With the official release of the SPDM 1.4 specification, support for post-quantum cryptographic primitives, specifically ML-KEM for key exchange and ML-DSA for signatures, is required for modern hardware attestation pipelines.
Because PQC public keys, ciphertexts, and signatures are significantly larger than traditional ECC equivalents, a strict zero-malloc architecture cannot simply expand stack or global buffers to fit worst-case payloads without severe memory penalties. To address this, we need to implement SPDM 1.2 Message Chunking (CHUNK_SEND / CHUNK_GET) alongside the algorithm definitions.
What to Add
- Algorithm Negotiation: Add SPDM 1.4 constants for ML-KEM (FIPS 203) and ML-DSA (FIPS 204) to the algorithm selection state machine.
- Chunking Engine: Implement a deterministic chunking state machine that uses a tiny, fixed-size MTU buffer to fetch and reconstruct large asymmetric payloads over multiple round-trips.
- Crypto Glue: Interface directly with the underlying wolfSSL PQC API primitives to parse and verify these larger payloads.
With the official release of the SPDM 1.4 specification, support for post-quantum cryptographic primitives, specifically ML-KEM for key exchange and ML-DSA for signatures, is required for modern hardware attestation pipelines.
Because PQC public keys, ciphertexts, and signatures are significantly larger than traditional ECC equivalents, a strict zero-malloc architecture cannot simply expand stack or global buffers to fit worst-case payloads without severe memory penalties. To address this, we need to implement SPDM 1.2 Message Chunking (
CHUNK_SEND/CHUNK_GET) alongside the algorithm definitions.What to Add