The Operational Credentials cluster (0x003E) is a Matter cluster that Manages the device's operational certificates for secure fabric communication.. It defines 15 commands and 7 attributes and is mandatory for 1 device type.
Operational Credentials 0x003E
Manages the device's operational certificates for secure fabric communication.
Spec History
This cluster's ClusterRevision across the Matter releases it has shipped in. Click a version to inspect the cluster as it existed in that release.
Attributes 7
Commands 15
Features 1
| Code | Name | Type | Flags |
|---|---|---|---|
| 0x0000 | NOCs | array | read: administer |
| 0x0001 | Fabrics | array | |
| 0x0002 |
SupportedFabrics
5..254
|
int8u | |
| 0x0003 |
CommissionedFabrics
max 254
|
int8u | |
| 0x0004 | TrustedRootCertificates | array | |
| 0x0005 |
CurrentFabricIndex
default 0
|
int8u | |
| 0x0006 | PQCDeviceAttestationProfile | PQCDeviceAttestationProfileStruct | Optional Provisional |
| Code | Name | Direction | Parameters |
|---|---|---|---|
| 0x00 |
AttestationRequest
invoke: administer
This command is used to perform an attestation request.
|
client→server |
AttestationNonce: octet_string |
| 0x01 |
AttestationResponse
This command is used to report the results of the AttestationRequest command.
|
server→client |
AttestationElements: long_octet_string, AttestationSignature: octet_string |
| 0x02 |
CertificateChainRequest
invoke: administer
This command is used to request a certificate from the device attestation certificate chain.
|
client→server |
CertificateType: CertificateChainTypeEnum, CryptoProfile: AttestationCryptoProfileEnum, SegmentID: int16u, MaxSegmentSize: int16u |
| 0x03 |
CertificateChainResponse
This command is used to report the results of the CertificateChainRequest command.
|
server→client |
Certificate: octet_string, TotalDocumentSize: int16u, NextSegmentID: int16u |
| 0x04 |
CSRRequest
invoke: administer
This command is used to perform a CSR request.
|
client→server |
CSRNonce: octet_string, IsForUpdateNOC: boolean |
| 0x05 |
CSRResponse
This command is used to report the results of the CSRRequest command.
|
server→client |
NOCSRElements: long_octet_string, AttestationSignature: octet_string |
| 0x06 |
AddNOC
invoke: administer
This command is used to add a new NOC to the device.
|
client→server |
NOCValue: long_octet_string, ICACValue: long_octet_string, IPKValue: octet_string, CaseAdminSubject: int64u, AdminVendorId: vendor_id |
| 0x07 |
UpdateNOC
invoke: administer
This command is used to update an existing NOC on the device.
|
client→server |
NOCValue: long_octet_string, ICACValue: long_octet_string |
| 0x08 |
NOCResponse
This command is used to report the results of the AddNOC, UpdateNOC, UpdateFabricLabel and RemoveFabric commands.
|
server→client |
StatusCode: NodeOperationalCertStatusEnum, FabricIndex: fabric_idx, DebugText: char_string |
| 0x09 |
UpdateFabricLabel
invoke: administer
This command is used to set the user-visible fabric label for a given Fabric.
|
client→server |
Label: char_string |
| 0x0A |
RemoveFabric
invoke: administer
This command is used to remove a Fabric from the device.
|
client→server |
FabricIndex: fabric_idx |
| 0x0B |
AddTrustedRootCertificate
invoke: administer
This command is used to add a trusted root certificate to the device.
|
client→server |
RootCACertificate: long_octet_string |
| 0x0C |
SetVIDVerificationStatement
invoke: administer
This command is used to manage the VendorID and VIDVerificationStatement fields of the Fabrics attribute, and the VVSC field of an entry in the NOCs attribute.
|
client→server |
VendorID: vendor_id, VIDVerificationStatement: octet_string, VVSC: long_octet_string |
| 0x0D |
SignVIDVerificationRequest
invoke: administer
This command is used to authenticate the fabric associated with the FabricIndex.
|
client→server |
FabricIndex: fabric_idx, ClientChallenge: octet_string |
| 0x0E |
SignVIDVerificationResponse
This command is used to report the results of the SignVIDVerificationRequest command.
|
server→client |
FabricIndex: fabric_idx, FabricBindingVersion: int8u, Signature: octet_string |
PQCDeviceAttestation
(PQCDA)
bit 0
Provisional
Support for PQC profiles in Device Attestation procedure
Device Types Using This Cluster
Device types in the Matter spec that reference this cluster
Devices Implementing This Cluster
705 devices in the survey implement this cluster
Matter Thread Dimmer Switch VTM31-SN
Inovelli
MYGGBETT door/window sensor
IKEA of Sweden
BILRESA dual button
IKEA of Sweden
GRILLPLATS plug
IKEA of Sweden
TIMMERFLOTTE temp/hmd sensor
IKEA of Sweden
MYGGSPRAY wrlss mtn sensor
IKEA of Sweden
Eve Energy
Eve Systems
ALPSTUGA air quality monitor
IKEA of Sweden
BILRESA scroll wheel
IKEA of Sweden
KLIPPBOK water leak sensor
IKEA of Sweden
Aqara Smart Light
Aqara
Essentials A19-A60
Nanoleaf
Onvis Smart Plug S4
Onvis
KAJPLATS GU10 WS 575lm
IKEA of Sweden
Aqara Door and Window Sensor P2
Aqara
Essentials Downlight
Nanoleaf
Eve Thermo
Eve Systems
Matter Thread On/Off Switch VTM30-SN
Inovelli
KAJPLATS GU10 CWS 575lm
IKEA of Sweden
KAJPLATS E27 WS globe 1521lm
IKEA of Sweden
Smart Multicolor Bulb
Tapo
KAJPLATS E27 CWS globe 1055lm
IKEA of Sweden
Presence Multi-Sensor FP300
Aqara
Tapo Mini Plug
TP-Link