RF Wireless World

Browse articles, tutorials, tools, and vendors.

Matter Security: PASE vs CASE vs DAC Explained

By RF Wireless Expert Team

Based on Matter Core Specification, this page describes how Matter secures the smart home, focusing on PASE, CASE and Device Attestation Certificates (DACs).

The Foundation of Matter Security

In the Matter ecosystem, security isn’t an afterthought; it is woven into the very fabric of the protocol. Every operational message sent between Matter devices is encrypted and authenticated. However, before two devices can securely turn on a light or unlock a door, they must first establish trust.

Matter achieves this through a multi-step lifecycle that relies on three core security pillars viz. PASE (for initial setup), Device Attestation (to block counterfeits) and CASE (for everyday communication). Let us explore, how they work together.

1. PASE (Passcode Authenticated Session Establishment)

When you take a brand new Matter device out of the box, it knows nothing about your home network, and your network knows nothing about the device. To communicate safely for the very first time, they use PASE.

How it works:

Every new Matter device comes with an onboarding payload usually a QR code or an 11 to 21-digit manual pairing code printed on the device or its manual. Hidden inside this code is a highly secure setup Passcode.

When you scan the QR code with your smartphone (the “Commissioner”), the PASE protocol kicks in. Instead of just sending the passcode over the air which a hacker could easily intercept; PASE uses an advanced cryptographic algorithm called SPAKE2+ (a Password Authenticated Key Exchange).

SPAKE2+ allows both the smartphone and the new device to mathematically prove to each other that they know the passcode without actually transmitting the passcode over the network.

Once this mathematical proof is complete, the two devices generate a shared set of encryption keys. They now have a secure, temporary tunnel to talk through.

2. DACs

Just because a device knows the setup passcode doesn’t mean it is a safe, certified product. Hackers could theoretically build a rogue device, print a QR code for it, and try to trick you into adding it to your home.

To prevent counterfeits and malicious devices from joining your network, Matter uses the Device Attestation procedure, which takes place inside the secure PASE tunnel we just built.

How it works:

During manufacturing, every legitimate Matter device is injected with a Device Attestation Certificate (DAC) and a corresponding, highly guarded Private Key. You can think of the DAC as the device’s cryptographic birth certificate. It mathematically proves who made the device and what specific product it is.

During setup, your smartphone challenges the new device: “Prove you are who you say you are.”

  1. The smartphone sends a random piece of data (a “nonce”) to the device.
  2. The device must use its secret Private Key to digitally sign this data and send it back along with its DAC.
  3. Your smartphone checks this signature. If the device was a cheap counterfeit, it wouldn’t possess the manufacturer’s true Private Key, and the signature would fail.
  4. Finally, the smartphone cross references the DAC with the Distributed Compliance Ledger (DCL); a global, secure database maintained by the Connectivity Standards Alliance (CSA). This ensures the device hasn’t had its certification revoked and is genuinely certified to run the Matter protocol.

If the device fails this background check, the system will immediately warn the user and can abort the setup, keeping your home safe from imposter hardware.

3. CASE (Certificate Authenticated Session Establishment)

Once the device passes the background check, the Commissioner (your phone) officially welcomes it into your home’s secure network known in Matter as a “Fabric.”

As a welcoming gift, the device is issued a brand new, locally generated certificate called a Node Operational Certificate (NOC). If the DAC was its “birth certificate,” the NOC is its “local passport.” It proves the device is now an authorized member of your specific home.

Once setup is complete, the temporary PASE tunnel is torn down. From this day forward, whenever this device wants to talk to another device in your home (like a motion sensor telling a smart plug to turn on), it uses CASE.

How it works:

CASE is the protocol used for day to day, operational communication. When two devices want to talk, they exchange their NOCs. They verify that they both belong to the same home network (i.e. same Fabric) and use Elliptic Curve Cryptography (ECDH) to quickly generate fresh, secure encryption keys.

Because CASE relies on these internally generated NOCs, all communication is completely local and independent of the internet. Even if your Wi-Fi router loses its connection to the outside world, your Matter devices can still authenticate each other and work flawlessly using CASE.

Summary

  • PASE uses the QR code to create a safe, temporary tunnel.
  • DACs are checked through that tunnel to ensure you aren’t installing a counterfeit device.
  • CASE is used forever after, relying on local network certificates to ensure fast, secure and private communication between the trusted devices in your home.

Continue Learning Matter Protocol

Compare Matter With Other Technologies

Keep Reading

Related Posts