libspdm is a sample implementation that follows the DMTF SPDM specification

Feature

1. Specification

   The SPDM and secured message follow :

   DSP0274 Security Protocol and Data Model (SPDM) Specification (version 1.0.1, version 1.1.1 and version 1.2.0)

   DSP0277 Secured Messages using SPDM Specification (version 1.0.0)

   The MCTP and secured MCTP follow :

   DSP0275 Security Protocol and Data Model (SPDM) over MCTP Binding Specification (version 1.0.0)

   DSP0276 Secured MCTP Messages over MCTP Binding Specification (version 1.0.0)

   The PCI DOE / IDE follow :

   PCI Data Object Exchange (DOE) ECN

   PCI Component Measurement and Authentication (CMA) ECN

   PCI Integrity and Data Encryption (IDE) ECN

2. Both SPDM requester and SPDM responder.

3. Programming Context:

   No heap is required in the SPDM lib. No writable global variable is required in the SPDM lib.

4. Implemented command and response:

   SPDM 1.0: GET_VERSION, GET_CAPABILITY, NEGOTIATE_ALGORITHM, GET_DIGEST, GET_CERTIFICATE, CHALLENGE, GET_MEASUREMENT.

   SPDM 1.1: KEY_EXCHANGE, FINISH, PSK_EXCHANGE, PSK_FINISH, END_SESSION, HEARTBEAT, KEY_UPDATE, ENCAPSULATED message

   SPDM 1.2: GET_CSR - TBD, SET_CERTIFICATE - TBD, CHUNK message - TBD

5. Cryptographic algorithm support:

   The SPDM lib requires cryptolib API, including random number, symmetric crypto, asymmetric crypto, hash and message authentication code etc.

   Current support algorithm: Hash:SHA2/SHA3/SM3, Signature:RSA-SSA/RSA-PSS/ECDSA/EdDSA/SM2-Sign, KeyExchange:FFDHE/ECDHE/SM2-KeyExchange, AEAD:AES_GCM/ChaCha20Poly1305/SM4_GCM. NOTE: Please don't mix NIST algorithm with Shang-Mi (SM) algorithm.

   An mbedtls wrapper is included in cryptlib_mbedtls. NOTE: SMx and EdDSA are not supported.

   An openssl wrapper is included in cryptlib_openssl. NOTE: SM2-KeyExchange and SM4_GCM are not supported.

6. Execution context:

   Support to build an OS application for spdm_requester_emu and SpdmResponder_emu to trace the communication.

   Support to be included in UEFI host environment EDKII, such as edkii_spdm_requester

   Support to be included in OpenBMC. It is in planning, see SPDM Integration.

Documents

1. Presentation

   Open Source Firmware Conference 2020 - openspdm

   Free and Open Source Developers European Meeting 2021 - openspdm

2. libspdm library threat model:

   The user guide can be found at threat_model

3. libspdm library design:

   The detailed design can be found at design

4. libspdm user guide:

   The user guide can be found at user_guide

Prerequisites

Build Tools for Windows

1. Compiler (Choose one)

   a) Visual Studio 2019

   b) Visual Studio 2015

   c) LLVM (LLVM13) Download: LLVM-13.0.0-win64.exe.

   • Add LLVM in PATH environment according to installation instruction.
   • Change LLVM install path to C:/LLVM.
   • LLVM13 works good for clang and libfuzzer build. Other versions are not validated for clang build.
   • Because the libfuzzer lib path is hard code in CMakeLists, other versions are fail for libfuzzer build.

2. cmake (Version 3.17.2 is known to work. Newer versions may fail).

Build Tools for Linux

1. Compiler (Choose one)

   a) GCC (above GCC5)

   b) LLVM (above LLVM10), install steps: sudo apt-get install llvm-10 then sudo apt-get install clang-10. Use llvm-ar -version and clang -v to confirm the LLVM version. If LLVM installation fails or LLVM installation version is low, you can update Linux version to fix the issue.

2. cmake.

Crypto library

1. mbedtls as Crypto library. Version 2.27.0.

2. openssl as crypto library. Version 1.1.1l.

Unit Test framework

1. cmocka. Version 1.1.5.

Build

Git Submodule

libspdm uses submodules for mbedtls, openssl and cmocka.

To get a full buildable repo, please use git submodule update --init. If there is an update for submodules, please use git submodule update.

Windows Builds

For ia32 builds, use a x86 Native Tools Command Prompt for Visual Studio... command prompt.

For x64 builds, use a x64 Native Tools Command Prompt for Visual Studio... command prompt.

General build steps: (Note the .. at the end of the cmake command).

cd libspdm
mkdir build
cd build
cmake -G"NMake Makefiles" -DARCH=<x64|ia32> -DTOOLCHAIN=<VS2019|VS2015|CLANG> -DTARGET=<Debug|Release> -DCRYPTO=<mbedtls|openssl> ..
nmake copy_sample_key
nmake

Example cmake commands: (Note the .. at the end of the cmake command).

cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Debug -DCRYPTO=mbedtls ..

cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Release -DCRYPTO=mbedtls ..

cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Debug -DCRYPTO=openssl ..

cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Release -DCRYPTO=openssl ..

Note ia32 build is not supported for CLANG build on windows.

Linux Builds

If ia32 builds on 64 bit Linux machine, need install sudo apt-get install gcc-multilib.

General build steps: (Note the .. at the end of the cmake command).

cd libspdm
mkdir build
cd build
cmake -DARCH=<x64|ia32|arm|aarch64|riscv32|riscv64|arc> -DTOOLCHAIN=<GCC|CLANG> -DTARGET=<Debug|Release> -DCRYPTO=<mbedtls|openssl> ..
make copy_sample_key
make

Example cmake commands: (Note the .. at the end of the cmake command).

cmake -DARCH=ia32 -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=openssl ..

cmake -DARCH=ia32 -DTOOLCHAIN=GCC -DTARGET=Release -DCRYPTO=openssl ..

cmake -DARCH=arm -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=openssl ..

cmake -DARCH=x64 -DTOOLCHAIN=CLANG -DTARGET=Release -DCRYPTO=mbedtls ..

Run Test

Run unit_test

The UnitTest output is at libspdm/build/bin. Open one command prompt at output dir to run test_spdm_requester > NUL and test_spdm_responder > NUL.

You may see something like:

      [==========] Running 2 test(s).
      [ RUN      ] test_spdm_responder_version_case1
      [       OK ] test_spdm_responder_version_case1
      [ RUN      ] test_spdm_responder_version_case2
      [       OK ] test_spdm_responder_version_case2
      [==========] 2 test(s) run.
      [  PASSED  ] 2 test(s).
   

Note: You MUST use a command prompt with the current working directory at libspdm/build/bin when running ULTs or they may fail. Eg. Don't run the ULT from libsdpm/build directory by calling "bin/test_spdm_responder > NULL"

Run spdm_emu

The spdm_emu output is at spdm_emu/build/bin. Open one command prompt at output dir to run spdm_responder_emu. Then open another command prompt to run spdm_requester_emu.

Please refer to spdm_emu for detail.

spdm_dump tool

The tool output is at spdm_dump/build/bin. It can be used to parse the pcap file for offline analysis.

Please refer to spdm_dump for detail.

Other Test

libspdm also supports other test such as code coverage, fuzzing, symbolic execution, model checker.

Please refer to test for detail.

Features not implemented yet

1. Please refer to issues for detail

Known limitations

This package is only the sample code to show the concept. It does not have a full validation such as robustness functional test and fuzzing test. It does not meet the production quality yet. Any codes including the API definition, the library and the drivers are subject to change.