Add details to VerifyAttestationInformation
so that more AttestationVerificationResult
values are reportable
#11918
Labels
Problem
Current
VerifyAttestationInformation
does simplified processing that will returnAttestationVerificationResult::kDacSignatureInvalid
for any failure of the certificate chain validation, event if not related to DAC signature. This is because there is only a bool result used and we do not expose the internal outcome of the certificate chain validation that would expose the true error, such as validity period expiration, malformed certs, missing extensions.Proposed Solution
ValidateCertificateChain
in CHIPCryptoPal to have more details about the failuresValidateCertificateChain
errors intoAttestationVerificationResult
casesVerifyAttestationInformation
to account for additional Matter-only policy regarding contents of DAC chain elements (e.g. specific requirements for extensions present, etc)The text was updated successfully, but these errors were encountered: