wolfSPDM will be a lightweight SPDM requester for embedded systems, currently in development at wolfSSL. It will implement the DMTF Security Protocol and Data Model (SPDM) 1.2 and later, so a host, BMC, or SoC will be able to authenticate the components it talks to, read signed firmware measurements, and open an encrypted, integrity-protected session with them, all on top of wolfCrypt.
SPDM is quickly becoming the common language of hardware attestation. TPMs, PCIe and CXL devices, SSDs, NICs, GPUs, and FPGA security processors such as the Secure Device Manager on Altera Agilex FPGAs all answer SPDM requests. wolfSPDM will be built for the other side of that conversation: small, deterministic requester code that will fit in firmware, bootloaders, and microcontrollers, not only servers.
Planned Features
- SPDM 1.2, 1.3, and 1.4 requester per DMTF DSP0274, with secured messages per DSP0277
- Zero dynamic allocation: one caller-provided context, no malloc
- Post-quantum ready: ML-DSA signatures and ML-KEM key exchange with SPDM 1.4, including a fully post-quantum handshake
- Device attestation: signed measurements, CHALLENGE, and certificate-chain validation
- Full session lifecycle: key exchange, encrypted messaging, heartbeat, and key update
- Transport-agnostic I/O callback for MCTP, SPI, I2C, or vendor buses
- Possible SPDM responder support as well, which can be compiled out entirely for requester-only builds
- Interoperability with the DMTF spdm-emu responder emulator across SPDM 1.2, 1.3, and 1.4
- Path to FIPS 140-3 (wolfCrypt certs #4718, #5041)
- Single vendor stack and 24×7 support
Where It Will Fit
- TPM 2.0: authenticated, encrypted sessions to discrete TPMs over the TCG SPDM-over-TPM binding
- FPGA SoCs: attesting the Secure Device Manager on Altera Agilex devices from the Arm hard processor system
- Data center: BMCs and roots of trust verifying PCIe and CXL cards, SSDs, NICs, and accelerators
- Embedded and automotive: controllers authenticating peripherals before trusting them
Built on wolfTPM SPDM
wolfSPDM will share its core with the SPDM support already shipping in wolfTPM, which provides SPDM 1.3 sessions to Nuvoton and Nations TPMs and an SPDM responder in the wolfTPM firmware TPM (fTPM). The plan is to extract that SPDM code from wolfTPM into its own standalone source tree so it can be used for non-TPM devices. wolfTPM will then likely pull wolfSPDM back in as a submodule, so both products share a single SPDM implementation. The result will be a general-purpose requester for any SPDM device.
Get Started
We are currently welcoming early evaluations. If you are building SPDM into a TPM, FPGA, BMC, or embedded device, or would like to discuss the roadmap, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now