {int(str(digit) * 8) for digit in range(10)}

def passcode_problems(passcodes_by_serial: dict[str, int]) -> list[str]:
    problems = [f"{serial} uses a forbidden passcode" for serial, code in passcodes_by_serial.items() if code in FORBIDDEN_PASSCODES]
    if len(set(passcodes_by_serial.values())) < len(passcodes_by_serial):
        problems.append("two units share a passcode")
    return problems

Go example

func isForbiddenPasscode(code uint32) bool {
	if code == 12345678 || code == 87654321 {
		return true
	}
	return code%11111111 == 0 && code/11111111 <= 9
}

func PasscodeProblems(passcodes map[string]uint32) []string {
	var problems []string
	seen := map[uint32]bool{}
	for serial, code := range passcodes {
		if isForbiddenPasscode(code) {
			problems = append(problems, serial+" uses a forbidden passcode")
		}
		if seen[code] {
			problems = append(problems, "two units share a passcode")
		}
		seen[code] = true
	}
	return problems
}

How to check

A factory test reads each unit's attestation chain and verifies it up to an approved root. A job over production records fails on any passcode in the forbidden list or shared by two units. A commissioning test with a controller completes, and a test with a device certificate from another vendor's chain fails.

Sources

• Connectivity Standards Alliance, Matter

Related rules

• IOT-2 Keep each device's private key in secure hardware in Connected devices
• IOT-6 Claim a device with a one-time code instead of its serial number in Connected devices