search

DMTF / SPDM-Responder-Validator

BSD 3-Clause "New" or "Revised" License
9 stars 13 forks source link

CHALLENGE_AUTH fail for all slot id except for 0 (GROUP 6 TC) #121

Closed chanss-park closed 9 months ago

chanss-park commented 9 months ago

In GROUP 6 TC (spdm_responder_test_6_challenge_auth.c), libspdm_verify_challenge_auth_signature() always uses slot 0 for signature verification. This causes CHALLENGE_AUTH fail for all slot id except for 0.

jyao1 commented 9 months ago

@chanss-park, all slots are using same key. I am not sure why it fails.

Are you observing the failure? If so, please let me know how to reproduce. or just guessing that it will failure?

chanss-park commented 9 months ago

First, I'm sorry for confusing you. In my code, different keys were used for each slot. (this is spec violation, my fault.) So, this implementation caused TC fail when only slot 0 was set and then used.

There is another question I'd like to ask you. (based on the commit "1d2c4a09687a55bc8d3876a918751a6ba4c4f76b") Do you intend to set only slot 0 for some TCs ? For example, spdm_test_case_measurements_setup_vca_challenge_session() function (in spdm_responder_test_7_measurements.c) is doing so at line 179. Your answer will be helpful for me to test my code.

steven-bellock commented 9 months ago

In my code, different keys were used for each slot. (this is spec violation, my fault.)

Ideally the GET_CERTIFICATES test would validate that the public key in certificate slots 1 through 7 are the same as the public key in certificate slot 0.

jyao1 commented 9 months ago

@chanss-park, my purpose is to test the all valid slots.

If you set same key but different cert for different slot, it will be a perfect test environment. If you observe the failure with that, please let me know the reproduce steps, we need to fix it.

chanss-park commented 9 months ago

Thanks for guiding me. I will retest it after fixing.