diff --git a/ChangeLog.md b/ChangeLog.md index 4ac76cb5..990e3053 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,5 +1,11 @@ # Release Notes +## Unreleased + +* Added SPDM transport-bound TPM policies (PR #594). + - Added `TPM2_PolicyTransportSPDM` client support and fwTPM enforcement. + - Added SPDM-bound NV policy examples and tests. + ## wolfTPM Release 4.2.0 (Sep 14, 2026) **Summary** diff --git a/src/tpm2.c b/src/tpm2.c index 662390d1..15312139 100644 --- a/src/tpm2.c +++ b/src/tpm2.c @@ -7278,8 +7278,10 @@ const char* TPM2_GetRCString(int rc) TPM_RC_STR(TPM_RC_BINDING, "Public and sensitive portions of an object are not cryptographically bound"); TPM_RC_STR(TPM_RC_CURVE, "Curve not supported"); TPM_RC_STR(TPM_RC_ECC_POINT, "Point is not on the required curve"); + #if defined(WOLFTPM_V185) || defined(WOLFTPM_SPDM) TPM_RC_STR(TPM_RC_CHANNEL, "Command is not protected by a secure channel required by the policy"); TPM_RC_STR(TPM_RC_CHANNEL_KEY, "Secure channel key does not match the key required by the policy"); + #endif default: break; } diff --git a/wolftpm/tpm2.h b/wolftpm/tpm2.h index ed1bc0cf..77ae060a 100644 --- a/wolftpm/tpm2.h +++ b/wolftpm/tpm2.h @@ -424,13 +424,16 @@ typedef enum { #endif /* TCG Part 2 Sec.6.6.3 Table 17 -- present since v1.16, not v1.85 */ TPM_RC_PARMS = RC_FMT1 + 0x02A, - TPM_RC_CHANNEL = RC_FMT1 + 0x030, - TPM_RC_CHANNEL_KEY = RC_FMT1 + 0x031, #ifdef WOLFTPM_PQC /* v185 rc4 Part 2 Sec.6.6.3 Table 17 additions */ TPM_RC_EXT_MU = RC_FMT1 + 0x02B, TPM_RC_ONE_SHOT_SIGNATURE = RC_FMT1 + 0x02C, TPM_RC_SIGN_CONTEXT_KEY = RC_FMT1 + 0x02D, +#endif +#if defined(WOLFTPM_V185) || defined(WOLFTPM_SPDM) + /* Part 2 v1.85 Sec.6.6.3 Table 17 channel protocol codes */ + TPM_RC_CHANNEL = RC_FMT1 + 0x030, + TPM_RC_CHANNEL_KEY = RC_FMT1 + 0x031, #endif RC_MAX_FMT1 = RC_FMT1 + 0x03F,