Signature generation for SPDM_CHALLENGE is not calculating as per actual length (after removing extra length)

[nipung87]

Hi,

I would like to discuss a topic where we are calculating Signature in SPDM CHALLENGE and issue I am facing on using DOE as transport. DOE states that we can send any length which is greater than the actual data present in the packet/buffer.

Due to some reason I do not have the actual length, and send additional length to DOE for SPDM and same is provided to SPDM library. Here, I notice that SPDM_CHALLENGE uses this length to calculate the signanature (using previous requests/responses) and not use the real valid length of the earlier requests/responses.

Is this correct and expected behavior? Kindly guide.

Thank you

[jyao1]

I notice that SPDM_CHALLENGE uses this length to calculate the signanature

I am not sure what "this length" means.

Libspdm calculates the valid message length and strip the padding bytes.

[nipung87]

Thanks for the quick response. Let me provide more details.

On SPDM responder, we are using non-secure messages sending "get version, get capability, negotiate algorithms, get digest, get certificate" which is followed by challenge request. All this happens before any session is established. DOE is used as a transport layer.
Due to some reasons we do not have real length of the packet at the DOE layer and we are sending extra bytes in the DOE length.

When we send packets to libspdm for handling, the transport decode function (registered in libspdm_register_transport_layer_func) and it provides the length from the transport layer (referred as 'this length' in original query) which is much more than the "real length" of the SPDM request. Libspdm dispatch the request and works on the request correctly.

Due to the failure I get, I was wondering if the request data stored (using libspdm_append_message_a/b/c) for generating the signature in SPDM_CHALLENGE is correct or not?
e.g. if we look in libspdm_rsp_certificate.c (https://github.com/DMTF/libspdm/blob/main/library/spdm_responder_lib/libspdm_rsp_certificate.c#L156), where libspdm_append_message_b() is called, the request_size used is provided as input to the API, which in above case is larger than actual/real request size.
For others like in libspdm_rsp_algorithms.c (https://github.com/DMTF/libspdm/blob/main/library/spdm_responder_lib/libspdm_rsp_algorithms.c#L855), the size used is correct.

Please correct me if my understanding is wrong.

Thanks

[steven-bellock]

That is a bug. I filed #2610.