diff --git a/README.md b/README.md index 881aef2..6e60108 100644 --- a/README.md +++ b/README.md @@ -139,7 +139,7 @@ Runs on every push and PR: ## Documentation -Full documentation is available in the Wiki: +Full documentation is available in the [GitHub Wiki](https://github.com/aidangarske/wolfSPDM/wiki): - [Getting Started](https://github.com/aidangarske/wolfSPDM/wiki/Getting-Started): Build instructions, prerequisites, memory modes, and first connection steps - [Supported Operations](https://github.com/aidangarske/wolfSPDM/wiki/Supported-Operations): SPDM operation coverage and API mapping diff --git a/docs/ATTESTATION.md b/docs/ATTESTATION.md deleted file mode 100644 index de6fe12..0000000 --- a/docs/ATTESTATION.md +++ /dev/null @@ -1,152 +0,0 @@ -# wolfSPDM Attestation (GET_MEASUREMENTS) - -## Overview - -wolfSPDM supports SPDM 1.2, 1.3, and 1.4 device attestation via -GET_MEASUREMENTS with optional cryptographic signature verification. This -enables a requester to retrieve firmware/hardware measurement blocks from -any SPDM-capable device and verify their authenticity. - -Version-specific notes: -- **SPDM 1.3 and 1.4** add a 32-byte RequesterContext field in - GET_MEASUREMENTS requests, which wolfSPDM populates automatically and - echo-verifies in the response. -- The 18-test integration matrix exercises both signed and unsigned - GET_MEASUREMENTS against the DMTF spdm-emu under each negotiated - version (1.2 / 1.3 / 1.4). - -The same protocol is used by: -- **GPUs** - NVIDIA uses SPDM over MCTP for GPU attestation -- **NICs** - BMC/iLO verify network cards -- **SSDs** - NVMe SPDM over DOE (Solidigm D7 series, etc.) -- **CXL memory devices** -- **Any PCIe device with CMA** (Component Measurement and Authentication) - -## API Reference - -### wolfSPDM_GetMeasurements - -```c -int wolfSPDM_GetMeasurements(WOLFSPDM_CTX* ctx, byte measOperation, - int requestSignature); -``` - -Retrieves measurements from the SPDM responder. - -**Parameters:** -- `measOperation` - `SPDM_MEAS_OPERATION_ALL` (0xFF) for all measurements, - or a specific 1-based index -- `requestSignature` - 1 to request signed measurements, 0 for unsigned - -**Return values:** -- `WOLFSPDM_SUCCESS` - Measurements retrieved and signature **verified** -- `WOLFSPDM_E_MEAS_NOT_VERIFIED` - Measurements retrieved but not verified - (unsigned request, or `NO_WOLFSPDM_MEAS_VERIFY` compiled out) -- `WOLFSPDM_E_MEAS_SIG_FAIL` - Signature verification **failed** - -### wolfSPDM_GetMeasurementCount / wolfSPDM_GetMeasurementBlock - -```c -int wolfSPDM_GetMeasurementCount(WOLFSPDM_CTX* ctx); -int wolfSPDM_GetMeasurementBlock(WOLFSPDM_CTX* ctx, int blockIdx, - byte* measIndex, byte* measType, byte* value, word32* valueSz); -``` - -Access individual measurement blocks after retrieval. - -### wolfSPDM_SendData / wolfSPDM_ReceiveData - -```c -int wolfSPDM_SendData(WOLFSPDM_CTX* ctx, const byte* data, word32 dataSz); -int wolfSPDM_ReceiveData(WOLFSPDM_CTX* ctx, byte* data, word32* dataSz); -``` - -Send/receive application data over an established SPDM session. - -## Build Configurations - -| Configuration | Flag | Effect | -|---|---|---| -| Full (default) | - | Measurement retrieval + signature verification | -| No verification | `-DNO_WOLFSPDM_MEAS_VERIFY` | Retrieval only, no sig verify | -| No measurements | `-DNO_WOLFSPDM_MEAS` | Zero measurement code/RAM | - -## Signature Verification - -When `requestSignature=1` and verification is compiled in: - -1. wolfSPDM sends GET_MEASUREMENTS with a 32-byte nonce -2. Responder returns measurements + ECDSA P-384 signature -3. wolfSPDM computes the L1/L2 transcript hash: - - L1 = GET_MEASUREMENTS request (complete message) - - L2 = MEASUREMENTS response (everything before the Signature field) - - Per DSP0274: M = combined_spdm_prefix || zero_pad || context_str || Hash(L1||L2) - - SignedData = Hash(M) -4. Verifies the signature using the responder's public key (extracted - from the certificate chain during `wolfSPDM_Connect()`) - -The nonce prevents replay attacks - each measurement request uses a fresh -random nonce that is included in the signed response. - -## Testing with spdm-emu - -Build and install [spdm-emu](https://github.com/DMTF/spdm-emu): - -```bash -git clone https://github.com/DMTF/spdm-emu.git -cd spdm-emu && mkdir build && cd build -cmake .. && make -``` - -Run the automated test script in this repo: - -```bash -# Runs 18 tests: session, signed/unsigned measurements, challenge, -# heartbeat, key update, each across SPDM 1.2 / 1.3 / 1.4. -export SPDM_EMU_PATH=../spdm-emu/build/bin -./examples/spdm_test.sh -``` - -The script automatically finds `spdm_responder_emu` via `SPDM_EMU_PATH` (or -`../spdm-emu/build/bin/`), starts/stops it per test, and verifies all the -test cases. - -Expected output with `--meas`: -``` -=== SPDM GET_MEASUREMENTS === -Measurements retrieved and signature VERIFIED -Measurement blocks: 8 - [1] type=0x00 size=48: - [2] type=0x01 size=48: - ... -``` - -With `--meas --no-sig`: -``` -=== SPDM GET_MEASUREMENTS === -Measurements retrieved (not signature-verified) -Measurement blocks: 8 - ... -``` - -## Standalone Demo - -`examples/spdm_demo` exercises the measurement flow against spdm-emu: - -| Flag | Description | -|---|---| -| `--meas` | Establish session + retrieve all measurements with signature verification | -| `--no-sig` | Skip signature verification (use with `--meas`) | - -## Security Notes - -- **Signed + verified measurements** provide cryptographic proof that - firmware/hardware state came from the authenticated responder -- **Replay protection** via fresh 32-byte nonce per request -- **Certificate chain validation** (chain-of-trust to root CA, expiry, - revocation) is NOT yet implemented - signature is verified against the - leaf certificate from session establishment. Full chain validation is - a follow-up item -- **Parser security**: All fields from the untrusted responder are - bounds-checked before use. Malformed responses return - `WOLFSPDM_E_MEASUREMENT` diff --git a/docs/wiki/API-Reference.md b/docs/wiki/API-Reference.md deleted file mode 100644 index 85f2c11..0000000 --- a/docs/wiki/API-Reference.md +++ /dev/null @@ -1,78 +0,0 @@ -# API Reference - -Public APIs are declared in `wolfspdm/spdm.h`. - -All APIs return `WOLFSPDM_SUCCESS` (`0`) on success unless documented otherwise; failures are negative error codes from `wolfspdm/spdm_error.h`. - -## Context and lifecycle - -- `wolfSPDM_Init` -- `wolfSPDM_InitStatic` -- `wolfSPDM_GetCtxSize` -- `wolfSPDM_Free` -- `wolfSPDM_New` *(only when built with `WOLFSPDM_DYNAMIC_MEMORY`)* - -## Configuration - -- `wolfSPDM_SetIO` -- `wolfSPDM_SetMaxVersion` -- `wolfSPDM_SetRequesterSessionId` -- `wolfSPDM_AllowUntrustedCerts` -- `wolfSPDM_SetTrustedCAs` -- `wolfSPDM_SetDebug` - -## Session establishment and state - -- `wolfSPDM_Connect` -- `wolfSPDM_IsConnected` -- `wolfSPDM_Disconnect` -- `wolfSPDM_GetSessionId` -- `wolfSPDM_GetNegotiatedVersion` -- `wolfSPDM_GetVersion_Negotiated` *(legacy compatibility symbol)* -- `wolfSPDM_GetLastPeerError` - -## Fine-grained handshake - -- `wolfSPDM_GetVersion` -- `wolfSPDM_GetCapabilities` -- `wolfSPDM_NegotiateAlgorithms` -- `wolfSPDM_GetDigests` -- `wolfSPDM_GetCertificate` -- `wolfSPDM_KeyExchange` -- `wolfSPDM_Finish` - -## Secured messaging - -- `wolfSPDM_SecuredExchange` -- `wolfSPDM_SendData` *(not in `WOLFSPDM_LEAN`)* -- `wolfSPDM_ReceiveData` *(not in `WOLFSPDM_LEAN`)* -- `wolfSPDM_EncryptMessage` *(not in `WOLFSPDM_LEAN`)* -- `wolfSPDM_DecryptMessage` *(not in `WOLFSPDM_LEAN`)* - -## Attestation - -- `wolfSPDM_GetMeasurements` *(not with `NO_WOLFSPDM_MEAS`)* -- `wolfSPDM_GetMeasurementCount` *(not with `NO_WOLFSPDM_MEAS`)* -- `wolfSPDM_GetMeasurementBlock` *(not with `NO_WOLFSPDM_MEAS`)* -- `wolfSPDM_Challenge` *(not with `NO_WOLFSPDM_CHALLENGE`)* - -## Session maintenance - -- `wolfSPDM_Heartbeat` -- `wolfSPDM_KeyUpdate` - -## Error utilities - -- `wolfSPDM_GetErrorString` - -## Common error codes - -Examples: -- `WOLFSPDM_E_INVALID_ARG` -- `WOLFSPDM_E_BAD_STATE` -- `WOLFSPDM_E_NOT_CONNECTED` -- `WOLFSPDM_E_IO_FAIL` -- `WOLFSPDM_E_PEER_ERROR` -- `WOLFSPDM_E_MEAS_SIG_FAIL` -- `WOLFSPDM_E_CHALLENGE` -- `WOLFSPDM_E_KEY_UPDATE` diff --git a/docs/wiki/Attestation-Notes.md b/docs/wiki/Attestation-Notes.md deleted file mode 100644 index d6bd32f..0000000 --- a/docs/wiki/Attestation-Notes.md +++ /dev/null @@ -1,57 +0,0 @@ -# Attestation Notes - -wolfSPDM supports SPDM attestation through both measurement retrieval and challenge authentication. - -## Measurement attestation (`GET_MEASUREMENTS`) - -Primary API: - -```c -int wolfSPDM_GetMeasurements(WOLFSPDM_CTX* ctx, byte measOperation, - int requestSignature); -``` - -Behavior: -- `requestSignature=1`: requests signed measurements; verifies signature when verification support is compiled in -- `requestSignature=0`: retrieves unsigned measurements (informational) - -Result access: -- `wolfSPDM_GetMeasurementCount` -- `wolfSPDM_GetMeasurementBlock` - -Relevant return codes: -- `WOLFSPDM_SUCCESS` -- `WOLFSPDM_E_MEAS_NOT_VERIFIED` -- `WOLFSPDM_E_MEAS_SIG_FAIL` -- `WOLFSPDM_E_MEASUREMENT` - -## Sessionless challenge attestation (`CHALLENGE_AUTH`) - -Primary API: - -```c -int wolfSPDM_Challenge(WOLFSPDM_CTX* ctx, int slotId, byte measHashType); -``` - -Typical prerequisite state: -- Version/capabilities/algorithms negotiated -- Digest and cert chain retrieved - -## Trust anchor handling - -Load trusted CA material with: - -```c -int wolfSPDM_SetTrustedCAs(WOLFSPDM_CTX* ctx, const byte* derCerts, - word32 derCertsSz); -``` - -`wolfSPDM_SetTrustedCAs` currently accepts a single DER certificate buffer for root-hash matching. - -## Feature toggles - -- `NO_WOLFSPDM_MEAS` disables measurements -- `NO_WOLFSPDM_MEAS_VERIFY` disables measurement signature verification -- `NO_WOLFSPDM_CHALLENGE` disables challenge API - -For deeper measurement details and test examples, see `docs/ATTESTATION.md`. diff --git a/docs/wiki/Configuration-and-Macros.md b/docs/wiki/Configuration-and-Macros.md deleted file mode 100644 index baa31df..0000000 --- a/docs/wiki/Configuration-and-Macros.md +++ /dev/null @@ -1,52 +0,0 @@ -# Configuration and Macros - -## Configure-time options - -From `configure.ac`: - -| Option | Default | Effect | -|--------|---------|--------| -| `--with-wolfssl=PATH` | system paths | Adds wolfSSL include/library search paths | -| `--enable-debug` | off | Defines `WOLFSPDM_DEBUG`, builds with `-g -O0` | -| `--enable-dynamic-mem` | off | Defines `WOLFSPDM_DYNAMIC_MEMORY` and enables `wolfSPDM_New` | - -## Public feature macros - -Defined in `wolfspdm/spdm.h` depending on build flags: - -- `WOLFSPDM_HAS_MEASUREMENTS` *(not defined if `NO_WOLFSPDM_MEAS`)* -- `WOLFSPDM_HAS_CHALLENGE` *(not defined if `NO_WOLFSPDM_CHALLENGE`)* -- `WOLFSPDM_HAS_HEARTBEAT` -- `WOLFSPDM_HAS_KEY_UPDATE` - -## Size and protocol constants - -From `wolfspdm/spdm.h` and `wolfspdm/spdm_types.h`: - -- `WOLFSPDM_CTX_STATIC_SIZE` = `32768` -- `WOLFSPDM_MAX_MSG_SIZE` = `4096` -- `WOLFSPDM_MAX_CERT_CHAIN` = `4096` -- `WOLFSPDM_MAX_TRANSCRIPT` = `4096` - -Version constants: -- `SPDM_VERSION_12`, `SPDM_VERSION_13`, `SPDM_VERSION_14` - -Measurement constants (when enabled): -- `SPDM_MEAS_OPERATION_ALL` -- `SPDM_MEAS_SUMMARY_HASH_NONE`, `_TCB`, `_ALL` - -## Common compile-time feature toggles - -These are used in source-level conditional compilation: - -| Macro | Effect | -|-------|--------| -| `NO_WOLFSPDM_MEAS` | Removes measurement APIs and related fields/code | -| `NO_WOLFSPDM_MEAS_VERIFY` | Keeps retrieval path but disables measurement signature verification | -| `NO_WOLFSPDM_CHALLENGE` | Removes challenge-attestation API/code | -| `WOLFSPDM_LEAN` | Excludes selected convenience secured-message helpers | - -## Notes - -- `wolfspdm/options.h` is auto-generated from `config.h` during build/install. -- API availability should be detected using feature macros rather than hard-coded assumptions. diff --git a/docs/wiki/Getting-Started.md b/docs/wiki/Getting-Started.md deleted file mode 100644 index cb69701..0000000 --- a/docs/wiki/Getting-Started.md +++ /dev/null @@ -1,82 +0,0 @@ -# Getting Started - -## Prerequisites - -wolfSPDM depends on wolfSSL/wolfCrypt with SPDM-required algorithms enabled. - -Minimum validated wolfSSL version: **v5.8.0-stable**. - -Example wolfSSL build: - -```bash -git clone https://github.com/wolfSSL/wolfssl.git -cd wolfssl -./autogen.sh -./configure --enable-wolftpm --enable-ecc --enable-sha384 \ - --enable-aesgcm --enable-hkdf --enable-sp -make -sudo make install -sudo ldconfig -``` - -## Build wolfSPDM - -```bash -./autogen.sh -./configure --with-wolfssl=/usr/local -make -make check -``` - -### Configure options - -| Option | Description | -|--------|-------------| -| `--with-wolfssl=PATH` | Path to wolfSSL headers/libs | -| `--enable-debug` | Enables debug build flags and `WOLFSPDM_DEBUG` | -| `--enable-dynamic-mem` | Enables heap-allocated context APIs (`wolfSPDM_New`) | - -## Memory modes - -### Static mode (default) - -Zero-malloc operation with caller-managed context memory: - -```c -byte spdmBuf[WOLFSPDM_CTX_STATIC_SIZE]; -WOLFSPDM_CTX* ctx = (WOLFSPDM_CTX*)spdmBuf; -wolfSPDM_InitStatic(ctx, sizeof(spdmBuf)); -``` - -`WOLFSPDM_CTX_STATIC_SIZE` is 32768 bytes. - -### Dynamic mode (optional) - -Enable with `--enable-dynamic-mem`, then: - -```c -WOLFSPDM_CTX* ctx = wolfSPDM_New(); -``` - -## Minimal connection flow - -1. Initialize context (`wolfSPDM_Init` or `wolfSPDM_InitStatic`) -2. Register transport callback with `wolfSPDM_SetIO` -3. Optionally set trust root with `wolfSPDM_SetTrustedCAs` -4. Establish session with `wolfSPDM_Connect` -5. Exchange secured data using `wolfSPDM_SecuredExchange` (or send/receive helpers) -6. End session with `wolfSPDM_Disconnect` -7. Cleanup via `wolfSPDM_Free` - -## Transport callback contract - -All transport is caller-owned through: - -```c -typedef int (*WOLFSPDM_IO_CB)(WOLFSPDM_CTX* ctx, - const byte* txBuf, word32 txSz, - byte* rxBuf, word32* rxSz, - void* userCtx); -``` - -The callback sends raw SPDM/SPDM-secured records and returns the responder message. diff --git a/docs/wiki/Home.md b/docs/wiki/Home.md deleted file mode 100644 index b95e52c..0000000 --- a/docs/wiki/Home.md +++ /dev/null @@ -1,57 +0,0 @@ -# wolfSPDM Documentation - -Welcome to the wolfSPDM wiki. This documentation covers wolfSPDM, a lightweight requester-only SPDM implementation for embedded systems and constrained environments. - -## What is wolfSPDM? - -wolfSPDM is a C library implementing: -- **SPDM 1.2 / 1.3 / 1.4** ([DMTF DSP0274](https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.4.0.pdf)) -- **Secured Messages over MCTP** ([DMTF DSP0277](https://www.dmtf.org/sites/default/files/standards/documents/DSP0277_1.2.0.pdf)) - -It uses [wolfSSL / wolfCrypt](https://www.wolfssl.com/) as its crypto backend and is tested end-to-end against the DMTF [spdm-emu](https://github.com/DMTF/spdm-emu) responder emulator. - -## Key Features - -| Feature | Description | -|---------|-------------| -| Requester-only SPDM stack | Purpose-built initiator implementation | -| SPDM 1.2/1.3/1.4 | Standards-based negotiation and session setup | -| Fixed Algorithm Set B | ECDSA P-384, ECDHE P-384, SHA-384, AES-256-GCM, HKDF-SHA384 | -| Zero-malloc by default | Static context (`WOLFSPDM_CTX_STATIC_SIZE`, 32 KB) | -| Optional dynamic context | `--enable-dynamic-mem` enables `wolfSPDM_New()` | -| Attestation operations | Signed/unsigned `GET_MEASUREMENTS`, sessionless `CHALLENGE_AUTH` | -| Session operations | `HEARTBEAT`, `KEY_UPDATE`, secured app data transfer | -| CI + security coverage | Multi-compiler, static analysis, CodeQL, Valgrind, spdm-emu integration | - -## Documentation - -| Page | Description | -|------|-------------| -| [[Getting Started]] | Dependencies, build, install, and first connection flow | -| [[Supported Operations]] | Supported SPDM flows and operation/API mapping | -| [[API Reference]] | Public API grouped by lifecycle and purpose | -| [[Configuration and Macros]] | Configure flags and compile-time feature controls | -| [[Testing and CI]] | Unit tests, emulator tests, and CI workflow coverage | -| [[Project Structure]] | Repository layout and module responsibilities | -| [[Attestation Notes]] | Measurement and challenge attestation details | - -## Protocol Session Flow - -The primary session establishment sequence is: - -`GET_VERSION -> GET_CAPABILITIES -> NEGOTIATE_ALGORITHMS -> GET_DIGESTS -> GET_CERTIFICATE -> KEY_EXCHANGE -> FINISH` - -After `FINISH`, secured messaging and maintenance operations are available. - -## Quick Links - -- [GitHub Repository](https://github.com/aidangarske/wolfSPDM) -- [README](https://github.com/aidangarske/wolfSPDM/blob/main/README.md) -- [DMTF DSP0274 (SPDM)](https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.4.0.pdf) -- [DMTF DSP0277 (Secured Messages)](https://www.dmtf.org/sites/default/files/standards/documents/DSP0277_1.2.0.pdf) -- [wolfSSL Website](https://www.wolfssl.com/) - -## License - -wolfSPDM is free software licensed under GPLv3. -For commercial licensing and support, contact [wolfSSL](https://www.wolfssl.com/contact/). diff --git a/docs/wiki/Project-Structure.md b/docs/wiki/Project-Structure.md deleted file mode 100644 index 59f1e00..0000000 --- a/docs/wiki/Project-Structure.md +++ /dev/null @@ -1,44 +0,0 @@ -# Project Structure - -## Top-level layout - -| Path | Purpose | -|------|---------| -| `src/` | Core protocol, crypto glue, transcript, secured messaging, and session logic | -| `wolfspdm/` | Public headers (`spdm.h`, `spdm_types.h`, `spdm_error.h`) | -| `examples/` | Demo client and emulator integration script | -| `test/` | Unit tests and emulator smoke test | -| `docs/` | Project documentation (including attestation notes) | -| `.github/workflows/` | CI workflows | - -## Core source modules - -| File | Responsibility | -|------|----------------| -| `src/spdm_context.c` | Context init/free lifecycle and state setup | -| `src/spdm_msg.c` | SPDM message construction and parsing | -| `src/spdm_crypto.c` | Cryptographic helper operations | -| `src/spdm_kdf.c` | HKDF-based key derivation | -| `src/spdm_transcript.c` | Transcript management (TH computations) | -| `src/spdm_secured.c` | Secured message protection (AES-256-GCM) | -| `src/spdm_session.c` | Handshake/session flow and higher-level operations | -| `src/spdm_internal.h` | Internal types, constants, and internal APIs | - -## Public API surface - -| Header | Content | -|--------|---------| -| `wolfspdm/spdm.h` | Main public API and feature macros | -| `wolfspdm/spdm_types.h` | SPDM protocol constants and algorithm identifiers | -| `wolfspdm/spdm_error.h` | Error code enum and error-string helper | - -## Build/test assets - -| File | Purpose | -|------|---------| -| `configure.ac` | Autotools configure logic and options | -| `Makefile.am` | Library, test, and example build targets | -| `examples/spdm_demo.c` | CLI demo for session/measurement/challenge/heartbeat/key update | -| `examples/spdm_test.sh` | 18-case emulator integration driver | -| `test/unit_test.c` | Unit test coverage | -| `test/test_spdm.c` | SPDM smoke-test utility | diff --git a/docs/wiki/Supported-Operations.md b/docs/wiki/Supported-Operations.md deleted file mode 100644 index 1409aeb..0000000 --- a/docs/wiki/Supported-Operations.md +++ /dev/null @@ -1,45 +0,0 @@ -# Supported Operations - -wolfSPDM implements requester-side SPDM operations for session establishment, secure data exchange, attestation, and session maintenance. - -## Operation coverage - -| Operation | SPDM area | wolfSPDM API | -|----------|-----------|--------------| -| Version negotiation | GET_VERSION | `wolfSPDM_GetVersion` | -| Capability negotiation | GET_CAPABILITIES | `wolfSPDM_GetCapabilities` | -| Algorithm negotiation | NEGOTIATE_ALGORITHMS | `wolfSPDM_NegotiateAlgorithms` | -| Certificate digest retrieval | GET_DIGESTS | `wolfSPDM_GetDigests` | -| Certificate chain retrieval | GET_CERTIFICATE | `wolfSPDM_GetCertificate` | -| Session key exchange | KEY_EXCHANGE | `wolfSPDM_KeyExchange` | -| Session finalization | FINISH | `wolfSPDM_Finish` | -| One-shot full connect | Full handshake | `wolfSPDM_Connect` | -| Secured app exchange | Secured messages | `wolfSPDM_SecuredExchange` | -| App send/receive helpers | Secured messages | `wolfSPDM_SendData`, `wolfSPDM_ReceiveData` | -| Measurements (signed/unsigned) | GET_MEASUREMENTS | `wolfSPDM_GetMeasurements` | -| Measurement block access | Measurement parsing | `wolfSPDM_GetMeasurementCount`, `wolfSPDM_GetMeasurementBlock` | -| Sessionless challenge auth | CHALLENGE / CHALLENGE_AUTH | `wolfSPDM_Challenge` | -| Keep-alive | HEARTBEAT | `wolfSPDM_Heartbeat` | -| Session key rotation | KEY_UPDATE | `wolfSPDM_KeyUpdate` | - -## Supported protocol versions - -- SPDM 1.2 (`0x12`) -- SPDM 1.3 (`0x13`) -- SPDM 1.4 (`0x14`) - -Maximum negotiated version can be capped with `wolfSPDM_SetMaxVersion`. - -## Fixed cryptographic profile (Algorithm Set B) - -- Hash: SHA-384 -- Asymmetric signature: ECDSA P-384 -- DHE: secp384r1 -- AEAD: AES-256-GCM -- Key schedule: SPDM key schedule + HKDF-SHA384 - -## Notable implementation scope - -- Requester-only implementation (no responder role) -- Designed for standards-based SPDM peers and DMTF spdm-emu -- Trust anchor support via `wolfSPDM_SetTrustedCAs` (single DER CA cert buffer) diff --git a/docs/wiki/Testing-and-CI.md b/docs/wiki/Testing-and-CI.md deleted file mode 100644 index 7681657..0000000 --- a/docs/wiki/Testing-and-CI.md +++ /dev/null @@ -1,47 +0,0 @@ -# Testing and CI - -## Local tests - -### Unit tests - -```bash -make check -./test/unit_test -``` - -### Integration test with DMTF spdm-emu - -```bash -export SPDM_EMU_PATH=../spdm-emu/build/bin -./examples/spdm_test.sh -``` - -`spdm_test.sh` runs 18 scenarios: -- Session -- Signed measurements -- Unsigned measurements -- Challenge -- Heartbeat -- Key update - -Across SPDM versions 1.2, 1.3, and 1.4. - -## CI workflow coverage - -Documented workflows include: - -- Build and Test (OS/config matrix) -- Multiple Compilers (GCC 11-13, Clang 14-17) -- Compiler Warnings (`-Werror`, pedantic/conversion/shadow checks) -- Static Analysis (cppcheck + scan-build) -- Memory Check (Valgrind) -- Empty Brace Scope Scan -- CodeQL Security -- Codespell -- SPDM Emulator Test (integration matrix on x64 + aarch64) - -See `.github/workflows/README.md` for workflow inventory details. - -## Validation caveat - -Building/tests require a compatible wolfSSL installation and may fail if `--with-wolfssl` is not provided or wolfSSL is absent from default search paths. diff --git a/docs/wiki/_Sidebar.md b/docs/wiki/_Sidebar.md deleted file mode 100644 index d3f3ddd..0000000 --- a/docs/wiki/_Sidebar.md +++ /dev/null @@ -1,10 +0,0 @@ -### Documentation - -- [[Home]] -- [[Getting Started]] -- [[Supported Operations]] -- [[API Reference]] -- [[Configuration and Macros]] -- [[Testing and CI]] -- [[Project Structure]] -- [[Attestation Notes]]