diff --git a/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.der b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.der new file mode 100644 index 00000000000000..9446797a8f58c1 Binary files /dev/null and b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.der differ diff --git a/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.pem b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.pem new file mode 100644 index 00000000000000..e74d12cbafd8ba --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB3jCCAYSgAwIBAgIUN0VEmprq7pGmVkijbDtpPl8U060wCgYIKoZIzj0EAwIw +MDEYMBYGA1UEAwwPTWF0dGVyIFRlc3QgUEFBMRQwEgYKKwYBBAGConwCAQwERkZG +MTAgFw0yNDEyMjAwODUwMzZaGA8yMTI0MTEyNjA4NTAzNlowSjEyMDAGA1UEAwwp +TWF0dGVyIFRlc3QgUEFBIERlbGVnYXRlZCBDUkwgU2lnbmVyIEZGRjExFDASBgor +BgEEAYKifAICDARGRkYxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaGswz0ZC +Dd6F8pDBp+AuJsgSRRy3LAgAHq5F5mPV4D8SGXkXPAr/969MmxV1ifaIl8lXA8iG +xJ5E5/kJRJpvu6NgMF4wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCAYIwHQYD +VR0OBBYEFAsXPNYVBXqMSFXWx9GcV7pEJQJLMB8GA1UdIwQYMBaAFGr9IncfUR/s +vxZBl2cQ3NwxoXF+MAoGCCqGSM49BAMCA0gAMEUCIHMX8kl5v8uH9nA1KVaLRcan +ucVPpXpUeD6hHr3+Luz4AiEA+yejFOAVby2r+TkwNwa/GViOTzqyJNoUXVTrWVSF +dgg= +-----END CERTIFICATE----- diff --git a/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.der b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.der new file mode 100644 index 00000000000000..d4a4571f154307 Binary files /dev/null and b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.der differ diff --git a/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.pem b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.pem new file mode 100644 index 00000000000000..ae81a1028730f2 --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Key.pem @@ -0,0 +1,5 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg00lpwVOJLhlEByQc +FuApLsnGO+ulYZ3rDbcpsbHr182hRANCAARoazDPRkIN3oXykMGn4C4myBJFHLcs +CAAerkXmY9XgPxIZeRc8Cv/3r0ybFXWJ9oiXyVcDyIbEnkTn+QlEmm+7 +-----END PRIVATE KEY----- diff --git a/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.der b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.der new file mode 100644 index 00000000000000..bbe43405c6bb0c Binary files /dev/null and b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.der differ diff --git a/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.pem b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.pem new file mode 100644 index 00000000000000..fce0da33e1fe09 --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/Chip-Test-PAA-FFF1-Delegated-CRL.pem @@ -0,0 +1,9 @@ +-----BEGIN X509 CRL----- +MIIBIjCByQIBATAKBggqhkjOPQQDAjBKMTIwMAYDVQQDDClNYXR0ZXIgVGVzdCBQ +QUEgRGVsZWdhdGVkIENSTCBTaWduZXIgRkZGMTEUMBIGCisGAQQBgqJ8AgIMBEZG +RjEXDTI0MTIyMDEwNDkzN1oYDzIxMjQxMjIxMTA0OTM3WjAbMBkCCDAmZDkrij8q +Fw0yNDEyMjAxMDQ5MDNaoC8wLTAfBgNVHSMEGDAWgBQLFzzWFQV6jEhV1sfRnFe6 +RCUCSzAKBgNVHRQEAwIBAjAKBggqhkjOPQQDAgNIADBFAiBODiXnWPxXD1ukQX5G +f0sPk+6kq0ZldrInaKRrhvrS4AIhALqvyYokAjw4AYQ3cE8ZkDFlxpNwpduiE7wC +KfQPQHgL +-----END X509 CRL----- diff --git a/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.der b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.der new file mode 100644 index 00000000000000..d70f5deb4e7f7a Binary files /dev/null and b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.der differ diff --git a/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.pem b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.pem new file mode 100644 index 00000000000000..c381b617bbeb12 --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIICADCCAaagAwIBAgIUVw1fcu6iCWBq1dXGGsKsld6mFBYwCgYIKoZIzj0EAwIw +PTElMCMGA1UEAwwcTWF0dGVyIERldiBQQUkgMHhGRkYxIG5vIFBJRDEUMBIGCisG +AQQBgqJ8AgEMBEZGRjEwIBcNMjQxMjIwMDkzNjQ5WhgPMjEyNDExMjYwOTM2NDla +MF8xMTAvBgNVBAMMKE1hdHRlciBEZXYgUEFJIERlbGVnYXRlZCBDUkwgU2lnbmVy +IEZGRjExFDASBgorBgEEAYKifAICDARGRkYxMRQwEgYKKwYBBAGConwCAgwEODAw +MTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNqxBPAik9Rc5p3oA6u/6kOHU1RA +QTNguQNsiptO/U8WgzRmzxru3KagacAHCvfjHAPOKpzFFaYiukphrWTXeYGjYDBe +MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgGCMB0GA1UdDgQWBBTNmS7mcSA0 +/ou1w0Ql37q9jrSeiTAfBgNVHSMEGDAWgBRjVA5H9kscONE4hKRi0WwZXY/7PDAK +BggqhkjOPQQDAgNIADBFAiBMSO42anuD/014dvZwoG9vNgkErcCYKxuFjOoNq0AZ +TAIhAMmZKBBa5UxAcnACDvYo2l55oSh8ieqLk1lbPJeA69Yl +-----END CERTIFICATE----- diff --git a/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.der b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.der new file mode 100644 index 00000000000000..f7d9584ce498fa Binary files /dev/null and b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.der differ diff --git a/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.pem b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.pem new file mode 100644 index 00000000000000..c7261dc2a12680 --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Key.pem @@ -0,0 +1,5 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgyVr680c6XfirYKEl +h51p8+7JU/7t60KHdNb/1IRM326hRANCAATasQTwIpPUXOad6AOrv+pDh1NUQEEz +YLkDbIqbTv1PFoM0Zs8a7tymoGnABwr34xwDziqcxRWmIrpKYa1k13mB +-----END PRIVATE KEY----- diff --git a/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.der b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.der new file mode 100644 index 00000000000000..e6ca9a4ad9ac16 Binary files /dev/null and b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.der differ diff --git a/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.pem b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.pem new file mode 100644 index 00000000000000..488ed951a2e5d3 --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/Matter-Development-PAI-FFF1-noPID-Delegated-CRL.pem @@ -0,0 +1,10 @@ +-----BEGIN X509 CRL----- +MIIBbzCCARQCAQEwCgYIKoZIzj0EAwIwXzExMC8GA1UEAwwoTWF0dGVyIERldiBQ +QUkgRGVsZWdhdGVkIENSTCBTaWduZXIgRkZGMTEUMBIGCisGAQQBgqJ8AgIMBEZG +RjExFDASBgorBgEEAYKifAICDAQ4MDAxFw0yNDEyMjAxMDUyNDZaGA8yMTI0MTIy +MTEwNTI0NlowUTAZAggKsEJJQyP+VBcNMjQxMjIwMTA1MjQ0WjAZAggZNn2XjqxT +OhcNMjQxMjIwMTA1MjMzWjAZAgglaTg9JLs26hcNMjQxMjIwMTA1MjM5WqAvMC0w +HwYDVR0jBBgwFoAUzZku5nEgNP6LtcNEJd+6vY60nokwCgYDVR0UBAMCAQQwCgYI +KoZIzj0EAwIDSQAwRgIhAMWax1hzDWwQn1dpj5Tg+ln1wGrPG6JDIOu+wFRFBc80 +AiEAqQj5PwEPp5QW1X9OvgnH3QXPQ0FKlTQY8MXHDo4qD2w= +-----END X509 CRL----- diff --git a/credentials/test/revoked-attestation-certificates/README.md b/credentials/test/revoked-attestation-certificates/README.md new file mode 100644 index 00000000000000..9bc64f03b97b44 --- /dev/null +++ b/credentials/test/revoked-attestation-certificates/README.md @@ -0,0 +1,60 @@ +# Revoked Attestation Certificates + +This directory contains test certificates, keys, and CRLs for device attestation revocation testing scenarios. +The test certificates and keys are intended to be used for testing purposes only and should not be used in production environments. + +## Direct CRL Signing +In this approach, the CA directly signs the Certificate Revocation List (CRL). + +### PAA Signed CRL +Process: +1. PAA issues the PAI +2. PAI issues the DAC +3. PAA revokes the PAI and updates the CRL + +- PAA: `Chip-Test-PAA-FFF1-Cert.[pem|der]` +- CRL: `Chip-Test-PAA-FFF1-CRL.[der|pem]` +- PAI(revoked): `Chip-Test-PAI-FFF1-noPID-Revoked-Cert.[pem|der]` +- DAC(signed by revoked PAI): `Chip-Test-DAC-FFF1-8001-Signed-By-Revoked-PAI-Cert.[pem|der]` + +### PAI Signed CRL +Process: +1. PAI issues the 3 DACs +2. PAI issues the DAC and updates the CRL + +- PAI: `Matter-Development-PAI-FFF1-noPID-Cert.[pem|der]` +- CRL: `Matter-Development-PAI-FFF1-noPID-CRL.[pem|der]` +- DACs(revoked): + - `Matter-Development-DAC-FFF1-8001-Revoked-01-Cert.[pem|der]` + - `Matter-Development-DAC-FFF1-8002-Revoked-02-Cert.[pem|der]` + - `Matter-Development-DAC-FFF1-8003-Revoked-03-Cert.[pem|der]` + +## Indirect CRL Signing (delegated CRL signing) +In this approach, the CA delegates the CRL signing responsibility to a separate entity. + +### PAA Delegated CRL Signing +Process: +1. PAA issues the PAI +2. PAA issues the Delegated CRL Signer +3. PAI issues the DAC +4. Delegated CRL Signer revokes the PAI and updates the CRL + +- PAA: `Chip-Test-PAA-FFF1-Cert.[pem|der]` +- CRL: `Chip-Test-PAA-FFF1-Delegated-CRL.[der|pem]` +- PAA delegated CRL Signer: `Chip-Test-PAA-FFF1-Delegated-CRL-Signer-Cert.[pem|der]` +- PAI(revoked by PAA delegated CRL Signer): `Chip-Test-PAI-FFF1-noPID-Revoked-Cert.[pem|der]` +- DAC(signed by revoked PAI): `Chip-Test-DAC-FFF1-8001-Signed-By-Revoked-PAI-Cert.[pem|der]` + +### PAI Delegated CRL Signing +Process: +1. PAI issues the 3 DACs +2. PAI issues the Delegated CRL Signer +3. Delegated CRL Signer revokes the DACs and updates the CRL + +- PAI: `Matter-Development-PAI-FFF1-noPID-Cert.[pem|der]` +- CRL: `Matter-Development-PAI-FFF1-noPID-Delegated-CRL.[pem|der]` +- PAI delegated CRL Signer: `Matter-Development-PAI-FFF1-Delegated-CRL-Signer-Cert.[pem|der]` +- DACs(revoked): + - `Matter-Development-DAC-FFF1-8001-Revoked-01-Cert.[pem|der]` + - `Matter-Development-DAC-FFF1-8002-Revoked-02-Cert.[pem|der]` + - `Matter-Development-DAC-FFF1-8003-Revoked-03-Cert.[pem|der]` \ No newline at end of file