Skip to content

OCP Device Identity Provisioning over SPDM#

OCP Global Summit 2026 digest Program Core pick 12–15 October 2026

Abstract Recording

Fabrizio Damato (AMD), Xiaoyu Ruan (Intel)

Play the recording: OCP Device Identity Provisioning over SPDM

  • Why: Directly in the PM's workload-identity core interest at the hardware layer: operator/tenant-owned PKI enrollment for fleet devices, standardized over SPDM instead of per-vendor proprietary flows.
  • What: The OCP Device Identity Provisioning specification: an Attested CSR that cryptographically binds a newly generated device keypair to the device's attested identity and measured state, plus a keypair-discovery flow so enrollment authorities can enumerate the identity keys a device exposes (from abstract only).
  • How: Flows currently ride on SPDM vendor-defined messages for early deployment, while OCP drives the capability into DMTF SPDM (anticipated in SPDM 1.5); open-source RoTs such as Caliptra are expected to adopt it.
  • Where applicable: Broadly applicable — this is a standardization talk, not an operator case study; the constraint is that full benefit requires RoT/BIOS support (Caliptra adoption is the open-source path) and SPDM-capable devices.