Matter Fabric Security: PASE, CASE and the Cryptography That Keeps Your Sensors Trusted

What a "fabric" is, and why it is the security boundary

A Matter fabric is the set of devices, controllers and shared cryptographic keys that trust each other as one logical smart-home instance, and the fabric — not the Wi-Fi network — is the real security boundary, because devices prove their identity to each other using fabric credentials rather than relying on the transport network to keep them apart. This is the mental model a brand needs: the "network" a customer thinks of is just the pipe; the fabric is the circle of trust drawn in cryptography. A device outside the fabric cannot join the conversation, and a device inside one fabric cannot eavesdrop on another. That property is what lets a sensor be secure even on a borrowed or untrusted Wi-Fi, and it is also what makes multi-admin — sharing one device with two ecosystems — safe rather than leaky.

PASE: the one-time commissioning handshake

PASE, or Passcode-Authenticated Session Establishment, is the temporary, setup-code-protected session used only during commissioning to securely introduce a new device to a fabric, and it is intentionally short-lived so the setup code that opens the door is never the thing that protects everyday traffic. When a customer scans the QR or types the code, PASE uses that code to establish an encrypted, authenticated channel just long enough to issue the device its real, certificate-based identity. The elegance is that the human-friendly code is a bootstrap secret, not a standing key: once commissioning completes, the code is spent and useless to an attacker who later learns it. We make sure the code is unique per device and the PASE session behaves exactly to spec, because a weakness here is the one place a human-typed secret touches the security model.

CASE: the certificate session that protects everything after

CASE, or Certificate-Authenticated Session Establishment, is the certificate-based session used for every communication after commissioning, so once a device holds its operational certificate it no longer needs the setup code and instead proves identity cryptographically on each connection. This is the workhorse of Matter security. Every time a controller reads a sensor or a sensor reports an event, the two ends run CASE and confirm each other's certificates before any data moves. Because the session is authenticated and encrypted at the application layer, the security does not depend on whether the Wi-Fi is WPA2 or WPA3, or whether the Thread mesh is publicly observable — the link is private regardless. We validate CASE against the real controllers a brand targets, because a device that fails CASE negotiation simply will not talk to that ecosystem, and that failure looks exactly like "broken hardware" to a customer.

Operational certificates vs the attestation credential

A Matter operational certificate, or NOC, is the per-fabric credential a device receives during commissioning that identifies it within one specific fabric, and it is distinct from the factory-installed device attestation credential that proves the device's authenticity to the ecosystem before it ever joins. The attestation credential is the "this is a genuine, un-cloned device" proof baked in at the factory; the NOC is the "this device belongs to your home" membership card handed out at commissioning. A device can hold an NOC for each fabric it belongs to, which is how multi-admin works — one attestation identity, several fabric memberships, each with its own scoped keys. We provision the attestation side on the line and confirm the NOC issuance during validation, because getting either half wrong breaks trust at exactly the moment a customer is setting up.

Fabric-scoped keys and safe multi-admin

Matter uses fabric-scoped keys, meaning the encryption and identity material is bound to one fabric, so a device commissioned into one fabric cannot decrypt or impersonate traffic on another, which is the property that lets multi-admin share a single device between ecosystems without exposing one to the other. Without fabric scoping, sharing a device with a second app would mean handing that app the keys to your whole home; with it, each fabric sees only its own slice. This is also why a returned or resold device is safe only if its old fabric credentials are fully erased — which is the factory's job at reset. We implement the reset so it removes the NOC and the scoped keys completely, not just logically, because a half-wiped device is a liability.

Factory stance: we build the trust path, not a black box

Shenan Yangguang designs, prototypes, validates and mass-produces these sensors; we do not relabel a third party's product. For fabric security we integrate a standard CSA-certified Matter connectivity module, provision the attestation credential on the line, build the PASE and CASE behaviour to spec, store the fabric-scoped keys in secure storage, and confirm NOC issuance and reset against the target ecosystems during validation. We also make the factory reset wipe the old fabric credentials cleanly, because a sensor that carries a previous owner's identity is a security and privacy defect, not a convenience. Where an ecosystem's CASE behaviour is uncertain, we flag it before launch rather than after. The goal is simple: a Matter sensor that is trusted on day one and stays trusted after a reset.

For the credential itself, see our device-attestation article; for what happens at first setup, our onboarding and multi-admin note covers the factory's commissioning duties.