Inquiry about Reference measurement TC

[hiption]

Hi all
I wonder if there are plans to add a TC to check the Reference measurement when executing the GET_MEASUREMENT command.
As the number of systems applying SPDM increases, requests for Reference measurement are increasing.
Although the Reference measurement is an independent item from SPDM, it is one of the main functions of SPDM, and many manufacturers are using SPDM-Responder-Validator to verify their products, so I request considering adding related TC.

[steven-bellock]

I wonder if there are plans to add a TC to check the Reference measurement when executing the GET_MEASUREMENT command.

No, there are not.

Are you thinking that SPDM-Responder-Validator would parse a RIM file to determine the expected values, and then compare the expected values to those returned from the MEASUREMENTS response?

[hiption]

That‘s right. I think it would be good if the digital signature verification of RIM was added to the scenario you mentioned.

[steven-bellock]

Presumably the entities that produced the RIM specification (TCG/IETF/???) would also provide a means to validate a RIM instance against its schema, including verification of the signature. SPDM-Responder-Validator could call into that as a all-in-one service, but the main service is still comparing the Responder's measurements to the RIM's expected values.

[hiption]

As far as I know, IETF CoRIM, COSE seem to be the most promising.
It is true that the most important function is comparing the expected value of RIM with the measurement delivered by the device.
However, since the actual host system uses RIM with signature, it would be good to include signature verification in TC from the perspective of "all-in-one service".
The TC can consider the option of using online or already stored certificates to load the certificate chain (from RootCA to leaf) used for signature verification.

[steven-bellock]

@jyao1 suggested that Responder-Validator publish a simple format that the test can use to check the measurement values. It would be up to the Integrator to translate the RIM to the simple format. For popular RIM formats the parser could be integrated into this repository.

[hiption]

Hi @steven-bellock , @jyao1
In my opinion, this function does not match the purpose of this repo for validating libspdm, so it would be better to add this function to spdm_device_attester_sample in spdm-emu. What do you think?

[jyao1]

This test suite is served as interface test.
It does not mean this test suite will validate all functionalities.

But if you have special thought, feel free to submit PR to add it.
We are happy to review and merge.