Skip to content

Request for enhancement: libspdm routine to find the hardware identity Serial Number #3088

@lordaule

Description

@lordaule

DSP0274 documents several optional certificate extensions for hardware identity:

  1. Subject Alternative Name otherName
  2. SPDM Non-critical Certificate Extension

Both of these are useful for authentication:

  1. in the otherName, the ub-DMTF-device-info is the "Device information string"
  2. in the id-DMTF-spdm-extension, theh presence of a id-DMTF-hardware-identity can be used to "identify the hardware identity certificate", which means the certificate SerialNumber is uniquely derived from the hardware.

libspdm should export a function which scans a certificate chain looking for the hardware identity serial number, using the following logic:

  • if the leaf certificate has otherName ub-DMTF-device-info, return that string.
  • if any certificate in the chain has id-DMTF-spdm-extension id-DMTF-hardware-identity return the x509 serial_number of that certificate
  • if none of the above are found, return nothing

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions