Skip to content

macro_check: enforce capability dependencies for KEM/DHE and signature algorithms#3621

Open
czwolak wants to merge 1 commit into
DMTF:mainfrom
czwolak:feature/spdm14-build-profiles
Open

macro_check: enforce capability dependencies for KEM/DHE and signature algorithms#3621
czwolak wants to merge 1 commit into
DMTF:mainfrom
czwolak:feature/spdm14-build-profiles

Conversation

@czwolak
Copy link
Copy Markdown
Contributor

@czwolak czwolak commented May 11, 2026 •
edited
Loading

Require KEY_EX_CAP when DHE/KEM/MUT_AUTH is enabled, and require CERT_CAP/CHAL_CAP/KEY_EX_CAP when any signature algorithm is enabled.

Keep checks focused on capability-to-algorithm consistency in libspdm_macro_check.h.

@czwolak czwolak force-pushed the feature/spdm14-build-profiles branch 3 times, most recently from 7bec0d7 to 7a4f216 Compare May 12, 2026 09:20
@jyao1
Copy link
Copy Markdown
Member

jyao1 commented May 14, 2026

please clarify the problem statement. Why this is needed?

@czwolak
Copy link
Copy Markdown
Contributor Author

czwolak commented May 14, 2026

please clarify the problem statement. Why this is needed?

Thanks for the feedback.
The need is to make SPDM 1.4 + PQC configuration deterministic and fail early.

Today, requester/responder role selection and PQC capability combinations can lead to invalid macro sets that are only discovered later (integration/CI/runtime).
This PR adds explicit SPDM 1.4 build profiles (both/requester/responder) and compile-time fail-fast checks so invalid combinations are rejected immediately.

So the value is:

  • clearer role-focused builds,
  • earlier detection of invalid SPDM/PQC configs,
  • lower integration/debug cost, while keeping backward compatibility (both remains default).

jyao1
jyao1 reviewed May 20, 2026
View reviewed changes
Comment thread include/library/spdm_lib_config_profile_requester.h Outdated
#ifndef SPDM_LIB_CONFIG_PROFILE_REQUESTER_H
#define SPDM_LIB_CONFIG_PROFILE_REQUESTER_H

#define LIBSPDM_SPDM14_BUILD_PROFILE_ID LIBSPDM_SPDM14_BUILD_PROFILE_REQUESTER
Copy link
Copy Markdown
Member

@jyao1 jyao1 May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure why we need SPDM14 here.
What about SPDM10, SPDM11, SPDM12, SPDM13, and future SPDM15?
Do we want to add for each specific version?

Copy link
Copy Markdown
Contributor Author

@czwolak czwolak May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed

jyao1
jyao1 reviewed May 20, 2026
View reviewed changes
Comment thread include/internal/libspdm_macro_check.h Outdated
#endif

#if (LIBSPDM_ML_KEM_SUPPORT) && !(LIBSPDM_ENABLE_CAPABILITY_KEY_EX_CAP)
#error ML-KEM support requires KEY_EX_CAP capability.
Copy link
Copy Markdown
Member

@jyao1 jyao1 May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why only check KEM? DHE also need KEY_EX.

Copy link
Copy Markdown
Contributor Author

@czwolak czwolak May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added for LIBSPDM_DHE_ALGO_SUPPORT

jyao1
jyao1 reviewed May 20, 2026
View reviewed changes
Comment thread include/internal/libspdm_macro_check.h Outdated
#if ((LIBSPDM_ML_DSA_SUPPORT) || (LIBSPDM_SLH_DSA_SUPPORT)) && \
!((LIBSPDM_ENABLE_CAPABILITY_CERT_CAP) || (LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP) || \
(LIBSPDM_ENABLE_CAPABILITY_KEY_EX_CAP) || (LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP))
#error ML-DSA/SLH-DSA support requires CERT_CAP, CHAL_CAP, KEY_EX_CAP, or MUT_AUTH_CAP.
Copy link
Copy Markdown
Member

@jyao1 jyao1 May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same question. RSA/ECDSA/EdDSA/... also need similar check.

Copy link
Copy Markdown
Contributor Author

@czwolak czwolak May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added for LIBSPDM_ASYM_ALGO_SUPPORT and removed MUT_AUTH_CAP from the condition. added condition that MUT_AUTH_CAP requires KEY_EX_CAP

@jyao1
Copy link
Copy Markdown
Member

jyao1 commented May 20, 2026

I notice this PR include 2 features: 1) add consistency check, 2) add PROFILE_ID.

I think those are 2 different features. I suggest we split to 2 different PRs.

jyao1
jyao1 reviewed May 20, 2026
View reviewed changes
Comment thread include/library/spdm_lib_config_profile_requester.h Outdated
Comment on lines +21 to +24
#define LIBSPDM_SEND_GET_CERTIFICATE_SUPPORT 1
#define LIBSPDM_SEND_CHALLENGE_SUPPORT 1
#define LIBSPDM_EVENT_RECIPIENT_SUPPORT 1
#define LIBSPDM_SEND_GET_ENDPOINT_INFO_SUPPORT 1
Copy link
Copy Markdown
Member

@jyao1 jyao1 May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand why those should be in profile.

Copy link
Copy Markdown
Contributor Author

@czwolak czwolak May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed

jyao1
jyao1 reviewed May 20, 2026
View reviewed changes
Comment thread include/library/spdm_lib_config_profile_responder.h Outdated
Comment on lines +20 to +23
#define LIBSPDM_SEND_GET_CERTIFICATE_SUPPORT 1
#define LIBSPDM_SEND_CHALLENGE_SUPPORT 1
#define LIBSPDM_EVENT_RECIPIENT_SUPPORT 0
#define LIBSPDM_SEND_GET_ENDPOINT_INFO_SUPPORT 0
Copy link
Copy Markdown
Member

@jyao1 jyao1 May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand why this is a must.

Copy link
Copy Markdown
Contributor Author

@czwolak czwolak May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed

@czwolak
Copy link
Copy Markdown
Contributor Author

czwolak commented May 20, 2026

@jyao1 I think I see your point. Lets close this PR and related task. I will try to introduce 1.4 as 1.1-1.3 was before without additional profiles, checks. Just pure support, OK?

@czwolak czwolak closed this May 20, 2026
@czwolak
Copy link
Copy Markdown
Contributor Author

czwolak commented May 20, 2026

I will try to introduce 1.4 as 1.1-1.3 was before, without additional build profiles, checks.

@czwolak czwolak reopened this May 21, 2026
@czwolak czwolak force-pushed the feature/spdm14-build-profiles branch from 7a4f216 to 3793857 Compare May 21, 2026 07:40
@czwolak czwolak changed the title Add SPDM 1.4 requester/responder build profiles macro_check: enforce capability dependencies for KEM/DHE and signature algorithms May 21, 2026
@jyao1
Copy link
Copy Markdown
Member

jyao1 commented May 22, 2026

please change the descript if the scope is changed.

jyao1
jyao1 reviewed May 22, 2026
View reviewed changes
Comment thread include/internal/libspdm_macro_check.h Outdated
Comment on lines +50 to +52
#if (LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP) && !(LIBSPDM_ENABLE_CAPABILITY_KEY_EX_CAP)
#error If MUT_AUTH_CAP is enabled then KEY_EX_CAP must also be enabled.
#endif
Copy link
Copy Markdown
Member

@jyao1 jyao1 May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The SPDM spec does not mention this rule.
I suggest to remove it.

Copy link
Copy Markdown
Contributor Author

@czwolak czwolak May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@czwolak czwolak force-pushed the feature/spdm14-build-profiles branch from 3793857 to 357c7cd Compare May 22, 2026 11:00
@czwolak
macro_check: enforce capability prerequisites for key exchange and si…
67df213 
…gnatures

Require KEY_EX_CAP when DHE/KEM/MUT_AUTH is enabled, and require CERT_CAP/CHAL_CAP/KEY_EX_CAP when any signature algorithm is enabled.

Keep checks focused on capability-to-algorithm consistency in libspdm_macro_check.h.

Signed-off-by: Cezary Zwolak <cezary.zwolak@intel.com>
@czwolak czwolak force-pushed the feature/spdm14-build-profiles branch from 357c7cd to 67df213 Compare May 27, 2026 07:56
@czwolak
Copy link
Copy Markdown
Contributor Author

czwolak commented May 27, 2026

I notice this PR include 2 features: 1) add consistency check, 2) add PROFILE_ID.

I think those are 2 different features. I suggest we split to 2 different PRs.

Only consistency check left

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jyao1 jyao1 jyao1 left review comments

@steven-bellock steven-bellock Awaiting requested review from steven-bellock steven-bellock is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@czwolak @jyao1