Repository navigation
Home
aidan garske edited this page May 15, 2026
·
7 revisions
Welcome to the wolfSPDM wiki. This documentation covers wolfSPDM, a lightweight requester-only SPDM implementation for embedded systems and constrained environments.
wolfSPDM is a C library implementing:
- SPDM 1.2 / 1.3 / 1.4 (DMTF DSP0274)
- Secured Messages over MCTP (DMTF DSP0277)
It uses wolfSSL / wolfCrypt as its crypto backend and is tested end-to-end against the DMTF spdm-emu responder emulator.
| Feature | Description |
|---|---|
| Requester-only SPDM stack | Purpose-built initiator implementation |
| SPDM 1.2/1.3/1.4 | Standards-based negotiation and session setup |
| Fixed Algorithm Set B | ECDSA P-384, ECDHE P-384, SHA-384, AES-256-GCM, HKDF-SHA384 |
| Zero-malloc by default | Static context (WOLFSPDM_CTX_STATIC_SIZE, 32 KB) |
| Optional dynamic context |
--enable-dynamic-mem enables wolfSPDM_New()
|
| Attestation operations | Signed/unsigned GET_MEASUREMENTS, sessionless CHALLENGE_AUTH
|
| Session operations |
HEARTBEAT, KEY_UPDATE, secured app data transfer |
| CI + security coverage | Multi-compiler, static analysis, CodeQL, Valgrind, spdm-emu integration |
| Page | Description |
|---|---|
| Getting Started | Dependencies, build, install, and first connection flow |
| Supported Operations | Supported SPDM flows and operation/API mapping |
| API Reference | Public API grouped by lifecycle and purpose |
| Configuration and Macros | Configure flags and compile-time feature controls |
| Testing and CI | Unit tests, emulator tests, and CI workflow coverage |
| Project Structure | Repository layout and module responsibilities |
| Attestation Notes | Measurement and challenge attestation details |
The primary session establishment sequence is:
GET_VERSION -> GET_CAPABILITIES -> NEGOTIATE_ALGORITHMS -> GET_DIGESTS -> GET_CERTIFICATE -> KEY_EXCHANGE -> FINISH
After FINISH, secured messaging and maintenance operations are available.
wolfSPDM is free software licensed under GPLv3. For commercial licensing and support, contact wolfSSL.