  Efforts to secure computing systems via software traditionally focus on the
operating system and application levels. In contrast, the Security Protocol and
Data Model (SPDM) tackles firmware level security challenges, which are much
harder (if at all possible) to detect with regular protection software. SPDM
includes key features like enabling peripheral authentication, authenticated
hardware measurements retrieval, and secure session establishment. Since SPDM
is a relatively recent proposal, there is a lack of studies evaluating its
performance impact on real-world applications. In this article, we address this
gap by: (1) implementing the protocol on a simple virtual device, and then
investigating the overhead introduced by each SDPM message; and (2) creating an
SPDM-capable virtual hard drive based on VirtIO, and comparing the resulting
read/write performance with a regular, unsecured implementation. Our results
suggest that SPDM bootstrap time takes the order of tens of milliseconds, while
the toll of introducing SPDM on hard drive communication highly depends on
specific workload patterns. For example, for mixed random read/write
operations, the slowdown is negligible in comparison to the baseline unsecured
setup. Conversely, for sequential read or write operations, the data encryption
process becomes the bottleneck, reducing the performance indicators by several
orders of magnitude.
