The mechanism of Matter device attestation, the identity verification process following QR-code provisioning, the DAC/PAI/PAA hierarchy, and the NOC issuance process are explained. The mechanisms for ensuring trustworthiness are organized following the specification announcements of 17 June 2026.
As part of the latest Matter specifications, the CSA announced Matter 1.6 and Product Security 1.1 on 17 June 2026, adding features including NFC provisioning before power-on and joint management by multiple controllers. Device attestation is positioned as the foundation supporting these features.
The Matter certificate hierarchy has three layers: the PAA at the root, the PAI in the middle and the DAC as the end entity. NOCs are used for day-to-day communication, while the DAC functions as the certificate for initial identity verification. Unlike root certificates for web servers, root certificates serving as the trust anchor are managed through a mechanism that obtains and updates trust information via the DCL.
Provisioning begins with a commissioner scanning a QR code and establishing an encrypted session between a smartphone application and the device, after which the device joins the fabric. The device obtains an NOC and joins the network, transitioning from BLE to the local network.
The three-stage verification of a device’s legitimacy consists of verifying the key’s legitimacy through challenge-response, the issuer’s legitimacy by validating DAC → PAI → PAA, and the information recorded in the CD. The process cannot be completed if any of these elements is missing. Once verification is complete, a CSR is submitted and an NOC is issued, after which communication switches to an NOC-based model.