-
Notifications
You must be signed in to change notification settings - Fork 135
Open
Description
Current
/os_stub/spdm_cert_verify_callback_sample/spdm_cert_verify_callback.c
has the following code:
result = libspdm_asn1_get_tag(&ptr, end, &obj_len,
LIBSPDM_CRYPTO_ASN1_SEQUENCE | LIBSPDM_CRYPTO_ASN1_CONSTRUCTED);
if (!result) {
*spdm_get_dice_tcb_info_size = 0;
return false;
}
result = libspdm_asn1_get_tag(&ptr, end, &obj_len,
LIBSPDM_CRYPTO_ASN1_SEQUENCE | LIBSPDM_CRYPTO_ASN1_CONSTRUCTED);
if (!result) {
*spdm_get_dice_tcb_info_size = 0;
return false;
}
The code requires the extension has "SEQUENCE (SEQUENCE (xxx))" structure.
However, according to DICE Attestation Architecture (https://trustedcomputinggroup.org/wp-content/uploads/DICE-Attestation-Architecture-v1.2_pub.pdf) :
tcg-dice-TcbInfo OBJECT IDENTIFIER ::= {tcg-dice tcbinfo(1)}
DiceTcbInfo ::== SEQUENCE { ...}
The DICETCBInfo should have only one layer of SEQUENCE.
tcg-dice-MultiTcbInfo OBJECT IDENTIFIER ::= {tcg-dice multi-tcbinfo(5)}
DiceTcbInfoSeq ::= SEQUENCE SIZE (1..MAX) OF DiceTcbInfo
Only MultiDICETCBInfo can have SEQUENCE(SEQUENCE(...)) structure.
Please help chech if our understanding is correct.