DAC and PKI in Matter: What every hardware founder needs to know
Matter certification is not a software problem. It’s a trust problem.
At the core of Matter’s security model are two components every device must implement: Device Attestation Certificates (DAC) and Public Key Infrastructure (PKI). Get either wrong, and certification fails — regardless of how well your firmware works.
What is a DAC?
A Device Attestation Certificate is a cryptographic credential that proves a device is what it claims to be. Think of it as a birth certificate — issued once, unique per device, and verified at commissioning time.
When a Matter controller adds a new device to a fabric, it checks the DAC against the CSA’s Product Attestation Authority. If the DAC is valid and the vendor ID matches, the device joins. If not, the controller rejects it.
This means every unit you manufacture needs a unique DAC. You can’t reuse them. You can’t generate them on-the-fly without CSA approval.
PKI: The infrastructure behind the certificate
DACs are useless without the infrastructure to issue, store, and verify them. This is where PKI comes in.
You need a Certificate Signing Request (CSR) pipeline, secure key storage, and integration with a Product Attestation Authority (PAA) approved by the CSA. For production volumes, this means provisioning during manufacturing — not after.
The most common failure mode we see: a working prototype passes lab testing, but production devices fail because DACs weren’t provisioned correctly at the factory.
How we handle it
We manage the full DAC lifecycle:
- PAA relationship setup
- CSR pipeline for manufacturing
- Secure key injection at production
- Pre-certification DAC validation
- Post-certification CD injection
This is not optional infrastructure. It is the price of entry for the Matter ecosystem.
More posts on ATL testing, DCL listing, and Matter OTA coming soon.