SPDM Component Integrity Action | Redfish Specification Forum

ratagupt
Guppy

Posts: 87

SPDM Component Integrity Action Jun 20, 2022 16:58:09 GMT

Quote

Post by ratagupt on Jun 20, 2022 16:58:09 GMT

Hi Team,

Having query related to SPDMGetSignedMeasurements action, As part of the response of this action, Redfish client get the SignedMeasurements through this property.
Description of this property says:

```
"SignedMeasurements": {

"description": "Base64 encoded cryptographic signed statement generated by the signer.",

"longDescription": "This property shall contain the cryptographic signed statement over the given nonce and measurement blocks corresponding to the requested measurement indices. If the SPDM version is 1.2, this value shall be a concatenation of SPDM 'VCA' and 'GET_MEASUREMENTS' requests and responses exchanged between the SPDM Requester and the SPDM Responder. If SPDM version is 1.0 or 1.1, this value shall be a concatenation of SPDM 'GET_MEASUREMENTS' requests and responses exchanged between the SPDM Requester and the SPDM Responder. The last 'MEASUREMENTS' response shall contain a signature generated over the 'L2' string by the SPDM Responder.",

"readonly": true,

"type": "string"

},
```

Our client is supporting version 1.1, so the value of this property will be a concatenation of SPDM 'GET_MEASUREMENTS' requests and responses exchanged between the SPDM Requester and the SPDM Responder and the last response will have the signature generated over L2 string.

How the redfish client will know the position of the signature in the string? Should we have signature in different property or size of the signature?

Last Edit: Jun 20, 2022 17:00:47 GMT by ratagupt

sphuong
Minnow

Posts: 3

SPDM Component Integrity Action Jun 21, 2022 15:29:50 GMT

Quote

Post by sphuong on Jun 21, 2022 15:29:50 GMT

Hi,

The redfish client will need to parse the SignedMeasurements, itself, to extract the signature. As the longDescriptions states, it is a concatenation of the actual response and request messages of VCA and/or the GET_MEASUREMENTS/MEASUREMENTS request and response message. Thus, the redfish client need to know understand how to interpret/parse the SPDM messages and to do this, it needs to consult the SPDM specification.

Last Edit: Jun 21, 2022 15:38:55 GMT by sphuong

ratagupt
Guppy

Posts: 87

SPDM Component Integrity Action Jun 22, 2022 12:36:57 GMT

Quote

Post by ratagupt on Jun 22, 2022 12:36:57 GMT

Jun 21, 2022 15:29:50 GMT sphuong said:

Hi,

The redfish client will need to parse the SignedMeasurements, itself, to extract the signature. As the longDescriptions states, it is a concatenation of the actual response and request messages of VCA and/or the GET_MEASUREMENTS/MEASUREMENTS request and response message. Thus, the redfish client need to know understand how to interpret/parse the SPDM messages and to do this, it needs to consult the SPDM specification.

This is too much on the redfish client perspective that they have to parse the whole string, and then get all the SPDM messages and identify where the signature starts.

Last Edit: Jun 22, 2022 12:40:32 GMT by ratagupt

mraineri
Administrator

Posts: 1,048

SPDM Component Integrity Action Jun 22, 2022 12:53:14 GMT

Quote

Post by mraineri on Jun 22, 2022 12:53:14 GMT

Unfortunately due to the nature of how a client can trust these types of responses, any sort of transformation of the data performed by the Redfish service means you lose any capability of verifying the signatures are authentic. The types of users that have expressed interest in leveraging these actions are in environments where they do not trust the BMC (usually due to policy of their organization).

However, in other environments where the BMC is considered a trust point, those types of users will rely on the Health of a given ComponentIntegrity resource to determine if there are potential security concerns with a device. In these cases, the BMC performs signature verification of measurements internally (and other types of security checks potentially) for determining the health of the device.