spdm: Support sequence number in session aead
A sequence number should be used as a counter in the nonce of the
encryption/decryption, otherwise the session is vulnerable to replay
attacks. The spec says the field in the request/response messages is
optional, so I didn't add it in the first place. Later on I realized
that the field itself is optional (depends on whether the transport
layer wants to use it for determining message sequence/lost of message
etc.), but even if we don't need to put the sequence number field, the
sequence number should still be used to derive nonce.
BUG=b:284404632
TEST=spdm unittests
Change-Id: If1fee874493ba7fec7f1610e6a53b490e72a8007
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/spdm/+/4878118
Tested-by: Howard Yang <hcyang@google.com>
Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Commit-Queue: Howard Yang <hcyang@google.com>
4 files changed
