DSP0274 documents several optional certificate extensions for hardware identity:
- Subject Alternative Name otherName
- SPDM Non-critical Certificate Extension
Both of these are useful for authentication:
- in the otherName, the ub-DMTF-device-info is the "Device information string"
- in the id-DMTF-spdm-extension, theh presence of a id-DMTF-hardware-identity can be used to "identify the hardware identity certificate", which means the certificate SerialNumber is uniquely derived from the hardware.
libspdm should export a function which scans a certificate chain looking for the hardware identity serial number, using the following logic:
- if the leaf certificate has otherName ub-DMTF-device-info, return that string.
- if any certificate in the chain has id-DMTF-spdm-extension id-DMTF-hardware-identity return the x509 serial_number of that certificate
- if none of the above are found, return nothing