Skip to content

TCBInfo format issue #3416

@reasly

Description

@reasly

Current
/os_stub/spdm_cert_verify_callback_sample/spdm_cert_verify_callback.c
has the following code:

    result = libspdm_asn1_get_tag(&ptr, end, &obj_len,
                                  LIBSPDM_CRYPTO_ASN1_SEQUENCE | LIBSPDM_CRYPTO_ASN1_CONSTRUCTED);
    if (!result) {
        *spdm_get_dice_tcb_info_size = 0;
        return false;
    }
    result = libspdm_asn1_get_tag(&ptr, end, &obj_len,
                                  LIBSPDM_CRYPTO_ASN1_SEQUENCE | LIBSPDM_CRYPTO_ASN1_CONSTRUCTED);
    if (!result) {
        *spdm_get_dice_tcb_info_size = 0;
        return false;
    }

The code requires the extension has "SEQUENCE (SEQUENCE (xxx))" structure.
However, according to DICE Attestation Architecture (https://trustedcomputinggroup.org/wp-content/uploads/DICE-Attestation-Architecture-v1.2_pub.pdf) :

tcg-dice-TcbInfo OBJECT IDENTIFIER ::= {tcg-dice tcbinfo(1)}
DiceTcbInfo ::== SEQUENCE { ...}

The DICETCBInfo should have only one layer of SEQUENCE.

tcg-dice-MultiTcbInfo OBJECT IDENTIFIER ::= {tcg-dice multi-tcbinfo(5)}
DiceTcbInfoSeq ::= SEQUENCE SIZE (1..MAX) OF DiceTcbInfo

Only MultiDICETCBInfo can have SEQUENCE(SEQUENCE(...)) structure.

Please help chech if our understanding is correct.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions