Add support for generation and verification of CSR attestation signature

[tcarmelveilleux]

Problem

Spec requires an attestation signature on the CSR. This attestation signature must then be validated by commissioner logic. This is currently omitted in the SDK.

Proposed Solution

• Implement adding the attestation signature using the DeviceAttestationCredentialsProvider
• Update DeviceAttestationVerifier to have a primitive to validate DAC chain and the signature, symetrical to the attestation prcedure
• Update commissioning sample to have reporting of failure of signature

[vijs]

@tcarmelveilleux Please review the merged PRs and confirm if this issue is addressed

[yufengwangca]

@tcarmelveilleux is there any remaining task for this ticket?

[tcarmelveilleux]

AutoCommissioner should at least check attestation signature on receipt of CSRResponse. This is the MVP for 1.0

[cecille]

Tennessee, can you just clarify what you want here? Do you want the auto commissioner to call VerifyNodeOperationalCSRInformation? Or do you want it to verify the generated cert chain?

We verify the CSR information right before we generate the NOC chain. I suppose we can pull this out into a separate step so folks that opt to replace the auto commissioner can call that as a separate step.

[cecille]

From offline discussion - twofold answer for this issue.

1. will make validation a separate step in commissioning to make this easier for devs implementing their own commissioning delegate to perform this step without being tied to generating the noc chain.
2. change the GenerateNOCChain function signature to accept the attestationChallenge and csrNonce so that the credentials delegate can verify the CSR before generating the noc chain if it desires (not adding that check to example delegates as it is checked by the auto commissioner, but just to allow other delegate to do so if they wish)