device-identity-provisioning: add keypair discovery and rename to Att… by fdamato · Pull Request #98 · opencomputeproject/Security

fdamato · 2026-05-27T03:54:10Z

…ested CSR

…ested CSR Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com>

xiaoyuruan · 2026-05-27T17:05:12Z

+
+1. The `KeyPairID` as a CBOR unsigned integer in the range `1..255`.
+2. An array of OIDs describing the derivation attributes of that keypair, drawn from the OIDs defined in @sec:defined-oids.
+


Place a pointer to the CDDL definition.

xiaoyuruan · 2026-05-29T21:17:02Z

+  / protected / <<{
+    / alg-id / 1 : 7,
+    / content-type / 3 : "application/eat+cbor",
+    ; SHA-384 digest of the Attestation Key (i.e. the SPDM Signing Key)


Change to hash of cert chain (same as DIGEST response)

xiaoyuruan · 2026-05-29T21:20:25Z

+  / unprotected / {},
+  / payload / <<{
+      / iss / 1 : "RT Alias Key",
+      / nonce / 10 : h'AAAABBBBAAAABBBBAAAABBBB',


Change to 32 bytes same as SPDM nonce

xiaoyuruan · 2026-05-29T21:26:32Z

-TODO: fill in
+A device may expose multiple identity keypairs (e.g., IDevID, LDevID, and other vendor- or owner-defined keys), each with its own derivation inputs. Before a PKI owner can select a suitable PKI anchor point, it must discover which keypairs the device supports and which derivation attributes are associated with each.
+
+This specification reuses the `GET_ATTESTED_CSR` command defined in @sec:establishing-trust-in-identity for keypair discovery, by reserving `KeyPairID = 0` as a discovery sentinel. SPDM 1.3 reserves the value 0 for the `KeyPairID` field, so it is safe to repurpose here without colliding with any valid keypair identifier.


remove "1.3". Say "value 0 is not a valid KeyPairID."

xiaoyuruan · 2026-05-29T21:28:08Z

+
+- `Param1` (`KeyPairID`) SHALL be `0`, indicating a discovery request rather than a CSR request.
+- `Param2` (Request Attributes), `RequesterInfoLength`, `OpaqueDataLength`, `RequesterInfo`, and `OpaqueData` SHALL be `0` / empty. The Responder SHALL ignore any non-zero values in these fields when `KeyPairID` is `0`.
+- `SignerSlotIDParam` SHALL be interpreted identically to the CSR case. Bit [4] selects whether the response is attested by an Attestation Key, and bits [3:0] select the SPDM slot whose Attestation Key signs the CWT. Requesters SHOULD request an attested response so that the inventory is attestable.


"Should" -> "shall"

xiaoyuruan · 2026-05-29T21:30:49Z

+
+When `KeyPairID = 0` is specified in the request, the Responder SHALL return an `ATTESTED_CSR` response whose `AttestedCSRdata` is an EAT encoded as a CWT, with the following requirements:
+
+- The EAT SHALL include the standard issuer claim and a nonce claim whose value matches the `Nonce` provided in the discovery request.


remove "the standard issuer claim"

xiaoyuruan · 2026-05-29T21:31:43Z

+
+- The EAT SHALL include the standard issuer claim and a nonce claim whose value matches the `Nonce` provided in the discovery request.
+- The EAT SHALL NOT include the CSR claim or the derivation-attribute-OID claim defined in @sec:establishing-trust-in-identity. Instead, it SHALL include a single private claim, the *KeyPair Inventory* claim, containing the device's keypair inventory.
+- If `SignerSlotIDParam` indicated an attested response, the CWT SHALL be signed by the Attestation Key corresponding to the specified slot, following the same `kid` and signing rules as in @sec:establishing-trust-in-identity.


remove "If SignerSlotIDParam indicated an attested response, " as it's always required.

xiaoyuruan · 2026-05-29T21:34:23Z

+
+The *KeyPair Inventory* claim SHALL be a CBOR array. Each element SHALL be a CBOR array of two elements:
+
+1. The `KeyPairID` as a CBOR unsigned integer in the range `1..255`.


KeyPairID is same as SPDM

xiaoyuruan · 2026-05-29T21:38:14Z

-![Envelope-signed Non-self-signed CSR](./diagrams/envelope_signed_csr_non_self_signed.drawio.svg){#fig:envelope-signed-csr-non-self-signed}
+![Attested Non-self-signed CSR](./diagrams/attested_csr_non_self_signed.drawio.svg){#fig:attested-csr-non-self-signed}
+
+This specification provides a definition for a vendor-defined SPDM command, utilizing VENDOR_DEFINED_REQUEST from SPDM 1.3, which can be used to surface these attested CSRs.


"from SPDM 1.3" -> "of SPDM 1.3 and later"

xiaoyuruan · 2026-05-29T21:44:33Z

@@ -237,12 +267,13 @@ Table: GET_ENVELOPE_SIGNED_CSR VendorDefinedReqPayload {#tbl:ecsr-req}
 +---------------------+---------------------+---------------------+----------------------------------------------+
 | 12                  | SignerSlotIDParam   | 1                   | - Bit [7:5]. Reserved.                       |
 |                     |                     |                     | - Bit [4:4]. If this value is `1`, the CSR   |


Signature is always required, so remove Bit [4] def.

xiaoyuruan · 2026-05-29T21:45:22Z

-  - E.g., Slot 0's certificate chain would extend at least to the vendor-endorsed certificate over IDevID. A separate slot's certificate chain would extend at least to the certificate issued by the slot's configured PKI owner.
-  - A device may report intermediate certificates for the slot's PKI owner if it is configured to do so.
+- The nonce claim SHALL match the nonce value provided in the GET_ATTESTED_CSR request to ensure freshness.
+- If SignerSlotIDParam indicates an attested response, the CWT SHALL be signed by an Attestation Key endorsed by the certificate chain corresponding to the specified SlotID. The Requester obtains the Attestation Key's certificate chain out-of-band via the SPDM `GET_CERTIFICATE` command for that slot.


remove "If SignerSlotIDParam indicates an attested response, " as sig is required

xiaoyuruan · 2026-05-29T21:45:36Z

-  - A device may report intermediate certificates for the slot's PKI owner if it is configured to do so.
+- The nonce claim SHALL match the nonce value provided in the GET_ATTESTED_CSR request to ensure freshness.
+- If SignerSlotIDParam indicates an attested response, the CWT SHALL be signed by an Attestation Key endorsed by the certificate chain corresponding to the specified SlotID. The Requester obtains the Attestation Key's certificate chain out-of-band via the SPDM `GET_CERTIFICATE` command for that slot.
+- If SignerSlotIDParam indicates an attested response, the `kid` parameter (COSE header label `4`) in the CWT's protected header SHALL be the SHA-384 digest of the DER-encoded `SubjectPublicKeyInfo` of the Attestation Key. The Requester uses this digest to confirm that the signing key matches the Attestation Key whose certificate chain it retrieved from the selected SPDM slot.


same as above

xiaoyuruan · 2026-05-29T21:46:42Z

-  - A device may report intermediate certificates for the slot's PKI owner if it is configured to do so.
+- The nonce claim SHALL match the nonce value provided in the GET_ATTESTED_CSR request to ensure freshness.
+- If SignerSlotIDParam indicates an attested response, the CWT SHALL be signed by an Attestation Key endorsed by the certificate chain corresponding to the specified SlotID. The Requester obtains the Attestation Key's certificate chain out-of-band via the SPDM `GET_CERTIFICATE` command for that slot.
+- If SignerSlotIDParam indicates an attested response, the `kid` parameter (COSE header label `4`) in the CWT's protected header SHALL be the SHA-384 digest of the DER-encoded `SubjectPublicKeyInfo` of the Attestation Key. The Requester uses this digest to confirm that the signing key matches the Attestation Key whose certificate chain it retrieved from the selected SPDM slot.


make it hash of cert chain to be consistent with DIGEST
"the DER-encoded SubjectPublicKeyInfo of the Attestation Key"

device-identity-provisioning: add keypair discovery and rename to Att…

dff2fed

…ested CSR Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com>

xiaoyuruan reviewed May 27, 2026

View reviewed changes

xiaoyuruan reviewed May 29, 2026

View reviewed changes


		1. The `KeyPairID` as a CBOR unsigned integer in the range `1..255`.
		2. An array of OIDs describing the derivation attributes of that keypair, drawn from the OIDs defined in @sec:defined-oids.


		When `KeyPairID = 0` is specified in the request, the Responder SHALL return an `ATTESTED_CSR` response whose `AttestedCSRdata` is an EAT encoded as a CWT, with the following requirements:

		- The EAT SHALL include the standard issuer claim and a nonce claim whose value matches the `Nonce` provided in the discovery request.


		The KeyPair Inventory claim SHALL be a CBOR array. Each element SHALL be a CBOR array of two elements:

		1. The `KeyPairID` as a CBOR unsigned integer in the range `1..255`.

Conversation

fdamato commented May 27, 2026

Uh oh!

xiaoyuruan May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xiaoyuruan May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

xiaoyuruan May 27, 2026 •

edited

Loading

xiaoyuruan May 29, 2026 •

edited

Loading