libspdm is a sample implementation that follows the DMTF SPDM specification
-
Specifications
The SPDM and secured message libraries follow :
DSP0274 Security Protocol and Data Model (SPDM) Specification (version 1.0.1, version 1.1.1 and version 1.2.1)
DSP0277 Secured Messages using SPDM Specification (version 1.1.0)
MCTP and secured MCTP follow :
DSP0275 Security Protocol and Data Model (SPDM) over MCTP Binding Specification (version 1.0.0)
DSP0276 Secured MCTP Messages over MCTP Binding Specification (version 1.0.0)
PCIE follows :
PCI Express Base Specification Revision 6.0 (version 1.0)
-
Includes libraries that can be used to construct an SPDM Requester and an SPDM Responder.
-
Programming Context
The core libraries in
libspdm/library/
require only the C99 freestanding headers and so are suitable for embedded and systems programming. Any functionality beyond the freestanding headers is provided bylibspdm/os_stub
or by the library's integrator. The core libraries do not contain any statically allocated variables. The core libraries do not dynamically allocate memory. -
Implemented Requests and Responses
SPDM 1.0:
GET_VERSION
,GET_CAPABILITIES
,NEGOTIATE_ALGORITHMS
,GET_DIGESTS
,GET_CERTIFICATE
,CHALLENGE
, andGET_MEASUREMENTS
.SPDM 1.1:
KEY_EXCHANGE
,FINISH
,PSK_EXCHANGE
,PSK_FINISH
,END_SESSION
,HEARTBEAT
,KEY_UPDATE
, andENCAPSULATED
messages.SPDM 1.2:
GET_CSR
,SET_CERTIFICATE
,CHUNK_SEND
, andCHUNK_GET
. -
Cryptographic Algorithm Support
The SPDM library requires cryptolib API, including random number generation, symmetric cryptography, asymmetric cryptography, hash, and message authentication code.
Currently supported algorithms: Hash:SHA2/SHA3/SM3, Signature:RSA-SSA/RSA-PSS/ECDSA/EdDSA/SM2-Sign, KeyExchange:FFDHE/ECDHE/SM2-KeyExchange, AEAD:AES_GCM/ChaCha20Poly1305/SM4_GCM. NOTE: NIST algorithms and Shang-Mi (SM) algorithms should not be mixed together.
An Mbed TLS wrapper is included in cryptlib_mbedtls. NOTE: SMx and EdDSA are not supported.
An OpenSSL wrapper is included in cryptlib_openssl. NOTE: SM2-KeyExchange and SM4_GCM are not supported.
-
Execution Context
Support to build an OS application for spdm_requester_emu and spdm_responder_emu to trace communication between Requester and Responder.
Support to be included in UEFI host environment EDKII, such as edkii_spdm_requester
Support to be included in OpenBMC. It is in planning, see SPDM Integration.
-
Presentation
Open Source Firmware Conference 2020 - openspdm
Free and Open Source Developers European Meeting 2021 - openspdm
-
libspdm Library Threat Model:
The user guide can be found at threat_model
-
libspdm Library Design:
The detailed design can be found at design
-
libspdm User Guide:
The user guide can be found at user_guide
-
Compiler (Choose one)
d) LLVM (LLVM13) Download: LLVM-13.0.0-win64.exe.
- Add LLVM in PATH environment according to installation instruction.
- Change LLVM install path to C:/LLVM.
- LLVM13 works good for clang and libfuzzer build. Other versions are not validated for clang build.
- Because the libfuzzer lib path is hard coded in CMakeLists, other versions may fail for libfuzzer build.
-
CMake (Version 3.17.2 is known to work. Newer versions may fail).
-
Compiler (Choose one)
a) GCC (above GCC5)
b) LLVM (above LLVM10), install steps:
sudo apt-get install llvm-10
thensudo apt-get install clang-10
. Usellvm-ar -version
andclang -v
to confirm the LLVM version. If LLVM installation fails or LLVM installation version is low, you can update Linux version to fix the issue.
- cmocka. Version 1.1.5.
libspdm uses submodules for mbedtls, openssl, and cmocka.
To get a fully buildable repository, use git submodule update --init
.
If there is an update for submodules, use git submodule update
.
For ia32 builds, use a x86 Native Tools Command Prompt for Visual Studio...
command prompt.
For x64 builds, use a x64 Native Tools Command Prompt for Visual Studio...
command prompt.
General build steps: (Note the ..
at the end of the cmake command).
cd libspdm
mkdir build
cd build
cmake -G"NMake Makefiles" -DARCH=<x64|ia32> -DTOOLCHAIN=<VS2022|VS2019|VS2015|CLANG> -DTARGET=<Debug|Release> -DCRYPTO=<mbedtls|openssl> ..
nmake copy_sample_key
nmake
Example CMake commands:
cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Debug -DCRYPTO=mbedtls ..
cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Release -DCRYPTO=mbedtls ..
cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Debug -DCRYPTO=openssl ..
cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Release -DCRYPTO=openssl ..
Note ia32 build is not supported for CLANG build on Windows.
CMake can also generate Visual Studio project files. For example:
cmake -G"Visual Studio 16 2019" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Release -DCRYPTO=mbedtls ..
If ia32 builds run on a 64-bit Linux machine, then install sudo apt-get install gcc-multilib
.
General build steps: (Note the ..
at the end of the cmake command).
cd libspdm
mkdir build
cd build
cmake -DARCH=<x64|ia32|arm|aarch64|riscv32|riscv64|arc> -DTOOLCHAIN=<GCC|CLANG> -DTARGET=<Debug|Release> -DCRYPTO=<mbedtls|openssl> ..
make copy_sample_key
make
Example CMake commands:
cmake -DARCH=ia32 -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=openssl ..
cmake -DARCH=ia32 -DTOOLCHAIN=GCC -DTARGET=Release -DCRYPTO=openssl ..
cmake -DARCH=arm -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=openssl ..
cmake -DARCH=x64 -DTOOLCHAIN=CLANG -DTARGET=Release -DCRYPTO=mbedtls ..
Run unit_test
The UnitTest output is at libspdm/build/bin.
Open one command prompt at output dir to run test_spdm_requester > NUL
and test_spdm_responder > NUL
.
You should see something like:
[==========] Running 2 test(s). [ RUN ] test_spdm_responder_version_case1 [ OK ] test_spdm_responder_version_case1 [ RUN ] test_spdm_responder_version_case2 [ OK ] test_spdm_responder_version_case2 [==========] 2 test(s) run. [ PASSED ] 2 test(s).
Note: You MUST use a command prompt with the current working directory at libspdm/build/bin when running ULTs or they may fail. Eg. Don't run the ULT from libsdpm/build directory by calling "bin/test_spdm_responder > NULL"
Run spdm_emu
The spdm_emu output is at spdm_emu/build/bin.
Open one command prompt at output dir to run spdm_responder_emu
. Then open another command prompt to run spdm_requester_emu
.
Refer to spdm_emu for more details.
spdm_dump tool
The tool output is at spdm_dump/build/bin. It can be used to parse the pcap file for offline analysis.
Refer to spdm_dump for more details.
libspdm also supports other tests such as code coverage, fuzzing, symbolic execution, model checker.
Refer to test for more details.
- Refer to issues for more details.
This package is only the sample code to show the concept of SPDM and should not be considered fit for production. Any code including the API definition is subject to change.