↓Skip to main content
Tetrel Security

Open Compute Project

Tetrel is a proud member of the Open Compute Project, participating as a Security Review Provider (SRP) for a number of OCP security programs.

OCP Startup Member logo OCP S.A.F.E. program logo Caliptra program logo OCP L.O.C.K. logo

Our staff have a long history of participation in the OCP security working groups (including the former Cloud Security Industry Summit), providing technical input on a number of publications and programs. For a full list of technical programs we are involved in, see OCP Technical Programs.

OCP S.A.F.E.™

OCP S.A.F.E. program logo

The OCP Security Appraisal Framework and Enablement (OCP S.A.F.E.™) program is the standard for assessing the security of the firmware supply chain for modern data centres. Tetrel is an approved Security Review Provider (SRP). Our team has been involved since the program’s inception. As an approved SRP, we conduct the independent and rigorous security reviews that enable component vendors to reduce audit overhead, meet the security requirements of hyperscale cloud providers, and demonstrate trustworthy hardware and firmware.

For a quick overview of OCP S.A.F.E.™ program, check out our slide deck “Navigating the OCP S.A.F.E.™ Process for Vendors”, presented at the 2026 OCP APAC Summit.

For information in Chinese 中文, see our handy key terms table at OCP S.A.F.E. 術語對照表.

Ready to discuss your project? Contact us and we’ll walk you through the details.

↑ Back to top

Program Overview

An OCP S.A.F.E assessment can be performed against one of three scopes. A higher scope means more the device must defend against more sophisticated attacks.

  1. Scope 1 covers the external attack surface of the firmware: any interface that can be attacked from outside the SoC, including external flash memories, serial and debug interfaces, PCIe and other host interfaces.
  2. Scope 2 includes all of Scope 1, and additionally the local attack surfaces within the device: attack surfaces between internal components and subsystems within the module or device.
  3. Scope 3 focuses on the physical attack surface of the hardware itself, such as fault injection attacks and cryptographic side-channel leakage.

Every assessment produces two reports: a Long Form Report with all findings and prescriptive remediation guidance, and a Short Form Report (SFR).

The Long Form Report contains detailed write-ups, including code snippets, for all findings. It’s intended for your internal use.

The Short Form Report is a machine-readable and cryptographically signed CoRIM artefact. This version of the report contains only the title and CVSS number of findings that have not been fixed. Findings are removed from the SFR as you resolve them and we validate the fix.

For OCP S.A.F.E. endorsement, the program requires the publication of the SFR to the OCP S.A.F.E. GitHub repository. Note that the SFR is always under your full control. In other words, you decide if and when the publication occurs.

To learn more about the assessment process, check out our slide deck “Navigating the OCP S.A.F.E.™ Process for Vendors”.

To see an example Short Form Report, check out the example SFR on this page.

Typical Assessment Timelines

Overall project timelines consist of a few key stages:

  1. Contract paperwork: We aim to be nimble and never let paperwork be a bottleneck on our side. The pace often depends on your legal and procurement processes, so looping those teams in early helps. Standard paperwork include:
    • Statement of Work (SoW): This is the per-project agreement covering fees, timelines, and technical details such as the project scope.
    • Master Services Agreement (MSA): This is the framework that governs the overall relationship, with multiple individual projects (SoWs) underneath.
    • Mutual Non-Disclosure Agreement (MNDA): Optional, since confidentiality is already covered by the MSA, but a standalone MNDA can accelerate information sharing while the MSA is negotiated in parallel. Occasionally multi-party NDAs may be required.
    • Purchase Order (PO): Some client procurement processes require this to be issued before we can start work over and above a signed SoW.
  2. Kick-off: Start dates are set by working backward from your deadline. To hit that date, we work with you in advance of the review kickoff to clearly communicate what we need for a successful review and help ensure you meet your deadlines. This primarily consists of the source code and documentation of all the in-scope targets, OCP S.O.L.I.D. self-assessment, and (if applicable) Caliptra integration evidence.
  3. Assessment: Larger scope means more effort, but we do our best to minimize calendar time by working in parallel and adding additional reviewers where it makes sense. Even large assessments can be completed within five or six calendar weeks once we have the final source code.
  4. Remediation and the SFR: If there are findings you want to fix before the final SFR is issued, we can plan for gaps in the assessment schedule up front. Some teams turn fixes around in under a day; others take months depending on their release schedules. After remediation, the retesting is usually quick, but we recommend allocating time for a few rounds of retesting in case fixes are incomplete.

↑ Back to top

Example Short Form Report

Below is an excerpt of an example Short Form Report (SFR), the machine-readable artefact produced at the end of an OCP S.A.F.E. review. Below is the human-readable JSON version of the signed and encoded CoRIM object. It contains a hash of the firmware and the files reviewed, as well as basic information on the findings. The full report objects are available in the OCP S.A.F.E. reports repository.

{
    "review_framework_version": "1.1",
    "device": {
        "vendor": "AMI",
        "product": "MegaRAC Community Edition",
        "category": "BMC Firmware",
        "repo_tag": "CE-AMI202510",
        "fw_version": "2.1-dev",
        "fw_hash_sha2_384": "ad9d2c...0cd34ce",
        "manifest": [
            {
                "file_name": "openbmc/.../pid-control_%.bbappend",
                "file_hash": "de51c...a00a975"
            },
            ...
        ]
    },
    "audit": {
        "srp": "Tetrel Security Inc.",
        "methodology": "Whitebox Review",
        "completion_date": "2025-10-09",
        "report_version": "2.0",
        "scope_number": "1",
        "cvss_version": "4.0",
        "issues": [
            {
                "title": "Insecure IPMI Password Management",
                "cvss_score": "4.5",
                "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L",
                "cwe": "CWE-522: Insufficiently Protected Credentials",
                "description": "The encryption key used to protect the IPMI password file is stored alongside the encrypted password. Further key management improvements involve support for hardware cryptography, and are dependent on the choice of hardware platform, which is left as an effort to the OEM. Furthermore, CVE-2013-4786 is codified in the IPMI specification and so it is recommended to disable IPMI during deployment.",
                "cve": "CVE-2013-4786"
            },
            {
                "title": "All Processes Run as Root",
                "cvss_score": "1.8",
                "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
                "cwe": "CWE-269: Improper Privilege Management",
                "description": "Nearly all processes on the system run as the `root` user. This is in violation of the *principle of least privilege*. Some of the processes of concern have significant external attack surfaces which, if compromised, would lead to a complete compromise of the BMC. This is also tracked against the upstream project at https://github.com/openbmc/openbmc/issues/3383",
                "cve": null
            },
            ...
        ]
    }
}

↑ Back to top

OCP S.A.F.E. 術語對照表 (Chinese Reference for Key Terms)

英文 中文 備註
OCP S.A.F.E. OCP安全評鑑框架 標準化的安全審查機制，透過核准的第三方資安審查服務商，降低重複審查評估成本。過去每家雲端服務供應商都需各自簽約、各自審查同一款產品，耗時且昂貴。OCP S.A.F.E.提供統一框架，審查結果以公開、可驗證的格式發布，一份報告可供所有雲端服務供應商重複採用。
SRP (Security Review Provider) 資安審查服務商 經 OCP 核准之第三方資安專業團隊。
DV (Device Vendor) 裝置廠商 送審的硬體／韌體／軟體廠商。
CSP (Cloud Service Provider) 雲端服務供應商 採用裝置的客戶群體。
SFR (Short-Form Report) 簡式報告 經審查服務商數位簽章之審查報告。由裝置廠商主動提交，並公開於 OCP S.A.F.E.™ GitHub 供雲端服務供應商下載以驗證韌體。報告的發布與否及時程安排，均由廠商全權主導。
LFR (Long-Form Report) 詳式報告 受保密協議 (NDA) 保護之完整報告，不對外公開。內文詳載所有審查細節（含漏洞影響評估、程式碼片段、修復建議等），僅供裝置廠商內部使用，後續修復作業由廠商自行主導。亦稱 detailed report / full report。
OCP S.O.L.I.D. OCP基礎設施裝置安全規範 針對資料中心硬體設立的「事前」資安設計準則。有別於「事後」補救，它提供明確的標準，讓裝置廠商在產品開發初期就能將資安規範融入架構中。S.O.L.I.D. 提供設計藍圖，而 S.A.F.E. 提供審查機制。資安審查服務商在進行OCP S.A.F.E.審查時，會針對S.O.L.I.D.的規範要求進行逐項核查，並將評估結果包含在詳式報告中。

↑ Back to top

OCP S.O.L.I.D. Accreditation

The OCP Securing Of Latest Infrastructure Devices (S.O.L.I.D.) specification sets out a set of minimum requirements (including business process requirements) that the CSPs expect devices to meet. This applies to all data centre components that directly or indirectly support production systems. Because the OCP S.A.F.E program has no “pass/fail” criteria (other than completing the assessment itself), OCP S.O.L.I.D. was developed to extend the framework and provide such a minimum criteria. Tetrel reviews these self-declarations as part of OCP S.A.F.E. assessments, however OCP S.A.F.E. goes much further than this minimum set of requirements.

↑ Back to top

Caliptra Trademark Audit

Caliptra logo

Caliptra is an open-source project delivering a Silicon Root of Trust (RoT) specification and implementation (RTL and firmware) for data center-class devices of all kinds. Its core purpose is to provide unforgeable device identity and a verifiable cryptographic mechanism to ensure that only trusted firmware is allowed to run on a device.

Tetrel is an active SRP providing Caliptra Trademark Audit services to device vendors who want to integrate Caliptra into their products, and make use of the trademark. The Caliptra Trademark is reserved for implementations that meet the highest bar for security and functional integrity, providing a crucial trust anchor for Confidential Computing and the entire hardware supply chain.

↑ Back to top

OCP L.O.C.K. Assessments

OCP L.O.C.K. logo

The OCP Layered Open-source Cryptographic Key management (L.O.C.K.) specification extends Caliptra to provide key management functionality for storage devices suitable for hyperscaler cloud providers. This brings additional integration requirements to the base Caliptra specification. Tetrel provides thorough reviews to ensure that this integration is error-free, and that all security guarantees of the Caliptra subsystem are upheld.

↑ Back to top

OCP Technical Programs

Our staff have contributed to a number of publications and security programs for OCP. Some of these are as follows:

Still more questions? Contact us and our friendly humans will help you figure out the next step.

↑ Back to top