Skip to content

Commit 2ff535b

Browse files
sgramsjyao1
sgrams
authored and
jyao1
committed
feat(test): separate USE_ECDSA and REQ_USE_ECDSA with SPDMRS_ env overrides
Separate base_asym_algo and req_asym_algo algorithm selection following SPDM spec terminology: - USE_ECDSA controls base_asym_algo (BaseAsymAlgo) - REQ_USE_ECDSA controls req_asym_algo (ReqBaseAsymAlg) Both can be overridden at runtime via environment variables: - SPDMRS_USE_ECDSA=false -> use RSA for base_asym_algo - SPDMRS_REQ_USE_ECDSA=false -> use RSA for req_asym_algo Applied globally to spdm-requester-emu, spdm-responder-emu, and spdmlib-test. Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
1 parent 1ba6b01 commit 2ff535b

6 files changed

Lines changed: 82 additions & 26 deletions

File tree

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,12 @@ export SPDMRS_RSP_EMU_PRIVATE_KEY_PATH=/path/to/device.key.p8
202202
cargo run -p spdm-responder-emu --no-default-features --features "spdm-ring,hashed-transcript-data,async-executor"
203203
```
204204

205+
If RSA is used instead of ECDSA, following environment variables can be set before running spdm-requester-emu, spdm-responder-emu, or spdmlib-test:
206+
```bash
207+
export SPDMRS_USE_ECDSA=false # controls base_asym_algo (BaseAsymAlgo)
208+
export SPDMRS_REQ_USE_ECDSA=false # controls req_asym_algo (ReqBaseAsymAlg)
209+
```
210+
205211
### Cross test with [spdm_emu](https://github.com/DMTF/spdm-emu)
206212
Open one command windows in workspace and run:
207213

‎test/spdm-emu/src/spdm_emu.rs‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,15 @@ use spdmlib::config;
1515

1616
pub const SOCKET_HEADER_LEN: usize = 12;
1717
pub const USE_PCIDOE: bool = true; // align with DMTF spdm_emu
18+
19+
/// Default for base_asym_algo (BaseAsymAlgo - responder signing algorithm).
20+
/// Override at runtime with SPDMRS_USE_ECDSA env variable.
1821
pub const USE_ECDSA: bool = true;
1922

23+
/// Default for req_asym_algo (ReqBaseAsymAlg - requester signing algorithm).
24+
/// Override at runtime with SPDMRS_REQ_USE_ECDSA env variable.
25+
pub const REQ_USE_ECDSA: bool = true;
26+
2027
pub const SOCKET_TRANSPORT_TYPE_MCTP: u32 = 0x01;
2128
pub const SOCKET_TRANSPORT_TYPE_PCI_DOE: u32 = 0x02;
2229

@@ -25,6 +32,24 @@ pub const SOCKET_SPDM_COMMAND_STOP: u32 = 0xFFFE;
2532
pub const SOCKET_SPDM_COMMAND_UNKOWN: u32 = 0xFFFF;
2633
pub const SOCKET_SPDM_COMMAND_TEST: u32 = 0xDEAD;
2734

35+
/// Check if ECDSA should be used for base_asym_algo (BaseAsymAlgo).
36+
/// SPDMRS_USE_ECDSA=false or 0 -> uses RSA
37+
/// SPDMRS_USE_ECDSA=true or unset -> uses ECDSA (default)
38+
pub fn use_ecdsa() -> bool {
39+
std::env::var("SPDMRS_USE_ECDSA")
40+
.map(|v| v != "false" && v != "0")
41+
.unwrap_or(USE_ECDSA)
42+
}
43+
44+
/// Check if ECDSA should be used for req_asym_algo (ReqBaseAsymAlg).
45+
/// SPDMRS_REQ_USE_ECDSA=false or 0 -> uses RSA
46+
/// SPDMRS_REQ_USE_ECDSA=true or unset -> uses ECDSA (default)
47+
pub fn req_use_ecdsa() -> bool {
48+
std::env::var("SPDMRS_REQ_USE_ECDSA")
49+
.map(|v| v != "false" && v != "0")
50+
.unwrap_or(REQ_USE_ECDSA)
51+
}
52+
2853
#[derive(Debug, Copy, Clone, Default)]
2954
pub struct SpdmSocketHeader {
3055
pub command: u32,

‎test/spdm-requester-emu/src/main.rs‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -132,15 +132,15 @@ async fn test_spdm(
132132
req_capabilities,
133133
req_ct_exponent: 0,
134134
measurement_specification: SpdmMeasurementSpecification::DMTF,
135-
base_asym_algo: if USE_ECDSA {
135+
base_asym_algo: if use_ecdsa() {
136136
SpdmBaseAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
137137
} else {
138138
SpdmBaseAsymAlgo::TPM_ALG_RSASSA_3072
139139
},
140140
base_hash_algo: SpdmBaseHashAlgo::TPM_ALG_SHA_384,
141141
dhe_algo: SpdmDheAlgo::SECP_384_R1,
142142
aead_algo: SpdmAeadAlgo::AES_256_GCM,
143-
req_asym_algo: if USE_ECDSA {
143+
req_asym_algo: if req_use_ecdsa() {
144144
SpdmReqAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
145145
} else {
146146
SpdmReqAsymAlgo::TPM_ALG_RSASSA_3072
@@ -161,19 +161,19 @@ async fn test_spdm(
161161
..Default::default()
162162
};
163163

164-
let ca_file_path = if USE_ECDSA {
164+
let ca_file_path = if use_ecdsa() {
165165
"test_key/ecp384/ca.cert.der"
166166
} else {
167167
"test_key/rsa3072/ca.cert.der"
168168
};
169169
let ca_cert = std::fs::read(ca_file_path).expect("unable to read ca cert!");
170-
let inter_file_path = if USE_ECDSA {
170+
let inter_file_path = if use_ecdsa() {
171171
"test_key/ecp384/inter.cert.der"
172172
} else {
173173
"test_key/rsa3072/inter.cert.der"
174174
};
175175
let inter_cert = std::fs::read(inter_file_path).expect("unable to read inter cert!");
176-
let leaf_file_path = if USE_ECDSA {
176+
let leaf_file_path = if use_ecdsa() {
177177
"test_key/ecp384/end_responder.cert.der"
178178
} else {
179179
"test_key/rsa3072/end_responder.cert.der"
@@ -638,15 +638,15 @@ async fn test_idekm_tdisp(
638638
req_capabilities,
639639
req_ct_exponent: 0,
640640
measurement_specification: SpdmMeasurementSpecification::DMTF,
641-
base_asym_algo: if USE_ECDSA {
641+
base_asym_algo: if use_ecdsa() {
642642
SpdmBaseAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
643643
} else {
644644
SpdmBaseAsymAlgo::TPM_ALG_RSASSA_3072
645645
},
646646
base_hash_algo: SpdmBaseHashAlgo::TPM_ALG_SHA_384,
647647
dhe_algo: SpdmDheAlgo::SECP_384_R1,
648648
aead_algo: SpdmAeadAlgo::AES_256_GCM,
649-
req_asym_algo: if USE_ECDSA {
649+
req_asym_algo: if req_use_ecdsa() {
650650
SpdmReqAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
651651
} else {
652652
SpdmReqAsymAlgo::TPM_ALG_RSASSA_3072
@@ -667,19 +667,19 @@ async fn test_idekm_tdisp(
667667
..Default::default()
668668
};
669669

670-
let ca_file_path = if USE_ECDSA {
670+
let ca_file_path = if use_ecdsa() {
671671
"test_key/ecp384/ca.cert.der"
672672
} else {
673673
"test_key/rsa3072/ca.cert.der"
674674
};
675675
let ca_cert = std::fs::read(ca_file_path).expect("unable to read ca cert!");
676-
let inter_file_path = if USE_ECDSA {
676+
let inter_file_path = if use_ecdsa() {
677677
"test_key/ecp384/inter.cert.der"
678678
} else {
679679
"test_key/rsa3072/inter.cert.der"
680680
};
681681
let inter_cert = std::fs::read(inter_file_path).expect("unable to read inter cert!");
682-
let leaf_file_path = if USE_ECDSA {
682+
let leaf_file_path = if use_ecdsa() {
683683
"test_key/ecp384/end_responder.cert.der"
684684
} else {
685685
"test_key/rsa3072/end_responder.cert.der"

‎test/spdm-responder-emu/src/main.rs‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -295,15 +295,15 @@ async fn handle_message(
295295
rsp_ct_exponent: 0,
296296
measurement_specification: SpdmMeasurementSpecification::DMTF,
297297
measurement_hash_algo: SpdmMeasurementHashAlgo::TPM_ALG_SHA_384,
298-
base_asym_algo: if USE_ECDSA {
298+
base_asym_algo: if use_ecdsa() {
299299
SpdmBaseAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
300300
} else {
301301
SpdmBaseAsymAlgo::TPM_ALG_RSASSA_3072
302302
},
303303
base_hash_algo: SpdmBaseHashAlgo::TPM_ALG_SHA_384,
304304
dhe_algo: SpdmDheAlgo::SECP_384_R1,
305305
aead_algo: SpdmAeadAlgo::AES_256_GCM,
306-
req_asym_algo: if USE_ECDSA {
306+
req_asym_algo: if req_use_ecdsa() {
307307
SpdmReqAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
308308
} else {
309309
SpdmReqAsymAlgo::TPM_ALG_RSASSA_3072
@@ -339,19 +339,19 @@ async fn handle_message(
339339
my_cert_chain_data.data[0..chain_len].copy_from_slice(&cert_chain);
340340
} else {
341341
// Use default individual cert files
342-
let ca_file_path = if USE_ECDSA {
342+
let ca_file_path = if use_ecdsa() {
343343
"test_key/ecp384/ca.cert.der"
344344
} else {
345345
"test_key/rsa3072/ca.cert.der"
346346
};
347347
let ca_cert = std::fs::read(ca_file_path).expect("unable to read ca cert!");
348-
let inter_file_path = if USE_ECDSA {
348+
let inter_file_path = if use_ecdsa() {
349349
"test_key/ecp384/inter.cert.der"
350350
} else {
351351
"test_key/rsa3072/inter.cert.der"
352352
};
353353
let inter_cert = std::fs::read(inter_file_path).expect("unable to read inter cert!");
354-
let leaf_file_path = if USE_ECDSA {
354+
let leaf_file_path = if use_ecdsa() {
355355
"test_key/ecp384/end_responder.cert.der"
356356
} else {
357357
"test_key/rsa3072/end_responder.cert.der"

‎test/spdmlib-test/src/common/mod.rs‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,33 @@
55
#![forbid(unsafe_code)]
66

77
// TBD: need test different algorithm combinations
8+
9+
/// Default for base_asym_algo (BaseAsymAlgo - responder signing algorithm).
10+
/// Override at runtime with SPDMRS_USE_ECDSA env variable.
811
pub const USE_ECDSA: bool = true;
912

13+
/// Default for req_asym_algo (ReqBaseAsymAlg - requester signing algorithm).
14+
/// Override at runtime with SPDMRS_REQ_USE_ECDSA env variable.
15+
pub const REQ_USE_ECDSA: bool = true;
16+
17+
/// Check if ECDSA should be used for base_asym_algo (BaseAsymAlgo).
18+
/// SPDMRS_USE_ECDSA=false or 0 -> uses RSA
19+
/// SPDMRS_USE_ECDSA=true or unset -> uses ECDSA (default)
20+
pub fn use_ecdsa() -> bool {
21+
std::env::var("SPDMRS_USE_ECDSA")
22+
.map(|v| v != "false" && v != "0")
23+
.unwrap_or(USE_ECDSA)
24+
}
25+
26+
/// Check if ECDSA should be used for req_asym_algo (ReqBaseAsymAlg).
27+
/// SPDMRS_REQ_USE_ECDSA=false or 0 -> uses RSA
28+
/// SPDMRS_REQ_USE_ECDSA=true or unset -> uses ECDSA (default)
29+
pub fn req_use_ecdsa() -> bool {
30+
std::env::var("SPDMRS_REQ_USE_ECDSA")
31+
.map(|v| v != "false" && v != "0")
32+
.unwrap_or(REQ_USE_ECDSA)
33+
}
34+
1035
pub mod util;
1136

1237
pub mod device_io;

‎test/spdmlib-test/src/common/util.rs‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
#![allow(unused)]
66

77
use super::device_io::TestSpdmDeviceIo;
8-
use super::USE_ECDSA;
8+
use super::{req_use_ecdsa, use_ecdsa};
99
use crate::common::device_io::{MySpdmDeviceIo, TestTransportEncap};
1010
use crate::common::secret_callback::*;
1111
use crate::common::transport::PciDoeTransportEncap;
@@ -224,15 +224,15 @@ pub fn req_create_info() -> (SpdmConfigInfo, SpdmProvisionInfo) {
224224
req_capabilities,
225225
req_ct_exponent: 0,
226226
measurement_specification: SpdmMeasurementSpecification::DMTF,
227-
base_asym_algo: if USE_ECDSA {
227+
base_asym_algo: if use_ecdsa() {
228228
SpdmBaseAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
229229
} else {
230230
SpdmBaseAsymAlgo::TPM_ALG_RSASSA_3072
231231
},
232232
base_hash_algo: SpdmBaseHashAlgo::TPM_ALG_SHA_384,
233233
dhe_algo: SpdmDheAlgo::SECP_384_R1,
234234
aead_algo: SpdmAeadAlgo::AES_256_GCM,
235-
req_asym_algo: if USE_ECDSA {
235+
req_asym_algo: if req_use_ecdsa() {
236236
SpdmReqAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
237237
} else {
238238
SpdmReqAsymAlgo::TPM_ALG_RSASSA_3072
@@ -256,19 +256,19 @@ pub fn req_create_info() -> (SpdmConfigInfo, SpdmProvisionInfo) {
256256
};
257257

258258
let crate_dir = get_test_key_directory();
259-
let ca_file_path = if USE_ECDSA {
259+
let ca_file_path = if use_ecdsa() {
260260
crate_dir.join("test_key/ecp384/ca.cert.der")
261261
} else {
262262
crate_dir.join("test_key/rsa3072/ca.cert.der")
263263
};
264264
let ca_cert = std::fs::read(ca_file_path).expect("unable to read ca cert!");
265-
let inter_file_path = if USE_ECDSA {
265+
let inter_file_path = if use_ecdsa() {
266266
crate_dir.join("test_key/ecp384/inter.cert.der")
267267
} else {
268268
crate_dir.join("test_key/rsa3072/inter.cert.der")
269269
};
270270
let inter_cert = std::fs::read(inter_file_path).expect("unable to read inter cert!");
271-
let leaf_file_path = if USE_ECDSA {
271+
let leaf_file_path = if use_ecdsa() {
272272
crate_dir.join("test_key/ecp384/end_responder.cert.der")
273273
} else {
274274
crate_dir.join("test_key/rsa3072/end_responder.cert.der")
@@ -392,15 +392,15 @@ pub fn rsp_create_info() -> (SpdmConfigInfo, SpdmProvisionInfo) {
392392
rsp_ct_exponent: 0,
393393
measurement_specification: SpdmMeasurementSpecification::DMTF,
394394
measurement_hash_algo: SpdmMeasurementHashAlgo::TPM_ALG_SHA_384,
395-
base_asym_algo: if USE_ECDSA {
395+
base_asym_algo: if use_ecdsa() {
396396
SpdmBaseAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
397397
} else {
398398
SpdmBaseAsymAlgo::TPM_ALG_RSASSA_3072
399399
},
400400
base_hash_algo: SpdmBaseHashAlgo::TPM_ALG_SHA_384,
401401
dhe_algo: SpdmDheAlgo::SECP_384_R1,
402402
aead_algo: SpdmAeadAlgo::AES_256_GCM,
403-
req_asym_algo: if USE_ECDSA {
403+
req_asym_algo: if req_use_ecdsa() {
404404
SpdmReqAsymAlgo::TPM_ALG_ECDSA_ECC_NIST_P384
405405
} else {
406406
SpdmReqAsymAlgo::TPM_ALG_RSASSA_3072
@@ -425,20 +425,20 @@ pub fn rsp_create_info() -> (SpdmConfigInfo, SpdmProvisionInfo) {
425425
};
426426

427427
let crate_dir = get_test_key_directory();
428-
let ca_file_path = if USE_ECDSA {
428+
let ca_file_path = if use_ecdsa() {
429429
crate_dir.join("test_key/ecp384/ca.cert.der")
430430
} else {
431431
crate_dir.join("test_key/rsa3072/ca.cert.der")
432432
};
433433
log::info!("{}", ca_file_path.display());
434434
let ca_cert = std::fs::read(ca_file_path).expect("unable to read ca cert!");
435-
let inter_file_path = if USE_ECDSA {
435+
let inter_file_path = if use_ecdsa() {
436436
crate_dir.join("test_key/ecp384/inter.cert.der")
437437
} else {
438438
crate_dir.join("test_key/rsa3072/inter.cert.der")
439439
};
440440
let inter_cert = std::fs::read(inter_file_path).expect("unable to read inter cert!");
441-
let leaf_file_path = if USE_ECDSA {
441+
let leaf_file_path = if use_ecdsa() {
442442
crate_dir.join("test_key/ecp384/end_responder.cert.der")
443443
} else {
444444
crate_dir.join("test_key/rsa3072/end_responder.cert.der")

0 commit comments

Comments
 (0)