diff --git a/CryptoPkg/Binaries/BaseCryptoDriver_ext_dep.json b/CryptoPkg/Binaries/BaseCryptoDriver_ext_dep.json
new file mode 100644
index 0000000000..ef1b376687
--- /dev/null
+++ b/CryptoPkg/Binaries/BaseCryptoDriver_ext_dep.json
@@ -0,0 +1,9 @@
+{
+ "scope": "global",
+ "type": "nuget",
+ "name": "edk2-basecrypto-driver-bin",
+ "source": "https://pkgs.dev.azure.com/projectmu/mu/_packaging/Mu-Public/nuget/v3/index.json",
+ "version": "2023.11.3",
+ "flags": ["set_build_var"],
+ "var_name": "BLD_*_SHARED_CRYPTO_PATH"
+}
diff --git a/CryptoPkg/CryptoPkg.ci.yaml b/CryptoPkg/CryptoPkg.ci.yaml
index b601bcf85c..ee039167d9 100644
--- a/CryptoPkg/CryptoPkg.ci.yaml
+++ b/CryptoPkg/CryptoPkg.ci.yaml
@@ -10,10 +10,9 @@
"DscPath": "CryptoPkg.dsc",
},
"LicenseCheck": {
- "IgnoreFiles": [
- # These directories contain auto-generated OpenSSL content
- "Library/OpensslLib/OpensslGen"
- ]
+ # MU_CHANGE [BEGIN] Move to Shared Crypto
+ "IgnoreFiles": []
+ # MU_CHANGE [END] Move to Shared Crypto
},
"EccCheck": {
## Exception sample looks like below:
@@ -28,34 +27,10 @@
],
## Both file path and directory path are accepted.
"IgnoreFiles": [
- "Library/OpensslLib/openssl",
- "Library/OpensslLib/OpensslGen",
+ # MU_CHANGE [BEGIN] Move to Shared Crypto
# The unit testing folder is not to be checked
- "Test/UnitTest",
- # This has OpenSSL interfaces that aren't UEFI spec compliant
- "Library/BaseCryptLib/SysCall",
- # This has OpenSSL interfaces that aren't UEFI spec compliant
- "Library/OpensslLib/OpensslStub",
- # This has OpenSSL interfaces that aren't UEFI spec compliant
- "Library/Include/CrtLibSupport.h",
- # This has OpenSSL interfaces that aren't UEFI spec compliant
- "Library/BaseCryptLib/Hash/CryptParallelHash.h",
- "Library/Include/fcntl.h",
- # This has Mbedtls interfaces that aren't UEFI spec compliant
- "Library/Include/stdint.h",
- "Library/Include/stubs-32.h",
- "Library/Include/inttypes.h",
- # These directories contain auto-generated OpenSSL content
- "Library/OpensslLib",
- "Library/IntrinsicLib",
- "Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c",
- # mbedtls
- "Library/MbedTlsLib/mbedtls",
- # This has mbedtls interfaces that aren't UEFI spec compliant
- "Library/MbedTlsLib/EcSm2Null.c",
- "Library/MbedTlsLib/CrtWrapper.c",
- "Library/MbedTlsLib/Include/mbedtls/mbedtls_config.h",
- "Library/BaseCryptLibMbedTls/SysCall"
+ "Test/UnitTest"
+ # MU_CHANGE [END] Move to Shared Crypto
]
},
"CompilerPlugin": {
@@ -63,7 +38,7 @@
},
## options defined .pytool/Plugin/HostUnitTestCompilerPlugin
"HostUnitTestCompilerPlugin": {
- "DscPath": "Test/CryptoPkgHostUnitTest.dsc"
+ #"DscPath": "Test/CryptoPkgHostUnitTest.dsc" # MU_CHANGE - Disable temporarily while transitioning crypto
},
"CharEncodingCheck": {
"IgnoreFiles": []
@@ -82,7 +57,11 @@
},
"DscCompleteCheck": {
"DscPath": "CryptoPkg.dsc",
- "IgnoreInf": []
+ "IgnoreInf": [
+ ## MU_CHANGE [BEGIN] Ignore Shared Crypto FIles
+ "CryptoPkg/Binaries/**"
+ ## MU_CHANGE [END]
+ ]
},
"GuidCheck": {
"IgnoreGuidName": [],
@@ -92,6 +71,10 @@
"LibraryClassCheck": {
"IgnoreHeaderFile": []
},
+ "MarkdownLintCheck": {
+ "AuditOnly": False, # If True, log all errors and then mark as skipped
+ "IgnoreFiles": [] # package root relative file, folder, or glob pattern to ignore
+ },
## options defined ci/Plugin/SpellCheck
"SpellCheck": {
@@ -105,46 +88,9 @@
# options defined in .pytool/Plugin/UncrustifyCheck
"UncrustifyCheck": {
"IgnoreFiles": [
- "Library/OpensslLib/OpensslGen/include/crypto/bn_conf.h",
- "Library/OpensslLib/OpensslGen/include/crypto/dso_conf.h",
- "Library/OpensslLib/OpensslGen/include/openssl/asn1.h",
- "Library/OpensslLib/OpensslGen/include/openssl/asn1t.h",
- "Library/OpensslLib/OpensslGen/include/openssl/bio.h",
- "Library/OpensslLib/OpensslGen/include/openssl/cmp.h",
- "Library/OpensslLib/OpensslGen/include/openssl/cms.h",
- "Library/OpensslLib/OpensslGen/include/openssl/conf.h",
- "Library/OpensslLib/OpensslGen/include/openssl/configuration-ec.h",
- "Library/OpensslLib/OpensslGen/include/openssl/configuration-noec.h",
- "Library/OpensslLib/OpensslGen/include/openssl/configuration.h",
- "Library/OpensslLib/OpensslGen/include/openssl/crmf.h",
- "Library/OpensslLib/OpensslGen/include/openssl/crypto.h",
- "Library/OpensslLib/OpensslGen/include/openssl/ct.h",
- "Library/OpensslLib/OpensslGen/include/openssl/err.h",
- "Library/OpensslLib/OpensslGen/include/openssl/ess.h",
- "Library/OpensslLib/OpensslGen/include/openssl/fipskey.h",
- "Library/OpensslLib/OpensslGen/include/openssl/lhash.h",
- "Library/OpensslLib/OpensslGen/include/openssl/ocsp.h",
- "Library/OpensslLib/OpensslGen/include/openssl/opensslv.h",
- "Library/OpensslLib/OpensslGen/include/openssl/pkcs12.h",
- "Library/OpensslLib/OpensslGen/include/openssl/pkcs7.h",
- "Library/OpensslLib/OpensslGen/include/openssl/safestack.h",
- "Library/OpensslLib/OpensslGen/include/openssl/srp.h",
- "Library/OpensslLib/OpensslGen/include/openssl/ssl.h",
- "Library/OpensslLib/OpensslGen/include/openssl/ui.h",
- "Library/OpensslLib/OpensslGen/include/openssl/x509.h",
- "Library/OpensslLib/OpensslGen/include/openssl/x509v3.h",
- "Library/OpensslLib/OpensslGen/include/openssl/x509_vfy.h",
- "Library/OpensslLib/OpensslGen/providers/common/der/der_digests_gen.c",
- "Library/OpensslLib/OpensslGen/providers/common/der/der_ecx_gen.c",
- "Library/OpensslLib/OpensslGen/providers/common/der/der_ec_gen.c",
- "Library/OpensslLib/OpensslGen/providers/common/der/der_rsa_gen.c",
- "Library/OpensslLib/OpensslGen/providers/common/der/der_wrap_gen.c",
- "Library/OpensslLib/OpensslGen/providers/common/include/prov/der_digests.h",
- "Library/OpensslLib/OpensslGen/providers/common/include/prov/der_ec.h",
- "Library/OpensslLib/OpensslGen/providers/common/include/prov/der_ecx.h",
- "Library/OpensslLib/OpensslGen/providers/common/include/prov/der_rsa.h",
- "Library/OpensslLib/OpensslGen/providers/common/include/prov/der_wrap.h",
- "Library/OpensslLib/OpensslStub/uefiprov.c"
+ # MU_CHANGE [BEGIN] Move to Shared Crypto
+ "opensslconf.h"
+ # MU_CHANGE [END] Move to Shared Crypto
]
}
}
diff --git a/CryptoPkg/CryptoPkg.dec b/CryptoPkg/CryptoPkg.dec
index e613b6b1ae..1cb6000fe5 100644
--- a/CryptoPkg/CryptoPkg.dec
+++ b/CryptoPkg/CryptoPkg.dec
@@ -19,19 +19,6 @@
[Includes]
Include
-[Includes.Common.Private]
- Private
- Library/Include
- Library/OpensslLib/openssl/include
- Library/OpensslLib/openssl/providers/common/include
- Library/OpensslLib/openssl/providers/implementations/include
- Library/OpensslLib/OpensslGen/include
- Library/OpensslLib/OpensslGen/providers/common/include
- Library/MbedTlsLib/Include
- Library/MbedTlsLib/mbedtls/include
- Library/MbedTlsLib/mbedtls/include/mbedtls
- Library/MbedTlsLib/mbedtls/library
-
[LibraryClasses]
## @libraryclass Provides basic library functions for cryptographic primitives.
##
@@ -45,15 +32,9 @@
#
HashApiLib|Include/Library/HashApiLib.h
-[LibraryClasses.common.Private]
- ## @libraryclass Provides library functions from the openssl project.
- #
- OpensslLib|Private/Library/OpensslLib.h
- MbedTlsLib|Private/Library/MbedTlsLib.h
-
- ## @libraryclass Provides compiler intrinsic functions required to link openssl project.
+ ## @libraryclass Provides HmacSha1 functionality
#
- InstrinsicLib|Private/Library/IntrinsicLib.h
+ HmacSha1Lib|Include/Library/HmacSha1Lib.h
[Protocols]
## EDK II Crypto DXE protocol
@@ -73,6 +54,246 @@
## Crypto package token space guid.
gEfiCryptoPkgTokenSpaceGuid = { 0x6bd7de60, 0x9ef7, 0x4899, { 0x97, 0xd0, 0xab, 0xff, 0xfd, 0xe9, 0x70, 0xf2 } }
+# MU_CHANGE [BEGIN]
+# ****************************************************************************
+# AUTOGENERATED BY CryptoBinPkg\Driver\Packaging\generate_cryptodriver.py
+# AUTOGENED AS temp_crypto_pcd.inc.dec
+# DO NOT MODIFY
+# GENERATED ON: 2024-03-08 19:11:45.603035
+
+[PcdsFixedAtBuild]
+# HMACSHA256
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256New|FALSE|BOOLEAN|0x3
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Free|FALSE|BOOLEAN|0x4
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256SetKey|FALSE|BOOLEAN|0x5
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Duplicate|FALSE|BOOLEAN|0x6
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Update|FALSE|BOOLEAN|0x7
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Final|FALSE|BOOLEAN|0x8
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256All|FALSE|BOOLEAN|0x9
+# HMACSHA384
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384New|FALSE|BOOLEAN|0xa
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Free|FALSE|BOOLEAN|0xb
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384SetKey|FALSE|BOOLEAN|0xc
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Duplicate|FALSE|BOOLEAN|0xd
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Update|FALSE|BOOLEAN|0xe
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Final|FALSE|BOOLEAN|0xf
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384All|FALSE|BOOLEAN|0x10
+# PKCS
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs5HashPassword|FALSE|BOOLEAN|0x11
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Encrypt|FALSE|BOOLEAN|0x12
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Decrypt|FALSE|BOOLEAN|0x13
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetSigners|FALSE|BOOLEAN|0x14
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7FreeSigners|FALSE|BOOLEAN|0x15
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetCertificatesList|FALSE|BOOLEAN|0x16
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Sign|FALSE|BOOLEAN|0x17
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Verify|FALSE|BOOLEAN|0x18
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceVerifyEKUsInPkcs7Signature|FALSE|BOOLEAN|0x19
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetAttachedContent|FALSE|BOOLEAN|0x1a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAuthenticodeVerify|FALSE|BOOLEAN|0x1b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceImageTimestampVerify|FALSE|BOOLEAN|0x1c
+# DH
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhNew|FALSE|BOOLEAN|0x1d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhFree|FALSE|BOOLEAN|0x1e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateParameter|FALSE|BOOLEAN|0x1f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhSetParameter|FALSE|BOOLEAN|0x20
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateKey|FALSE|BOOLEAN|0x21
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhComputeKey|FALSE|BOOLEAN|0x22
+# RANDOM
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomSeed|FALSE|BOOLEAN|0x23
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomBytes|FALSE|BOOLEAN|0x24
+# RSA
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaNew|FALSE|BOOLEAN|0x25
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaFree|FALSE|BOOLEAN|0x26
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaSetKey|FALSE|BOOLEAN|0x27
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetKey|FALSE|BOOLEAN|0x28
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGenerateKey|FALSE|BOOLEAN|0x29
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaCheckKey|FALSE|BOOLEAN|0x2a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Sign|FALSE|BOOLEAN|0x2b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Verify|FALSE|BOOLEAN|0x2c
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssSign|FALSE|BOOLEAN|0x2d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssVerify|FALSE|BOOLEAN|0x2e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPrivateKeyFromPem|FALSE|BOOLEAN|0x2f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPublicKeyFromX509|FALSE|BOOLEAN|0x30
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaOaepEncrypt|FALSE|BOOLEAN|0x31
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaOaepDecrypt|FALSE|BOOLEAN|0x32
+# SHA1
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1GetContextSize|FALSE|BOOLEAN|0x33
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Init|FALSE|BOOLEAN|0x34
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Duplicate|FALSE|BOOLEAN|0x35
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Update|FALSE|BOOLEAN|0x36
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Final|FALSE|BOOLEAN|0x37
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1HashAll|FALSE|BOOLEAN|0x38
+# SHA256
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256GetContextSize|FALSE|BOOLEAN|0x39
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Init|FALSE|BOOLEAN|0x3a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Duplicate|FALSE|BOOLEAN|0x3b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Update|FALSE|BOOLEAN|0x3c
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Final|FALSE|BOOLEAN|0x3d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256HashAll|FALSE|BOOLEAN|0x3e
+# SHA384
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384GetContextSize|FALSE|BOOLEAN|0x3f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Init|FALSE|BOOLEAN|0x40
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Duplicate|FALSE|BOOLEAN|0x41
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Update|FALSE|BOOLEAN|0x42
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Final|FALSE|BOOLEAN|0x43
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384HashAll|FALSE|BOOLEAN|0x44
+# SHA512
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512GetContextSize|FALSE|BOOLEAN|0x45
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Init|FALSE|BOOLEAN|0x46
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Duplicate|FALSE|BOOLEAN|0x47
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Update|FALSE|BOOLEAN|0x48
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Final|FALSE|BOOLEAN|0x49
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512HashAll|FALSE|BOOLEAN|0x4a
+# PARALLELHASH256
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceParallelHash256HashAll|FALSE|BOOLEAN|0x4b
+# AEADAESGCM
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmEncrypt|FALSE|BOOLEAN|0x4c
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmDecrypt|FALSE|BOOLEAN|0x4d
+# X509
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSubjectName|FALSE|BOOLEAN|0x4e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCommonName|FALSE|BOOLEAN|0x4f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetOrganizationName|FALSE|BOOLEAN|0x50
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCert|FALSE|BOOLEAN|0x51
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificate|FALSE|BOOLEAN|0x52
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStackV|FALSE|BOOLEAN|0x53
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStack|FALSE|BOOLEAN|0x54
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509Free|FALSE|BOOLEAN|0x55
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509StackFree|FALSE|BOOLEAN|0x56
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetTBSCert|FALSE|BOOLEAN|0x57
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetVersion|FALSE|BOOLEAN|0x58
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSerialNumber|FALSE|BOOLEAN|0x59
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetIssuerName|FALSE|BOOLEAN|0x5a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSignatureAlgorithm|FALSE|BOOLEAN|0x5b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtensionData|FALSE|BOOLEAN|0x5c
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetValidity|FALSE|BOOLEAN|0x5d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509FormatDateTime|FALSE|BOOLEAN|0x5e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetKeyUsage|FALSE|BOOLEAN|0x5f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedKeyUsage|FALSE|BOOLEAN|0x60
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCertChain|FALSE|BOOLEAN|0x61
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCertFromCertChain|FALSE|BOOLEAN|0x62
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedBasicConstraints|FALSE|BOOLEAN|0x63
+# ASN1
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAsn1GetTag|FALSE|BOOLEAN|0x64
+# BIGNUM
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInit|FALSE|BOOLEAN|0x65
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFromBin|FALSE|BOOLEAN|0x66
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumToBin|FALSE|BOOLEAN|0x67
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFree|FALSE|BOOLEAN|0x68
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAdd|FALSE|BOOLEAN|0x69
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSub|FALSE|BOOLEAN|0x6a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMod|FALSE|BOOLEAN|0x6b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumExpMod|FALSE|BOOLEAN|0x6c
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInverseMod|FALSE|BOOLEAN|0x6d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumDiv|FALSE|BOOLEAN|0x6e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMulMod|FALSE|BOOLEAN|0x6f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCmp|FALSE|BOOLEAN|0x70
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBits|FALSE|BOOLEAN|0x71
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBytes|FALSE|BOOLEAN|0x72
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsWord|FALSE|BOOLEAN|0x73
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsOdd|FALSE|BOOLEAN|0x74
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCopy|FALSE|BOOLEAN|0x75
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumRShift|FALSE|BOOLEAN|0x76
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumConstTime|FALSE|BOOLEAN|0x77
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSqrMod|FALSE|BOOLEAN|0x78
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumNewContext|FALSE|BOOLEAN|0x79
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumContextFree|FALSE|BOOLEAN|0x7a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSetUint|FALSE|BOOLEAN|0x7b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAddMod|FALSE|BOOLEAN|0x7c
+# TDES
+# AES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesGetContextSize|FALSE|BOOLEAN|0x7d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesInit|FALSE|BOOLEAN|0x7e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcEncrypt|FALSE|BOOLEAN|0x7f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcDecrypt|FALSE|BOOLEAN|0x80
+# ARC4
+# SM3
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3GetContextSize|FALSE|BOOLEAN|0x81
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Init|FALSE|BOOLEAN|0x82
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Duplicate|FALSE|BOOLEAN|0x83
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Update|FALSE|BOOLEAN|0x84
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Final|FALSE|BOOLEAN|0x85
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3HashAll|FALSE|BOOLEAN|0x86
+# HKDF
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256ExtractAndExpand|FALSE|BOOLEAN|0x87
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Extract|FALSE|BOOLEAN|0x88
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Expand|FALSE|BOOLEAN|0x89
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384ExtractAndExpand|FALSE|BOOLEAN|0x8a
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Extract|FALSE|BOOLEAN|0x8b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Expand|FALSE|BOOLEAN|0x8c
+# TLS
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInitialize|FALSE|BOOLEAN|0x8d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxFree|FALSE|BOOLEAN|0x8e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxNew|FALSE|BOOLEAN|0x8f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsFree|FALSE|BOOLEAN|0x90
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsNew|FALSE|BOOLEAN|0x91
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInHandshake|FALSE|BOOLEAN|0x92
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsDoHandshake|FALSE|BOOLEAN|0x93
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsHandleAlert|FALSE|BOOLEAN|0x94
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCloseNotify|FALSE|BOOLEAN|0x95
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficOut|FALSE|BOOLEAN|0x96
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficIn|FALSE|BOOLEAN|0x97
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsRead|FALSE|BOOLEAN|0x98
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsWrite|FALSE|BOOLEAN|0x99
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsShutdown|FALSE|BOOLEAN|0x9a
+# TLSSET
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVersion|FALSE|BOOLEAN|0x9b
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetConnectionEnd|FALSE|BOOLEAN|0x9c
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCipherList|FALSE|BOOLEAN|0x9d
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCompressionMethod|FALSE|BOOLEAN|0x9e
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerify|FALSE|BOOLEAN|0x9f
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerifyHost|FALSE|BOOLEAN|0xa0
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSessionId|FALSE|BOOLEAN|0xa1
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCaCertificate|FALSE|BOOLEAN|0xa2
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPublicCert|FALSE|BOOLEAN|0xa3
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKeyEx|FALSE|BOOLEAN|0xa4
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKey|FALSE|BOOLEAN|0xa5
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCertRevocationList|FALSE|BOOLEAN|0xa6
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSignatureAlgoList|FALSE|BOOLEAN|0xa7
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetEcCurve|FALSE|BOOLEAN|0xa8
+# TLSGET
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVersion|FALSE|BOOLEAN|0xa9
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetConnectionEnd|FALSE|BOOLEAN|0xaa
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCipher|FALSE|BOOLEAN|0xab
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCompressionId|FALSE|BOOLEAN|0xac
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVerify|FALSE|BOOLEAN|0xad
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetSessionId|FALSE|BOOLEAN|0xae
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetClientRandom|FALSE|BOOLEAN|0xaf
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetServerRandom|FALSE|BOOLEAN|0xb0
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetKeyMaterial|FALSE|BOOLEAN|0xb1
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCaCertificate|FALSE|BOOLEAN|0xb2
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPublicCert|FALSE|BOOLEAN|0xb3
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPrivateKey|FALSE|BOOLEAN|0xb4
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCertRevocationList|FALSE|BOOLEAN|0xb5
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetExportKey|FALSE|BOOLEAN|0xb6
+# EC
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupInit|FALSE|BOOLEAN|0xb7
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetCurve|FALSE|BOOLEAN|0xb8
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetOrder|FALSE|BOOLEAN|0xb9
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupFree|FALSE|BOOLEAN|0xba
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInit|FALSE|BOOLEAN|0xbb
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointDeInit|FALSE|BOOLEAN|0xbc
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointGetAffineCoordinates|FALSE|BOOLEAN|0xbd
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetAffineCoordinates|FALSE|BOOLEAN|0xbe
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointAdd|FALSE|BOOLEAN|0xbf
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointMul|FALSE|BOOLEAN|0xc0
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInvert|FALSE|BOOLEAN|0xc1
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsOnCurve|FALSE|BOOLEAN|0xc2
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsAtInfinity|FALSE|BOOLEAN|0xc3
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointEqual|FALSE|BOOLEAN|0xc4
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetCompressedCoordinates|FALSE|BOOLEAN|0xc5
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcNewByNid|FALSE|BOOLEAN|0xc6
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcFree|FALSE|BOOLEAN|0xc7
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGenerateKey|FALSE|BOOLEAN|0xc8
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPubKey|FALSE|BOOLEAN|0xc9
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDhComputeKey|FALSE|BOOLEAN|0xca
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPrivateKeyFromPem|FALSE|BOOLEAN|0xcb
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPublicKeyFromX509|FALSE|BOOLEAN|0xcc
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaSign|FALSE|BOOLEAN|0xcd
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaVerify|FALSE|BOOLEAN|0xce
+# AUTOGEN ENDS
+# ****************************************************************************
+# MU_CHANGE [END]
+
[PcdsFixedAtBuild]
## Enable/Disable the families and individual services produced by the
# EDK II Crypto Protocols/PPIs. The default is all services disabled.
diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index d2a7213489..85a5ae1b29 100644
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -2,9 +2,9 @@
# Cryptographic Library Package for UEFI Security Implementation.
# PEIM, DXE Driver, and SMM Driver with all crypto services enabled.
#
-# Copyright (c) 2009 - 2022, Intel Corporation. All rights reserved.
+# Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.
# Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
-# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
+# Copyright (c) Microsoft Corporation.
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -19,73 +19,12 @@
PLATFORM_GUID = E1063286-6C8C-4c25-AEF0-67A9A5B6E6B6
PLATFORM_VERSION = 0.98
DSC_SPECIFICATION = 0x00010005
- SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64|RISCV64|LOONGARCH64
+ OUTPUT_DIRECTORY = Build/CryptoPkg
+ SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64|RISCV64
BUILD_TARGETS = DEBUG|RELEASE|NOOPT
SKUID_IDENTIFIER = DEFAULT
- #
- # Flavor of PEI, DXE, SMM modules to build.
- # Must be one of ALL, NONE, MIN_PEI, MIN_DXE_MIN_SMM, TARGET_UINT_TESTS.
- # Default is ALL that is used for package build verification.
- # ALL - Build PEIM, DXE, and SMM drivers. Protocols and PPIs
- # publish all services.
- # NONE - Build PEIM, DXE, and SMM drivers. Protocols and PPIs
- # publish no services. Used to verify compiler/linker
- # optimizations are working correctly.
- # MIN_PEI - Build PEIM with PPI that publishes minimum required
- # services.
- # MIN_DXE_MIN_SMM - Build DXE and SMM drivers with Protocols that publish
- # minimum required services.
- # TARGET_UNIT_TESTS - Build target-based unit tests
- #
- DEFINE CRYPTO_SERVICES = ALL
-!if $(CRYPTO_SERVICES) IN "ALL NONE MIN_PEI MIN_DXE_MIN_SMM TARGET_UNIT_TESTS"
-!else
- !error CRYPTO_SERVICES must be set to one of ALL NONE MIN_PEI MIN_DXE_MIN_SMM TARGET_UNIT_TESTS.
-!endif
-
-#
-# Define different OUTPUT_DIRECTORY for each CRYPTO_SERVICES profile
-#
-!if $(CRYPTO_SERVICES) == ALL
- OUTPUT_DIRECTORY = Build/CryptoPkg/All
-!endif
-!if $(CRYPTO_SERVICES) == NONE
- OUTPUT_DIRECTORY = Build/CryptoPkg/None
-!endif
-!if $(CRYPTO_SERVICES) == MIN_PEI
- OUTPUT_DIRECTORY = Build/CryptoPkg/MinPei
-!endif
-!if $(CRYPTO_SERVICES) == MIN_DXE_MIN_SMM
- OUTPUT_DIRECTORY = Build/CryptoPkg/MinDxeMinSmm
-!endif
-!if $(CRYPTO_SERVICES) == TARGET_UNIT_TESTS
- OUTPUT_DIRECTORY = Build/CryptoPkg/TagetUnitTests
-!endif
-
-#
-# Define FILE_GUID names/values for CryptoPei, CryptopDxe, and CryptoSmm
-# drivers that are linked with different OpensslLib instances
-#
- DEFINE PEI_CRYPTO_GUID = C693A250-6B36-49B9-B7F3-7283F8136A72
- DEFINE PEI_STD_GUID = EBD49F5C-6D8B-40D1-A56D-9AFA485A8661
- DEFINE PEI_FULL_GUID = D51FCE59-6860-49C0-9B35-984470735D17
- DEFINE PEI_STD_ACCEL_GUID = DCC9CB49-7BE2-47C6-864E-6DCC932360F9
- DEFINE PEI_FULL_ACCEL_GUID = A10827AD-7598-4955-B661-52EE2B62B057
- DEFINE DXE_CRYPTO_GUID = 31C17C54-325D-47D5-8622-888098F10E44
- DEFINE DXE_STD_GUID = ADD6D05A-52A2-437B-98E7-DBFDA89352CD
- DEFINE DXE_FULL_GUID = AA83B296-F6EA-447F-B013-E80E98629CF8
- DEFINE DXE_STD_ACCEL_GUID = 9FBDAD27-910C-4229-9EFF-A93BB5FE18C6
- DEFINE DXE_FULL_ACCEL_GUID = 41A491D1-A972-468B-A299-DABF415A43B7
- DEFINE SMM_CRYPTO_GUID = 1A1C9E13-5722-4636-AB73-31328EDE8BAF
- DEFINE SMM_STD_GUID = E4D7D1E3-E886-4412-A442-EFD6F2502DD3
- DEFINE SMM_FULL_GUID = 1930CE7E-6598-48ED-8AB1-EBE7E85EC254
- DEFINE SMM_STD_ACCEL_GUID = 828959D3-CEA6-4B79-B1FC-5AFA0D7F2144
- DEFINE SMM_FULL_ACCEL_GUID = C1760694-AB3A-4532-8C6D-52D8F86EB1AA
-
-!if $(CRYPTO_SERVICES) == TARGET_UNIT_TESTS
!include UnitTestFrameworkPkg/UnitTestFrameworkPkgTarget.dsc.inc
-!endif
################################################################################
#
@@ -98,32 +37,25 @@
[LibraryClasses]
BaseLib|MdePkg/Library/BaseLib/BaseLib.inf
BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
- DevicePathLib|MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
- SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
- SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
- TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
- RngLib|MdePkg/Library/BaseRngLibNull/BaseRngLibNull.inf
- PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf
- DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf
- DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf
- OemHookStatusCodeLib|MdeModulePkg/Library/OemHookStatusCodeLibNull/OemHookStatusCodeLibNull.inf
+ PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
+ DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
+ UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf
+ UefiDriverEntryPoint|MdePkg/Library/UefiDriverEntryPoint/UefiDriverEntryPoint.inf
+ BaseCryptLib|CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
+ HmacSha1Lib|CryptoPkg/Library/HmacSha1Lib/HmacSha1LibNull.inf # MU_CHANGE add HmacSha1Lib
+ TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
HashApiLib|CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.inf
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+ RngLib|MdePkg/Library/BaseRngLibNull/BaseRngLibNull.inf
NULL|MdePkg/Library/StackCheckLibNull/StackCheckLibNull.inf # MU_CHANGE: /GS and -fstack-protector support
-[LibraryClasses.IA32, LibraryClasses.X64, LibraryClasses.AARCH64]
- RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
-
-[LibraryClasses.AARCH64.DXE_DRIVER, LibraryClasses.ARM.DXE_DRIVER, LibraryClasses.AARCH64.UEFI_APPLICATION, LibraryClasses.ARM.UEFI_APPLICATION]
- RngLib|SecurityPkg/RandomNumberGenerator/RngDxeLib/RngDxeLib.inf
-
+[LibraryClasses.common.UEFI_APPLICATION]
+ RngLib|MdePkg/Library/DxeRngLib/DxeRngLib.inf
+
[LibraryClasses.ARM, LibraryClasses.AARCH64]
- # MU_CHANGE [BEGIN]: Remove ArmLib (will be updated in future shared crypto changes)
- # ArmLib|ArmPkg/Library/ArmLib/ArmBaseLib.inf
- # MU_CHANGE [END]: Remove ArmLib (will be updated in future shared crypto changes)
+ #ArmLib|ArmPkg/Library/ArmLib/ArmBaseLib.inf ## MU_CHANGE
+ #
# It is not possible to prevent the ARM compiler for generic intrinsic functions.
# This library provides the instrinsic functions generate by a given compiler.
# [LibraryClasses.ARM, LibraryClasses.AARCH64] and NULL mean link this library
@@ -135,58 +67,6 @@
# Add support for stack protector
# NULL|MdePkg/Library/BaseStackCheckLib/BaseStackCheckLib.inf # MU_CHANGE: Use Project Mu StackCheckLib
-# MU_CHANGE [BEGIN]: Remove ArmSoftFloatLib from LibraryClasses.ARM due to ArmPkg removal
-# [LibraryClasses.ARM]
-# ArmSoftFloatLib|ArmPkg/Library/ArmSoftFloatLib/ArmSoftFloatLib.inf
-# MU_CHANGE [END]: Remove ArmSoftFloatLib from LibraryClasses.ARM due to ArmPkg removal
-
-[LibraryClasses.common.SEC]
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
-
-[LibraryClasses.common.PEIM]
- PeimEntryPoint|MdePkg/Library/PeimEntryPoint/PeimEntryPoint.inf
- PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointerLib.inf
- PeiServicesLib|MdePkg/Library/PeiServicesLib/PeiServicesLib.inf
- MemoryAllocationLib|MdePkg/Library/PeiMemoryAllocationLib/PeiMemoryAllocationLib.inf
- HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf
- PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf
- ReportStatusCodeLib|MdeModulePkg/Library/PeiReportStatusCodeLib/PeiReportStatusCodeLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
-
-[LibraryClasses.IA32.PEIM, LibraryClasses.X64.PEIM]
- PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLibIdt/PeiServicesTablePointerLibIdt.inf
-
-[LibraryClasses.common.DXE_DRIVER]
- UefiDriverEntryPoint|MdePkg/Library/UefiDriverEntryPoint/UefiDriverEntryPoint.inf
- UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf
- UefiRuntimeServicesTableLib|MdePkg/Library/UefiRuntimeServicesTableLib/UefiRuntimeServicesTableLib.inf
- MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
- ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
- PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
-
-[LibraryClasses.common.DXE_SMM_DRIVER]
- UefiDriverEntryPoint|MdePkg/Library/UefiDriverEntryPoint/UefiDriverEntryPoint.inf
- UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf
- SmmServicesTableLib|MdePkg/Library/SmmServicesTableLib/SmmServicesTableLib.inf
- MmServicesTableLib|MdePkg/Library/MmServicesTableLib/MmServicesTableLib.inf
- MemoryAllocationLib|MdePkg/Library/SmmMemoryAllocationLib/SmmMemoryAllocationLib.inf
- ReportStatusCodeLib|MdeModulePkg/Library/SmmReportStatusCodeLib/SmmReportStatusCodeLib.inf
- PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
-
-[LibraryClasses.common.UEFI_APPLICATION]
- UefiApplicationEntryPoint|MdePkg/Library/UefiApplicationEntryPoint/UefiApplicationEntryPoint.inf
- UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf
- UefiRuntimeServicesTableLib|MdePkg/Library/UefiRuntimeServicesTableLib/UefiRuntimeServicesTableLib.inf
- MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
- ReportStatusCodeLib|MdePkg/Library/BaseReportStatusCodeLibNull/BaseReportStatusCodeLibNull.inf
- PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
-
################################################################################
#
# Pcd Section - list of all EDK II PCD Entries defined by this Platform
@@ -197,104 +77,7 @@
gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x80000000
gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x06
-#
-# For ALL and TARGET_UINT_TESTS profiles, enable all non-deprecated families
-# and services in PcdCryptoServiceFamilyEnable.
-#
-!if $(CRYPTO_SERVICES) IN "ALL TARGET_UINT_TESTS"
-[PcdsFixedAtBuild]
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha384.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Dh.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Random.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Arc4.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tls.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsSet.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsGet.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.RsaPss.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.ParallelHash.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Bn.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Ec.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-!endif
-
-#
-# Enable minimum set of families/services in PcdCryptoServiceFamilyEnable
-# required by typical PEI phase.
-#
-!if $(CRYPTO_SERVICES) == MIN_PEI
-[PcdsFixedAtBuild]
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha384.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Pkcs1Verify | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.New | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Free | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.SetKey | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs5HashPassword | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-!endif
-
-#
-# Enable minimum set of families/services in PcdCryptoServiceFamilyEnable
-# required by typical DXE and SMM phases.
-#
-!if $(CRYPTO_SERVICES) == MIN_DXE_MIN_SMM
-[PcdsFixedAtBuild]
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha384.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs1v2Encrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs5HashPassword | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs7Verify | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.VerifyEKUsInPkcs7Signature | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs7GetSigners | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs7FreeSigners | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.AuthenticodeVerify | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Random.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Pkcs1Verify | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.New | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Free | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.SetKey | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.GetPublicKeyFromX509 | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.HashAll | FALSE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Services.GetSubjectName | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Services.GetCommonName | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Services.GetOrganizationName | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Services.GetTBSCert | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tls.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsSet.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsGet.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Services.Encrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Services.Decrypt | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-!endif
+## MU_CHANGE Remove PCD definitions
###################################################################################################
#
@@ -314,305 +97,42 @@
# generated for it, but the binary will not be put into any firmware volume.
#
###################################################################################################
-
-#
-# If profile is TARGET_UNIT_TESTS, then build target-based unit tests
-# using the OpensslLib, BaseCryptLib, and TlsLib with the largest set of
-# available services.
-#
-!if $(CRYPTO_SERVICES) == TARGET_UNIT_TESTS
-[Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
- #
- # Target based unit tests
- #
- CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibShell.inf {
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFull.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
-
- MSFT:*_*_*_DLINK_FLAGS = /ALIGN:4096 /FILEALIGN:4096 /SUBSYSTEM:CONSOLE
- MSFT:DEBUG_*_*_DLINK_FLAGS = /EXPORT:InitializeDriver=$(IMAGE_ENTRY_POINT) /BASE:0x10000
- MSFT:DEBUG_*_*_DLINK_FLAGS = /EXPORT:InitializeDriver=$(IMAGE_ENTRY_POINT) /BASE:0x10000
- MSFT:NOOPT_*_*_DLINK_FLAGS = /EXPORT:InitializeDriver=$(IMAGE_ENTRY_POINT) /BASE:0x10000
- }
-
-[Components.IA32, Components.X64]
- CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibShell.inf {
-
- FILE_GUID = B91B9A95-4D52-4501-A98F-A1711C14ED93
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFullAccel.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
-
- MSFT:*_*_*_DLINK_FLAGS = /ALIGN:4096 /FILEALIGN:4096 /SUBSYSTEM:CONSOLE
- MSFT:DEBUG_*_*_DLINK_FLAGS = /EXPORT:InitializeDriver=$(IMAGE_ENTRY_POINT) /BASE:0x10000
- MSFT:DEBUG_*_*_DLINK_FLAGS = /EXPORT:InitializeDriver=$(IMAGE_ENTRY_POINT) /BASE:0x10000
- MSFT:NOOPT_*_*_DLINK_FLAGS = /EXPORT:InitializeDriver=$(IMAGE_ENTRY_POINT) /BASE:0x10000
- }
-
-[Components.RISCV64]
- CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibShell.inf {
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
- }
-!endif
-
#
# If profile is ALL, then do verification build of all library instances.
#
-!if $(CRYPTO_SERVICES) == ALL
[Components]
#
# Build verification of all library instances
#
- CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
- CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf
- CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
- CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
- CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
- CryptoPkg/Library/BaseCryptLibMbedTls/BaseCryptLib.inf
- CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.inf
- CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.inf
- CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.inf
- CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.inf
- CryptoPkg/Library/BaseCryptLibMbedTls/TestBaseCryptLib.inf
- CryptoPkg/Library/MbedTlsLib/MbedTlsLib.inf
- CryptoPkg/Library/MbedTlsLib/MbedTlsLibFull.inf
+
+ CryptoPkg/Library/HmacSha1Lib/HmacSha1LibNull.inf
CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
- CryptoPkg/Library/TlsLib/TlsLib.inf
CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
- CryptoPkg/Library/OpensslLib/OpensslLib.inf
- CryptoPkg/Library/OpensslLib/OpensslLibFull.inf
CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.inf
+
CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.inf
CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.inf
- CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.inf
- #
- # Build verification of target-based unit tests
- #
- CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibShell.inf {
-
- UnitTestLib|UnitTestFrameworkPkg/Library/UnitTestLib/UnitTestLib.inf
- UnitTestPersistenceLib|UnitTestFrameworkPkg/Library/UnitTestPersistenceLibNull/UnitTestPersistenceLibNull.inf
- UnitTestResultReportLib|UnitTestFrameworkPkg/Library/UnitTestResultReportLib/UnitTestResultReportLibConOut.inf
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
- }
+ CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.inf
+ CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.inf # MU_CHANGE: Add StandaloneMmCryptLib
-[Components.IA32, Components.X64]
- #
- # Build verification of IA32/X64 specific libraries
- #
- CryptoPkg/Library/OpensslLib/OpensslLibAccel.inf
- CryptoPkg/Library/OpensslLib/OpensslLibFullAccel.inf
-!endif
-
-#
-# If profile is ALL or NONE or MIN_PEI, then build CryptoPei with all supported
-# OpensslLib instances.
-#
-!if $(CRYPTO_SERVICES) in "ALL NONE MIN_PEI"
-[Components]
- #
- # CryptoPei with OpensslLib instance without SSL or EC services
- #
- CryptoPkg/Driver/CryptoPei.inf {
-
- FILE_GUID = $(PEI_CRYPTO_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
- }
- #
- # CryptoPei with OpensslLib instance without EC services
- #
- CryptoPkg/Driver/CryptoPei.inf {
-
- FILE_GUID = $(PEI_STD_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- }
-[Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
- #
- # CryptoPei with OpensslLib instance with all services
- #
- CryptoPkg/Driver/CryptoPei.inf {
-
- FILE_GUID = $(PEI_FULL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFull.inf
- }
-
-[Components.IA32, Components.X64]
- #
- # CryptoPei with IA32/X64 performance optimized OpensslLib instance without EC services
- # IA32/X64 assembly optimizations required larger alignments
- #
- CryptoPkg/Driver/CryptoPei.inf {
-
- FILE_GUID = $(PEI_STD_ACCEL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibAccel.inf
-
- MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:64
- MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:256
- }
-
- #
- # CryptoPei with IA32/X64 performance optimized OpensslLib instance all services
- # IA32/X64 assembly optimizations required larger alignments
- #
- CryptoPkg/Driver/CryptoPei.inf {
-
- FILE_GUID = $(PEI_FULL_ACCEL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFullAccel.inf
-
- MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:4096
- MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:4096
- }
-!endif
-
-#
-# If profile is ALL or NONE or MIN_DXE_MIN_SMM, then build CryptoDxe and
-# CryptoSmm using all supported OpensslLib instances.
-#
-!if $(CRYPTO_SERVICES) in "ALL NONE MIN_DXE_MIN_SMM"
-[Components]
- #
- # CryptoDxe with OpensslLib instance with no SSL or EC services
- #
- CryptoPkg/Driver/CryptoDxe.inf {
-
- FILE_GUID = $(DXE_CRYPTO_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
- }
- #
- # CryptoDxe with OpensslLib instance with no EC services
- #
- CryptoPkg/Driver/CryptoDxe.inf {
-
- FILE_GUID = $(DXE_STD_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- }
-[Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
- #
- # CryptoDxe with OpensslLib instance with all services
- #
- CryptoPkg/Driver/CryptoDxe.inf {
-
- FILE_GUID = $(DXE_FULL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFull.inf
- }
-
-[Components.IA32, Components.X64]
- #
- # CryptoDxe with IA32/X64 performance optimized OpensslLib instance with no EC services
- # with TLS feature enabled.
- # IA32/X64 assembly optimizations required larger alignments
- #
- CryptoPkg/Driver/CryptoDxe.inf {
-
- FILE_GUID = $(DXE_STD_ACCEL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibAccel.inf
-
- MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:64
- MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:256
- }
- #
- # CryptoDxe with IA32/X64 performance optimized OpensslLib instance with all services.
- # IA32/X64 assembly optimizations required larger alignments
- #
- CryptoPkg/Driver/CryptoDxe.inf {
-
- FILE_GUID = $(DXE_FULL_ACCEL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFullAccel.inf
-
- MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:4096
- MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:4096
- }
- #
- # CryptoSmm with OpensslLib instance with no SSL or EC services
- #
- CryptoPkg/Driver/CryptoSmm.inf {
-
- FILE_GUID = $(SMM_CRYPTO_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
- }
- #
- # CryptoSmm with OpensslLib instance with no SSL services
- #
- CryptoPkg/Driver/CryptoSmm.inf {
-
- FILE_GUID = $(SMM_STD_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- }
- #
- # CryptoSmm with OpensslLib instance with no all services
- #
- CryptoPkg/Driver/CryptoSmm.inf {
-
- FILE_GUID = $(SMM_FULL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFull.inf
- }
- #
- # CryptoSmm with IA32/X64 performance optimized OpensslLib instance with no EC services
- # IA32/X64 assembly optimizations required larger alignments
- #
- CryptoPkg/Driver/CryptoSmm.inf {
-
- FILE_GUID = $(SMM_STD_ACCEL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibAccel.inf
-
- MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:64
- MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:256
- }
- #
- # CryptoSmm with IA32/X64 performance optimized OpensslLib instance with all services
- # IA32/X64 assembly optimizations required larger alignments
- #
- CryptoPkg/Driver/CryptoSmm.inf {
-
- FILE_GUID = $(SMM_FULL_ACCEL_GUID)
-
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibFullAccel.inf
-
- MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:4096
- MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:4096
- }
-!endif
+# MU_CHANGE START
+[Components.X64, Components.IA32]
+ CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.inf
## MU_CHANGE TCBZ_3799 - can't compile for ARM as it depends on ArmSoftFloatLib
[Components.IA32, Components.X64, Components.AARCH64]
- CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibShell.inf { ## Add unit-test application for the crypto tests.
+ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/BaseCryptLibUnitTestApp.inf { ## Add unit-test application for the crypto tests.
## MU_CHANGE [START] add library classes to allow crypto tests to run in uefi shell correctly
DebugLib|MdePkg/Library/UefiDebugLibDebugPortProtocol/UefiDebugLibDebugPortProtocol.inf # MU_CHANGE add debug lib
DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf # MU_CHANGE add debug lib
UefiRuntimeServicesTableLib|MdePkg/Library/UefiRuntimeServicesTableLib/UefiRuntimeServicesTableLib.inf
- OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
- IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0xFFFFFFFF
+ !include CryptoPkg/Test/Crypto.pcd.ALL.inc.dsc
## MU_CHANGE [END]
}
## MU_CHANGE [END]
@@ -621,3 +141,13 @@
[BuildOptions]
RELEASE_*_*_CC_FLAGS = -DMDEPKG_NDEBUG
*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES
+!if $(CRYPTO_SERVICES) IN "ALL"
+ MSFT:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES
+ INTEL:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES
+ GCC:*_*_*_CC_FLAGS = -D ENABLE_MD5_DEPRECATED_INTERFACES
+!endif
+#MU_CHANGE START
+[BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER, BuildOptions.common.EDKII.DXE_SMM_DRIVER, BuildOptions.common.EDKII.SMM_CORE, BuildOptions.common.EDKII.DXE_DRIVER]
+ MSFT:*_*_IA32_DLINK_FLAGS = /ALIGN:4096 # enable 4k alignment for MAT and other protections.
+ MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:4096 # enable 4k alignment for MAT and other protections.
+#MU_CHANGE END
diff --git a/CryptoPkg/CryptoPkg.uni b/CryptoPkg/CryptoPkg.uni
index 28459fcafe..417ddac1d8 100644
--- a/CryptoPkg/CryptoPkg.uni
+++ b/CryptoPkg/CryptoPkg.uni
@@ -27,6 +27,4 @@
"0x00000008 - HASH_ALG_SHA512.
\n"
"0x00000010 - HASH_ALG_SM3.
"
-#string STR_gEfiCryptoPkgTokenSpaceGuid_PcdCryptoServiceFamilyEnable_PROMPT #language en-US "Enable/Disable EDK II Crypto Protocol/PPI services"
-
-#string STR_gEfiCryptoPkgTokenSpaceGuid_PcdCryptoServiceFamilyEnable_HELP #language en-US "Enable/Disable the families and individual services produced by the EDK II Crypto Protocols/PPIs. The default is all services disabled. This Structured PCD is associated with PCD_CRYPTO_SERVICE_FAMILY_ENABLE structure that is defined in Include/Pcd/PcdCryptoServiceFamilyEnable.h."
+// MU_CHANGE remove Structured PCD help strings
\ No newline at end of file
diff --git a/CryptoPkg/CryptoPkgMbedTls.dsc b/CryptoPkg/CryptoPkgMbedTls.dsc
deleted file mode 100644
index 8c2f8dea07..0000000000
--- a/CryptoPkg/CryptoPkgMbedTls.dsc
+++ /dev/null
@@ -1,284 +0,0 @@
-## @file
-# Cryptographic Library Package for UEFI Security Implementation.
-# PEIM, DXE Driver, and SMM Driver with all crypto services enabled.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-################################################################################
-#
-# Defines Section - statements that will be processed to create a Makefile.
-#
-################################################################################
-[Defines]
- PLATFORM_NAME = CryptoPkg
- PLATFORM_GUID = E1063286-6C8C-4c25-AEF0-67A9A5B6E6B6
- PLATFORM_VERSION = 0.98
- DSC_SPECIFICATION = 0x00010005
- OUTPUT_DIRECTORY = Build/CryptoPkgMbed
- SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64|RISCV64
- BUILD_TARGETS = DEBUG|RELEASE|NOOPT
- SKUID_IDENTIFIER = DEFAULT
-
-!ifndef CRYPTO_IMG_TYPE
- DEFINE CRYPTO_IMG_TYPE = DXE_SMM
-!endif
-
-!if $(CRYPTO_IMG_TYPE) IN "PEI_DEFAULT PEI_PREMEM DXE_SMM"
-!else
- !error CRYPTO_IMG_TYPE must be set to one of PEI_DEFAULT PEI_PREMEM DXE_SMM.
-!endif
-
-################################################################################
-#
-# Library Class section - list of all Library Classes needed by this Platform.
-#
-################################################################################
-
-!include MdePkg/MdeLibs.dsc.inc
-[LibraryClasses]
- BaseLib|MdePkg/Library/BaseLib/BaseLib.inf
- BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
- PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
- DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
- UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf
- UefiDriverEntryPoint|MdePkg/Library/UefiDriverEntryPoint/UefiDriverEntryPoint.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
- HashApiLib|CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.inf
- RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
- SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
-
-[LibraryClasses.ARM, LibraryClasses.AARCH64]
- # MU_CHANGE [BEGIN]: Remove ArmPkg lib (will be updated in potential future changes for mbedtls support)
- #
- # It is not possible to prevent the ARM compiler for generic intrinsic functions.
- # This library provides the instrinsic functions generate by a given compiler.
- # [LibraryClasses.ARM, LibraryClasses.AARCH64] and NULL mean link this library
- # into all ARM and AARCH64 images.
- #
- # NULL|ArmPkg/Library/CompilerIntrinsicsLib/CompilerIntrinsicsLib.inf
- # MU_CHANGE [END]: Remove ArmPkg lib (will be updated in potential future changes for mbedtls support)
-
- # Add support for stack protector
- NULL|MdePkg/Library/BaseStackCheckLib/BaseStackCheckLib.inf
-
-[LibraryClasses.common.PEIM]
- PeimEntryPoint|MdePkg/Library/PeimEntryPoint/PeimEntryPoint.inf
- MemoryAllocationLib|MdePkg/Library/PeiMemoryAllocationLib/PeiMemoryAllocationLib.inf
- PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointerLib.inf
- PeiServicesLib|MdePkg/Library/PeiServicesLib/PeiServicesLib.inf
- HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf
-
-[LibraryClasses.common.DXE_SMM_DRIVER]
- SmmServicesTableLib|MdePkg/Library/SmmServicesTableLib/SmmServicesTableLib.inf
- MemoryAllocationLib|MdePkg/Library/SmmMemoryAllocationLib/SmmMemoryAllocationLib.inf
- MmServicesTableLib|MdePkg/Library/MmServicesTableLib/MmServicesTableLib.inf
- SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
-
-[LibraryClasses]
- MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
- DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf
- DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf
- OemHookStatusCodeLib|MdeModulePkg/Library/OemHookStatusCodeLibNull/OemHookStatusCodeLibNull.inf
- PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf
- DevicePathLib|MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
- PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
- TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
- UefiRuntimeServicesTableLib|MdePkg/Library/UefiRuntimeServicesTableLib/UefiRuntimeServicesTableLib.inf
- IoLib|MdePkg/Library/BaseIoLibIntrinsic/BaseIoLibIntrinsic.inf
- MbedTlsLib|CryptoPkg/Library/MbedTlsLib/MbedTlsLib.inf
- IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
- SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
-
-# MU_CHANGE [BEGIN]: Remove ArmSoftFloatLib from LibraryClasses.ARM due to ArmPkg removal
-# [LibraryClasses.ARM]
-# ArmSoftFloatLib|ArmPkg/Library/ArmSoftFloatLib/ArmSoftFloatLib.inf
-# MU_CHANGE [END]: Remove ArmSoftFloatLib from LibraryClasses.ARM due to ArmPkg removal
-
-[LibraryClasses.common.PEIM]
- PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf
- ReportStatusCodeLib|MdeModulePkg/Library/PeiReportStatusCodeLib/PeiReportStatusCodeLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
-
-[LibraryClasses.IA32.PEIM, LibraryClasses.X64.PEIM]
- PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLibIdt/PeiServicesTablePointerLibIdt.inf
-
-[LibraryClasses.ARM.PEIM, LibraryClasses.AARCH64.PEIM]
- PeiServicesTablePointerLib|ArmPkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointerLib.inf
-
-[LibraryClasses.common.DXE_DRIVER]
- ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLibMbedTls/BaseCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
-
-[LibraryClasses.common.DXE_SMM_DRIVER]
- ReportStatusCodeLib|MdeModulePkg/Library/SmmReportStatusCodeLib/SmmReportStatusCodeLib.inf
- BaseCryptLib|CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.inf
- TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
-
-################################################################################
-#
-# Pcd Section - list of all EDK II PCD Entries defined by this Platform
-#
-################################################################################
-[PcdsFixedAtBuild]
- gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x0f
- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x80000000
- gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x06
-
-!if $(CRYPTO_IMG_TYPE) IN "DXE_SMM"
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacMd5.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md4.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md5.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Dh.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Random.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tdes.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Arc4.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tls.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsSet.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsGet.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.ParallelHash.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-!endif
-
-!if $(CRYPTO_IMG_TYPE) IN "PEI_DEFAULT"
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Pkcs1Verify | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.New | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.SetKey | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Free | TRUE
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Services.Final | TRUE
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.Final | TRUE
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.Final | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.HashAll | TRUE
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Services.Final | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Services.HashAll | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Services.Duplicate | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Services.New | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Services.Free | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Services.SetKey | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Services.Duplicate | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Services.Final | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Services.Sha256ExtractAndExpand | TRUE
-!endif
-
-!if $(CRYPTO_IMG_TYPE) IN "PEI_PREMEM"
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Services.Final | TRUE
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.Final | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Services.HashAll | TRUE
-
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Services.GetContextSize | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Services.Init | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Services.Update | TRUE
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Services.Final | TRUE
-!endif
-
-###################################################################################################
-#
-# Components Section - list of the modules and components that will be processed by compilation
-# tools and the EDK II tools to generate PE32/PE32+/Coff image files.
-#
-# Note: The EDK II DSC file is not used to specify how compiled binary images get placed
-# into firmware volume images. This section is just a list of modules to compile from
-# source into UEFI-compliant binaries.
-# It is the FDF file that contains information on combining binary files into firmware
-# volume images, whose concept is beyond UEFI and is described in PI specification.
-# Binary modules do not need to be listed in this section, as they should be
-# specified in the FDF file. For example: Shell binary (Shell_Full.efi), FAT binary (Fat.efi),
-# Logo (Logo.bmp), and etc.
-# There may also be modules listed in this section that are not required in the FDF file,
-# When a module listed here is excluded from FDF file, then UEFI-compliant binary will be
-# generated for it, but the binary will not be put into any firmware volume.
-#
-###################################################################################################
-
-!if $(CRYPTO_IMG_TYPE) IN "PEI_DEFAULT PEI_PREMEM"
-[Components.IA32, Components.X64, Components.ARM, Components.AARCH64]
- CryptoPkg/Driver/CryptoPei.inf {
-
- !if "$(CRYPTO_SERVICES)" == "ALL"
- FILE_GUID = 8DF53C2E-3380-495F-A8B7-370CFE28E1C6
- !elseif "$(CRYPTO_SERVICES)" == "NONE"
- FILE_GUID = E5A97EE3-71CC-407F-9DA9-6BE0C8A6C7DF
- !elseif "$(CRYPTO_SERVICES)" == "MIN_PEI"
- FILE_GUID = 0F5827A9-35FD-4F41-8D38-9BAFCE594D31
- !endif
- }
-!endif
-
-!if $(CRYPTO_IMG_TYPE) IN "DXE_SMM"
-[Components.IA32, Components.X64, Components.AARCH64]
- CryptoPkg/Driver/CryptoDxe.inf {
-
- !if "$(CRYPTO_SERVICES)" == "ALL"
- FILE_GUID = D9444B06-060D-42C5-9344-F04707BE0169
- !elseif "$(CRYPTO_SERVICES)" == "NONE"
- FILE_GUID = C7A340F4-A6CC-4F95-A2DA-42BEA4C3944A
- !elseif "$(CRYPTO_SERVICES)" == MIN_DXE_MIN_SMM
- FILE_GUID = DDF5BE9E-159A-4B77-B6D7-82B84B5763A2
- !endif
- }
-
-[Components.IA32, Components.X64]
- CryptoPkg/Driver/CryptoSmm.inf {
-
- !if "$(CRYPTO_SERVICES)" == "ALL"
- FILE_GUID = A3542CE8-77F7-49DC-A834-45D37D2EC1FA
- !elseif "$(CRYPTO_SERVICES)" == "NONE"
- FILE_GUID = 6DCB3127-01E7-4131-A487-DC77A965A541
- !elseif "$(CRYPTO_SERVICES)" == MIN_DXE_MIN_SMM
- FILE_GUID = 85F7EA15-3A2B-474A-8875-180542CD6BF3
- !endif
- }
-!endif
-
-[BuildOptions]
- *_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES
- MSFT:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES
- INTEL:*_*_*_CC_FLAGS = /D ENABLE_MD5_DEPRECATED_INTERFACES
- GCC:*_*_*_CC_FLAGS = -D ENABLE_MD5_DEPRECATED_INTERFACES
- RVCT:*_*_*_CC_FLAGS = -DENABLE_MD5_DEPRECATED_INTERFACES
-!if $(CRYPTO_IMG_TYPE) IN "DXE_SMM"
- MSFT:*_*_*_DLINK_FLAGS = /ALIGN:4096
- GCC:*_GCC*_*_DLINK_FLAGS = -z common-page-size=0x1000
-!endif
diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
deleted file mode 100644
index d11de00bce..0000000000
--- a/CryptoPkg/Driver/Crypto.c
+++ /dev/null
@@ -1,7119 +0,0 @@
-/** @file
- Implements the EDK II Crypto Protocol/PPI services using the library services
- from BaseCryptLib and TlsLib.
-
- Copyright (C) Microsoft Corporation. All rights reserved.
- Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-#include
-#include
-#include
-#include
-#include
-#include
-
-/**
- A macro used to retrieve the FixedAtBuild PcdCryptoServiceFamilyEnable with a
- typecast to its associcted structure type PCD_CRYPTO_SERVICE_FAMILY_ENABLE.
-**/
-#define EDKII_CRYPTO_PCD ((const PCD_CRYPTO_SERVICE_FAMILY_ENABLE *)\
- (FixedPcdGetPtr (PcdCryptoServiceFamilyEnable)))
-
-/**
- A macro used to call a non-void BaseCryptLib function if it is enabled.
-
- If a BaseCryptLib function is not enabled, there will be no references to it
- from this module and will be optimized away reducing the size of this module.
-
- @param Enable The name of the enable field in PCD
- PcdCryptoServiceFamilyEnable for the BaseCryptLib
- function being called. If the value of this field
- is non-zero, then the BaseCryptLib function is
- enabled.
- @param Function The name of the BaseCryptLib function.
- @param Args The argument list to pass to Function.
- @param ErrorReturnValue The value to return if the BaseCryptLib function is
- not enabled.
-
-**/
-#define CALL_BASECRYPTLIB(Enable, Function, Args, ErrorReturnValue) \
- EDKII_CRYPTO_PCD->Enable \
- ? Function Args \
- : (BaseCryptLibServiceNotEnabled (#Function), ErrorReturnValue)
-
-/**
- A macro used to call a void BaseCryptLib function if it is enabled.
-
- If a BaseCryptLib function is not enabled, there will be no references to it
- from this module and will be optimized away reducing the size of this module.
-
- @param Enable The name of the enable field in PCD
- PcdCryptoServiceFamilyEnable for the BaseCryptLib
- function being called. If the value of this field
- is non-zero, then the BaseCryptLib function is
- enabled.
- @param Function The name of the BaseCryptLib function.
- @param Args The argument list to pass to Function.
-
-**/
-#define CALL_VOID_BASECRYPTLIB(Enable, Function, Args) \
- EDKII_CRYPTO_PCD->Enable \
- ? Function Args \
- : BaseCryptLibServiceNotEnabled (#Function)
-
-/**
- Internal worker function that prints a debug message and asserts if a call is
- made to a BaseCryptLib function that is not enabled in the EDK II Crypto
- Protocol/PPI.
-
- If this debug message and assert are observed, then a module is using
- BaseCryptLib function that is not enabled in a Crypto driver. The
- PcdCryptoServiceFamilyEnable should be updated to enable the missing service.
-
- @param[in] FunctionName Null-terminated ASCII string that is the name of an
- EDK II Crypto service.
-
-**/
-static
-VOID
-BaseCryptLibServiceNotEnabled (
- IN CONST CHAR8 *FunctionName
- )
-{
- DEBUG ((DEBUG_ERROR, "[%a] Function %a() is not enabled\n", gEfiCallerBaseName, FunctionName));
- ASSERT_EFI_ERROR (EFI_UNSUPPORTED);
-}
-
-/**
- Internal worker function that prints a debug message and asserts if a call is
- made to a BaseCryptLib function that is deprecated and unsupported any longer.
-
- @param[in] FunctionName Null-terminated ASCII string that is the name of an
- EDK II Crypto service.
-
-**/
-static
-VOID
-BaseCryptLibServiceDeprecated (
- IN CONST CHAR8 *FunctionName
- )
-{
- DEBUG ((DEBUG_ERROR, "[%a] Function %a() is deprecated and unsupported any longer\n", gEfiCallerBaseName, FunctionName));
- ASSERT_EFI_ERROR (EFI_UNSUPPORTED);
-}
-
-/**
- Returns the version of the EDK II Crypto Protocol.
-
- @return The version of the EDK II Crypto Protocol.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceGetCryptoVersion (
- VOID
- )
-{
- return EDKII_CRYPTO_VERSION;
-}
-
-// =====================================================================================
-// One-Way Cryptographic Hash Primitives
-// =====================================================================================
-
-/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-DeprecatedCryptoServiceMd4GetContextSize (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("Md4GetContextSize"), 0;
-}
-
-/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[out] Md4Context Pointer to MD4 context being initialized.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd4Init (
- OUT VOID *Md4Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Md4Init"), FALSE;
-}
-
-/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] Md4Context Pointer to MD4 context being copied.
- @param[out] NewMd4Context Pointer to new MD4 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd4Duplicate (
- IN CONST VOID *Md4Context,
- OUT VOID *NewMd4Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Md4Duplicate"), FALSE;
-}
-
-/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] Md4Context Pointer to the MD4 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd4Update (
- IN OUT VOID *Md4Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return BaseCryptLibServiceDeprecated ("Md4Update"), FALSE;
-}
-
-/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] Md4Context Pointer to the MD4 context.
- @param[out] HashValue Pointer to a buffer that receives the MD4 digest
- value (16 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd4Final (
- IN OUT VOID *Md4Context,
- OUT UINT8 *HashValue
- )
-{
- return BaseCryptLibServiceDeprecated ("Md4Final"), FALSE;
-}
-
-/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD4 digest
- value (16 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd4HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return BaseCryptLibServiceDeprecated ("Md4HashAll"), FALSE;
-}
-
-#ifndef ENABLE_MD5_DEPRECATED_INTERFACES
-
-/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- If this interface is not supported, then return zero.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-DeprecatedCryptoServiceMd5GetContextSize (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("Md5GetContextSize"), 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd5Init (
- OUT VOID *Md5Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Md5Init"), FALSE;
-}
-
-/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Md5Init"), FALSE;
-}
-
-/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly initialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd5Update (
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return BaseCryptLibServiceDeprecated ("Md5Init"), FALSE;
-}
-
-/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly initialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
- )
-{
- return BaseCryptLibServiceDeprecated ("Md5Final"), FALSE;
-}
-
-/**
- Computes the MD5 message digest of a input data buffer.
-
- This function performs the MD5 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceMd5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return BaseCryptLibServiceDeprecated ("Md5HashAll"), FALSE;
-}
-
-#else
-
-/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceMd5GetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Md5.Services.GetContextSize, Md5GetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceMd5Init (
- OUT VOID *Md5Context
- )
-{
- return CALL_BASECRYPTLIB (Md5.Services.Init, Md5Init, (Md5Context), FALSE);
-}
-
-/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceMd5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
- )
-{
- return CALL_BASECRYPTLIB (Md5.Services.Duplicate, Md5Duplicate, (Md5Context, NewMd5Context), FALSE);
-}
-
-/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly initialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceMd5Update (
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (Md5.Services.Update, Md5Update, (Md5Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly initialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceMd5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Md5.Services.Final, Md5Final, (Md5Context, HashValue), FALSE);
-}
-
-/**
- Computes the MD5 message digest of a input data buffer.
-
- This function performs the MD5 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceMd5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Md5.Services.HashAll, Md5HashAll, (Data, DataSize, HashValue), FALSE);
-}
-
-#endif
-
-#ifdef DISABLE_SHA1_DEPRECATED_INTERFACES
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- If this interface is not supported, then return zero.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-DeprecatedCryptoServiceSha1GetContextSize (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("Sha1GetContextSize"), 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceSha1Init (
- OUT VOID *Sha1Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Sha1Init"), FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceSha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Sha1Duplicate"), FALSE;
-}
-
-/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceSha1Update (
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return BaseCryptLibServiceDeprecated ("Sha1Update"), FALSE;
-}
-
-/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceSha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
- )
-{
- return BaseCryptLibServiceDeprecated ("Sha1Final"), FALSE;
-}
-
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceSha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return BaseCryptLibServiceDeprecated ("Sha1HashAll"), FALSE;
-}
-
-#else
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceSha1GetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Sha1.Services.GetContextSize, Sha1GetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha1Init (
- OUT VOID *Sha1Context
- )
-{
- return CALL_BASECRYPTLIB (Sha1.Services.Init, Sha1Init, (Sha1Context), FALSE);
-}
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
- )
-{
- return CALL_BASECRYPTLIB (Sha1.Services.Duplicate, Sha1Duplicate, (Sha1Context, NewSha1Context), FALSE);
-}
-
-/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha1Update (
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (Sha1.Services.Update, Sha1Update, (Sha1Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha1.Services.Final, Sha1Final, (Sha1Context, HashValue), FALSE);
-}
-
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha1.Services.HashAll, Sha1HashAll, (Data, DataSize, HashValue), FALSE);
-}
-
-#endif
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceSha256GetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Sha256.Services.GetContextSize, Sha256GetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha256Init (
- OUT VOID *Sha256Context
- )
-{
- return CALL_BASECRYPTLIB (Sha256.Services.Init, Sha256Init, (Sha256Context), FALSE);
-}
-
-/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha256Duplicate (
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
- )
-{
- return CALL_BASECRYPTLIB (Sha256.Services.Duplicate, Sha256Duplicate, (Sha256Context, NewSha256Context), FALSE);
-}
-
-/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha256Update (
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (Sha256.Services.Update, Sha256Update, (Sha256Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha256Final (
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha256.Services.Final, Sha256Final, (Sha256Context, HashValue), FALSE);
-}
-
-/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha256.Services.HashAll, Sha256HashAll, (Data, DataSize, HashValue), FALSE);
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceSha384GetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Sha384.Services.GetContextSize, Sha384GetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval TRUE SHA-384 context initialization succeeded.
- @retval FALSE SHA-384 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha384Init (
- OUT VOID *Sha384Context
- )
-{
- return CALL_BASECRYPTLIB (Sha384.Services.Init, Sha384Init, (Sha384Context), FALSE);
-}
-
-/**
- Makes a copy of an existing SHA-384 context.
-
- If Sha384Context is NULL, then return FALSE.
- If NewSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval TRUE SHA-384 context copy succeeded.
- @retval FALSE SHA-384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha384Duplicate (
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
- )
-{
- return CALL_BASECRYPTLIB (Sha384.Services.Duplicate, Sha384Duplicate, (Sha384Context, NewSha384Context), FALSE);
-}
-
-/**
- Digests the input data and updates SHA-384 context.
-
- This function performs SHA-384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
- by Sha384Final(). Behavior with invalid context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-384 data digest succeeded.
- @retval FALSE SHA-384 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha384Update (
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (Sha384.Services.Update, Sha384Update, (Sha384Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the SHA-384 digest value.
-
- This function completes SHA-384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-384 context cannot
- be used again.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
- finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha384Final (
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha384.Services.Final, Sha384Final, (Sha384Context, HashValue), FALSE);
-}
-
-/**
- Computes the SHA-384 message digest of a input data buffer.
-
- This function performs the SHA-384 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha384HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha384.Services.HashAll, Sha384HashAll, (Data, DataSize, HashValue), FALSE);
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceSha512GetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Sha512.Services.GetContextSize, Sha512GetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval TRUE SHA-512 context initialization succeeded.
- @retval FALSE SHA-512 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha512Init (
- OUT VOID *Sha512Context
- )
-{
- return CALL_BASECRYPTLIB (Sha512.Services.Init, Sha512Init, (Sha512Context), FALSE);
-}
-
-/**
- Makes a copy of an existing SHA-512 context.
-
- If Sha512Context is NULL, then return FALSE.
- If NewSha512Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval TRUE SHA-512 context copy succeeded.
- @retval FALSE SHA-512 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha512Duplicate (
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
- )
-{
- return CALL_BASECRYPTLIB (Sha512.Services.Duplicate, Sha512Duplicate, (Sha512Context, NewSha512Context), FALSE);
-}
-
-/**
- Digests the input data and updates SHA-512 context.
-
- This function performs SHA-512 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
- by Sha512Final(). Behavior with invalid context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-512 data digest succeeded.
- @retval FALSE SHA-512 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha512Update (
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (Sha512.Services.Update, Sha512Update, (Sha512Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the SHA-512 digest value.
-
- This function completes SHA-512 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-512 context cannot
- be used again.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
- finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha512Final (
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha512.Services.Final, Sha512Final, (Sha512Context, HashValue), FALSE);
-}
-
-/**
- Computes the SHA-512 message digest of a input data buffer.
-
- This function performs the SHA-512 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSha512HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sha512.Services.HashAll, Sha512HashAll, (Data, DataSize, HashValue), FALSE);
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
-
- @return The size, in bytes, of the context buffer required for SM3 hash operations.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceSm3GetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Sm3.Services.GetContextSize, Sm3GetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
- subsequent use.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[out] Sm3Context Pointer to SM3 context being initialized.
-
- @retval TRUE SM3 context initialization succeeded.
- @retval FALSE SM3 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSm3Init (
- OUT VOID *Sm3Context
- )
-{
- return CALL_BASECRYPTLIB (Sm3.Services.Init, Sm3Init, (Sm3Context), FALSE);
-}
-
-/**
- Makes a copy of an existing SM3 context.
-
- If Sm3Context is NULL, then return FALSE.
- If NewSm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sm3Context Pointer to SM3 context being copied.
- @param[out] NewSm3Context Pointer to new SM3 context.
-
- @retval TRUE SM3 context copy succeeded.
- @retval FALSE SM3 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSm3Duplicate (
- IN CONST VOID *Sm3Context,
- OUT VOID *NewSm3Context
- )
-{
- return CALL_BASECRYPTLIB (Sm3.Services.Duplicate, Sm3Duplicate, (Sm3Context, NewSm3Context), FALSE);
-}
-
-/**
- Digests the input data and updates SM3 context.
-
- This function performs SM3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
- by Sm3Final(). Behavior with invalid context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SM3 data digest succeeded.
- @retval FALSE SM3 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSm3Update (
- IN OUT VOID *Sm3Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (Sm3.Services.Update, Sm3Update, (Sm3Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the SM3 digest value.
-
- This function completes SM3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SM3 context cannot
- be used again.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be
- finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSm3Final (
- IN OUT VOID *Sm3Context,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sm3.Services.Final, Sm3Final, (Sm3Context, HashValue), FALSE);
-}
-
-/**
- Computes the SM3 message digest of a input data buffer.
-
- This function performs the SM3 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceSm3HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- return CALL_BASECRYPTLIB (Sm3.Services.HashAll, Sm3HashAll, (Data, DataSize, HashValue), FALSE);
-}
-
-// =====================================================================================
-// MAC (Message Authentication Code) Primitive
-// =====================================================================================
-
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @retval NULL This interface is not supported.
-
-**/
-VOID *
-EFIAPI
-DeprecatedCryptoServiceHmacMd5New (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacMd5New"), NULL;
-}
-
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] HmacMd5Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-DeprecatedCryptoServiceHmacMd5Free (
- IN VOID *HmacMd5Ctx
- )
-{
- BaseCryptLibServiceDeprecated ("HmacMd5Free");
-}
-
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[out] HmacMd5Context Pointer to HMAC-MD5 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacMd5SetKey (
- OUT VOID *HmacMd5Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacMd5SetKey"), FALSE;
-}
-
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] HmacMd5Context Pointer to HMAC-MD5 context being copied.
- @param[out] NewHmacMd5Context Pointer to new HMAC-MD5 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacMd5Duplicate (
- IN CONST VOID *HmacMd5Context,
- OUT VOID *NewHmacMd5Context
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacMd5Duplicate"), FALSE;
-}
-
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] HmacMd5Context Pointer to the HMAC-MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacMd5Update (
- IN OUT VOID *HmacMd5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacMd5Update"), FALSE;
-}
-
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] HmacMd5Context Pointer to the HMAC-MD5 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-MD5 digest
- value (16 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacMd5Final (
- IN OUT VOID *HmacMd5Context,
- OUT UINT8 *HmacValue
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacMd5Final"), FALSE;
-}
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @return NULL This interface is not supported.
-
-**/
-VOID *
-EFIAPI
-DeprecatedCryptoServiceHmacSha1New (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacSha1New"), NULL;
-}
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-DeprecatedCryptoServiceHmacSha1Free (
- IN VOID *HmacSha1Ctx
- )
-{
- BaseCryptLibServiceDeprecated ("HmacSha1Free");
-}
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacSha1SetKey (
- OUT VOID *HmacSha1Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacSha1SetKey"), FALSE;
-}
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
- @param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacSha1Duplicate (
- IN CONST VOID *HmacSha1Context,
- OUT VOID *NewHmacSha1Context
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacSha1Duplicate"), FALSE;
-}
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacSha1Update (
- IN OUT VOID *HmacSha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacSha1Update"), FALSE;
-}
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
- value (20 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceHmacSha1Final (
- IN OUT VOID *HmacSha1Context,
- OUT UINT8 *HmacValue
- )
-{
- return BaseCryptLibServiceDeprecated ("HmacSha1Final"), FALSE;
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha256New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-CryptoServiceHmacSha256New (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (HmacSha256.Services.New, HmacSha256New, (), NULL);
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceHmacSha256Free (
- IN VOID *HmacSha256Ctx
- )
-{
- CALL_VOID_BASECRYPTLIB (HmacSha256.Services.Free, HmacSha256Free, (HmacSha256Ctx));
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha256Update().
-
- If HmacSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha256SetKey (
- OUT VOID *HmacSha256Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return CALL_BASECRYPTLIB (HmacSha256.Services.SetKey, HmacSha256SetKey, (HmacSha256Context, Key, KeySize), FALSE);
-}
-
-/**
- Makes a copy of an existing HMAC-SHA256 context.
-
- If HmacSha256Context is NULL, then return FALSE.
- If NewHmacSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
- @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
- @retval TRUE HMAC-SHA256 context copy succeeded.
- @retval FALSE HMAC-SHA256 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha256Duplicate (
- IN CONST VOID *HmacSha256Context,
- OUT VOID *NewHmacSha256Context
- )
-{
- return CALL_BASECRYPTLIB (HmacSha256.Services.Duplicate, HmacSha256Duplicate, (HmacSha256Context, NewHmacSha256Context), FALSE);
-}
-
-/**
- Digests the input data and updates HMAC-SHA256 context.
-
- This function performs HMAC-SHA256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA256 data digest succeeded.
- @retval FALSE HMAC-SHA256 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha256Update (
- IN OUT VOID *HmacSha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (HmacSha256.Services.Update, HmacSha256Update, (HmacSha256Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the HMAC-SHA256 digest value.
-
- This function completes HMAC-SHA256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA256 context cannot
- be used again.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid HMAC-SHA256 context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha256Final (
- IN OUT VOID *HmacSha256Context,
- OUT UINT8 *HmacValue
- )
-{
- return CALL_BASECRYPTLIB (HmacSha256.Services.Final, HmacSha256Final, (HmacSha256Context, HmacValue), FALSE);
-}
-
-/**
- Computes the HMAC-SHA256 digest of a input data buffer.
-
- This function performs the HMAC-SHA256 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha256All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- return CALL_BASECRYPTLIB (HmacSha256.Services.All, HmacSha256All, (Data, DataSize, Key, KeySize, HmacValue), FALSE);
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha384New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-CryptoServiceHmacSha384New (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (HmacSha384.Services.New, HmacSha384New, (), NULL);
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceHmacSha384Free (
- IN VOID *HmacSha384Ctx
- )
-{
- CALL_VOID_BASECRYPTLIB (HmacSha384.Services.Free, HmacSha384Free, (HmacSha384Ctx));
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha384Update().
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha384SetKey (
- OUT VOID *HmacSha384Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return CALL_BASECRYPTLIB (HmacSha384.Services.SetKey, HmacSha384SetKey, (HmacSha384Context, Key, KeySize), FALSE);
-}
-
-/**
- Makes a copy of an existing HMAC-SHA384 context.
-
- If HmacSha384Context is NULL, then return FALSE.
- If NewHmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
- @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
- @retval TRUE HMAC-SHA384 context copy succeeded.
- @retval FALSE HMAC-SHA384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha384Duplicate (
- IN CONST VOID *HmacSha384Context,
- OUT VOID *NewHmacSha384Context
- )
-{
- return CALL_BASECRYPTLIB (HmacSha384.Services.Duplicate, HmacSha256Duplicate, (HmacSha384Context, NewHmacSha384Context), FALSE);
-}
-
-/**
- Digests the input data and updates HMAC-SHA384 context.
-
- This function performs HMAC-SHA384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA384 data digest succeeded.
- @retval FALSE HMAC-SHA384 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha384Update (
- IN OUT VOID *HmacSha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (HmacSha384.Services.Update, HmacSha384Update, (HmacSha384Context, Data, DataSize), FALSE);
-}
-
-/**
- Completes computation of the HMAC-SHA384 digest value.
-
- This function completes HMAC-SHA384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA384 context cannot
- be used again.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha384Final (
- IN OUT VOID *HmacSha384Context,
- OUT UINT8 *HmacValue
- )
-{
- return CALL_BASECRYPTLIB (HmacSha384.Services.Final, HmacSha384Final, (HmacSha384Context, HmacValue), FALSE);
-}
-
-/**
- Computes the HMAC-SHA384 digest of a input data buffer.
-
- This function performs the HMAC-SHA384 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHmacSha384All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- return CALL_BASECRYPTLIB (HmacSha384.Services.All, HmacSha384All, (Data, DataSize, Key, KeySize, HmacValue), FALSE);
-}
-
-// =====================================================================================
-// Symmetric Cryptography Primitive
-// =====================================================================================
-
-/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-DeprecatedCryptoServiceTdesGetContextSize (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("TdesGetContextSize"), 0;
-}
-
-/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[out] TdesContext Pointer to TDES context being initialized.
- @param[in] Key Pointer to the user-supplied TDES key.
- @param[in] KeyLength Length of TDES key in bits.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceTdesInit (
- OUT VOID *TdesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
- )
-{
- return BaseCryptLibServiceDeprecated ("TdesInit"), FALSE;
-}
-
-/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] TdesContext Pointer to the TDES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the TDES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceTdesEcbEncrypt (
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("TdesEcbEncrypt"), FALSE;
-}
-
-/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] TdesContext Pointer to the TDES context.
- @param[in] Input Pointer to the buffer containing the data to be decrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the TDES decryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceTdesEcbDecrypt (
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("TdesEcbDecrypt"), FALSE;
-}
-
-/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] TdesContext Pointer to the TDES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the TDES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceTdesCbcEncrypt (
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("TdesCbcEncrypt"), FALSE;
-}
-
-/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] TdesContext Pointer to the TDES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the TDES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceTdesCbcDecrypt (
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("TdesCbcDecrypt"), FALSE;
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for AES operations.
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-CryptoServiceAesGetContextSize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Aes.Services.GetContextSize, AesGetContextSize, (), 0);
-}
-
-/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- This function initializes user-supplied memory pointed by AesContext as AES context.
- In addition, it sets up all AES key materials for subsequent encryption and decryption
- operations.
- There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
-
- If AesContext is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeyLength is not valid, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval TRUE AES context initialization succeeded.
- @retval FALSE AES context initialization failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAesInit (
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
- )
-{
- return CALL_BASECRYPTLIB (Aes.Services.Init, AesInit, (AesContext, Key, KeyLength), FALSE);
-}
-
-/**
- AES ECB Mode is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceAesEcbEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("AesEcbEncrypt"), FALSE;
-}
-
-/**
- AES ECB Mode is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be decrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the AES decryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceAesEcbDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("AesEcbDecrypt"), FALSE;
-}
-
-/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES encryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES encryption succeeded.
- @retval FALSE AES encryption failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAesCbcEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- return CALL_BASECRYPTLIB (Aes.Services.CbcEncrypt, AesCbcEncrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);
-}
-
-/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES decryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES decryption succeeded.
- @retval FALSE AES decryption failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAesCbcDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- return CALL_BASECRYPTLIB (Aes.Services.CbcDecrypt, AesCbcDecrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);
-}
-
-/**
- ARC4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-DeprecatedCryptoServiceArc4GetContextSize (
- VOID
- )
-{
- return BaseCryptLibServiceDeprecated ("Arc4GetContextSize"), 0;
-}
-
-/**
- ARC4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[out] Arc4Context Pointer to ARC4 context being initialized.
- @param[in] Key Pointer to the user-supplied ARC4 key.
- @param[in] KeySize Size of ARC4 key in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceArc4Init (
- OUT VOID *Arc4Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return BaseCryptLibServiceDeprecated ("Arc4Init"), FALSE;
-}
-
-/**
- ARC4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] Arc4Context Pointer to the ARC4 context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the ARC4 encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceArc4Encrypt (
- IN OUT VOID *Arc4Context,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("Arc4Encrypt"), FALSE;
-}
-
-/**
- ARC4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] Arc4Context Pointer to the ARC4 context.
- @param[in] Input Pointer to the buffer containing the data to be decrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the ARC4 decryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceArc4Decrypt (
- IN OUT VOID *Arc4Context,
- IN UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- return BaseCryptLibServiceDeprecated ("Arc4Decrypt"), FALSE;
-}
-
-/**
- ARC4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
- @param[in, out] Arc4Context Pointer to the ARC4 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DeprecatedCryptoServiceArc4Reset (
- IN OUT VOID *Arc4Context
- )
-{
- return BaseCryptLibServiceDeprecated ("Arc4Reset"), FALSE;
-}
-
-// =====================================================================================
-// Asymmetric Cryptography Primitive
-// =====================================================================================
-
-/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-CryptoServiceRsaNew (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.New, RsaNew, (), NULL);
-}
-
-/**
- Release the specified RSA context.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceRsaFree (
- IN VOID *RsaContext
- )
-{
- CALL_VOID_BASECRYPTLIB (Rsa.Services.Free, RsaFree, (RsaContext));
-}
-
-/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaSetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.SetKey, RsaSetKey, (RsaContext, KeyTag, BigNumber, BnSize), FALSE);
-}
-
-/**
- Gets the tag-designated RSA key component from the established RSA context.
-
- This function retrieves the tag-designated RSA key component from the
- established RSA context as a non-negative integer (octet string format
- represented in RSA PKCS#1).
- If specified key component has not been set or has been cleared, then returned
- BnSize is set to 0.
- If the BigNumber buffer is too small to hold the contents of the key, FALSE
- is returned and BnSize is set to the required buffer size to obtain the key.
-
- If RsaContext is NULL, then return FALSE.
- If BnSize is NULL, then return FALSE.
- If BnSize is large enough but BigNumber is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[out] BigNumber Pointer to octet integer buffer.
- @param[in, out] BnSize On input, the size of big number buffer in bytes.
- On output, the size of data returned in big number buffer in bytes.
-
- @retval TRUE RSA key component was retrieved successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE BnSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaGetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- OUT UINT8 *BigNumber,
- IN OUT UINTN *BnSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.GetKey, RsaGetKey, (RsaContext, KeyTag, BigNumber, BnSize), FALSE);
-}
-
-/**
- Generates RSA key components.
-
- This function generates RSA key components. It takes RSA public exponent E and
- length in bits of RSA modulus N as input, and generates all key components.
- If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] ModulusLength Length of RSA modulus N in bits.
- @param[in] PublicExponent Pointer to RSA public exponent.
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
-
- @retval TRUE RSA key component was generated successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaGenerateKey (
- IN OUT VOID *RsaContext,
- IN UINTN ModulusLength,
- IN CONST UINT8 *PublicExponent,
- IN UINTN PublicExponentSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.GenerateKey, RsaGenerateKey, (RsaContext, ModulusLength, PublicExponent, PublicExponentSize), FALSE);
-}
-
-/**
- Validates key components of RSA context.
- NOTE: This function performs integrity checks on all the RSA key material, so
- the RSA key structure must contain all the private key data.
-
- This function validates key components of RSA context in following aspects:
- - Whether p is a prime
- - Whether q is a prime
- - Whether n = p * q
- - Whether d*e = 1 mod lcm(p-1,q-1)
-
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context to check.
-
- @retval TRUE RSA key components are valid.
- @retval FALSE RSA key components are not valid.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaCheckKey (
- IN VOID *RsaContext
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.CheckKey, RsaCheckKey, (RsaContext), FALSE);
-}
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in PKCS1-v1_5.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaPkcs1Sign (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.Pkcs1Sign, RsaPkcs1Sign, (RsaContext, MessageHash, HashSize, Signature, SigSize), FALSE);
-}
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaPkcs1Verify (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.Pkcs1Verify, RsaPkcs1Verify, (RsaContext, MessageHash, HashSize, Signature, SigSize), FALSE);
-}
-
-/**
- Retrieve the RSA Private Key from the password-protected PEM key data.
-
- If PemData is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA private key component. Use RsaFree() function to free the
- resource.
-
- @retval TRUE RSA Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **RsaContext
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.GetPrivateKeyFromPem, RsaGetPrivateKeyFromPem, (PemData, PemSize, Password, RsaContext), FALSE);
-}
-
-/**
- Retrieve the RSA Public Key from one DER-encoded X509 certificate.
-
- If Cert is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA public key component. Use RsaFree() function to free the
- resource.
-
- @retval TRUE RSA Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve RSA public key from X509 certificate.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **RsaContext
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.GetPublicKeyFromX509, RsaGetPublicKeyFromX509, (Cert, CertSize, RsaContext), FALSE);
-}
-
-/**
- Retrieve the subject bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If SubjectSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
- @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate subject retrieved successfully.
- @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
- The SubjectSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetSubjectName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertSubject,
- IN OUT UINTN *SubjectSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetSubjectName, X509GetSubjectName, (Cert, CertSize, CertSubject, SubjectSize), FALSE);
-}
-
-/**
- Retrieve the common name (CN) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string (UTF8). At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If CommonNameSize is NULL.
- If CommonName is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no CommonName entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-CryptoServiceX509GetCommonName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *CommonName OPTIONAL,
- IN OUT UINTN *CommonNameSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetCommonName, X509GetCommonName, (Cert, CertSize, CommonName, CommonNameSize), RETURN_UNSUPPORTED);
-}
-
-/**
- Retrieve the organization name (O) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] NameBuffer Buffer to contain the retrieved certificate organization
- name string. At most NameBufferSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,
- and the size of buffer returned Name on output.
- If NameBuffer is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If NameBufferSize is NULL.
- If NameBuffer is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no Organization Name entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the NameBuffer is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-CryptoServiceX509GetOrganizationName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *NameBuffer OPTIONAL,
- IN OUT UINTN *NameBufferSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetOrganizationName, X509GetOrganizationName, (Cert, CertSize, NameBuffer, NameBufferSize), RETURN_UNSUPPORTED);
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
-
- If Cert is NULL, then return FALSE.
- If CACert is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
- @param[in] CACertSize Size of the CA Certificate in bytes.
-
- @retval TRUE The certificate was issued by the trusted CA.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509VerifyCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *CACert,
- IN UINTN CACertSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.VerifyCert, X509VerifyCert, (Cert, CertSize, CACert, CACertSize), FALSE);
-}
-
-/**
- Construct a X509 object from DER-encoded certificate data.
-
- If Cert is NULL, then return FALSE.
- If SingleX509Cert is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded certificate data.
- @param[in] CertSize The size of certificate data in bytes.
- @param[out] SingleX509Cert The generated X509 object.
-
- @retval TRUE The X509 object generation succeeded.
- @retval FALSE The operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509ConstructCertificate (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **SingleX509Cert
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.ConstructCertificate, X509ConstructCertificate, (Cert, CertSize, SingleX509Cert), FALSE);
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509ConstructCertificateStackV (
- IN OUT UINT8 **X509Stack,
- IN VA_LIST Args
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.ConstructCertificateStackV, X509ConstructCertificateStackV, (X509Stack, Args), FALSE);
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param ... A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509ConstructCertificateStack (
- IN OUT UINT8 **X509Stack,
- ...
- )
-{
- VA_LIST Args;
- BOOLEAN Result;
-
- VA_START (Args, X509Stack);
- Result = CryptoServiceX509ConstructCertificateStackV (X509Stack, Args);
- VA_END (Args);
- return Result;
-}
-
-/**
- Release the specified X509 object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Cert Pointer to the X509 object to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceX509Free (
- IN VOID *X509Cert
- )
-{
- CALL_VOID_BASECRYPTLIB (X509.Services.Free, X509Free, (X509Cert));
-}
-
-/**
- Release the specified X509 stack object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Stack Pointer to the X509 stack object to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceX509StackFree (
- IN VOID *X509Stack
- )
-{
- CALL_VOID_BASECRYPTLIB (X509.Services.StackFree, X509StackFree, (X509Stack));
-}
-
-/**
- Retrieve the TBSCertificate from one given X.509 certificate.
-
- @param[in] Cert Pointer to the given DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
- @param[out] TBSCertSize Size of the TBS certificate in bytes.
-
- If Cert is NULL, then return FALSE.
- If TBSCert is NULL, then return FALSE.
- If TBSCertSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @retval TRUE The TBSCertificate was retrieved successfully.
- @retval FALSE Invalid X.509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetTBSCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **TBSCert,
- OUT UINTN *TBSCertSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetTBSCert, X509GetTBSCert, (Cert, CertSize, TBSCert, TBSCertSize), FALSE);
-}
-
-/**
- Retrieve the version from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Version Pointer to the retrieved version integer.
-
- @retval TRUE The certificate version retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- @retval FALSE The operation is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetVersion (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Version
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetVersion, X509GetVersion, (Cert, CertSize, Version), FALSE);
-}
-
-/**
- Retrieve the serialNumber from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
- @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
- and the size of buffer returned SerialNumber on output.
-
- @retval TRUE The certificate serialNumber retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- If SerialNumberSize is NULL.
- If Certificate is invalid.
- @retval FALSE If no SerialNumber exists.
- @retval FALSE If the SerialNumber is NULL. The required buffer size
- (including the final null) is returned in the
- SerialNumberSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetSerialNumber (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *SerialNumber, OPTIONAL
- IN OUT UINTN *SerialNumberSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetSerialNumber, X509GetSerialNumber, (Cert, CertSize, SerialNumber, SerialNumberSize), FALSE);
-}
-
-/**
- Retrieve the issuer bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
- @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate issuer retrieved successfully.
- @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
- The CertIssuerSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetIssuerName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertIssuer,
- IN OUT UINTN *CertIssuerSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetIssuerName, X509GetIssuerName, (Cert, CertSize, CertIssuer, CertIssuerSize), FALSE);
-}
-
-/**
- Retrieve the Signature Algorithm from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Oid Signature Algorithm Object identifier buffer.
- @param[in,out] OidSize Signature Algorithm Object identifier buffer size
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If OidSize is NULL.
- If Oid is not NULL and *OidSize is 0.
- If Certificate is invalid.
- @retval FALSE If no SignatureType.
- @retval FALSE If the Oid is NULL. The required buffer size
- is returned in the OidSize.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetSignatureAlgorithm (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Oid, OPTIONAL
- IN OUT UINTN *OidSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetSignatureAlgorithm, X509GetSignatureAlgorithm, (Cert, CertSize, Oid, OidSize), FALSE);
-}
-
-/**
- Retrieve Extension data from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] Oid Object identifier buffer
- @param[in] OidSize Object identifier buffer size
- @param[out] ExtensionData Extension bytes.
- @param[in, out] ExtensionDataSize Extension bytes size.
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If ExtensionDataSize is NULL.
- If ExtensionData is not NULL and *ExtensionDataSize is 0.
- If Certificate is invalid.
- @retval FALSE If no Extension entry match Oid.
- @retval FALSE If the ExtensionData is NULL. The required buffer size
- is returned in the ExtensionDataSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetExtensionData (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *Oid,
- IN UINTN OidSize,
- OUT UINT8 *ExtensionData,
- IN OUT UINTN *ExtensionDataSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetExtensionData, X509GetExtensionData, (Cert, CertSize, Oid, OidSize, ExtensionData, ExtensionDataSize), FALSE);
-}
-
-/**
- Retrieve the Extended Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage bytes.
- @param[in, out] UsageSize Key Usage buffer sizs in bytes.
-
- @retval TRUE The Usage bytes retrieve successfully.
- @retval FALSE If Cert is NULL.
- If CertSize is NULL.
- If Usage is not NULL and *UsageSize is 0.
- If Cert is invalid.
- @retval FALSE If the Usage is NULL. The required buffer size
- is returned in the UsageSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetExtendedKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Usage,
- IN OUT UINTN *UsageSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetExtendedKeyUsage, X509GetExtendedKeyUsage, (Cert, CertSize, Usage, UsageSize), FALSE);
-}
-
-/**
- Retrieve the Validity from one X.509 certificate
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] From notBefore Pointer to DateTime object.
- @param[in,out] FromSize notBefore DateTime object size.
- @param[in] To notAfter Pointer to DateTime object.
- @param[in,out] ToSize notAfter DateTime object size.
-
- Note: X509CompareDateTime to compare DateTime oject
- x509SetDateTime to get a DateTime object from a DateTimeStr
-
- @retval TRUE The certificate Validity retrieved successfully.
- @retval FALSE Invalid certificate, or Validity retrieve failed.
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetValidity (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN UINT8 *From,
- IN OUT UINTN *FromSize,
- IN UINT8 *To,
- IN OUT UINTN *ToSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetValidity, X509GetValidity, (Cert, CertSize, From, FromSize, To, ToSize), FALSE);
-}
-
-/**
- Format a DateTimeStr to DataTime object in DataTime Buffer
-
- If DateTimeStr is NULL, then return FALSE.
- If DateTimeSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
- Ref: https://www.w3.org/TR/NOTE-datetime
- Z stand for UTC time
- @param[out] DateTime Pointer to a DateTime object.
- @param[in,out] DateTimeSize DateTime object buffer size.
-
- @retval TRUE The DateTime object create successfully.
- @retval FALSE If DateTimeStr is NULL.
- If DateTimeSize is NULL.
- If DateTime is not NULL and *DateTimeSize is 0.
- If Year Month Day Hour Minute Second combination is invalid datetime.
- @retval FALSE If the DateTime is NULL. The required buffer size
- (including the final null) is returned in the
- DateTimeSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509FormatDateTime (
- IN CONST CHAR8 *DateTimeStr,
- OUT VOID *DateTime,
- IN OUT UINTN *DateTimeSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.FormatDateTime, X509FormatDateTime, (DateTimeStr, DateTime, DateTimeSize), FALSE);
-}
-
-/**
- Compare DateTime1 object and DateTime2 object.
-
- If DateTime1 is NULL, then return -2.
- If DateTime2 is NULL, then return -2.
- If DateTime1 == DateTime2, then return 0
- If DateTime1 > DateTime2, then return 1
- If DateTime1 < DateTime2, then return -1
-
- @param[in] DateTime1 Pointer to a DateTime Ojbect
- @param[in] DateTime2 Pointer to a DateTime Object
-
- @retval 0 If DateTime1 == DateTime2
- @retval 1 If DateTime1 > DateTime2
- @retval -1 If DateTime1 < DateTime2
-**/
-INT32
-EFIAPI
-CryptoServiceX509CompareDateTime (
- IN CONST VOID *DateTime1,
- IN CONST VOID *DateTime2
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.CompareDateTime, X509CompareDateTime, (DateTime1, DateTime2), FALSE);
-}
-
-/**
- Retrieve the Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
-
- @retval TRUE The certificate Key Usage retrieved successfully.
- @retval FALSE Invalid certificate, or Usage is NULL
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Usage
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetKeyUsage, X509GetKeyUsage, (Cert, CertSize, Usage), FALSE);
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
- @param[in] RootCert Trusted Root Certificate buffer
-
- @param[in] RootCertLength Trusted Root Certificate buffer length
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509VerifyCertChain (
- IN CONST UINT8 *RootCert,
- IN UINTN RootCertLength,
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.VerifyCertChain, X509VerifyCertChain, (RootCert, RootCertLength, CertChain, CertChainLength), FALSE);
-}
-
-/**
- Get one X509 certificate from CertChain.
-
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] CertIndex Index of certificate.
-
- @param[out] Cert The certificate at the index of CertChain.
- @param[out] CertLength The length certificate at the index of CertChain.
-
- @retval TRUE Success.
- @retval FALSE Failed to get certificate from certificate chain.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetCertFromCertChain (
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength,
- IN CONST INT32 CertIndex,
- OUT CONST UINT8 **Cert,
- OUT UINTN *CertLength
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetCertFromCertChain, X509GetCertFromCertChain, (CertChain, CertChainLength, CertIndex, Cert, CertLength), FALSE);
-}
-
-/**
- Retrieve the tag and length of the tag.
-
- @param Ptr The position in the ASN.1 data
- @param End End of data
- @param Length The variable that will receive the length
- @param Tag The expected tag
-
- @retval TRUE Get tag successful
- @retval FALSe Failed to get tag or tag not match
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAsn1GetTag (
- IN OUT UINT8 **Ptr,
- IN CONST UINT8 *End,
- OUT UINTN *Length,
- IN UINT32 Tag
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.Asn1GetTag, Asn1GetTag, (Ptr, End, Length, Tag), FALSE);
-}
-
-/**
- Retrieve the basic constraints from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize size of the X509 certificate in bytes.
- @param[out] BasicConstraints basic constraints bytes.
- @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
-
- @retval TRUE The basic constraints retrieve successfully.
- @retval FALSE If cert is NULL.
- If cert_size is NULL.
- If basic_constraints is not NULL and *basic_constraints_size is 0.
- If cert is invalid.
- @retval FALSE The required buffer size is small.
- The return buffer size is basic_constraints_size parameter.
- @retval FALSE If no Extension entry match oid.
- @retval FALSE The operation is not supported.
- **/
-BOOLEAN
-EFIAPI
-CryptoServiceX509GetExtendedBasicConstraints (
- CONST UINT8 *Cert,
- UINTN CertSize,
- UINT8 *BasicConstraints,
- UINTN *BasicConstraintsSize
- )
-{
- return CALL_BASECRYPTLIB (X509.Services.GetExtendedBasicConstraints, X509GetExtendedBasicConstraints, (Cert, CertSize, BasicConstraints, BasicConstraintsSize), FALSE);
-}
-
-/**
- Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
- password based encryption key derivation function PBKDF2, as specified in RFC 2898.
-
- If Password or Salt or OutKey is NULL, then return FALSE.
- If the hash algorithm could not be determined, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] PasswordLength Length of input password in bytes.
- @param[in] Password Pointer to the array for the password.
- @param[in] SaltLength Size of the Salt in bytes.
- @param[in] Salt Pointer to the Salt.
- @param[in] IterationCount Number of iterations to perform. Its value should be
- greater than or equal to 1.
- @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
- NOTE: DigestSize will be used to determine the hash algorithm.
- Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
- @param[in] KeyLength Size of the derived key buffer in bytes.
- @param[out] OutKey Pointer to the output derived key buffer.
-
- @retval TRUE A key was derived successfully.
- @retval FALSE One of the pointers was NULL or one of the sizes was too large.
- @retval FALSE The hash algorithm could not be determined from the digest size.
- @retval FALSE The key derivation operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs5HashPassword (
- IN UINTN PasswordLength,
- IN CONST CHAR8 *Password,
- IN UINTN SaltLength,
- IN CONST UINT8 *Salt,
- IN UINTN IterationCount,
- IN UINTN DigestSize,
- IN UINTN KeyLength,
- OUT UINT8 *OutKey
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs5HashPassword, Pkcs5HashPassword, (PasswordLength, Password, SaltLength, Salt, IterationCount, DigestSize, KeyLength, OutKey), FALSE);
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to parse X509 certificate.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
- will be used to encrypt the data.
- @param[in] PublicKeySize Size of the X509 cert buffer.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs1v2Encrypt (
- IN CONST UINT8 *PublicKey,
- IN UINTN PublicKeySize,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs1v2Encrypt, Pkcs1v2Encrypt, (PublicKey, PublicKeySize, InData, InDataSize, PrngSeed, PrngSeedSize, EncryptedData, EncryptedDataSize), FALSE);
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a public key using RsaSetKey().
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaOaepEncrypt (
- IN VOID *RsaContext,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.RsaOaepEncrypt, RsaOaepEncrypt, (RsaContext, InData, InDataSize, PrngSeed, PrngSeedSize, DigestLen, EncryptedData, EncryptedDataSize), FALSE);
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] PrivateKey A pointer to the DER-encoded private key.
- @param[in] PrivateKeySize Size of the private key buffer.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs1v2Decrypt (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs1v2Decrypt, Pkcs1v2Decrypt, (PrivateKey, PrivateKeySize, EncryptedData, EncryptedDataSize, OutData, OutDataSize), FALSE);
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a private key using RsaSetKey().
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaOaepDecrypt (
- IN VOID *RsaContext,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- return CALL_BASECRYPTLIB (Rsa.Services.RsaOaepDecrypt, RsaOaepDecrypt, (RsaContext, EncryptedData, EncryptedDataSize, DigestLen, OutData, OutDataSize), FALSE);
-}
-
-/**
- Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then
- return FALSE. If P7Length overflow, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] StackLength Length of signer's certificates in bytes.
- @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- @param[out] CertLength Length of the trusted certificate in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs7GetSigners (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **CertStack,
- OUT UINTN *StackLength,
- OUT UINT8 **TrustedCert,
- OUT UINTN *CertLength
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs7GetSigners, Pkcs7GetSigners, (P7Data, P7Length, CertStack, StackLength, TrustedCert, CertLength), FALSE);
-}
-
-/**
- Wrap function to use free() to free allocated memory for certificates.
-
- If this interface is not supported, then ASSERT().
-
- @param[in] Certs Pointer to the certificates to be freed.
-
-**/
-VOID
-EFIAPI
-CryptoServicePkcs7FreeSigners (
- IN UINT8 *Certs
- )
-{
- CALL_VOID_BASECRYPTLIB (Pkcs.Services.Pkcs7FreeSigners, Pkcs7FreeSigners, (Certs));
-}
-
-/**
- Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
- unchained to the signer's certificates.
- The input signed data could be wrapped in a ContentInfo structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
- certificate. It's caller's responsibility to free the buffer
- with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] ChainLength Length of the chained certificates list buffer in bytes.
- @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
- responsibility to free the buffer with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs7GetCertificatesList (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **SignerChainCerts,
- OUT UINTN *ChainLength,
- OUT UINT8 **UnchainCerts,
- OUT UINTN *UnchainLength
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs7GetCertificatesList, Pkcs7GetCertificatesList, (P7Data, P7Length, SignerChainCerts, ChainLength, UnchainCerts, UnchainLength), FALSE);
-}
-
-/**
- Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
- Syntax Standard, version 1.5". This interface is only intended to be used for
- application to perform PKCS#7 functionality validation.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] PrivateKey Pointer to the PEM-formatted private key data for
- data signing.
- @param[in] PrivateKeySize Size of the PEM private key data in bytes.
- @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
- key data.
- @param[in] InData Pointer to the content to be signed.
- @param[in] InDataSize Size of InData in bytes.
- @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
- @param[in] OtherCerts Pointer to an optional additional set of certificates to
- include in the PKCS#7 signedData (e.g. any intermediate
- CAs in the chain).
- @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
- responsibility to free the buffer with FreePool().
- @param[out] SignedDataSize Size of SignedData in bytes.
-
- @retval TRUE PKCS#7 data signing succeeded.
- @retval FALSE PKCS#7 data signing failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs7Sign (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN CONST UINT8 *KeyPassword,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN UINT8 *SignCert,
- IN UINT8 *OtherCerts OPTIONAL,
- OUT UINT8 **SignedData,
- OUT UINTN *SignedDataSize
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs7Sign, Pkcs7Sign, (PrivateKey, PrivateKeySize, KeyPassword, InData, InDataSize, SignCert, OtherCerts, SignedData, SignedDataSize), FALSE);
-}
-
-/**
- Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, TrustedCert or InData is NULL, then return FALSE.
- If P7Length, CertLength or DataLength overflow, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertLength Length of the trusted certificate in bytes.
- @param[in] InData Pointer to the content to be verified.
- @param[in] DataLength Length of InData in bytes.
-
- @retval TRUE The specified PKCS#7 signed data is valid.
- @retval FALSE Invalid PKCS#7 signed data.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs7Verify (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertLength,
- IN CONST UINT8 *InData,
- IN UINTN DataLength
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs7Verify, Pkcs7Verify, (P7Data, P7Length, TrustedCert, CertLength, InData, DataLength), FALSE);
-}
-
-/**
- This function receives a PKCS7 formatted signature, and then verifies that
- the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity
- leaf signing certificate.
- Note that this function does not validate the certificate chain.
-
- Applications for custom EKU's are quite flexible. For example, a policy EKU
- may be present in an Issuing Certificate Authority (CA), and any sub-ordinate
- certificate issued might also contain this EKU, thus constraining the
- sub-ordinate certificate. Other applications might allow a certificate
- embedded in a device to specify that other Object Identifiers (OIDs) are
- present which contains binary data specifying custom capabilities that
- the device is able to do.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-RETURN_STATUS
-EFIAPI
-CryptoServiceVerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.VerifyEKUsInPkcs7Signature, VerifyEKUsInPkcs7Signature, (Pkcs7Signature, SignatureSize, RequiredEKUs, RequiredEKUsSize, RequireAllPresent), FALSE);
-}
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
- then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
-
- Caution: This function may receive untrusted input. So this function will do
- basic check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServicePkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.Pkcs7GetAttachedContent, Pkcs7GetAttachedContent, (P7Data, P7Length, Content, ContentSize), FALSE);
-}
-
-/**
- Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
- Authenticode Portable Executable Signature Format".
-
- If AuthData is NULL, then return FALSE.
- If ImageHash is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[in] ImageHash Pointer to the original image file hash value. The procedure
- for calculating the image hash value is described in Authenticode
- specification.
- @param[in] HashSize Size of Image hash value in bytes.
-
- @retval TRUE The specified Authenticode Signature is valid.
- @retval FALSE Invalid Authenticode Signature.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAuthenticodeVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertSize,
- IN CONST UINT8 *ImageHash,
- IN UINTN HashSize
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.AuthenticodeVerify, AuthenticodeVerify, (AuthData, DataSize, TrustedCert, CertSize, ImageHash, HashSize), FALSE);
-}
-
-/**
- Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
- signature.
-
- If AuthData is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
- is used for TSA certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
- @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceImageTimestampVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- OUT EFI_TIME *SigningTime
- )
-{
- return CALL_BASECRYPTLIB (Pkcs.Services.ImageTimestampVerify, ImageTimestampVerify, (AuthData, DataSize, TsaCert, CertSize, SigningTime), FALSE);
-}
-
-// =====================================================================================
-// DH Key Exchange Primitive
-// =====================================================================================
-
-/**
- Allocates and Initializes one Diffie-Hellman Context for subsequent use.
-
- @return Pointer to the Diffie-Hellman Context that has been initialized.
- If the allocations fails, DhNew() returns NULL.
- If the interface is not supported, DhNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-CryptoServiceDhNew (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Dh.Services.New, DhNew, (), NULL);
-}
-
-/**
- Release the specified DH context.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] DhContext Pointer to the DH context to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceDhFree (
- IN VOID *DhContext
- )
-{
- CALL_VOID_BASECRYPTLIB (Dh.Services.Free, DhFree, (DhContext));
-}
-
-/**
- Generates DH parameter.
-
- Given generator g, and length of prime number p in bits, this function generates p,
- and sets DH context according to value of g and p.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[out] Prime Pointer to the buffer to receive the generated prime number.
-
- @retval TRUE DH parameter generation succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE PRNG fails to generate random prime number with PrimeLength.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceDhGenerateParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- OUT UINT8 *Prime
- )
-{
- return CALL_BASECRYPTLIB (Dh.Services.GenerateParameter, DhGenerateParameter, (DhContext, Generator, PrimeLength, Prime), FALSE);
-}
-
-/**
- Sets generator and prime parameters for DH.
-
- Given generator g, and prime number p, this function and sets DH
- context accordingly.
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[in] Prime Pointer to the prime number.
-
- @retval TRUE DH parameter setting succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE Value of Generator is not suitable for the Prime.
- @retval FALSE Value of Prime is not a prime number.
- @retval FALSE Value of Prime is not a safe prime number.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceDhSetParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- IN CONST UINT8 *Prime
- )
-{
- return CALL_BASECRYPTLIB (Dh.Services.SetParameter, DhSetParameter, (DhContext, Generator, PrimeLength, Prime), FALSE);
-}
-
-/**
- Generates DH public key.
-
- This function generates random secret exponent, and computes the public key, which is
- returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
- If the PublicKey buffer is too small to hold the public key, FALSE is returned and
- PublicKeySize is set to the required buffer size to obtain the public key.
-
- If DhContext is NULL, then return FALSE.
- If PublicKeySize is NULL, then return FALSE.
- If PublicKeySize is large enough but PublicKey is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[out] PublicKey Pointer to the buffer to receive generated public key.
- @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
- On output, the size of data returned in PublicKey buffer in bytes.
-
- @retval TRUE DH public key generation succeeded.
- @retval FALSE DH public key generation failed.
- @retval FALSE PublicKeySize is not large enough.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceDhGenerateKey (
- IN OUT VOID *DhContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- return CALL_BASECRYPTLIB (Dh.Services.GenerateKey, DhGenerateKey, (DhContext, PublicKey, PublicKeySize), FALSE);
-}
-
-/**
- Computes exchanged common key.
-
- Given peer's public key, this function computes the exchanged common key, based on its own
- context including value of prime modulus and random secret exponent.
-
- If DhContext is NULL, then return FALSE.
- If PeerPublicKey is NULL, then return FALSE.
- If KeySize is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] PeerPublicKey Pointer to the peer's public key.
- @param[in] PeerPublicKeySize Size of peer's public key in bytes.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
-
- @retval TRUE DH exchanged key generation succeeded.
- @retval FALSE DH exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceDhComputeKey (
- IN OUT VOID *DhContext,
- IN CONST UINT8 *PeerPublicKey,
- IN UINTN PeerPublicKeySize,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- return CALL_BASECRYPTLIB (Dh.Services.ComputeKey, DhComputeKey, (DhContext, PeerPublicKey, PeerPublicKeySize, Key, KeySize), FALSE);
-}
-
-// =====================================================================================
-// Pseudo-Random Generation Primitive
-// =====================================================================================
-
-/**
- Sets up the seed value for the pseudorandom number generator.
-
- This function sets up the seed value for the pseudorandom number generator.
- If Seed is not NULL, then the seed passed in is used.
- If Seed is NULL, then default seed is used.
- If this interface is not supported, then return FALSE.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval TRUE Pseudorandom number generator has enough entropy for random generation.
- @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRandomSeed (
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
- )
-{
- return CALL_BASECRYPTLIB (Random.Services.Seed, RandomSeed, (Seed, SeedSize), FALSE);
-}
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- If Output is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval TRUE Pseudorandom byte stream generated successfully.
- @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRandomBytes (
- OUT UINT8 *Output,
- IN UINTN Size
- )
-{
- return CALL_BASECRYPTLIB (Random.Services.Bytes, RandomBytes, (Output, Size), FALSE);
-}
-
-// =====================================================================================
-// Key Derivation Function Primitive
-// =====================================================================================
-
-/**
- Derive key data using HMAC-SHA256 based KDF.
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHkdfSha256ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return CALL_BASECRYPTLIB (Hkdf.Services.Sha256ExtractAndExpand, HkdfSha256ExtractAndExpand, (Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize), FALSE);
-}
-
-/**
- Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHkdfSha256Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- return CALL_BASECRYPTLIB (Hkdf.Services.Sha256Extract, HkdfSha256Extract, (Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize), FALSE);
-}
-
-/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHkdfSha256Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return CALL_BASECRYPTLIB (Hkdf.Services.Sha256Expand, HkdfSha256Expand, (Prk, PrkSize, Info, InfoSize, Out, OutSize), FALSE);
-}
-
-/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHkdfSha384ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return CALL_BASECRYPTLIB (Hkdf.Services.Sha384ExtractAndExpand, HkdfSha384ExtractAndExpand, (Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize), FALSE);
-}
-
-/**
- Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHkdfSha384Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- return CALL_BASECRYPTLIB (Hkdf.Services.Sha384Extract, HkdfSha384Extract, (Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize), FALSE);
-}
-
-/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceHkdfSha384Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return CALL_BASECRYPTLIB (Hkdf.Services.Sha384Expand, HkdfSha384Expand, (Prk, PrkSize, Info, InfoSize, Out, OutSize), FALSE);
-}
-
-/**
- Initializes the OpenSSL library.
-
- This function registers ciphers and digests used directly and indirectly
- by SSL/TLS, and initializes the readable error messages.
- This function must be called before any other action takes places.
-
- @retval TRUE The OpenSSL library has been initialized.
- @retval FALSE Failed to initialize the OpenSSL library.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceTlsInitialize (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.Initialize, TlsInitialize, (), FALSE);
-}
-
-/**
- Free an allocated SSL_CTX object.
-
- @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
-
-**/
-VOID
-EFIAPI
-CryptoServiceTlsCtxFree (
- IN VOID *TlsCtx
- )
-{
- CALL_VOID_BASECRYPTLIB (Tls.Services.CtxFree, TlsCtxFree, (TlsCtx));
-}
-
-/**
- Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
- connections.
-
- @param[in] MajorVer Major Version of TLS/SSL Protocol.
- @param[in] MinorVer Minor Version of TLS/SSL Protocol.
-
- @return Pointer to an allocated SSL_CTX object.
- If the creation failed, TlsCtxNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-CryptoServiceTlsCtxNew (
- IN UINT8 MajorVer,
- IN UINT8 MinorVer
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.CtxNew, TlsCtxNew, (MajorVer, MinorVer), NULL);
-}
-
-/**
- Free an allocated TLS object.
-
- This function removes the TLS object pointed to by Tls and frees up the
- allocated memory. If Tls is NULL, nothing is done.
-
- @param[in] Tls Pointer to the TLS object to be freed.
-
-**/
-VOID
-EFIAPI
-CryptoServiceTlsFree (
- IN VOID *Tls
- )
-{
- CALL_VOID_BASECRYPTLIB (Tls.Services.Free, TlsFree, (Tls));
-}
-
-/**
- Create a new TLS object for a connection.
-
- This function creates a new TLS object for a connection. The new object
- inherits the setting of the underlying context TlsCtx: connection method,
- options, verification setting.
-
- @param[in] TlsCtx Pointer to the SSL_CTX object.
-
- @return Pointer to an allocated SSL object.
- If the creation failed, TlsNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-CryptoServiceTlsNew (
- IN VOID *TlsCtx
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.New, TlsNew, (TlsCtx), NULL);
-}
-
-/**
- Checks if the TLS handshake was done.
-
- This function will check if the specified TLS handshake was done.
-
- @param[in] Tls Pointer to the TLS object for handshake state checking.
-
- @retval TRUE The TLS handshake was done.
- @retval FALSE The TLS handshake was not done.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceTlsInHandshake (
- IN VOID *Tls
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.InHandshake, TlsInHandshake, (Tls), FALSE);
-}
-
-/**
- Perform a TLS/SSL handshake.
-
- This function will perform a TLS/SSL handshake.
-
- @param[in] Tls Pointer to the TLS object for handshake operation.
- @param[in] BufferIn Pointer to the most recently received TLS Handshake packet.
- @param[in] BufferInSize Packet size in bytes for the most recently received TLS
- Handshake packet.
- @param[out] BufferOut Pointer to the buffer to hold the built packet.
- @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferIn is NULL but BufferInSize is NOT 0.
- BufferInSize is 0 but BufferIn is NOT NULL.
- BufferOutSize is NULL.
- BufferOut is NULL if *BufferOutSize is not zero.
- @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
- @retval EFI_ABORTED Something wrong during handshake.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsDoHandshake (
- IN VOID *Tls,
- IN UINT8 *BufferIn OPTIONAL,
- IN UINTN BufferInSize OPTIONAL,
- OUT UINT8 *BufferOut OPTIONAL,
- IN OUT UINTN *BufferOutSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.DoHandshake, TlsDoHandshake, (Tls, BufferIn, BufferInSize, BufferOut, BufferOutSize), EFI_UNSUPPORTED);
-}
-
-/**
- Handle Alert message recorded in BufferIn. If BufferIn is NULL and BufferInSize is zero,
- TLS session has errors and the response packet needs to be Alert message based on error type.
-
- @param[in] Tls Pointer to the TLS object for state checking.
- @param[in] BufferIn Pointer to the most recently received TLS Alert packet.
- @param[in] BufferInSize Packet size in bytes for the most recently received TLS
- Alert packet.
- @param[out] BufferOut Pointer to the buffer to hold the built packet.
- @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferIn is NULL but BufferInSize is NOT 0.
- BufferInSize is 0 but BufferIn is NOT NULL.
- BufferOutSize is NULL.
- BufferOut is NULL if *BufferOutSize is not zero.
- @retval EFI_ABORTED An error occurred.
- @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsHandleAlert (
- IN VOID *Tls,
- IN UINT8 *BufferIn OPTIONAL,
- IN UINTN BufferInSize OPTIONAL,
- OUT UINT8 *BufferOut OPTIONAL,
- IN OUT UINTN *BufferOutSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.HandleAlert, TlsHandleAlert, (Tls, BufferIn, BufferInSize, BufferOut, BufferOutSize), EFI_UNSUPPORTED);
-}
-
-/**
- Build the CloseNotify packet.
-
- @param[in] Tls Pointer to the TLS object for state checking.
- @param[in, out] Buffer Pointer to the buffer to hold the built packet.
- @param[in, out] BufferSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferSize is NULL.
- Buffer is NULL if *BufferSize is not zero.
- @retval EFI_BUFFER_TOO_SMALL BufferSize is too small to hold the response packet.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsCloseNotify (
- IN VOID *Tls,
- IN OUT UINT8 *Buffer,
- IN OUT UINTN *BufferSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.CloseNotify, TlsCloseNotify, (Tls, Buffer, BufferSize), EFI_UNSUPPORTED);
-}
-
-/**
- Attempts to read bytes from one TLS object and places the data in Buffer.
-
- This function will attempt to read BufferSize bytes from the TLS object
- and places the data in Buffer.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] Buffer Pointer to the buffer to store the data.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The amount of data successfully read from the TLS object.
- @retval <=0 No data was successfully read.
-
-**/
-INTN
-EFIAPI
-CryptoServiceTlsCtrlTrafficOut (
- IN VOID *Tls,
- IN OUT VOID *Buffer,
- IN UINTN BufferSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.CtrlTrafficOut, TlsCtrlTrafficOut, (Tls, Buffer, BufferSize), 0);
-}
-
-/**
- Attempts to write data from the buffer to TLS object.
-
- This function will attempt to write BufferSize bytes data from the Buffer
- to the TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The amount of data successfully written to the TLS object.
- @retval <=0 No data was successfully written.
-
-**/
-INTN
-EFIAPI
-CryptoServiceTlsCtrlTrafficIn (
- IN VOID *Tls,
- IN VOID *Buffer,
- IN UINTN BufferSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.CtrlTrafficIn, TlsCtrlTrafficIn, (Tls, Buffer, BufferSize), 0);
-}
-
-/**
- Attempts to read bytes from the specified TLS connection into the buffer.
-
- This function tries to read BufferSize bytes data from the specified TLS
- connection into the Buffer.
-
- @param[in] Tls Pointer to the TLS connection for data reading.
- @param[in,out] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The read operation was successful, and return value is the
- number of bytes actually read from the TLS connection.
- @retval <=0 The read operation was not successful.
-
-**/
-INTN
-EFIAPI
-CryptoServiceTlsRead (
- IN VOID *Tls,
- IN OUT VOID *Buffer,
- IN UINTN BufferSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.Read, TlsRead, (Tls, Buffer, BufferSize), 0);
-}
-
-/**
- Attempts to write data to a TLS connection.
-
- This function tries to write BufferSize bytes data from the Buffer into the
- specified TLS connection.
-
- @param[in] Tls Pointer to the TLS connection for data writing.
- @param[in] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The write operation was successful, and return value is the
- number of bytes actually written to the TLS connection.
- @retval <=0 The write operation was not successful.
-
-**/
-INTN
-EFIAPI
-CryptoServiceTlsWrite (
- IN VOID *Tls,
- IN VOID *Buffer,
- IN UINTN BufferSize
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.Write, TlsWrite, (Tls, Buffer, BufferSize), 0);
-}
-
-/**
- Shutdown a TLS connection.
-
- Shutdown the TLS connection without releasing the resources, meaning a new
- connection can be started without calling TlsNew() and without setting
- certificates etc.
-
- @param[in] Tls Pointer to the TLS object to shutdown.
-
- @retval EFI_SUCCESS The TLS is shutdown successfully.
- @retval EFI_INVALID_PARAMETER Tls is NULL.
- @retval EFI_PROTOCOL_ERROR Some other error occurred.
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsShutdown (
- IN VOID *Tls
- )
-{
- return CALL_BASECRYPTLIB (Tls.Services.Shutdown, TlsShutdown, (Tls), EFI_UNSUPPORTED);
-}
-
-/**
- Set a new TLS/SSL method for a particular TLS object.
-
- This function sets a new TLS/SSL method for a particular TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] MajorVer Major Version of TLS/SSL Protocol.
- @param[in] MinorVer Minor Version of TLS/SSL Protocol.
-
- @retval EFI_SUCCESS The TLS/SSL method was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetVersion (
- IN VOID *Tls,
- IN UINT8 MajorVer,
- IN UINT8 MinorVer
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.Version, TlsSetVersion, (Tls, MajorVer, MinorVer), EFI_UNSUPPORTED);
-}
-
-/**
- Set TLS object to work in client or server mode.
-
- This function prepares a TLS object to work in client or server mode.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] IsServer Work in server mode.
-
- @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetConnectionEnd (
- IN VOID *Tls,
- IN BOOLEAN IsServer
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.ConnectionEnd, TlsSetConnectionEnd, (Tls, IsServer), EFI_UNSUPPORTED);
-}
-
-/**
- Set the ciphers list to be used by the TLS object.
-
- This function sets the ciphers for use by a specified TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
- cipher identifier comes from the TLS Cipher Suite
- Registry of the IANA, interpreting Byte1 and Byte2
- in network (big endian) byte order.
- @param[in] CipherNum The number of cipher in the list.
-
- @retval EFI_SUCCESS The ciphers list was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
- @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetCipherList (
- IN VOID *Tls,
- IN UINT16 *CipherId,
- IN UINTN CipherNum
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.CipherList, TlsSetCipherList, (Tls, CipherId, CipherNum), EFI_UNSUPPORTED);
-}
-
-/**
- Set the compression method for TLS/SSL operations.
-
- This function handles TLS/SSL integrated compression methods.
-
- @param[in] CompMethod The compression method ID.
-
- @retval EFI_SUCCESS The compression method for the communication was
- set successfully.
- @retval EFI_UNSUPPORTED Unsupported compression method.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetCompressionMethod (
- IN UINT8 CompMethod
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.CompressionMethod, TlsSetCompressionMethod, (CompMethod), EFI_UNSUPPORTED);
-}
-
-/**
- Set peer certificate verification mode for the TLS connection.
-
- This function sets the verification mode flags for the TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] VerifyMode A set of logically or'ed verification mode flags.
-
-**/
-VOID
-EFIAPI
-CryptoServiceTlsSetVerify (
- IN VOID *Tls,
- IN UINT32 VerifyMode
- )
-{
- CALL_VOID_BASECRYPTLIB (TlsSet.Services.Verify, TlsSetVerify, (Tls, VerifyMode));
-}
-
-/**
- Set the specified host name to be verified.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Flags The setting flags during the validation.
- @param[in] HostName The specified host name to be verified.
-
- @retval EFI_SUCCESS The HostName setting was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_ABORTED Invalid HostName setting.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetVerifyHost (
- IN VOID *Tls,
- IN UINT32 Flags,
- IN CHAR8 *HostName
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.VerifyHost, TlsSetVerifyHost, (Tls, Flags, HostName), EFI_UNSUPPORTED);
-}
-
-/**
- Sets a TLS/SSL session ID to be used during TLS/SSL connect.
-
- This function sets a session ID to be used when the TLS/SSL connection is
- to be established.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] SessionId Session ID data used for session resumption.
- @param[in] SessionIdLen Length of Session ID in bytes.
-
- @retval EFI_SUCCESS Session ID was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED No available session for ID setting.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetSessionId (
- IN VOID *Tls,
- IN UINT8 *SessionId,
- IN UINT16 SessionIdLen
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.SessionId, TlsSetSessionId, (Tls, SessionId, SessionIdLen), EFI_UNSUPPORTED);
-}
-
-/**
- Adds the CA to the cert store when requesting Server or Client authentication.
-
- This function adds the CA certificate to the list of CAs when requesting
- Server or Client authentication for the chosen TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded binary
- X.509 certificate or PEM-encoded X.509 certificate.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
- @retval EFI_ABORTED Invalid X.509 certificate.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetCaCertificate (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.CaCertificate, TlsSetCaCertificate, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Loads the local public certificate into the specified TLS object.
-
- This function loads the X.509 certificate into the specified TLS object
- for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded binary
- X.509 certificate or PEM-encoded X.509 certificate.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
- @retval EFI_ABORTED Invalid X.509 certificate.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetHostPublicCert (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.HostPublicCert, TlsSetHostPublicCert, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Adds the local private key to the specified TLS object.
-
- This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
- key) into the specified TLS object for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
- or PKCS#8 private key.
- @param[in] DataSize The size of data buffer in bytes.
- @param[in] Password Pointer to NULL-terminated private key password, set it to NULL
- if private key not encrypted.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid private key data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetHostPrivateKeyEx (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize,
- IN VOID *Password OPTIONAL
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.HostPrivateKeyEx, TlsSetHostPrivateKeyEx, (Tls, Data, DataSize, Password), EFI_UNSUPPORTED);
-}
-
-/**
- Adds the local private key to the specified TLS object.
-
- This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
- key) into the specified TLS object for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
- or PKCS#8 private key.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid private key data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetHostPrivateKey (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.HostPrivateKey, TlsSetHostPrivateKey, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Adds the CA-supplied certificate revocation list for certificate validation.
-
- This function adds the CA-supplied certificate revocation list data for
- certificate validity checking.
-
- @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid CRL data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetCertRevocationList (
- IN VOID *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.CertRevocationList, TlsSetCertRevocationList, (Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Set the signature algorithm list to used by the TLS object.
-
- This function sets the signature algorithms for use by a specified TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] Data Array of UINT8 of signature algorithms. The array consists of
- pairs of the hash algorithm and the signature algorithm as defined
- in RFC 5246
- @param[in] DataSize The length the SignatureAlgoList. Must be divisible by 2.
-
- @retval EFI_SUCCESS The signature algorithm list was set successfully.
- @retval EFI_INVALID_PARAMETER The parameters are invalid.
- @retval EFI_UNSUPPORTED No supported TLS signature algorithm was found in SignatureAlgoList
- @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetSignatureAlgoList (
- IN VOID *Tls,
- IN UINT8 *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.SignatureAlgoList, TlsSetSignatureAlgoList, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Set the EC curve to be used for TLS flows
-
- This function sets the EC curve to be used for TLS flows.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] Data An EC named curve as defined in section 5.1.1 of RFC 4492.
- @param[in] DataSize Size of Data, it should be sizeof (UINT32)
-
- @retval EFI_SUCCESS The EC curve was set successfully.
- @retval EFI_INVALID_PARAMETER The parameters are invalid.
- @retval EFI_UNSUPPORTED The requested TLS EC curve is not supported
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsSetEcCurve (
- IN VOID *Tls,
- IN UINT8 *Data,
- IN UINTN DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsSet.Services.EcCurve, TlsSetEcCurve, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the protocol version used by the specified TLS connection.
-
- This function returns the protocol version used by the specified TLS
- connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The protocol version of the specified TLS connection.
-
-**/
-UINT16
-EFIAPI
-CryptoServiceTlsGetVersion (
- IN VOID *Tls
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.Version, TlsGetVersion, (Tls), 0);
-}
-
-/**
- Gets the connection end of the specified TLS connection.
-
- This function returns the connection end (as client or as server) used by
- the specified TLS connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The connection end used by the specified TLS connection.
-
-**/
-UINT8
-EFIAPI
-CryptoServiceTlsGetConnectionEnd (
- IN VOID *Tls
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.ConnectionEnd, TlsGetConnectionEnd, (Tls), 0);
-}
-
-/**
- Gets the cipher suite used by the specified TLS connection.
-
- This function returns current cipher suite used by the specified
- TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] CipherId The cipher suite used by the TLS object.
-
- @retval EFI_SUCCESS The cipher suite was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported cipher suite.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetCurrentCipher (
- IN VOID *Tls,
- IN OUT UINT16 *CipherId
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.CurrentCipher, TlsGetCurrentCipher, (Tls, CipherId), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the compression methods used by the specified TLS connection.
-
- This function returns current integrated compression methods used by
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] CompressionId The current compression method used by
- the TLS object.
-
- @retval EFI_SUCCESS The compression method was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_ABORTED Invalid Compression method.
- @retval EFI_UNSUPPORTED This function is not supported.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetCurrentCompressionId (
- IN VOID *Tls,
- IN OUT UINT8 *CompressionId
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.CurrentCompressionId, TlsGetCurrentCompressionId, (Tls, CompressionId), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the verification mode currently set in the TLS connection.
-
- This function returns the peer verification mode currently set in the
- specified TLS connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The verification mode set in the specified TLS connection.
-
-**/
-UINT32
-EFIAPI
-CryptoServiceTlsGetVerify (
- IN VOID *Tls
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.Verify, TlsGetVerify, (Tls), 0);
-}
-
-/**
- Gets the session ID used by the specified TLS connection.
-
- This function returns the TLS/SSL session ID currently used by the
- specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] SessionId Buffer to contain the returned session ID.
- @param[in,out] SessionIdLen The length of Session ID in bytes.
-
- @retval EFI_SUCCESS The Session ID was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetSessionId (
- IN VOID *Tls,
- IN OUT UINT8 *SessionId,
- IN OUT UINT16 *SessionIdLen
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.SessionId, TlsGetSessionId, (Tls, SessionId, SessionIdLen), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the client random data used in the specified TLS connection.
-
- This function returns the TLS/SSL client random data currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] ClientRandom Buffer to contain the returned client
- random data (32 bytes).
-
-**/
-VOID
-EFIAPI
-CryptoServiceTlsGetClientRandom (
- IN VOID *Tls,
- IN OUT UINT8 *ClientRandom
- )
-{
- CALL_VOID_BASECRYPTLIB (TlsGet.Services.ClientRandom, TlsGetClientRandom, (Tls, ClientRandom));
-}
-
-/**
- Gets the server random data used in the specified TLS connection.
-
- This function returns the TLS/SSL server random data currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] ServerRandom Buffer to contain the returned server
- random data (32 bytes).
-
-**/
-VOID
-EFIAPI
-CryptoServiceTlsGetServerRandom (
- IN VOID *Tls,
- IN OUT UINT8 *ServerRandom
- )
-{
- CALL_VOID_BASECRYPTLIB (TlsGet.Services.ServerRandom, TlsGetServerRandom, (Tls, ServerRandom));
-}
-
-/**
- Gets the master key data used in the specified TLS connection.
-
- This function returns the TLS/SSL master key material currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] KeyMaterial Buffer to contain the returned key material.
-
- @retval EFI_SUCCESS Key material was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetKeyMaterial (
- IN VOID *Tls,
- IN OUT UINT8 *KeyMaterial
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.KeyMaterial, TlsGetKeyMaterial, (Tls, KeyMaterial), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the CA Certificate from the cert store.
-
- This function returns the CA certificate for the chosen
- TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the CA
- certificate data sent to the client.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetCaCertificate (
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.CaCertificate, TlsGetCaCertificate, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the local public Certificate set in the specified TLS object.
-
- This function returns the local public certificate which was currently set
- in the specified TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the local
- public certificate.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_NOT_FOUND The certificate is not found.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetHostPublicCert (
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.HostPublicCert, TlsGetHostPublicCert, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the local private key set in the specified TLS object.
-
- This function returns the local private key data which was currently set
- in the specified TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the local
- private key data.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetHostPrivateKey (
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.HostPrivateKey, TlsGetHostPrivateKey, (Tls, Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Gets the CA-supplied certificate revocation list data set in the specified
- TLS object.
-
- This function returns the CA-supplied certificate revocation list data which
- was currently set in the specified TLS object.
-
- @param[out] Data Pointer to the data buffer to receive the CRL data.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetCertRevocationList (
- OUT VOID *Data,
- IN OUT UINTN *DataSize
- )
-{
- return CALL_BASECRYPTLIB (TlsGet.Services.CertRevocationList, TlsGetCertRevocationList, (Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Derive keying material from a TLS connection.
-
- This function exports keying material using the mechanism described in RFC
- 5705.
-
- @param[in] Tls Pointer to the TLS object
- @param[in] Label Description of the key for the PRF function
- @param[in] Context Optional context
- @param[in] ContextLen The length of the context value in bytes
- @param[out] KeyBuffer Buffer to hold the output of the TLS-PRF
- @param[in] KeyBufferLen The length of the KeyBuffer
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The TLS object is invalid.
- @retval EFI_PROTOCOL_ERROR Some other error occurred.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoServiceTlsGetExportKey (
- IN VOID *Tls,
- IN CONST VOID *Label,
- IN CONST VOID *Context,
- IN UINTN ContextLen,
- OUT VOID *KeyBuffer,
- IN UINTN KeyBufferLen
- )
-{
- return CALL_BASECRYPTLIB (
- TlsGet.Services.ExportKey,
- TlsGetExportKey,
- (Tls, Label, Context, ContextLen,
- KeyBuffer, KeyBufferLen),
- EFI_UNSUPPORTED
- );
-}
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
- RFC 8017.
- Mask generation function is the same as the message digest algorithm.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If Message is NULL, then return FALSE.
- If MsgSize is zero or > INT_MAX, then return FALSE.
- If DigestLen is NOT 32, 48 or 64, return FALSE.
- If SaltLen is not equal to DigestLen, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] Message Pointer to octet message to be signed.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
- @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
- @param[out] Signature Pointer to buffer to receive RSA PSS signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in RSASSA-PSS.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaPssSign (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- return CALL_BASECRYPTLIB (RsaPss.Services.Sign, RsaPssSign, (RsaContext, Message, MsgSize, DigestLen, SaltLen, Signature, SigSize), FALSE);
-}
-
-/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceRsaPssVerify (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
- )
-{
- return CALL_BASECRYPTLIB (RsaPss.Services.Verify, RsaPssVerify, (RsaContext, Message, MsgSize, Signature, SigSize, DigestLen, SaltLen), FALSE);
-}
-
-/**
- Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
- published December 2016.
-
- @param[in] Input Pointer to the input message (X).
- @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
- @param[in] BlockSize The size of each block (B).
- @param[out] Output Pointer to the output buffer.
- @param[in] OutputByteLen The desired number of output bytes (L).
- @param[in] Customization Pointer to the customization string (S).
- @param[in] CustomByteLen The length of the customization string in bytes.
-
- @retval TRUE ParallelHash256 digest computation succeeded.
- @retval FALSE ParallelHash256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceParallelHash256HashAll (
- IN CONST VOID *Input,
- IN UINTN InputByteLen,
- IN UINTN BlockSize,
- OUT VOID *Output,
- IN UINTN OutputByteLen,
- IN CONST VOID *Customization,
- IN UINTN CustomByteLen
- )
-{
- return CALL_BASECRYPTLIB (ParallelHash.Services.HashAll, ParallelHash256HashAll, (Input, InputByteLen, BlockSize, Output, OutputByteLen, Customization, CustomByteLen), FALSE);
-}
-
-/**
- Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be encrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the encryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAeadAesGcmEncrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- OUT UINT8 *TagOut,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- return CALL_BASECRYPTLIB (AeadAesGcm.Services.Encrypt, AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);
-}
-
-/**
- Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
- If additional authenticated data verification fails, FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be decrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[in] Tag Pointer to a buffer that contains the authentication tag.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the decryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated decryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceAeadAesGcmDecrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- IN CONST UINT8 *Tag,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- return CALL_BASECRYPTLIB (AeadAesGcm.Services.Decrypt, AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);
-}
-
-// =====================================================================================
-// Big number primitives
-// =====================================================================================
-
-/**
- Allocate new Big Number.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-CryptoServiceBigNumInit (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Init, BigNumInit, (), NULL);
-}
-
-/**
- Allocate new Big Number and assign the provided value to it.
-
- @param[in] Buf Big endian encoded buffer.
- @param[in] Len Buffer length.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-CryptoServiceBigNumFromBin (
- IN CONST UINT8 *Buf,
- IN UINTN Len
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.FromBin, BigNumFromBin, (Buf, Len), NULL);
-}
-
-/**
- Convert the absolute value of Bn into big-endian form and store it at Buf.
- The Buf array should have at least BigNumBytes() in it.
-
- @param[in] Bn Big number to convert.
- @param[out] Buf Output buffer.
-
- @retval The length of the big-endian number placed at Buf or -1 on error.
-**/
-INTN
-EFIAPI
-CryptoServiceBigNumToBin (
- IN CONST VOID *Bn,
- OUT UINT8 *Buf
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.ToBin, BigNumToBin, (Bn, Buf), -1);
-}
-
-/**
- Free the Big Number.
-
- @param[in] Bn Big number to free.
- @param[in] Clear TRUE if the buffer should be cleared.
-**/
-VOID
-EFIAPI
-CryptoServiceBigNumFree (
- IN VOID *Bn,
- IN BOOLEAN Clear
- )
-{
- CALL_VOID_BASECRYPTLIB (Bn.Services.Free, BigNumFree, (Bn, Clear));
-}
-
-/**
- Calculate the sum of two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA + BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumAdd (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Add, BigNumAdd, (BnA, BnB, BnRes), FALSE);
-}
-
-/**
- Subtract two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA - BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumSub (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Sub, BigNumSub, (BnA, BnB, BnRes), FALSE);
-}
-
-/**
- Calculate remainder: BnRes = BnA % BnB.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA % BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Mod, BigNumMod, (BnA, BnB, BnRes), FALSE);
-}
-
-/**
- Compute BnA to the BnP-th power modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized.
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnP Big number (power).
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result of (BnA ^ BnP) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumExpMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnP,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.ExpMod, BigNumExpMod, (BnA, BnP, BnM, BnRes), FALSE);
-}
-
-/**
- Compute BnA inverse modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumInverseMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.InverseMod, BigNumInverseMod, (BnA, BnM, BnRes), FALSE);
-}
-
-/**
- Divide two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result, such that BnA / BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumDiv (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Div, BigNumDiv, (BnA, BnB, BnRes), FALSE);
-}
-
-/**
- Multiply two Big Numbers modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumMulMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.MulMod, BigNumMulMod, (BnA, BnB, BnM, BnRes), FALSE);
-}
-
-/**
- Compare two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
-
- @retval 0 BnA == BnB.
- @retval 1 BnA > BnB.
- @retval -1 BnA < BnB.
-**/
-INTN
-EFIAPI
-CryptoServiceBigNumCmp (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Cmp, BigNumCmp, (BnA, BnB), 0);
-}
-
-/**
- Get number of bits in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bits.
-**/
-UINTN
-EFIAPI
-CryptoServiceBigNumBits (
- IN CONST VOID *Bn
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Bits, BigNumBits, (Bn), 0);
-}
-
-/**
- Get number of bytes in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bytes.
-**/
-UINTN
-EFIAPI
-CryptoServiceBigNumBytes (
- IN CONST VOID *Bn
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Bytes, BigNumBytes, (Bn), 0);
-}
-
-/**
- Checks if Big Number equals to the given Num.
-
- @param[in] Bn Big number.
- @param[in] Num Number.
-
- @retval TRUE iff Bn == Num.
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumIsWord (
- IN CONST VOID *Bn,
- IN UINTN Num
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.IsWord, BigNumIsWord, (Bn, Num), FALSE);
-}
-
-/**
- Checks if Big Number is odd.
-
- @param[in] Bn Big number.
-
- @retval TRUE Bn is odd (Bn % 2 == 1).
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumIsOdd (
- IN CONST VOID *Bn
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.IsOdd, BigNumIsOdd, (Bn), FALSE);
-}
-
-/**
- Copy Big number.
-
- @param[out] BnDst Destination.
- @param[in] BnSrc Source.
-
- @retval BnDst on success.
- @retval NULL otherwise.
-**/
-VOID *
-EFIAPI
-CryptoServiceBigNumCopy (
- OUT VOID *BnDst,
- IN CONST VOID *BnSrc
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.Copy, BigNumCopy, (BnDst, BnSrc), NULL);
-}
-
-/**
- Get constant Big number with value of "1".
- This may be used to save expensive allocations.
-
- @retval Big Number with value of 1.
-**/
-CONST VOID *
-EFIAPI
-CryptoServiceBigNumValueOne (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.ValueOne, BigNumValueOne, (), NULL);
-}
-
-/**
- Shift right Big Number.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] Bn Big number.
- @param[in] N Number of bits to shift.
- @param[out] BnRes The result.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumRShift (
- IN CONST VOID *Bn,
- IN UINTN N,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.RShift, BigNumRShift, (Bn, N, BnRes), FALSE);
-}
-
-/**
- Mark Big Number for constant time computations.
- This function should be called before any constant time computations are
- performed on the given Big number.
-
- @param[in] Bn Big number.
-**/
-VOID
-EFIAPI
-CryptoServiceBigNumConstTime (
- IN VOID *Bn
- )
-{
- CALL_VOID_BASECRYPTLIB (Bn.Services.ConstTime, BigNumConstTime, (Bn));
-}
-
-/**
- Calculate square modulo.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumSqrMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.SqrMod, BigNumSqrMod, (BnA, BnM, BnRes), FALSE);
-}
-
-/**
- Create new Big Number computation context. This is an opaque structure
- which should be passed to any function that requires it. The BN context is
- needed to optimize calculations and expensive allocations.
-
- @retval Big Number context struct or NULL on failure.
-**/
-VOID *
-EFIAPI
-CryptoServiceBigNumNewContext (
- VOID
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.NewContext, BigNumNewContext, (), NULL);
-}
-
-/**
- Free Big Number context that was allocated with BigNumNewContext().
-
- @param[in] BnCtx Big number context to free.
-**/
-VOID
-EFIAPI
-CryptoServiceBigNumContextFree (
- IN VOID *BnCtx
- )
-{
- CALL_VOID_BASECRYPTLIB (Bn.Services.ContextFree, BigNumContextFree, (BnCtx));
-}
-
-/**
- Set Big Number to a given value.
-
- @param[in] Bn Big number to set.
- @param[in] Val Value to set.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumSetUint (
- IN VOID *Bn,
- IN UINTN Val
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.SetUint, BigNumSetUint, (Bn, Val), FALSE);
-}
-
-/**
- Add two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA + BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceBigNumAddMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- return CALL_BASECRYPTLIB (Bn.Services.AddMod, BigNumAddMod, (BnA, BnB, BnM, BnRes), FALSE);
-}
-
-// =====================================================================================
-// Basic Elliptic Curve Primitives
-// =====================================================================================
-
-/**
- Initialize new opaque EcGroup object. This object represents an EC curve and
- and is used for calculation within this group. This object should be freed
- using EcGroupFree() function.
-
- @param[in] CryptoNid Identifying number for the ECC curve (Defined in
- BaseCryptLib.h).
-
- @retval EcGroup object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-CryptoServiceEcGroupInit (
- IN UINTN CryptoNid
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GroupInit, EcGroupInit, (CryptoNid), NULL);
-}
-
-/**
- Get EC curve parameters. While elliptic curve equation is Y^2 mod P = (X^3 + AX + B) Mod P.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
- @param[in] EcGroup EC group object.
- @param[out] BnPrime Group prime number.
- @param[out] BnA A coefficient.
- @param[out] BnB B coefficient.
- @param[in] BnCtx BN context.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcGroupGetCurve (
- IN CONST VOID *EcGroup,
- OUT VOID *BnPrime,
- OUT VOID *BnA,
- OUT VOID *BnB,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GroupGetCurve, EcGroupGetCurve, (EcGroup, BnPrime, BnA, BnB, BnCtx), FALSE);
-}
-
-/**
- Get EC group order.
- This function will set the provided Big Number object to the corresponding
- value. The caller needs to make sure that the "out" BigNumber parameter
- is properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnOrder Group prime number.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcGroupGetOrder (
- IN VOID *EcGroup,
- OUT VOID *BnOrder
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GroupGetOrder, EcGroupGetOrder, (EcGroup, BnOrder), FALSE);
-}
-
-/**
- Free previously allocated EC group object using EcGroupInit().
-
- @param[in] EcGroup EC group object to free.
-**/
-VOID
-EFIAPI
-CryptoServiceEcGroupFree (
- IN VOID *EcGroup
- )
-{
- CALL_VOID_BASECRYPTLIB (Ec.Services.GroupFree, EcGroupFree, (EcGroup));
-}
-
-/**
- Initialize new opaque EC Point object. This object represents an EC point
- within the given EC group (curve).
-
- @param[in] EC Group, properly initialized using EcGroupInit().
-
- @retval EC Point object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-CryptoServiceEcPointInit (
- IN CONST VOID *EcGroup
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointInit, EcPointInit, (EcGroup), NULL);
-}
-
-/**
- Free previously allocated EC Point object using EcPointInit().
-
- @param[in] EcPoint EC Point to free.
- @param[in] Clear TRUE iff the memory should be cleared.
-**/
-VOID
-EFIAPI
-CryptoServiceEcPointDeInit (
- IN VOID *EcPoint,
- IN BOOLEAN Clear
- )
-{
- CALL_VOID_BASECRYPTLIB (Ec.Services.PointDeInit, EcPointDeInit, (EcPoint, Clear));
-}
-
-/**
- Get EC point affine (x,y) coordinates.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[out] BnX X coordinate.
- @param[out] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointGetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- OUT VOID *BnX,
- OUT VOID *BnY,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointGetAffineCoordinates, EcPointGetAffineCoordinates, (EcGroup, EcPoint, BnX, BnY, BnCtx), FALSE);
-}
-
-/**
- Set EC point affine (x,y) coordinates.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[in] BnX X coordinate.
- @param[in] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointSetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN CONST VOID *BnY,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointSetAffineCoordinates, EcPointSetAffineCoordinates, (EcGroup, EcPoint, BnX, BnY, BnCtx), FALSE);
-}
-
-/**
- EC Point addition. EcPointResult = EcPointA + EcPointB.
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPointA EC Point.
- @param[in] EcPointB EC Point.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointAdd (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointAdd, EcPointAdd, (EcGroup, EcPointResult, EcPointA, EcPointB, BnCtx), FALSE);
-}
-
-/**
- Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPoint EC Point.
- @param[in] BnPScalar P Scalar.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointMul (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPoint,
- IN CONST VOID *BnPScalar,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointMul, EcPointMul, (EcGroup, EcPointResult, EcPoint, BnPScalar, BnCtx), FALSE);
-}
-
-/**
- Calculate the inverse of the supplied EC point.
-
- @param[in] EcGroup EC group object.
- @param[in,out] EcPoint EC point to invert.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointInvert (
- IN CONST VOID *EcGroup,
- IN OUT VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointInvert, EcPointInvert, (EcGroup, EcPoint, BnCtx), FALSE);
-}
-
-/**
- Check if the supplied point is on EC curve.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On curve.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointIsOnCurve (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointIsOnCurve, EcPointIsOnCurve, (EcGroup, EcPoint, BnCtx), FALSE);
-}
-
-/**
- Check if the supplied point is at infinity.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
-
- @retval TRUE At infinity.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointIsAtInfinity (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointIsAtInfinity, EcPointIsAtInfinity, (EcGroup, EcPoint), FALSE);
-}
-
-/**
- Check if EC points are equal.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPointA EC point A.
- @param[in] EcPointB EC point B.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE A == B.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointEqual (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointEqual, EcPointEqual, (EcGroup, EcPointA, EcPointB, BnCtx), FALSE);
-}
-
-/**
- Set EC point compressed coordinates. Points can be described in terms of
- their compressed coordinates. For a point (x, y), for any given value for x
- such that the point is on the curve there will only ever be two possible
- values for y. Therefore, a point can be set using this function where BnX is
- the x coordinate and YBit is a value 0 or 1 to identify which of the two
- possible values for y should be used.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC Point.
- @param[in] BnX X coordinate.
- @param[in] YBit 0 or 1 to identify which Y value is used.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcPointSetCompressedCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN UINT8 YBit,
- IN VOID *BnCtx
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.PointSetCompressedCoordinates, EcPointSetCompressedCoordinates, (EcGroup, EcPoint, BnX, YBit, BnCtx), FALSE);
-}
-
-// =====================================================================================
-// Elliptic Curve Diffie Hellman Primitives
-// =====================================================================================
-
-/**
- Allocates and Initializes one Elliptic Curve Context for subsequent use
- with the NID.
-
- @param[in] Nid cipher NID
- @return Pointer to the Elliptic Curve Context that has been initialized.
- If the allocations fails, EcNewByNid() returns NULL.
-**/
-VOID *
-EFIAPI
-CryptoServiceEcNewByNid (
- IN UINTN Nid
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.NewByNid, EcNewByNid, (Nid), NULL);
-}
-
-/**
- Release the specified EC context.
-
- @param[in] EcContext Pointer to the EC context to be released.
-**/
-VOID
-EFIAPI
-CryptoServiceEcFree (
- IN VOID *EcContext
- )
-{
- CALL_VOID_BASECRYPTLIB (Ec.Services.Free, EcFree, (EcContext));
-}
-
-/**
- Generates EC key and returns EC public key (X, Y), Please note, this function uses
- pseudo random number generator. The caller must make sure RandomSeed()
- function was properly called before.
- The Ec context should be correctly initialized by EcNewByNid.
- This function generates random secret, and computes the public key (X, Y), which is
- returned via parameter Public, PublicSize.
- X is the first half of Public with size being PublicSize / 2,
- Y is the second half of Public with size being PublicSize / 2.
- EC context is updated accordingly.
- If the Public buffer is too small to hold the public X, Y, FALSE is returned and
- PublicSize is set to the required buffer size to obtain the public X, Y.
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- If EcContext is NULL, then return FALSE.
- If PublicSize is NULL, then return FALSE.
- If PublicSize is large enough but Public is NULL, then return FALSE.
- @param[in, out] EcContext Pointer to the EC context.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC public X,Y generation succeeded.
- @retval FALSE EC public X,Y generation failed.
- @retval FALSE PublicKeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcGenerateKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GenerateKey, EcGenerateKey, (EcContext, PublicKey, PublicKeySize), FALSE);
-}
-
-/**
- Gets the public key component from the established EC context.
- The Ec context should be correctly initialized by EcNewByNid, and successfully
- generate key pair from EcGenerateKey().
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to EC context being set.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC key component was retrieved successfully.
- @retval FALSE Invalid EC key component.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcGetPubKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GetPubKey, EcGetPubKey, (EcContext, PublicKey, PublicKeySize), FALSE);
-}
-
-/**
- Computes exchanged common key.
- Given peer's public key (X, Y), this function computes the exchanged common key,
- based on its own context including value of curve parameter and random secret.
- X is the first half of PeerPublic with size being PeerPublicSize / 2,
- Y is the second half of PeerPublic with size being PeerPublicSize / 2.
- If EcContext is NULL, then return FALSE.
- If PeerPublic is NULL, then return FALSE.
- If PeerPublicSize is 0, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- For P-256, the PeerPublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PeerPublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PeerPublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to the EC context.
- @param[in] PeerPublic Pointer to the peer's public X,Y.
- @param[in] PeerPublicSize Size of peer's public X,Y in bytes.
- @param[in] CompressFlag Flag of PeerPublic is compressed or not.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
- @retval TRUE EC exchanged key generation succeeded.
- @retval FALSE EC exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcDhComputeKey (
- IN OUT VOID *EcContext,
- IN CONST UINT8 *PeerPublic,
- IN UINTN PeerPublicSize,
- IN CONST INT32 *CompressFlag,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.DhComputeKey, EcDhComputeKey, (EcContext, PeerPublic, PeerPublicSize, CompressFlag, Key, KeySize), FALSE);
-}
-
-/**
- Retrieve the EC Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC public key component. Use EcFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve EC public key from X509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **EcContext
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GetPublicKeyFromX509, EcGetPublicKeyFromX509, (Cert, CertSize, EcContext), FALSE);
-}
-
-/**
- Retrieve the EC Private Key from the password-protected PEM key data.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC private key component. Use EcFree() function to free the
- resource.
-
- If PemData is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **EcContext
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.GetPrivateKeyFromPem, EcGetPrivateKeyFromPem, (PemData, PemSize, Password, EcContext), FALSE);
-}
-
-/**
- Carries out the EC-DSA signature.
-
- This function carries out the EC-DSA signature.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
- If SigSize is large enough but Signature is NULL, then return FALSE.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature generation.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive EC-DSA signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in EC-DSA.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcDsaSign (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.DsaSign, EcDsaSign, (EcContext, HashNid, MessageHash, HashSize, Signature, SigSize), FALSE);
-}
-
-/**
- Verifies the EC-DSA signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature verification.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to EC-DSA signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in EC-DSA.
- @retval FALSE Invalid signature or invalid EC context.
-
-**/
-BOOLEAN
-EFIAPI
-CryptoServiceEcDsaVerify (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- return CALL_BASECRYPTLIB (Ec.Services.DsaVerify, EcDsaVerify, (EcContext, HashNid, MessageHash, HashSize, Signature, SigSize), FALSE);
-}
-
-const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
- /// Version
- CryptoServiceGetCryptoVersion,
- /// HMAC MD5 - deprecated and unsupported
- DeprecatedCryptoServiceHmacMd5New,
- DeprecatedCryptoServiceHmacMd5Free,
- DeprecatedCryptoServiceHmacMd5SetKey,
- DeprecatedCryptoServiceHmacMd5Duplicate,
- DeprecatedCryptoServiceHmacMd5Update,
- DeprecatedCryptoServiceHmacMd5Final,
- /// HMAC SHA1 - deprecated and unsupported
- DeprecatedCryptoServiceHmacSha1New,
- DeprecatedCryptoServiceHmacSha1Free,
- DeprecatedCryptoServiceHmacSha1SetKey,
- DeprecatedCryptoServiceHmacSha1Duplicate,
- DeprecatedCryptoServiceHmacSha1Update,
- DeprecatedCryptoServiceHmacSha1Final,
- /// HMAC SHA256
- CryptoServiceHmacSha256New,
- CryptoServiceHmacSha256Free,
- CryptoServiceHmacSha256SetKey,
- CryptoServiceHmacSha256Duplicate,
- CryptoServiceHmacSha256Update,
- CryptoServiceHmacSha256Final,
- /// Md4 - deprecated and unsupported
- DeprecatedCryptoServiceMd4GetContextSize,
- DeprecatedCryptoServiceMd4Init,
- DeprecatedCryptoServiceMd4Duplicate,
- DeprecatedCryptoServiceMd4Update,
- DeprecatedCryptoServiceMd4Final,
- DeprecatedCryptoServiceMd4HashAll,
- #ifndef ENABLE_MD5_DEPRECATED_INTERFACES
- /// Md5 - deprecated and unsupported
- DeprecatedCryptoServiceMd5GetContextSize,
- DeprecatedCryptoServiceMd5Init,
- DeprecatedCryptoServiceMd5Duplicate,
- DeprecatedCryptoServiceMd5Update,
- DeprecatedCryptoServiceMd5Final,
- DeprecatedCryptoServiceMd5HashAll,
- #else
- /// Md5
- CryptoServiceMd5GetContextSize,
- CryptoServiceMd5Init,
- CryptoServiceMd5Duplicate,
- CryptoServiceMd5Update,
- CryptoServiceMd5Final,
- CryptoServiceMd5HashAll,
- #endif
- /// Pkcs
- CryptoServicePkcs1v2Encrypt,
- CryptoServicePkcs5HashPassword,
- CryptoServicePkcs7Verify,
- CryptoServiceVerifyEKUsInPkcs7Signature,
- CryptoServicePkcs7GetSigners,
- CryptoServicePkcs7FreeSigners,
- CryptoServicePkcs7Sign,
- CryptoServicePkcs7GetAttachedContent,
- CryptoServicePkcs7GetCertificatesList,
- CryptoServiceAuthenticodeVerify,
- CryptoServiceImageTimestampVerify,
- /// DH
- CryptoServiceDhNew,
- CryptoServiceDhFree,
- CryptoServiceDhGenerateParameter,
- CryptoServiceDhSetParameter,
- CryptoServiceDhGenerateKey,
- CryptoServiceDhComputeKey,
- /// Random
- CryptoServiceRandomSeed,
- CryptoServiceRandomBytes,
- /// RSA
- CryptoServiceRsaPkcs1Verify,
- CryptoServiceRsaNew,
- CryptoServiceRsaFree,
- CryptoServiceRsaSetKey,
- CryptoServiceRsaGetKey,
- CryptoServiceRsaGenerateKey,
- CryptoServiceRsaCheckKey,
- CryptoServiceRsaPkcs1Sign,
- CryptoServiceRsaPkcs1Verify,
- CryptoServiceRsaGetPrivateKeyFromPem,
- CryptoServiceRsaGetPublicKeyFromX509,
- #ifdef DISABLE_SHA1_DEPRECATED_INTERFACES
- /// Sha1 - deprecated and unsupported
- DeprecatedCryptoServiceSha1GetContextSize,
- DeprecatedCryptoServiceSha1Init,
- DeprecatedCryptoServiceSha1Duplicate,
- DeprecatedCryptoServiceSha1Update,
- DeprecatedCryptoServiceSha1Final,
- DeprecatedCryptoServiceSha1HashAll,
- #else
- /// Sha1
- CryptoServiceSha1GetContextSize,
- CryptoServiceSha1Init,
- CryptoServiceSha1Duplicate,
- CryptoServiceSha1Update,
- CryptoServiceSha1Final,
- CryptoServiceSha1HashAll,
- #endif
- /// Sha256
- CryptoServiceSha256GetContextSize,
- CryptoServiceSha256Init,
- CryptoServiceSha256Duplicate,
- CryptoServiceSha256Update,
- CryptoServiceSha256Final,
- CryptoServiceSha256HashAll,
- /// Sha384
- CryptoServiceSha384GetContextSize,
- CryptoServiceSha384Init,
- CryptoServiceSha384Duplicate,
- CryptoServiceSha384Update,
- CryptoServiceSha384Final,
- CryptoServiceSha384HashAll,
- /// Sha512
- CryptoServiceSha512GetContextSize,
- CryptoServiceSha512Init,
- CryptoServiceSha512Duplicate,
- CryptoServiceSha512Update,
- CryptoServiceSha512Final,
- CryptoServiceSha512HashAll,
- /// X509
- CryptoServiceX509GetSubjectName,
- CryptoServiceX509GetCommonName,
- CryptoServiceX509GetOrganizationName,
- CryptoServiceX509VerifyCert,
- CryptoServiceX509ConstructCertificate,
- CryptoServiceX509ConstructCertificateStack,
- CryptoServiceX509Free,
- CryptoServiceX509StackFree,
- CryptoServiceX509GetTBSCert,
- /// TDES - deprecated and unsupported
- DeprecatedCryptoServiceTdesGetContextSize,
- DeprecatedCryptoServiceTdesInit,
- DeprecatedCryptoServiceTdesEcbEncrypt,
- DeprecatedCryptoServiceTdesEcbDecrypt,
- DeprecatedCryptoServiceTdesCbcEncrypt,
- DeprecatedCryptoServiceTdesCbcDecrypt,
- /// AES - ECB mode is deprecated and unsupported
- CryptoServiceAesGetContextSize,
- CryptoServiceAesInit,
- DeprecatedCryptoServiceAesEcbEncrypt,
- DeprecatedCryptoServiceAesEcbDecrypt,
- CryptoServiceAesCbcEncrypt,
- CryptoServiceAesCbcDecrypt,
- /// Arc4 - deprecated and unsupported
- DeprecatedCryptoServiceArc4GetContextSize,
- DeprecatedCryptoServiceArc4Init,
- DeprecatedCryptoServiceArc4Encrypt,
- DeprecatedCryptoServiceArc4Decrypt,
- DeprecatedCryptoServiceArc4Reset,
- /// SM3
- CryptoServiceSm3GetContextSize,
- CryptoServiceSm3Init,
- CryptoServiceSm3Duplicate,
- CryptoServiceSm3Update,
- CryptoServiceSm3Final,
- CryptoServiceSm3HashAll,
- /// HKDF
- CryptoServiceHkdfSha256ExtractAndExpand,
- /// X509 (Continued)
- CryptoServiceX509ConstructCertificateStackV,
- /// TLS
- CryptoServiceTlsInitialize,
- CryptoServiceTlsCtxFree,
- CryptoServiceTlsCtxNew,
- CryptoServiceTlsFree,
- CryptoServiceTlsNew,
- CryptoServiceTlsInHandshake,
- CryptoServiceTlsDoHandshake,
- CryptoServiceTlsHandleAlert,
- CryptoServiceTlsCloseNotify,
- CryptoServiceTlsCtrlTrafficOut,
- CryptoServiceTlsCtrlTrafficIn,
- CryptoServiceTlsRead,
- CryptoServiceTlsWrite,
- /// TLS Set
- CryptoServiceTlsSetVersion,
- CryptoServiceTlsSetConnectionEnd,
- CryptoServiceTlsSetCipherList,
- CryptoServiceTlsSetCompressionMethod,
- CryptoServiceTlsSetVerify,
- CryptoServiceTlsSetVerifyHost,
- CryptoServiceTlsSetSessionId,
- CryptoServiceTlsSetCaCertificate,
- CryptoServiceTlsSetHostPublicCert,
- CryptoServiceTlsSetHostPrivateKey,
- CryptoServiceTlsSetCertRevocationList,
- /// TLS Get
- CryptoServiceTlsGetVersion,
- CryptoServiceTlsGetConnectionEnd,
- CryptoServiceTlsGetCurrentCipher,
- CryptoServiceTlsGetCurrentCompressionId,
- CryptoServiceTlsGetVerify,
- CryptoServiceTlsGetSessionId,
- CryptoServiceTlsGetClientRandom,
- CryptoServiceTlsGetServerRandom,
- CryptoServiceTlsGetKeyMaterial,
- CryptoServiceTlsGetCaCertificate,
- CryptoServiceTlsGetHostPublicCert,
- CryptoServiceTlsGetHostPrivateKey,
- CryptoServiceTlsGetCertRevocationList,
- /// RSA PSS
- CryptoServiceRsaPssSign,
- CryptoServiceRsaPssVerify,
- /// Parallel hash
- CryptoServiceParallelHash256HashAll,
- /// HMAC SHA256 (continued)
- CryptoServiceHmacSha256All,
- /// HMAC SHA384
- CryptoServiceHmacSha384New,
- CryptoServiceHmacSha384Free,
- CryptoServiceHmacSha384SetKey,
- CryptoServiceHmacSha384Duplicate,
- CryptoServiceHmacSha384Update,
- CryptoServiceHmacSha384Final,
- CryptoServiceHmacSha384All,
- /// HKDF (continued)
- CryptoServiceHkdfSha256Extract,
- CryptoServiceHkdfSha256Expand,
- CryptoServiceHkdfSha384ExtractAndExpand,
- CryptoServiceHkdfSha384Extract,
- CryptoServiceHkdfSha384Expand,
- /// Aead Aes GCM
- CryptoServiceAeadAesGcmEncrypt,
- CryptoServiceAeadAesGcmDecrypt,
- /// Big Numbers
- CryptoServiceBigNumInit,
- CryptoServiceBigNumFromBin,
- CryptoServiceBigNumToBin,
- CryptoServiceBigNumFree,
- CryptoServiceBigNumAdd,
- CryptoServiceBigNumSub,
- CryptoServiceBigNumMod,
- CryptoServiceBigNumExpMod,
- CryptoServiceBigNumInverseMod,
- CryptoServiceBigNumDiv,
- CryptoServiceBigNumMulMod,
- CryptoServiceBigNumCmp,
- CryptoServiceBigNumBits,
- CryptoServiceBigNumBytes,
- CryptoServiceBigNumIsWord,
- CryptoServiceBigNumIsOdd,
- CryptoServiceBigNumCopy,
- CryptoServiceBigNumValueOne,
- CryptoServiceBigNumRShift,
- CryptoServiceBigNumConstTime,
- CryptoServiceBigNumSqrMod,
- CryptoServiceBigNumNewContext,
- CryptoServiceBigNumContextFree,
- CryptoServiceBigNumSetUint,
- CryptoServiceBigNumAddMod,
- /// EC
- CryptoServiceEcGroupInit,
- CryptoServiceEcGroupGetCurve,
- CryptoServiceEcGroupGetOrder,
- CryptoServiceEcGroupFree,
- CryptoServiceEcPointInit,
- CryptoServiceEcPointDeInit,
- CryptoServiceEcPointGetAffineCoordinates,
- CryptoServiceEcPointSetAffineCoordinates,
- CryptoServiceEcPointAdd,
- CryptoServiceEcPointMul,
- CryptoServiceEcPointInvert,
- CryptoServiceEcPointIsOnCurve,
- CryptoServiceEcPointIsAtInfinity,
- CryptoServiceEcPointEqual,
- CryptoServiceEcPointSetCompressedCoordinates,
- CryptoServiceEcNewByNid,
- CryptoServiceEcFree,
- CryptoServiceEcGenerateKey,
- CryptoServiceEcGetPubKey,
- CryptoServiceEcDhComputeKey,
- /// TLS (continued)
- CryptoServiceTlsShutdown,
- /// TLS Set (continued)
- CryptoServiceTlsSetHostPrivateKeyEx,
- CryptoServiceTlsSetSignatureAlgoList,
- CryptoServiceTlsSetEcCurve,
- /// TLS Get (continued)
- CryptoServiceTlsGetExportKey,
- /// Ec (Continued)
- CryptoServiceEcGetPublicKeyFromX509,
- CryptoServiceEcGetPrivateKeyFromPem,
- CryptoServiceEcDsaSign,
- CryptoServiceEcDsaVerify,
- /// X509 (Continued)
- CryptoServiceX509GetVersion,
- CryptoServiceX509GetSerialNumber,
- CryptoServiceX509GetIssuerName,
- CryptoServiceX509GetSignatureAlgorithm,
- CryptoServiceX509GetExtensionData,
- CryptoServiceX509GetExtendedKeyUsage,
- CryptoServiceX509GetValidity,
- CryptoServiceX509FormatDateTime,
- CryptoServiceX509CompareDateTime,
- CryptoServiceX509GetKeyUsage,
- CryptoServiceX509VerifyCertChain,
- CryptoServiceX509GetCertFromCertChain,
- CryptoServiceAsn1GetTag,
- CryptoServiceX509GetExtendedBasicConstraints,
- CryptoServicePkcs1v2Decrypt,
- CryptoServiceRsaOaepEncrypt,
- CryptoServiceRsaOaepDecrypt,
-};
diff --git a/CryptoPkg/Driver/Crypto.uni b/CryptoPkg/Driver/Crypto.uni
deleted file mode 100644
index 3e83f9c22a..0000000000
--- a/CryptoPkg/Driver/Crypto.uni
+++ /dev/null
@@ -1,13 +0,0 @@
-// /** @file
-// Module that produces the EDK II Crypto Protocol/PPI using the library
-// services from BaseCryptLib and TlsLib.
-//
-// Copyright (c) 2020, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Module that produces the EDK II Crypto Protocol/PPI using the library services from BaseCryptLib and TlsLib"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Module that produces the EDK II Crypto Protocol/PPI using the library services from BaseCryptLib and TlsLib."
diff --git a/CryptoPkg/Driver/CryptoDxe.c b/CryptoPkg/Driver/CryptoDxe.c
deleted file mode 100644
index cb3ca11d02..0000000000
--- a/CryptoPkg/Driver/CryptoDxe.c
+++ /dev/null
@@ -1,38 +0,0 @@
-/** @file
- Installs the EDK II Crypto Protocol
-
- Copyright (C) Microsoft Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-
-extern CONST EDKII_CRYPTO_PROTOCOL mEdkiiCrypto;
-
-/**
- The module Entry Point of the Crypto Dxe Driver.
-
- @param[in] ImageHandle The firmware allocated handle for the EFI image.
- @param[in] SystemTable A pointer to the EFI System Table.
-
- @retval EFI_SUCCESS The entry point is executed successfully.
- @retval Other Some error occurs when executing this entry point.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoDxeEntry (
- IN EFI_HANDLE ImageHandle,
- IN EFI_SYSTEM_TABLE *SystemTable
- )
-{
- return gBS->InstallMultipleProtocolInterfaces (
- &ImageHandle,
- &gEdkiiCryptoProtocolGuid,
- (EDKII_CRYPTO_PROTOCOL *)&mEdkiiCrypto,
- NULL
- );
-}
diff --git a/CryptoPkg/Driver/CryptoDxe.inf b/CryptoPkg/Driver/CryptoDxe.inf
deleted file mode 100644
index 0d08f3a190..0000000000
--- a/CryptoPkg/Driver/CryptoDxe.inf
+++ /dev/null
@@ -1,49 +0,0 @@
-## @file
-# Produces the EDK II Crypto Protocol using the library services from
-# BaseCryptLib and TlsLib. PcdCryptoServiceFamilyEnable is used to enable the
-# subset of available services.
-#
-# Copyright (C) Microsoft Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x0001001B
- PI_SPECIFICATION_VERSION = 0x0001000A
- BASE_NAME = CryptoDxe
- MODULE_UNI_FILE = Crypto.uni
- FILE_GUID = FEA01457-E381-4135-9475-C6AFD0076C61
- MODULE_TYPE = DXE_DRIVER
- VERSION_STRING = 1.0
- ENTRY_POINT = CryptoDxeEntry
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- Crypto.c
- CryptoDxe.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- UefiDriverEntryPoint
- UefiBootServicesTableLib
- DebugLib
- BaseCryptLib
- TlsLib
-
-[Protocols]
- gEdkiiCryptoProtocolGuid ## PRODUCES
-
-[Pcd]
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable #CONSUMES
-
-[Depex]
- TRUE
diff --git a/CryptoPkg/Driver/CryptoPei.c b/CryptoPkg/Driver/CryptoPei.c
deleted file mode 100644
index e538aa4218..0000000000
--- a/CryptoPkg/Driver/CryptoPei.c
+++ /dev/null
@@ -1,99 +0,0 @@
-/** @file
- Installs the EDK II Crypto PPI. If this PEIM is dispatched before memory is
- discovered, the RegisterForShadow() feature is used to reload this PEIM into
- memory after memory is discovered.
-
- Copyright (C) Microsoft Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-#include
-
-extern CONST EDKII_CRYPTO_PROTOCOL mEdkiiCrypto;
-
-CONST EFI_PEI_PPI_DESCRIPTOR mEdkiiCryptoPpiList = {
- (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
- &gEdkiiCryptoPpiGuid,
- (EDKII_CRYPTO_PPI *)&mEdkiiCrypto
-};
-
-/**
-Entry to CryptoPeiEntry.
-
-@param FileHandle The image handle.
-@param PeiServices The PEI services table.
-
-@retval Status From internal routine or boot object, should not fail
-**/
-EFI_STATUS
-EFIAPI
-CryptoPeiEntry (
- IN EFI_PEI_FILE_HANDLE FileHandle,
- IN CONST EFI_PEI_SERVICES **PeiServices
- )
-{
- EFI_STATUS Status;
- VOID *MemoryDiscoveredPpi;
- EDKII_CRYPTO_PPI *EdkiiCryptoPpi;
- EFI_PEI_PPI_DESCRIPTOR *EdkiiCryptoPpiDescriptor;
-
- //
- // Not all Open SSL services support XIP due to use of global variables.
- // Use gEfiPeiMemoryDiscoveredPpiGuid to detect Pre-Mem and Post-Mem and
- // always shadow this module in memory in Post-Mem.
- //
- Status = PeiServicesLocatePpi (
- &gEfiPeiMemoryDiscoveredPpiGuid,
- 0,
- NULL,
- (VOID **)&MemoryDiscoveredPpi
- );
- if (Status == EFI_NOT_FOUND) {
- //
- // CryptoPei is dispatched before gEfiPeiMemoryDiscoveredPpiGuid
- //
- Status = PeiServicesRegisterForShadow (FileHandle);
- ASSERT_EFI_ERROR (Status);
- if (!EFI_ERROR (Status)) {
- //
- // First CryptoPpi installation. CryptoPei could come from memory or flash
- // it will be re-installed after gEfiPeiMemoryDiscoveredPpiGuid
- //
- DEBUG ((DEBUG_INFO, "CryptoPeiEntry: Install Pre-Memory Crypto PPI\n"));
- Status = PeiServicesInstallPpi (&mEdkiiCryptoPpiList);
- ASSERT_EFI_ERROR (Status);
- }
- } else if (Status == EFI_SUCCESS) {
- //
- // CryptoPei is dispatched after gEfiPeiMemoryDiscoveredPpiGuid
- //
- Status = PeiServicesLocatePpi (
- &gEdkiiCryptoPpiGuid,
- 0,
- &EdkiiCryptoPpiDescriptor,
- (VOID **)&EdkiiCryptoPpi
- );
- if (!EFI_ERROR (Status)) {
- //
- // CryptoPei was also dispatched before gEfiPeiMemoryDiscoveredPpiGuid
- //
- DEBUG ((DEBUG_INFO, "CryptoPeiEntry: ReInstall Post-Memmory Crypto PPI\n"));
- Status = PeiServicesReInstallPpi (
- EdkiiCryptoPpiDescriptor,
- &mEdkiiCryptoPpiList
- );
- ASSERT_EFI_ERROR (Status);
- } else {
- DEBUG ((DEBUG_INFO, "CryptoPeiEntry: Install Post-Memmory Crypto PPI\n"));
- Status = PeiServicesInstallPpi (&mEdkiiCryptoPpiList);
- }
- } else {
- ASSERT_EFI_ERROR (Status);
- }
-
- return Status;
-}
diff --git a/CryptoPkg/Driver/CryptoPei.inf b/CryptoPkg/Driver/CryptoPei.inf
deleted file mode 100644
index dfa1ab58b1..0000000000
--- a/CryptoPkg/Driver/CryptoPei.inf
+++ /dev/null
@@ -1,51 +0,0 @@
-## @file
-# Produces the EDK II Crypto PPI using the library services from BaseCryptLib
-# and TlsLib. PcdCryptoServiceFamilyEnable is used to enable the subset of
-# available services. If this PEIM is dispatched before memory is discovered,
-# the RegisterForShadow() feature is used to reload this PEIM into memory after
-# memory is discovered.
-#
-# Copyright (C) Microsoft Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x0001001B
- BASE_NAME = CryptoPei
- MODULE_UNI_FILE = Crypto.uni
- FILE_GUID = 0D1CE46B-72D9-4BA7-95DA-23511865E661
- MODULE_TYPE = PEIM
- VERSION_STRING = 1.0
- ENTRY_POINT = CryptoPeiEntry
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- Crypto.c
- CryptoPei.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- PeimEntryPoint
- PeiServicesLib
- DebugLib
- BaseCryptLib
- TlsLib
-
-[Ppis]
- gEfiPeiMemoryDiscoveredPpiGuid ## CONSUMES
- gEdkiiCryptoPpiGuid ## PRODUCES
-
-[Pcd]
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable ## CONSUMES
-
-[Depex]
- TRUE
diff --git a/CryptoPkg/Driver/CryptoSmm.c b/CryptoPkg/Driver/CryptoSmm.c
deleted file mode 100644
index 32182bb094..0000000000
--- a/CryptoPkg/Driver/CryptoSmm.c
+++ /dev/null
@@ -1,41 +0,0 @@
-/** @file
- Installs the EDK II Crypto SMM Protocol
-
- Copyright (C) Microsoft Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-
-extern CONST EDKII_CRYPTO_PROTOCOL mEdkiiCrypto;
-
-/**
- The module Entry Point of the Crypto SMM Driver.
-
- @param[in] ImageHandle The firmware allocated handle for the EFI image.
- @param[in] SystemTable A pointer to the EFI System Table.
-
- @retval EFI_SUCCESS The entry point is executed successfully.
- @retval Other Some error occurs when executing this entry point.
-
-**/
-EFI_STATUS
-EFIAPI
-CryptoSmmEntry (
- IN EFI_HANDLE ImageHandle,
- IN EFI_SYSTEM_TABLE *SystemTable
- )
-{
- EFI_HANDLE Handle;
-
- Handle = NULL;
- return gSmst->SmmInstallProtocolInterface (
- &Handle,
- &gEdkiiSmmCryptoProtocolGuid,
- EFI_NATIVE_INTERFACE,
- (EDKII_CRYPTO_PROTOCOL *)&mEdkiiCrypto
- );
-}
diff --git a/CryptoPkg/Driver/CryptoSmm.inf b/CryptoPkg/Driver/CryptoSmm.inf
deleted file mode 100644
index 9fe8718823..0000000000
--- a/CryptoPkg/Driver/CryptoSmm.inf
+++ /dev/null
@@ -1,49 +0,0 @@
-## @file
-# Produces the EDK II SMM Crypto Protocol using the library services from
-# BaseCryptLib and TlsLib. PcdCryptoServiceFamilyEnable is used to enable the
-# subset of available services.
-#
-# Copyright (C) Microsoft Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x0001001B
- PI_SPECIFICATION_VERSION = 0x00010014
- BASE_NAME = CryptoSmm
- MODULE_UNI_FILE = Crypto.uni
- FILE_GUID = 391B853F-F488-479B-A3D6-870766C7A38F
- MODULE_TYPE = DXE_SMM_DRIVER
- VERSION_STRING = 1.0
- ENTRY_POINT = CryptoSmmEntry
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- Crypto.c
- CryptoSmm.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- UefiDriverEntryPoint
- SmmServicesTableLib
- DebugLib
- BaseCryptLib
- TlsLib
-
-[Protocols]
- gEdkiiSmmCryptoProtocolGuid ## PRODUCES
-
-[Pcd]
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable ## CONSUMES
-
-[Depex]
- TRUE
diff --git a/CryptoPkg/Include/Library/HmacSha1Lib.h b/CryptoPkg/Include/Library/HmacSha1Lib.h
new file mode 100644
index 0000000000..5840eec0a2
--- /dev/null
+++ b/CryptoPkg/Include/Library/HmacSha1Lib.h
@@ -0,0 +1,176 @@
+/** @file
+ Defines base cryptographic library APIs for HmacSha1.
+ The Base Cryptographic Library provides implementations of basic cryptography
+ primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security
+ functionality enabling.
+
+Copyright (c) Microsoft Corporation.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+Largely copied from BaseCryptLib from release/202002
+
+**/
+
+#ifndef HMAC_SHA_1_LIB_H_
+#define HMAC_SHA_1_LIB_H_
+
+#include
+
+/**
+ Set user-supplied key for subsequent use. It must be done before any
+ calling to HmacSha1Update().
+
+ If HmacSha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+
+ @param[out] HmacSha1Context Pointer to HMAC-Sha1 context.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+
+ @retval TRUE The Key is set successfully.
+ @retval FALSE The Key is set unsuccessfully.
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1SetKey (
+ OUT VOID *HmacSha1Context,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize
+ );
+
+/**
+ Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
+
+ If this interface is not supported, then return NULL.
+
+ @return Pointer to the HMAC_CTX context that has been initialized.
+ If the allocations fails, HmacSha1New() returns NULL.
+ @return NULL This interface is not supported.
+
+**/
+VOID *
+EFIAPI
+HmacSha1New (
+ VOID
+ );
+
+/**
+ Release the specified HMAC_CTX context.
+
+ If this interface is not supported, then do nothing.
+
+ @param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
+
+**/
+VOID
+EFIAPI
+HmacSha1Free (
+ IN VOID *HmacSha1Ctx
+ );
+
+/**
+ Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for
+ subsequent use.
+
+ If HmacSha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+
+ @param[out] HmacSha1Context Pointer to HMAC-SHA1 context being initialized.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+
+ @retval TRUE HMAC-SHA1 context initialization succeeded.
+ @retval FALSE HMAC-SHA1 context initialization failed.
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Init (
+ OUT VOID *HmacSha1Context,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize
+ );
+
+/**
+ Makes a copy of an existing HMAC-SHA1 context.
+
+ If HmacSha1Context is NULL, then return FALSE.
+ If NewHmacSha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+
+ @param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
+ @param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
+
+ @retval TRUE HMAC-SHA1 context copy succeeded.
+ @retval FALSE HMAC-SHA1 context copy failed.
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Duplicate (
+ IN CONST VOID *HmacSha1Context,
+ OUT VOID *NewHmacSha1Context
+ );
+
+/**
+ Digests the input data and updates HMAC-SHA1 context.
+
+ This function performs HMAC-SHA1 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ HMAC-SHA1 context should be already correctly initialized by HmacSha1Init(), and should not
+ be finalized by HmacSha1Final(). Behavior with invalid context is undefined.
+
+ If HmacSha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+
+ @param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
+ @param[in] Data Pointer to the buffer containing the data to be digested.
+ @param[in] DataSize Size of Data buffer in bytes.
+
+ @retval TRUE HMAC-SHA1 data digest succeeded.
+ @retval FALSE HMAC-SHA1 data digest failed.
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Update (
+ IN OUT VOID *HmacSha1Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
+ );
+
+/**
+ Completes computation of the HMAC-SHA1 digest value.
+
+ This function completes HMAC-SHA1 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the HMAC-SHA1 context cannot
+ be used again.
+ HMAC-SHA1 context should be already correctly initialized by HmacSha1Init(), and should
+ not be finalized by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.
+
+ If HmacSha1Context is NULL, then return FALSE.
+ If HmacValue is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+
+ @param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
+ @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
+ value (20 bytes).
+
+ @retval TRUE HMAC-SHA1 digest computation succeeded.
+ @retval FALSE HMAC-SHA1 digest computation failed.
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Final (
+ IN OUT VOID *HmacSha1Context,
+ OUT UINT8 *HmacValue
+ );
+
+#endif
diff --git a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
deleted file mode 100644
index 7b3741381c..0000000000
--- a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
+++ /dev/null
@@ -1,433 +0,0 @@
-/** @file
- Defines the PCD_CRYPTO_SERVICE_FAMILY_ENABLE structure associated with
- gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable that is used
- to enable/disable crypto services at either the family scope or the
- individual service scope. Platforms can minimize the number of enabled
- services to reduce size.
-
- The following services have been deprecated and must never be enabled.
- The associated fields in this data structure are never removed or replaced
- to preseve the binary layout of the data structure. New services are
- always added to the end of the data structure.
- * HmacMd5 family
- * HmacSha1 family
- * Md4 family
- * Md5 family
- * Tdes family
- * Arc4 family
- * Aes.Services.EcbEncrypt service
- * Aes.Services.EcbDecrypt service
-
- Is is recommended that the following services always be disabled and may
- be deprecated in the future.
- * Sha1 family
-
- Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.
- Copyright (c) Microsoft Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#ifndef __PCD_CRYPTO_SERVICE_FAMILY_ENABLE_H__
-#define __PCD_CRYPTO_SERVICE_FAMILY_ENABLE_H__
-
-///
-/// Define used to enable all the crypto services in a family
-///
-#define PCD_CRYPTO_SERVICE_ENABLE_FAMILY 0xFFFFFFFF
-
-///
-/// PCD_CRYPTO_SERVICE_FAMILY_ENABLE structure. Each field in this structure
-/// is associated with a service in the EDK II Crypto Protocol/PPI. This allows
-/// each individual service to be enabled/disabled in a DSC file. Services are
-/// also grouped into families. Unions are used to support enabling or
-/// disabling an entire family in a single DSC statement.
-///
-typedef struct {
- union {
- struct {
- UINT8 New : 1; // Deprecated
- UINT8 Free : 1; // Deprecated
- UINT8 SetKey : 1; // Deprecated
- UINT8 Duplicate : 1; // Deprecated
- UINT8 Update : 1; // Deprecated
- UINT8 Final : 1; // Deprecated
- } Services;
- UINT32 Family; // Deprecated
- } HmacMd5;
- union {
- struct {
- UINT8 New : 1; // Deprecated
- UINT8 Free : 1; // Deprecated
- UINT8 SetKey : 1; // Deprecated
- UINT8 Duplicate : 1; // Deprecated
- UINT8 Update : 1; // Deprecated
- UINT8 Final : 1; // Deprecated
- } Services;
- UINT32 Family; // Deprecated
- } HmacSha1;
- union {
- struct {
- UINT8 New : 1;
- UINT8 Free : 1;
- UINT8 SetKey : 1;
- UINT8 Duplicate : 1;
- UINT8 Update : 1;
- UINT8 Final : 1;
- UINT8 All : 1;
- } Services;
- UINT32 Family;
- } HmacSha256;
- union {
- struct {
- UINT8 New : 1;
- UINT8 Free : 1;
- UINT8 SetKey : 1;
- UINT8 Duplicate : 1;
- UINT8 Update : 1;
- UINT8 Final : 1;
- UINT8 All : 1;
- } Services;
- UINT32 Family;
- } HmacSha384;
- union {
- struct {
- UINT8 GetContextSize : 1; // Deprecated
- UINT8 Init : 1; // Deprecated
- UINT8 Duplicate : 1; // Deprecated
- UINT8 Update : 1; // Deprecated
- UINT8 Final : 1; // Deprecated
- UINT8 HashAll : 1; // Deprecated
- } Services;
- UINT32 Family; // Deprecated
- } Md4;
- union {
- struct {
- UINT8 GetContextSize : 1; // Deprecated
- UINT8 Init : 1; // Deprecated
- UINT8 Duplicate : 1; // Deprecated
- UINT8 Update : 1; // Deprecated
- UINT8 Final : 1; // Deprecated
- UINT8 HashAll : 1; // Deprecated
- } Services;
- UINT32 Family;
- } Md5; // Deprecated
- union {
- struct {
- UINT8 Pkcs1v2Encrypt : 1;
- UINT8 Pkcs5HashPassword : 1;
- UINT8 Pkcs7Verify : 1;
- UINT8 VerifyEKUsInPkcs7Signature : 1;
- UINT8 Pkcs7GetSigners : 1;
- UINT8 Pkcs7FreeSigners : 1;
- UINT8 Pkcs7Sign : 1;
- UINT8 Pkcs7GetAttachedContent : 1;
- UINT8 Pkcs7GetCertificatesList : 1;
- UINT8 AuthenticodeVerify : 1;
- UINT8 ImageTimestampVerify : 1;
- UINT8 Pkcs1v2Decrypt : 1;
- } Services;
- UINT32 Family;
- } Pkcs;
- union {
- struct {
- UINT8 New : 1;
- UINT8 Free : 1;
- UINT8 GenerateParameter : 1;
- UINT8 SetParameter : 1;
- UINT8 GenerateKey : 1;
- UINT8 ComputeKey : 1;
- } Services;
- UINT32 Family;
- } Dh;
- union {
- struct {
- UINT8 Seed : 1;
- UINT8 Bytes : 1;
- } Services;
- UINT32 Family;
- } Random;
- union {
- struct {
- UINT8 VerifyPkcs1 : 1;
- UINT8 New : 1;
- UINT8 Free : 1;
- UINT8 SetKey : 1;
- UINT8 GetKey : 1;
- UINT8 GenerateKey : 1;
- UINT8 CheckKey : 1;
- UINT8 Pkcs1Sign : 1;
- UINT8 Pkcs1Verify : 1;
- UINT8 GetPrivateKeyFromPem : 1;
- UINT8 GetPublicKeyFromX509 : 1;
- UINT8 RsaOaepEncrypt : 1;
- UINT8 RsaOaepDecrypt : 1;
- } Services;
- UINT32 Family;
- } Rsa;
- union {
- struct {
- UINT8 GetContextSize : 1; // Recommend disable
- UINT8 Init : 1; // Recommend disable
- UINT8 Duplicate : 1; // Recommend disable
- UINT8 Update : 1; // Recommend disable
- UINT8 Final : 1; // Recommend disable
- UINT8 HashAll : 1; // Recommend disable
- } Services;
- UINT32 Family; // Recommend disable
- } Sha1;
- union {
- struct {
- UINT8 GetContextSize : 1;
- UINT8 Init : 1;
- UINT8 Duplicate : 1;
- UINT8 Update : 1;
- UINT8 Final : 1;
- UINT8 HashAll : 1;
- } Services;
- UINT32 Family;
- } Sha256;
- union {
- struct {
- UINT8 GetContextSize : 1;
- UINT8 Init : 1;
- UINT8 Duplicate : 1;
- UINT8 Update : 1;
- UINT8 Final : 1;
- UINT8 HashAll : 1;
- } Services;
- UINT32 Family;
- } Sha384;
- union {
- struct {
- UINT8 GetContextSize : 1;
- UINT8 Init : 1;
- UINT8 Duplicate : 1;
- UINT8 Update : 1;
- UINT8 Final : 1;
- UINT8 HashAll : 1;
- } Services;
- UINT32 Family;
- } Sha512;
- union {
- struct {
- UINT8 GetSubjectName : 1;
- UINT8 GetCommonName : 1;
- UINT8 GetOrganizationName : 1;
- UINT8 VerifyCert : 1;
- UINT8 ConstructCertificate : 1;
- UINT8 ConstructCertificateStack : 1;
- UINT8 ConstructCertificateStackV : 1;
- UINT8 Free : 1;
- UINT8 StackFree : 1;
- UINT8 GetTBSCert : 1;
- UINT8 GetVersion : 1;
- UINT8 GetSerialNumber : 1;
- UINT8 GetIssuerName : 1;
- UINT8 GetSignatureAlgorithm : 1;
- UINT8 GetExtensionData : 1;
- UINT8 GetExtendedKeyUsage : 1;
- UINT8 GetValidity : 1;
- UINT8 FormatDateTime : 1;
- UINT8 CompareDateTime : 1;
- UINT8 GetKeyUsage : 1;
- UINT8 VerifyCertChain : 1;
- UINT8 GetCertFromCertChain : 1;
- UINT8 Asn1GetTag : 1;
- UINT8 GetExtendedBasicConstraints : 1;
- } Services;
- UINT32 Family;
- } X509;
- union {
- struct {
- UINT8 GetContextSize : 1; // Deprecated
- UINT8 Init : 1; // Deprecated
- UINT8 EcbEncrypt : 1; // Deprecated
- UINT8 EcbDecrypt : 1; // Deprecated
- UINT8 CbcEncrypt : 1; // Deprecated
- UINT8 CbcDecrypt : 1; // Deprecated
- } Services;
- UINT32 Family; // Deprecated
- } Tdes;
- union {
- struct {
- UINT8 GetContextSize : 1;
- UINT8 Init : 1;
- UINT8 EcbEncrypt : 1; // Deprecated
- UINT8 EcbDecrypt : 1; // Deprecated
- UINT8 CbcEncrypt : 1;
- UINT8 CbcDecrypt : 1;
- } Services;
- UINT32 Family;
- } Aes;
- union {
- struct {
- UINT8 GetContextSize : 1; // Deprecated
- UINT8 Init : 1; // Deprecated
- UINT8 Encrypt : 1; // Deprecated
- UINT8 Decrypt : 1; // Deprecated
- UINT8 Reset : 1; // Deprecated
- } Services;
- UINT32 Family; // Deprecated
- } Arc4;
- union {
- struct {
- UINT8 GetContextSize : 1;
- UINT8 Init : 1;
- UINT8 Duplicate : 1;
- UINT8 Update : 1;
- UINT8 Final : 1;
- UINT8 HashAll : 1;
- } Services;
- UINT32 Family;
- } Sm3;
- union {
- struct {
- UINT8 Sha256ExtractAndExpand : 1;
- UINT8 Sha256Extract : 1;
- UINT8 Sha256Expand : 1;
- UINT8 Sha384ExtractAndExpand : 1;
- UINT8 Sha384Extract : 1;
- UINT8 Sha384Expand : 1;
- } Services;
- UINT32 Family;
- } Hkdf;
- union {
- struct {
- UINT8 Initialize : 1;
- UINT8 CtxFree : 1;
- UINT8 CtxNew : 1;
- UINT8 Free : 1;
- UINT8 New : 1;
- UINT8 InHandshake : 1;
- UINT8 DoHandshake : 1;
- UINT8 HandleAlert : 1;
- UINT8 CloseNotify : 1;
- UINT8 CtrlTrafficOut : 1;
- UINT8 CtrlTrafficIn : 1;
- UINT8 Read : 1;
- UINT8 Write : 1;
- UINT8 Shutdown : 1;
- } Services;
- UINT32 Family;
- } Tls;
- union {
- struct {
- UINT8 Version : 1;
- UINT8 ConnectionEnd : 1;
- UINT8 CipherList : 1;
- UINT8 CompressionMethod : 1;
- UINT8 Verify : 1;
- UINT8 VerifyHost : 1;
- UINT8 SessionId : 1;
- UINT8 CaCertificate : 1;
- UINT8 HostPublicCert : 1;
- UINT8 HostPrivateKey : 1;
- UINT8 CertRevocationList : 1;
- UINT8 HostPrivateKeyEx : 1;
- UINT8 SignatureAlgoList : 1;
- UINT8 EcCurve : 1;
- } Services;
- UINT32 Family;
- } TlsSet;
- union {
- struct {
- UINT8 Version : 1;
- UINT8 ConnectionEnd : 1;
- UINT8 CurrentCipher : 1;
- UINT8 CurrentCompressionId : 1;
- UINT8 Verify : 1;
- UINT8 SessionId : 1;
- UINT8 ClientRandom : 1;
- UINT8 ServerRandom : 1;
- UINT8 KeyMaterial : 1;
- UINT8 CaCertificate : 1;
- UINT8 HostPublicCert : 1;
- UINT8 HostPrivateKey : 1;
- UINT8 CertRevocationList : 1;
- UINT8 ExportKey : 1;
- } Services;
- UINT32 Family;
- } TlsGet;
- union {
- struct {
- UINT8 Sign : 1;
- UINT8 Verify : 1;
- } Services;
- UINT32 Family;
- } RsaPss;
- union {
- struct {
- UINT8 HashAll : 1;
- } Services;
- UINT32 Family;
- } ParallelHash;
- union {
- struct {
- UINT8 Encrypt : 1;
- UINT8 Decrypt : 1;
- } Services;
- UINT32 Family;
- } AeadAesGcm;
- union {
- struct {
- UINT8 Init : 1;
- UINT8 FromBin : 1;
- UINT8 ToBin : 1;
- UINT8 Free : 1;
- UINT8 Add : 1;
- UINT8 Sub : 1;
- UINT8 Mod : 1;
- UINT8 ExpMod : 1;
- UINT8 InverseMod : 1;
- UINT8 Div : 1;
- UINT8 MulMod : 1;
- UINT8 Cmp : 1;
- UINT8 Bits : 1;
- UINT8 Bytes : 1;
- UINT8 IsWord : 1;
- UINT8 IsOdd : 1;
- UINT8 Copy : 1;
- UINT8 ValueOne : 1;
- UINT8 RShift : 1;
- UINT8 ConstTime : 1;
- UINT8 SqrMod : 1;
- UINT8 NewContext : 1;
- UINT8 ContextFree : 1;
- UINT8 SetUint : 1;
- UINT8 AddMod : 1;
- } Services;
- UINT32 Family;
- } Bn;
- union {
- struct {
- UINT8 GroupInit : 1;
- UINT8 GroupGetCurve : 1;
- UINT8 GroupGetOrder : 1;
- UINT8 GroupFree : 1;
- UINT8 PointInit : 1;
- UINT8 PointDeInit : 1;
- UINT8 PointGetAffineCoordinates : 1;
- UINT8 PointSetAffineCoordinates : 1;
- UINT8 PointAdd : 1;
- UINT8 PointMul : 1;
- UINT8 PointInvert : 1;
- UINT8 PointIsOnCurve : 1;
- UINT8 PointIsAtInfinity : 1;
- UINT8 PointEqual : 1;
- UINT8 PointSetCompressedCoordinates : 1;
- UINT8 NewByNid : 1;
- UINT8 Free : 1;
- UINT8 GenerateKey : 1;
- UINT8 GetPubKey : 1;
- UINT8 DhComputeKey : 1;
- UINT8 GetPublicKeyFromX509 : 1;
- UINT8 GetPrivateKeyFromPem : 1;
- UINT8 DsaSign : 1;
- UINT8 DsaVerify : 1;
- } Services;
- UINT32 Family;
- } Ec;
-} PCD_CRYPTO_SERVICE_FAMILY_ENABLE;
-
-#endif
diff --git a/CryptoPkg/Private/Ppi/Crypto.h b/CryptoPkg/Include/Ppi/Crypto.h
similarity index 81%
rename from CryptoPkg/Private/Ppi/Crypto.h
rename to CryptoPkg/Include/Ppi/Crypto.h
index ad5a524644..d9e148b15c 100644
--- a/CryptoPkg/Private/Ppi/Crypto.h
+++ b/CryptoPkg/Include/Ppi/Crypto.h
@@ -1,7 +1,7 @@
/** @file
This PPI provides Crypto services to PEIMs
- Copyright (C) Microsoft Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Include/Protocol/Crypto.h
similarity index 80%
rename from CryptoPkg/Private/Protocol/Crypto.h
rename to CryptoPkg/Include/Protocol/Crypto.h
index 5a471631f1..5782595acb 100644
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Include/Protocol/Crypto.h
@@ -1,8 +1,7 @@
/** @file
This Protocol provides Crypto services to DXE modules
- Copyright (C) Microsoft Corporation. All rights reserved.
- Copyright (c) 2020 - 2022, Intel Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -21,7 +20,7 @@
/// the EDK II Crypto Protocol is extended, this version define must be
/// increased.
///
-#define EDKII_CRYPTO_VERSION 17
+#define EDKII_CRYPTO_VERSION 18 // MU_CHANGE
///
/// EDK II Crypto Protocol forward declaration
@@ -40,111 +39,23 @@ UINTN
VOID
);
-// =====================================================================================
-// MAC (Message Authentication Code) Primitive
-// =====================================================================================
+// MU_CHANGE [BEGIN]
+// ****************************************************************************
+// AUTOGENERATED BY CryptoBinPkg\Driver\Packaging\generate_cryptodriver.py
+// AUTOGENED AS temp_Crypto.h
+// DO NOT MODIFY
+// GENERATED ON: 2024-04-08 11:12:11.528450
-/**
- HMAC MD5 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
-**/
-typedef
-VOID *
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_MD5_NEW)(
- VOID
- );
-
-typedef
-VOID
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_MD5_FREE)(
- IN VOID *HmacMd5Ctx
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_MD5_SET_KEY)(
- OUT VOID *HmacMd5Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_MD5_DUPLICATE)(
- IN CONST VOID *HmacMd5Context,
- OUT VOID *NewHmacMd5Context
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_MD5_UPDATE)(
- IN OUT VOID *HmacMd5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_MD5_FINAL)(
- IN OUT VOID *HmacMd5Context,
- OUT UINT8 *HmacValue
- );
-
-/**
- HMAC SHA1 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
-**/
-typedef
-VOID *
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_NEW)(
- VOID
- );
-
-typedef
-VOID
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FREE)(
- IN VOID *HmacSha1Ctx
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_SET_KEY)(
- OUT VOID *HmacSha1Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_DUPLICATE)(
- IN CONST VOID *HmacSha1Context,
- OUT VOID *NewHmacSha1Context
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_UPDATE)(
- IN OUT VOID *HmacSha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FINAL)(
- IN OUT VOID *HmacSha1Context,
- OUT UINT8 *HmacValue
- );
+// =============================================================================
+// HMACSHA256 functions
+// =============================================================================
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha256New() returns NULL.
-
**/
+// FROM BaseCryptLib.h:941
typedef
VOID *
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_NEW)(
@@ -153,10 +64,9 @@ VOID *
/**
Release the specified HMAC_CTX context.
-
@param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
**/
+// FROM BaseCryptLib.h:953
typedef
VOID
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_FREE)(
@@ -166,19 +76,16 @@ VOID
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha256Update().
-
If HmacSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
-
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:975
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_SET_KEY)(
@@ -189,19 +96,16 @@ BOOLEAN
/**
Makes a copy of an existing HMAC-SHA256 context.
-
If HmacSha256Context is NULL, then return FALSE.
If NewHmacSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
@param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
@retval TRUE HMAC-SHA256 context copy succeeded.
@retval FALSE HMAC-SHA256 context copy failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:998
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_DUPLICATE)(
@@ -211,24 +115,20 @@ BOOLEAN
/**
Digests the input data and updates HMAC-SHA256 context.
-
This function performs HMAC-SHA256 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
by HmacSha256Final(). Behavior with invalid context is undefined.
-
If HmacSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
-
@retval TRUE HMAC-SHA256 data digest succeeded.
@retval FALSE HMAC-SHA256 data digest failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1025
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_UPDATE)(
@@ -239,26 +139,22 @@ BOOLEAN
/**
Completes computation of the HMAC-SHA256 digest value.
-
This function completes HMAC-SHA256 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA256 context cannot
be used again.
HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
by HmacSha256Final(). Behavior with invalid HMAC-SHA256 context is undefined.
-
If HmacSha256Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
value (32 bytes).
-
@retval TRUE HMAC-SHA256 digest computation succeeded.
@retval FALSE HMAC-SHA256 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1055
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_FINAL)(
@@ -268,24 +164,20 @@ BOOLEAN
/**
Computes the HMAC-SHA256 digest of a input data buffer.
-
This function performs the HMAC-SHA256 digest of a given data buffer, and places
the digest value into the specified memory.
-
If this interface is not supported, then return FALSE.
-
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
+ @param[out] HashValue Pointer to a buffer that receives the HMAC-SHA256 digest
value (32 bytes).
-
@retval TRUE HMAC-SHA256 digest computation succeeded.
@retval FALSE HMAC-SHA256 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1082
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA256_ALL)(
@@ -296,13 +188,16 @@ BOOLEAN
OUT UINT8 *HmacValue
);
+// =============================================================================
+// HMACSHA384 functions
+// =============================================================================
+
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha384New() returns NULL.
-
**/
+// FROM BaseCryptLib.h:1099
typedef
VOID *
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_NEW)(
@@ -311,10 +206,9 @@ VOID *
/**
Release the specified HMAC_CTX context.
-
@param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
-
**/
+// FROM BaseCryptLib.h:1111
typedef
VOID
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_FREE)(
@@ -324,19 +218,16 @@ VOID
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha384Update().
-
If HmacSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
-
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1133
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_SET_KEY)(
@@ -347,19 +238,16 @@ BOOLEAN
/**
Makes a copy of an existing HMAC-SHA384 context.
-
If HmacSha384Context is NULL, then return FALSE.
If NewHmacSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
@param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
@retval TRUE HMAC-SHA384 context copy succeeded.
@retval FALSE HMAC-SHA384 context copy failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1156
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_DUPLICATE)(
@@ -369,24 +257,20 @@ BOOLEAN
/**
Digests the input data and updates HMAC-SHA384 context.
-
This function performs HMAC-SHA384 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
by HmacSha384Final(). Behavior with invalid context is undefined.
-
If HmacSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
-
@retval TRUE HMAC-SHA384 data digest succeeded.
@retval FALSE HMAC-SHA384 data digest failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1183
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_UPDATE)(
@@ -397,26 +281,22 @@ BOOLEAN
/**
Completes computation of the HMAC-SHA384 digest value.
-
This function completes HMAC-SHA384 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA384 context cannot
be used again.
HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
If HmacSha384Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
value (48 bytes).
-
@retval TRUE HMAC-SHA384 digest computation succeeded.
@retval FALSE HMAC-SHA384 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1213
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_FINAL)(
@@ -426,24 +306,20 @@ BOOLEAN
/**
Computes the HMAC-SHA384 digest of a input data buffer.
-
This function performs the HMAC-SHA384 digest of a given data buffer, and places
the digest value into the specified memory.
-
If this interface is not supported, then return FALSE.
-
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
+ @param[out] HashValue Pointer to a buffer that receives the HMAC-SHA384 digest
value (48 bytes).
-
@retval TRUE HMAC-SHA384 digest computation succeeded.
@retval FALSE HMAC-SHA384 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:1240
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA384_ALL)(
@@ -454,4453 +330,3716 @@ BOOLEAN
OUT UINT8 *HmacValue
);
-// =====================================================================================
-// One-Way Cryptographic Hash Primitives
-// =====================================================================================
+// =============================================================================
+// PKCS functions
+// =============================================================================
/**
- MD4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
+ Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
+ password based encryption key derivation function PBKDF2, as specified in RFC 2898.
+ If Password or Salt or OutKey is NULL, then return FALSE.
+ If the hash algorithm could not be determined, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] PasswordLength Length of input password in bytes.
+ @param[in] Password Pointer to the array for the password.
+ @param[in] SaltLength Size of the Salt in bytes.
+ @param[in] Salt Pointer to the Salt.
+ @param[in] IterationCount Number of iterations to perform. Its value should be
+ greater than or equal to 1.
+ @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
+ NOTE: DigestSize will be used to determine the hash algorithm.
+ Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
+ @param[in] KeyLength Size of the derived key buffer in bytes.
+ @param[out] OutKey Pointer to the output derived key buffer.
+ @retval TRUE A key was derived successfully.
+ @retval FALSE One of the pointers was NULL or one of the sizes was too large.
+ @retval FALSE The hash algorithm could not be determined from the digest size.
+ @retval FALSE The key derivation operation failed.
+ @retval FALSE This interface is not supported.
**/
-typedef
-UINTN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_MD4_GET_CONTEXT_SIZE)(
- VOID
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_MD4_INIT)(
- OUT VOID *Md4Context
- );
-
+// FROM BaseCryptLib.h:2097
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_MD4_DUPLICATE)(
- IN CONST VOID *Md4Context,
- OUT VOID *NewMd4Context
+(EFIAPI *EDKII_CRYPTO_PKCS5_HASH_PASSWORD)(
+ IN UINTN PasswordLength,
+ IN CONST CHAR8 *Password,
+ IN UINTN SaltLength,
+ IN CONST UINT8 *Salt,
+ IN UINTN IterationCount,
+ IN UINTN DigestSize,
+ IN UINTN KeyLength,
+ OUT UINT8 *OutKey
);
+/**
+ Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ encrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - X509 key size does not match any known key size.
+ - Fail to parse X509 certificate.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ - Data size is too large for the provided key size (max size is a function of key size
+ and hash digest size).
+ @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
+ will be used to encrypt the data.
+ @param[in] PublicKeySize Size of the X509 cert buffer.
+ @param[in] InData Data to be encrypted.
+ @param[in] InDataSize Size of the data buffer.
+ @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
+ to be used when initializing the PRNG. NULL otherwise.
+ @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
+ 0 otherwise.
+ @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] EncryptedDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
+**/
+// FROM BaseCryptLib.h:2139
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_MD4_UPDATE)(
- IN OUT VOID *Md4Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+(EFIAPI *EDKII_CRYPTO_PKCS1V2_ENCRYPT)(
+ IN CONST UINT8 *PublicKey,
+ IN UINTN PublicKeySize,
+ IN UINT8 *InData,
+ IN UINTN InDataSize,
+ IN CONST UINT8 *PrngSeed OPTIONAL,
+ IN UINTN PrngSeedSize OPTIONAL,
+ OUT UINT8 **EncryptedData,
+ OUT UINTN *EncryptedDataSize
);
+/**
+ Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ decrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - Fail to parse private key.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ @param[in] PrivateKey A pointer to the DER-encoded private key.
+ @param[in] PrivateKeySize Size of the private key buffer.
+ @param[in] EncryptedData Data to be decrypted.
+ @param[in] EncryptedDataSize Size of the encrypted buffer.
+ @param[out] OutData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] OutDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
+**/
+// FROM BaseCryptLib.h:2219
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_MD4_FINAL)(
- IN OUT VOID *Md4Context,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_PKCS1V2_DECRYPT)(
+ IN CONST UINT8 *PrivateKey,
+ IN UINTN PrivateKeySize,
+ IN UINT8 *EncryptedData,
+ IN UINTN EncryptedDataSize,
+ OUT UINT8 **OutData,
+ OUT UINTN *OutDataSize
);
+/**
+ Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
+ Cryptographic Message Syntax Standard". The input signed data could be wrapped
+ in a ContentInfo structure.
+ If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then
+ return FALSE. If P7Length overflow, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] P7Data Pointer to the PKCS#7 message to verify.
+ @param[in] P7Length Length of the PKCS#7 message in bytes.
+ @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
+ It's caller's responsibility to free the buffer with
+ Pkcs7FreeSigners().
+ This data structure is EFI_CERT_STACK type.
+ @param[out] StackLength Length of signer's certificates in bytes.
+ @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
+ It's caller's responsibility to free the buffer with
+ Pkcs7FreeSigners().
+ @param[out] CertLength Length of the trusted certificate in bytes.
+ @retval TRUE The operation is finished successfully.
+ @retval FALSE Error occurs during the operation.
+ @retval FALSE This interface is not supported.
+**/
+// FROM BaseCryptLib.h:2324
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_MD4_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_PKCS7_GET_SIGNERS)(
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ OUT UINT8 **CertStack,
+ OUT UINTN *StackLength,
+ OUT UINT8 **TrustedCert,
+ OUT UINTN *CertLength
);
-// ----------------------------------------------------------------------------
-
/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
- @retval 0 This interface is not supported.
-
+ Wrap function to use free() to free allocated memory for certificates.
+ If this interface is not supported, then ASSERT().
+ @param[in] Certs Pointer to the certificates to be freed.
**/
+// FROM BaseCryptLib.h:2343
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_MD5_GET_CONTEXT_SIZE)(
- VOID
+VOID
+(EFIAPI *EDKII_CRYPTO_PKCS7_FREE_SIGNERS)(
+ IN UINT8 *Certs
);
/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
- @retval FALSE This interface is not supported.
-
+ Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
+ Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
+ unchained to the signer's certificates.
+ The input signed data could be wrapped in a ContentInfo structure.
+ @param[in] P7Data Pointer to the PKCS#7 message.
+ @param[in] P7Length Length of the PKCS#7 message in bytes.
+ @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
+ certificate. It's caller's responsibility to free the buffer
+ with Pkcs7FreeSigners().
+ This data structure is EFI_CERT_STACK type.
+ @param[out] ChainLength Length of the chained certificates list buffer in bytes.
+ @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
+ responsibility to free the buffer with Pkcs7FreeSigners().
+ This data structure is EFI_CERT_STACK type.
+ @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
+ @retval TRUE The operation is finished successfully.
+ @retval FALSE Error occurs during the operation.
**/
+// FROM BaseCryptLib.h:2371
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_MD5_INIT)(
- OUT VOID *Md5Context
+(EFIAPI *EDKII_CRYPTO_PKCS7_GET_CERTIFICATES_LIST)(
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ OUT UINT8 **SignerChainCerts,
+ OUT UINTN *ChainLength,
+ OUT UINT8 **UnchainCerts,
+ OUT UINTN *UnchainLength
);
/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
+ Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
+ Syntax Standard, version 1.5". This interface is only intended to be used for
+ application to perform PKCS#7 functionality validation.
If this interface is not supported, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] PrivateKey Pointer to the PEM-formatted private key data for
+ data signing.
+ @param[in] PrivateKeySize Size of the PEM private key data in bytes.
+ @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
+ key data.
+ @param[in] InData Pointer to the content to be signed.
+ @param[in] InDataSize Size of InData in bytes.
+ @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
+ @param[in] SignCertSize Size of signer's DER-encoded certificate to sign with. // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
+ @param[in] OtherCerts Pointer to an optional additional set of certificates to
+ include in the PKCS#7 signedData (e.g. any intermediate
+ CAs in the chain).
+ @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
+ responsibility to free the buffer with FreePool().
+ @param[out] SignedDataSize Size of SignedData in bytes.
+ @retval TRUE PKCS#7 data signing succeeded.
+ @retval FALSE PKCS#7 data signing failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2410
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_MD5_DUPLICATE)(
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
+(EFIAPI *EDKII_CRYPTO_PKCS7_SIGN)(
+ IN CONST UINT8 *PrivateKey,
+ IN UINTN PrivateKeySize,
+ IN CONST UINT8 *KeyPassword,
+ IN UINT8 *InData,
+ IN UINTN InDataSize,
+ IN CONST UINT8 *SignCert,
+ IN UINTN SignCertSize,
+ IN UINT8 *OtherCerts OPTIONAL,
+ OUT UINT8 **SignedData,
+ OUT UINTN *SignedDataSize
);
/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly initialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
+ Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
+ Cryptographic Message Syntax Standard". The input signed data could be wrapped
+ in a ContentInfo structure.
+ If P7Data, TrustedCert or InData is NULL, then return FALSE.
+ If P7Length, CertLength or DataLength overflow, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] P7Data Pointer to the PKCS#7 message to verify.
+ @param[in] P7Length Length of the PKCS#7 message in bytes.
+ @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
+ is used for certificate chain verification.
+ @param[in] CertLength Length of the trusted certificate in bytes.
+ @param[in] InData Pointer to the content to be verified.
+ @param[in] DataLength Length of InData in bytes.
+ @retval TRUE The specified PKCS#7 signed data is valid.
+ @retval FALSE Invalid PKCS#7 signed data.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2449
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_MD5_UPDATE)(
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+(EFIAPI *EDKII_CRYPTO_PKCS7_VERIFY)(
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ IN CONST UINT8 *TrustedCert,
+ IN UINTN CertLength,
+ IN CONST UINT8 *InData,
+ IN UINTN DataLength
);
/**
- Completes computation of the MD5 digest value.
+ This function receives a PKCS7 formatted signature, and then verifies that
+ the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity
+ leaf signing certificate.
+ Note that this function does not validate the certificate chain.
+ Applications for custom EKU's are quite flexible. For example, a policy EKU
+ may be present in an Issuing Certificate Authority (CA), and any sub-ordinate
+ certificate issued might also contain this EKU, thus constraining the
+ sub-ordinate certificate. Other applications might allow a certificate
+ embedded in a device to specify that other Object Identifiers (OIDs) are
+ present which contains binary data specifying custom capabilities that
+ the device is able to do.
+ @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
+ containing the content block with both the signature,
+ the signer's certificate, and any necessary intermediate
+ certificates.
+ @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
+ @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
+ required EKUs that must be present in the signature.
+ @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
+ @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
+ must be present in the leaf signer. If it is
+ FALSE, then we will succeed if we find any
+ of the specified EKU's.
+ @retval EFI_SUCCESS The required EKUs were found in the signature.
+ @retval EFI_INVALID_PARAMETER A parameter was invalid.
+ @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
+**/
+// FROM BaseCryptLib.h:2492
+typedef
+RETURN_STATUS
+(EFIAPI *EDKII_CRYPTO_VERIFY_EKUS_IN_PKCS7_SIGNATURE)(
+ IN CONST UINT8 *Pkcs7Signature,
+ IN CONST UINT32 SignatureSize,
+ IN CONST CHAR8 *RequiredEKUs[],
+ IN CONST UINT32 RequiredEKUsSize,
+ IN BOOLEAN RequireAllPresent
+ );
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly initialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
+/**
+ Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+ data could be wrapped in a ContentInfo structure.
+ If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
+ then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
+ Caution: This function may receive untrusted input. So this function will do
+ basic check for PKCS#7 data structure.
+ @param[in] P7Data Pointer to the PKCS#7 signed data to process.
+ @param[in] P7Length Length of the PKCS#7 signed data in bytes.
+ @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
+ It's caller's responsibility to free the buffer with FreePool().
+ @param[out] ContentSize The size of the extracted content in bytes.
+ @retval TRUE The P7Data was correctly formatted for processing.
+ @retval FALSE The P7Data was not correctly formatted for processing.
+**/
+// FROM BaseCryptLib.h:2522
+typedef
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_PKCS7_GET_ATTACHED_CONTENT)(
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ OUT VOID **Content,
+ OUT UINTN *ContentSize
+ );
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
+/**
+ Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
+ Authenticode Portable Executable Signature Format".
+ If AuthData is NULL, then return FALSE.
+ If ImageHash is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
+ PE/COFF image to be verified.
+ @param[in] DataSize Size of the Authenticode Signature in bytes.
+ @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
+ is used for certificate chain verification.
+ @param[in] CertSize Size of the trusted certificate in bytes.
+ @param[in] ImageHash Pointer to the original image file hash value. The procedure
+ for calculating the image hash value is described in Authenticode
+ specification.
+ @param[in] HashSize Size of Image hash value in bytes.
+ @retval TRUE The specified Authenticode Signature is valid.
+ @retval FALSE Invalid Authenticode Signature.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2555
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_MD5_FINAL)(
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_AUTHENTICODE_VERIFY)(
+ IN CONST UINT8 *AuthData,
+ IN UINTN DataSize,
+ IN CONST UINT8 *TrustedCert,
+ IN UINTN CertSize,
+ IN CONST UINT8 *ImageHash,
+ IN UINTN HashSize
);
/**
- Computes the MD5 message digest of a input data buffer.
-
- This function performs the MD5 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
+ Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
+ signature.
+ If AuthData is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
+ PE/COFF image to be verified.
+ @param[in] DataSize Size of the Authenticode Signature in bytes.
+ @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
+ is used for TSA certificate chain verification.
+ @param[in] CertSize Size of the trusted certificate in bytes.
+ @param[out] SigningTime Return the time of timestamp generation time if the timestamp
+ signature is valid.
+ @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
+ @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
**/
+// FROM BaseCryptLib.h:2586
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_MD5_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_IMAGE_TIMESTAMP_VERIFY)(
+ IN CONST UINT8 *AuthData,
+ IN UINTN DataSize,
+ IN CONST UINT8 *TsaCert,
+ IN UINTN CertSize,
+ OUT EFI_TIME *SigningTime
);
-// =====================================================================================
-// PKCS
-// =====================================================================================
+// =============================================================================
+// DH functions
+// =============================================================================
/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the encrypted message in
- in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to parse X509 certificate.
- - Fail to allocate an intermediate buffer.
- - NULL pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size and hash digest size).
-
- @param[in] PublicKey A pointer to the DER-encoded X509 certificate that will be used to encrypt the data.
- @param[in] PublicKeySize Size of the X509 cert buffer.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer. 0 otherwise.
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
+ Allocates and Initializes one Diffie-Hellman Context for subsequent use.
+ @return Pointer to the Diffie-Hellman Context that has been initialized.
+ If the allocations fails, DhNew() returns NULL.
+ If the interface is not supported, DhNew() returns NULL.
+**/
+// FROM BaseCryptLib.h:2982
+typedef
+VOID *
+(EFIAPI *EDKII_CRYPTO_DH_NEW)(
+ VOID
+ );
+/**
+ Release the specified DH context.
+ If the interface is not supported, then ASSERT().
+ @param[in] DhContext Pointer to the DH context to be released.
**/
+// FROM BaseCryptLib.h:2996
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS1_ENCRYPT_V2)(
- IN CONST UINT8 *PublicKey,
- IN UINTN PublicKeySize,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
+VOID
+(EFIAPI *EDKII_CRYPTO_DH_FREE)(
+ IN VOID *DhContext
);
/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- @param[in] PrivateKey A pointer to the DER-encoded private key.
- @param[in] PrivateKeySize Size of the private key buffer.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
+ Generates DH parameter.
+ Given generator g, and length of prime number p in bits, this function generates p,
+ and sets DH context according to value of g and p.
+ Before this function can be invoked, pseudorandom number generator must be correctly
+ initialized by RandomSeed().
+ If DhContext is NULL, then return FALSE.
+ If Prime is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[in] Generator Value of generator.
+ @param[in] PrimeLength Length in bits of prime to be generated.
+ @param[out] Prime Pointer to the buffer to receive the generated prime number.
+ @retval TRUE DH parameter generation succeeded.
+ @retval FALSE Value of Generator is not supported.
+ @retval FALSE PRNG fails to generate random prime number with PrimeLength.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:3026
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS1V2_DECRYPT)(
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
+(EFIAPI *EDKII_CRYPTO_DH_GENERATE_PARAMETER)(
+ IN OUT VOID *DhContext,
+ IN UINTN Generator,
+ IN UINTN PrimeLength,
+ OUT UINT8 *Prime
);
/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a public key using RsaSetKey().
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_OAEP_ENCRYPT)(
- IN VOID *RsaContext,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- );
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a private key using RsaSetKey().
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_OAEP_DECRYPT)(
- IN VOID *RsaContext,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- );
-
-// ---------------------------------------------
-// PKCS5
-
-/**
- Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
- password based encryption key derivation function PBKDF2, as specified in RFC 2898.
-
- If Password or Salt or OutKey is NULL, then return FALSE.
- If the hash algorithm could not be determined, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] PasswordLength Length of input password in bytes.
- @param[in] Password Pointer to the array for the password.
- @param[in] SaltLength Size of the Salt in bytes.
- @param[in] Salt Pointer to the Salt.
- @param[in] IterationCount Number of iterations to perform. Its value should be
- greater than or equal to 1.
- @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
- NOTE: DigestSize will be used to determine the hash algorithm.
- Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
- @param[in] KeyLength Size of the derived key buffer in bytes.
- @param[out] OutKey Pointer to the output derived key buffer.
-
- @retval TRUE A key was derived successfully.
- @retval FALSE One of the pointers was NULL or one of the sizes was too large.
- @retval FALSE The hash algorithm could not be determined from the digest size.
- @retval FALSE The key derivation operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS5_PW_HASH)(
- IN UINTN PasswordSize,
- IN CONST CHAR8 *Password,
- IN UINTN SaltSize,
- IN CONST UINT8 *Salt,
- IN UINTN IterationCount,
- IN UINTN DigestSize,
- IN UINTN OutputSize,
- OUT UINT8 *Output
- );
-
-// ---------------------------------------------
-// PKCS7
-
-/**
- Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, TrustedCert or InData is NULL, then return FALSE.
- If P7Length, CertLength or DataLength overflow, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertLength Length of the trusted certificate in bytes.
- @param[in] InData Pointer to the content to be verified.
- @param[in] DataLength Length of InData in bytes.
-
- @retval TRUE The specified PKCS#7 signed data is valid.
- @retval FALSE Invalid PKCS#7 signed data.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS7_VERIFY)(
- IN CONST UINT8 *P7Data,
- IN UINTN P7DataLength,
- IN CONST UINT8 *TrustedCert,
- IN UINTN TrustedCertLength,
- IN CONST UINT8 *Data,
- IN UINTN DataLength
- );
-
-/**
- VerifyEKUsInPkcs7Signature()
-
- This function receives a PKCS7 formatted signature, and then verifies that
- the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity
- leaf signing certificate.
-
- Note that this function does not validate the certificate chain.
-
- Applications for custom EKU's are quite flexible. For example, a policy EKU
- may be present in an Issuing Certificate Authority (CA), and any sub-ordinate
- certificate issued might also contain this EKU, thus constraining the
- sub-ordinate certificate. Other applications might allow a certificate
- embedded in a device to specify that other Object Identifiers (OIDs) are
- present which contains binary data specifying custom capabilities that
- the device is able to do.
-
- @param[in] Pkcs7Signature - The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
-
- @param[in] Pkcs7SignatureSize - Number of bytes in Pkcs7Signature.
-
- @param[in] RequiredEKUs - Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
-
- @param[in] RequiredEKUsSize - Number of elements in the RequiredEKUs string array.
-
- @param[in] RequireAllPresent - If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval EFI_SUCCESS - The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER - A parameter was invalid.
- @retval EFI_NOT_FOUND - One or more EKU's were not found in the signature.
-
-**/
-typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_PKCS7_VERIFY_EKU)(
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- );
-
-/**
- Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then
- return FALSE. If P7Length overflow, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] StackLength Length of signer's certificates in bytes.
- @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- @param[out] CertLength Length of the trusted certificate in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS7_GET_SIGNERS)(
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **CertStack,
- OUT UINTN *StackLength,
- OUT UINT8 **TrustedCert,
- OUT UINTN *CertLength
- );
-
-/**
- Wrap function to use free() to free allocated memory for certificates.
-
- If this interface is not supported, then ASSERT().
-
- @param[in] Certs Pointer to the certificates to be freed.
-
-**/
-typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_PKCS7_FREE_SIGNERS)(
- IN UINT8 *Certs
- );
-
-/**
- Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
- Syntax Standard, version 1.5". This interface is only intended to be used for
- application to perform PKCS#7 functionality validation.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] PrivateKey Pointer to the PEM-formatted private key data for
- data signing.
- @param[in] PrivateKeySize Size of the PEM private key data in bytes.
- @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
- key data.
- @param[in] InData Pointer to the content to be signed.
- @param[in] InDataSize Size of InData in bytes.
- @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
- @param[in] OtherCerts Pointer to an optional additional set of certificates to
- include in the PKCS#7 signedData (e.g. any intermediate
- CAs in the chain).
- @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
- responsibility to free the buffer with FreePool().
- @param[out] SignedDataSize Size of SignedData in bytes.
-
- @retval TRUE PKCS#7 data signing succeeded.
- @retval FALSE PKCS#7 data signing failed.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS7_SIGN)(
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN CONST UINT8 *KeyPassword,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN UINT8 *SignCert,
- IN UINT8 *OtherCerts OPTIONAL,
- OUT UINT8 **SignedData,
- OUT UINTN *SignedDataSize
- );
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
- then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
-
- Caution: This function may receive untrusted input. So this function will do
- basic check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS7_GET_ATTACHED_CONTENT)(
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- );
-
-/**
- Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
- unchained to the signer's certificates.
- The input signed data could be wrapped in a ContentInfo structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
- certificate. It's caller's responsibility to free the buffer
- with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] ChainLength Length of the chained certificates list buffer in bytes.
- @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
- responsibility to free the buffer with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PKCS7_GET_CERTIFICATES_LIST)(
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **SignerChainCerts,
- OUT UINTN *ChainLength,
- OUT UINT8 **UnchainCerts,
- OUT UINTN *UnchainLength
- );
-
-/**
- Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
- Authenticode Portable Executable Signature Format".
-
- If AuthData is NULL, then return FALSE.
- If ImageHash is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[in] ImageHash Pointer to the original image file hash value. The procedure
- for calculating the image hash value is described in Authenticode
- specification.
- @param[in] HashSize Size of Image hash value in bytes.
-
- @retval TRUE The specified Authenticode Signature is valid.
- @retval FALSE Invalid Authenticode Signature.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_AUTHENTICODE_VERIFY)(
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertSize,
- IN CONST UINT8 *ImageHash,
- IN UINTN HashSize
- );
-
-/**
- Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
- signature.
-
- If AuthData is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
- is used for TSA certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
- @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_IMAGE_TIMESTAMP_VERIFY)(
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- OUT EFI_TIME *SigningTime
- );
-
-// =====================================================================================
-// DH Key Exchange Primitive
-// =====================================================================================
-
-/**
- Allocates and Initializes one Diffie-Hellman Context for subsequent use.
-
- @return Pointer to the Diffie-Hellman Context that has been initialized.
- If the allocations fails, DhNew() returns NULL.
- If the interface is not supported, DhNew() returns NULL.
-
-**/
-typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_DH_NEW)(
- VOID
- );
-
-/**
- Release the specified DH context.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] DhContext Pointer to the DH context to be released.
-
-**/
-typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_DH_FREE)(
- IN VOID *DhContext
- );
-
-/**
- Generates DH parameter.
-
- Given generator g, and length of prime number p in bits, this function generates p,
- and sets DH context according to value of g and p.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[out] Prime Pointer to the buffer to receive the generated prime number.
-
- @retval TRUE DH parameter generation succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE PRNG fails to generate random prime number with PrimeLength.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_DH_GENERATE_PARAMETER)(
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- OUT UINT8 *Prime
- );
-
-/**
- Sets generator and prime parameters for DH.
-
- Given generator g, and prime number p, this function and sets DH
- context accordingly.
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[in] Prime Pointer to the prime number.
-
- @retval TRUE DH parameter setting succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE Value of Generator is not suitable for the Prime.
- @retval FALSE Value of Prime is not a prime number.
- @retval FALSE Value of Prime is not a safe prime number.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_DH_SET_PARAMETER)(
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- IN CONST UINT8 *Prime
- );
-
-/**
- Generates DH public key.
-
- This function generates random secret exponent, and computes the public key, which is
- returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
- If the PublicKey buffer is too small to hold the public key, FALSE is returned and
- PublicKeySize is set to the required buffer size to obtain the public key.
-
- If DhContext is NULL, then return FALSE.
- If PublicKeySize is NULL, then return FALSE.
- If PublicKeySize is large enough but PublicKey is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[out] PublicKey Pointer to the buffer to receive generated public key.
- @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
- On output, the size of data returned in PublicKey buffer in bytes.
-
- @retval TRUE DH public key generation succeeded.
- @retval FALSE DH public key generation failed.
- @retval FALSE PublicKeySize is not large enough.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_DH_GENERATE_KEY)(
- IN OUT VOID *DhContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- );
-
-/**
- Computes exchanged common key.
-
- Given peer's public key, this function computes the exchanged common key, based on its own
- context including value of prime modulus and random secret exponent.
-
- If DhContext is NULL, then return FALSE.
- If PeerPublicKey is NULL, then return FALSE.
- If KeySize is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] PeerPublicKey Pointer to the peer's public key.
- @param[in] PeerPublicKeySize Size of peer's public key in bytes.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
-
- @retval TRUE DH exchanged key generation succeeded.
- @retval FALSE DH exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_DH_COMPUTE_KEY)(
- IN OUT VOID *DhContext,
- IN CONST UINT8 *PeerPublicKey,
- IN UINTN PeerPublicKeySize,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- );
-
-// =====================================================================================
-// Pseudo-Random Generation Primitive
-// =====================================================================================
-
-/**
- Sets up the seed value for the pseudorandom number generator.
-
- This function sets up the seed value for the pseudorandom number generator.
- If Seed is not NULL, then the seed passed in is used.
- If Seed is NULL, then default seed is used.
- If this interface is not supported, then return FALSE.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval TRUE Pseudorandom number generator has enough entropy for random generation.
- @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RANDOM_SEED)(
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
- );
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- If Output is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval TRUE Pseudorandom byte stream generated successfully.
- @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RANDOM_BYTES)(
- OUT UINT8 *Output,
- IN UINTN Size
- );
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_VERIFY_PKCS1)(
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- );
-
-/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
-**/
-typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_RSA_NEW)(
- VOID
- );
-
-/**
- Release the specified RSA context.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_RSA_FREE)(
- IN VOID *RsaContext
- );
-
-/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_SET_KEY)(
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
- );
-
-/**
- Gets the tag-designated RSA key component from the established RSA context.
-
- This function retrieves the tag-designated RSA key component from the
- established RSA context as a non-negative integer (octet string format
- represented in RSA PKCS#1).
- If specified key component has not been set or has been cleared, then returned
- BnSize is set to 0.
- If the BigNumber buffer is too small to hold the contents of the key, FALSE
- is returned and BnSize is set to the required buffer size to obtain the key.
-
- If RsaContext is NULL, then return FALSE.
- If BnSize is NULL, then return FALSE.
- If BnSize is large enough but BigNumber is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[out] BigNumber Pointer to octet integer buffer.
- @param[in, out] BnSize On input, the size of big number buffer in bytes.
- On output, the size of data returned in big number buffer in bytes.
-
- @retval TRUE RSA key component was retrieved successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE BnSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_GET_KEY)(
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- OUT UINT8 *BigNumber,
- IN OUT UINTN *BnSize
- );
-
-/**
- Generates RSA key components.
-
- This function generates RSA key components. It takes RSA public exponent E and
- length in bits of RSA modulus N as input, and generates all key components.
- If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] ModulusLength Length of RSA modulus N in bits.
- @param[in] PublicExponent Pointer to RSA public exponent.
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
-
- @retval TRUE RSA key component was generated successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_GENERATE_KEY)(
- IN OUT VOID *RsaContext,
- IN UINTN ModulusLength,
- IN CONST UINT8 *PublicExponent,
- IN UINTN PublicExponentSize
- );
-
-/**
- Validates key components of RSA context.
- NOTE: This function performs integrity checks on all the RSA key material, so
- the RSA key structure must contain all the private key data.
-
- This function validates key components of RSA context in following aspects:
- - Whether p is a prime
- - Whether q is a prime
- - Whether n = p * q
- - Whether d*e = 1 mod lcm(p-1,q-1)
-
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context to check.
-
- @retval TRUE RSA key components are valid.
- @retval FALSE RSA key components are not valid.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_CHECK_KEY)(
- IN VOID *RsaContext
- );
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in PKCS1-v1_5.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_PKCS1_SIGN)(
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- );
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_PKCS1_VERIFY)(
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- );
-
-/**
- Retrieve the RSA Private Key from the password-protected PEM key data.
-
- If PemData is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA private key component. Use RsaFree() function to free the
- resource.
-
- @retval TRUE RSA Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_GET_PRIVATE_KEY_FROM_PEM)(
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **RsaContext
- );
-
-/**
- Retrieve the RSA Public Key from one DER-encoded X509 certificate.
-
- If Cert is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA public key component. Use RsaFree() function to free the
- resource.
-
- @retval TRUE RSA Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve RSA public key from X509 certificate.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_GET_PUBLIC_KEY_FROM_X509)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **RsaContext
- );
-
-// ----------------------------------------
-// SHA
-// ----------------------------------------
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
- @retval 0 This interface is not supported.
-
-**/
-typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_SHA1_GET_CONTEXT_SIZE)(
- VOID
- );
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
- @retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA1_INIT)(
- OUT VOID *Sha1Context
- );
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
+ Sets generator and prime parameters for DH.
+ Given generator g, and prime number p, this function and sets DH
+ context accordingly.
+ If DhContext is NULL, then return FALSE.
+ If Prime is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[in] Generator Value of generator.
+ @param[in] PrimeLength Length in bits of prime to be generated.
+ @param[in] Prime Pointer to the prime number.
+ @retval TRUE DH parameter setting succeeded.
+ @retval FALSE Value of Generator is not supported.
+ @retval FALSE Value of Generator is not suitable for the Prime.
+ @retval FALSE Value of Prime is not a prime number.
+ @retval FALSE Value of Prime is not a safe prime number.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:3058
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA1_DUPLICATE)(
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
+(EFIAPI *EDKII_CRYPTO_DH_SET_PARAMETER)(
+ IN OUT VOID *DhContext,
+ IN UINTN Generator,
+ IN UINTN PrimeLength,
+ IN CONST UINT8 *Prime
);
/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
+ Generates DH public key.
+ This function generates random secret exponent, and computes the public key, which is
+ returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
+ If the PublicKey buffer is too small to hold the public key, FALSE is returned and
+ PublicKeySize is set to the required buffer size to obtain the public key.
+ If DhContext is NULL, then return FALSE.
+ If PublicKeySize is NULL, then return FALSE.
+ If PublicKeySize is large enough but PublicKey is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[out] PublicKey Pointer to the buffer to receive generated public key.
+ @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
+ On output, the size of data returned in PublicKey buffer in bytes.
+ @retval TRUE DH public key generation succeeded.
+ @retval FALSE DH public key generation failed.
+ @retval FALSE PublicKeySize is not large enough.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:3091
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA1_UPDATE)(
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+(EFIAPI *EDKII_CRYPTO_DH_GENERATE_KEY)(
+ IN OUT VOID *DhContext,
+ OUT UINT8 *PublicKey,
+ IN OUT UINTN *PublicKeySize
);
/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
+ Computes exchanged common key.
+ Given peer's public key, this function computes the exchanged common key, based on its own
+ context including value of prime modulus and random secret exponent.
+ If DhContext is NULL, then return FALSE.
+ If PeerPublicKey is NULL, then return FALSE.
+ If KeySize is NULL, then return FALSE.
+ If Key is NULL, then return FALSE.
+ If KeySize is not large enough, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[in] PeerPublicKey Pointer to the peer's public key.
+ @param[in] PeerPublicKeySize Size of peer's public key in bytes.
+ @param[out] Key Pointer to the buffer to receive generated key.
+ @param[in, out] KeySize On input, the size of Key buffer in bytes.
+ On output, the size of data returned in Key buffer in bytes.
+ @retval TRUE DH exchanged key generation succeeded.
+ @retval FALSE DH exchanged key generation failed.
+ @retval FALSE KeySize is not large enough.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:3125
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA1_FINAL)(
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_DH_COMPUTE_KEY)(
+ IN OUT VOID *DhContext,
+ IN CONST UINT8 *PeerPublicKey,
+ IN UINTN PeerPublicKeySize,
+ OUT UINT8 *Key,
+ IN OUT UINTN *KeySize
);
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
+// =============================================================================
+// RANDOM functions
+// =============================================================================
+/**
+ Sets up the seed value for the pseudorandom number generator.
+ This function sets up the seed value for the pseudorandom number generator.
+ If Seed is not NULL, then the seed passed in is used.
+ If Seed is NULL, then default seed is used.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
+ @param[in] Seed Pointer to seed value.
+ If NULL, default seed is used.
+ @param[in] SeedSize Size of seed value.
+ If Seed is NULL, this parameter is ignored.
+ @retval TRUE Pseudorandom number generator has enough entropy for random generation.
+ @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
@retval FALSE This interface is not supported.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA1_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- );
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
-**/
-typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_SHA256_GET_CONTEXT_SIZE)(
- VOID
- );
-
-/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
**/
+// FROM BaseCryptLib.h:3157
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA256_INIT)(
- OUT VOID *Sha256Context
+(EFIAPI *EDKII_CRYPTO_RANDOM_SEED)(
+ IN CONST UINT8 *Seed OPTIONAL,
+ IN UINTN SeedSize
);
/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
+ Generates a pseudorandom byte stream of the specified size.
+ If Output is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
+ @param[out] Output Pointer to buffer to receive random value.
+ @param[in] Size Size of random bytes to generate.
+ @retval TRUE Pseudorandom byte stream generated successfully.
+ @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
@retval FALSE This interface is not supported.
-
**/
+// FROM BaseCryptLib.h:3178
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA256_DUPLICATE)(
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
+(EFIAPI *EDKII_CRYPTO_RANDOM_BYTES)(
+ OUT UINT8 *Output,
+ IN UINTN Size
);
-/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
+// =============================================================================
+// RSA functions
+// =============================================================================
+/**
+ Allocates and initializes one RSA context for subsequent use.
+ @return Pointer to the RSA context that has been initialized.
+ If the allocations fails, RsaNew() returns NULL.
**/
+// FROM BaseCryptLib.h:1475
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA256_UPDATE)(
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+VOID *
+(EFIAPI *EDKII_CRYPTO_RSA_NEW)(
+ VOID
);
/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
+ Release the specified RSA context.
+ If RsaContext is NULL, then return FALSE.
+ @param[in] RsaContext Pointer to the RSA context to be released.
**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA256_FINAL)(
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
+// FROM BaseCryptLib.h:1489
+typedef
+VOID
+(EFIAPI *EDKII_CRYPTO_RSA_FREE)(
+ IN VOID *RsaContext
);
/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ Sets the tag-designated key component into the established RSA context.
+ This function sets the tag-designated RSA key component into the established
+ RSA context from the user-specified non-negative integer (octet string format
+ represented in RSA PKCS#1).
+ If BigNumber is NULL, then the specified key component in RSA context is cleared.
+ If RsaContext is NULL, then return FALSE.
+ @param[in, out] RsaContext Pointer to RSA context being set.
+ @param[in] KeyTag Tag of RSA key component being set.
+ @param[in] BigNumber Pointer to octet integer buffer.
+ If NULL, then the specified key component in RSA
+ context is cleared.
+ @param[in] BnSize Size of big number buffer in bytes.
+ If BigNumber is NULL, then it is ignored.
+ @retval TRUE RSA key component was set successfully.
+ @retval FALSE Invalid RSA key component tag.
**/
+// FROM BaseCryptLib.h:1517
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA256_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_RSA_SET_KEY)(
+ IN OUT VOID *RsaContext,
+ IN RSA_KEY_TAG KeyTag,
+ IN CONST UINT8 *BigNumber,
+ IN UINTN BnSize
);
/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
- @retval 0 This interface is not supported.
-
+ Gets the tag-designated RSA key component from the established RSA context.
+ This function retrieves the tag-designated RSA key component from the
+ established RSA context as a non-negative integer (octet string format
+ represented in RSA PKCS#1).
+ If specified key component has not been set or has been cleared, then returned
+ BnSize is set to 0.
+ If the BigNumber buffer is too small to hold the contents of the key, FALSE
+ is returned and BnSize is set to the required buffer size to obtain the key.
+ If RsaContext is NULL, then return FALSE.
+ If BnSize is NULL, then return FALSE.
+ If BnSize is large enough but BigNumber is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] RsaContext Pointer to RSA context being set.
+ @param[in] KeyTag Tag of RSA key component being set.
+ @param[out] BigNumber Pointer to octet integer buffer.
+ @param[in, out] BnSize On input, the size of big number buffer in bytes.
+ On output, the size of data returned in big number buffer in bytes.
+ @retval TRUE RSA key component was retrieved successfully.
+ @retval FALSE Invalid RSA key component tag.
+ @retval FALSE BnSize is too small.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1554
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_SHA384_GET_CONTEXT_SIZE)(
- VOID
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_RSA_GET_KEY)(
+ IN OUT VOID *RsaContext,
+ IN RSA_KEY_TAG KeyTag,
+ OUT UINT8 *BigNumber,
+ IN OUT UINTN *BnSize
);
/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval TRUE SHA-384 context initialization succeeded.
- @retval FALSE SHA-384 context initialization failed.
-
+ Generates RSA key components.
+ This function generates RSA key components. It takes RSA public exponent E and
+ length in bits of RSA modulus N as input, and generates all key components.
+ If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
+ Before this function can be invoked, pseudorandom number generator must be correctly
+ initialized by RandomSeed().
+ If RsaContext is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] RsaContext Pointer to RSA context being set.
+ @param[in] ModulusLength Length of RSA modulus N in bits.
+ @param[in] PublicExponent Pointer to RSA public exponent.
+ @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
+ @retval TRUE RSA key component was generated successfully.
+ @retval FALSE Invalid RSA key component tag.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1586
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA384_INIT)(
- OUT VOID *Sha384Context
+(EFIAPI *EDKII_CRYPTO_RSA_GENERATE_KEY)(
+ IN OUT VOID *RsaContext,
+ IN UINTN ModulusLength,
+ IN CONST UINT8 *PublicExponent,
+ IN UINTN PublicExponentSize
);
/**
- Makes a copy of an existing SHA-384 context.
-
- If Sha384Context is NULL, then return FALSE.
- If NewSha384Context is NULL, then return FALSE.
+ Validates key components of RSA context.
+ NOTE: This function performs integrity checks on all the RSA key material, so
+ the RSA key structure must contain all the private key data.
+ This function validates key components of RSA context in following aspects:
+ - Whether p is a prime
+ - Whether q is a prime
+ - Whether n = p * q
+ - Whether d*e = 1 mod lcm(p-1,q-1)
+ If RsaContext is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval TRUE SHA-384 context copy succeeded.
- @retval FALSE SHA-384 context copy failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] RsaContext Pointer to RSA context to check.
+ @retval TRUE RSA key components are valid.
+ @retval FALSE RSA key components are not valid.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1616
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA384_DUPLICATE)(
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
+(EFIAPI *EDKII_CRYPTO_RSA_CHECK_KEY)(
+ IN VOID *RsaContext
);
/**
- Digests the input data and updates SHA-384 context.
-
- This function performs SHA-384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
- by Sha384Final(). Behavior with invalid context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-384 data digest succeeded.
- @retval FALSE SHA-384 data digest failed.
-
+ Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
+ This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
+ RSA PKCS#1.
+ If the Signature buffer is too small to hold the contents of signature, FALSE
+ is returned and SigSize is set to the required buffer size to obtain the signature.
+ If RsaContext is NULL, then return FALSE.
+ If MessageHash is NULL, then return FALSE.
+ If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
+ If SigSize is large enough but Signature is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] RsaContext Pointer to RSA context for signature generation.
+ @param[in] MessageHash Pointer to octet message hash to be signed.
+ @param[in] HashSize Size of the message hash in bytes.
+ @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
+ @param[in, out] SigSize On input, the size of Signature buffer in bytes.
+ On output, the size of data returned in Signature buffer in bytes.
+ @retval TRUE Signature successfully generated in PKCS1-v1_5.
+ @retval FALSE Signature generation failed.
+ @retval FALSE SigSize is too small.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1649
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA384_UPDATE)(
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+(EFIAPI *EDKII_CRYPTO_RSA_PKCS1_SIGN)(
+ IN VOID *RsaContext,
+ IN CONST UINT8 *MessageHash,
+ IN UINTN HashSize,
+ OUT UINT8 *Signature,
+ IN OUT UINTN *SigSize
);
/**
- Completes computation of the SHA-384 digest value.
-
- This function completes SHA-384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-384 context cannot
- be used again.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
- finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
-
+ Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
+ RSA PKCS#1.
+ If RsaContext is NULL, then return FALSE.
+ If MessageHash is NULL, then return FALSE.
+ If Signature is NULL, then return FALSE.
+ If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then return FALSE.
+ @param[in] RsaContext Pointer to RSA context for signature verification.
+ @param[in] MessageHash Pointer to octet message hash to be checked.
+ @param[in] HashSize Size of the message hash in bytes.
+ @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
+ @param[in] SigSize Size of signature in bytes.
+ @retval TRUE Valid signature encoded in PKCS1-v1_5.
+ @retval FALSE Invalid signature or invalid RSA context.
**/
+// FROM BaseCryptLib.h:1678
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA384_FINAL)(
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_RSA_PKCS1_VERIFY)(
+ IN VOID *RsaContext,
+ IN CONST UINT8 *MessageHash,
+ IN UINTN HashSize,
+ IN CONST UINT8 *Signature,
+ IN UINTN SigSize
);
/**
- Computes the SHA-384 message digest of a input data buffer.
-
- This function performs the SHA-384 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
+ Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
+ This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
+ RFC 8017.
+ Mask generation function is the same as the message digest algorithm.
+ If the Signature buffer is too small to hold the contents of signature, FALSE
+ is returned and SigSize is set to the required buffer size to obtain the signature.
+ If RsaContext is NULL, then return FALSE.
+ If Message is NULL, then return FALSE.
+ If MsgSize is zero or > INT_MAX, then return FALSE.
+ If DigestLen is NOT 32, 48 or 64, return FALSE.
+ If SaltLen is not equal to DigestLen, then return FALSE.
+ If SigSize is large enough but Signature is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] RsaContext Pointer to RSA context for signature generation.
+ @param[in] Message Pointer to octet message to be signed.
+ @param[in] MsgSize Size of the message in bytes.
+ @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
+ @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
+ @param[out] Signature Pointer to buffer to receive RSA PSS signature.
+ @param[in, out] SigSize On input, the size of Signature buffer in bytes.
+ On output, the size of data returned in Signature buffer in bytes.
+ @retval TRUE Signature successfully generated in RSASSA-PSS.
+ @retval FALSE Signature generation failed.
+ @retval FALSE SigSize is too small.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1720
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA384_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_RSA_PSS_SIGN)(
+ IN VOID *RsaContext,
+ IN CONST UINT8 *Message,
+ IN UINTN MsgSize,
+ IN UINT16 DigestLen,
+ IN UINT16 SaltLen,
+ OUT UINT8 *Signature,
+ IN OUT UINTN *SigSize
);
/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
-
+ Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
+ Implementation determines salt length automatically from the signature encoding.
+ Mask generation function is the same as the message digest algorithm.
+ Salt length should be equal to digest length.
+ @param[in] RsaContext Pointer to RSA context for signature verification.
+ @param[in] Message Pointer to octet message to be verified.
+ @param[in] MsgSize Size of the message in bytes.
+ @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
+ @param[in] SigSize Size of signature in bytes.
+ @param[in] DigestLen Length of digest for RSA operation.
+ @param[in] SaltLen Salt length for PSS encoding.
+ @retval TRUE Valid signature encoded in RSASSA-PSS.
+ @retval FALSE Invalid signature or invalid RSA context.
**/
+// FROM BaseCryptLib.h:1750
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_SHA512_GET_CONTEXT_SIZE)(
- VOID
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_RSA_PSS_VERIFY)(
+ IN VOID *RsaContext,
+ IN CONST UINT8 *Message,
+ IN UINTN MsgSize,
+ IN CONST UINT8 *Signature,
+ IN UINTN SigSize,
+ IN UINT16 DigestLen,
+ IN UINT16 SaltLen
);
/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval TRUE SHA-512 context initialization succeeded.
- @retval FALSE SHA-512 context initialization failed.
-
+ Retrieve the RSA Private Key from the password-protected PEM key data.
+ If PemData is NULL, then return FALSE.
+ If RsaContext is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
+ @param[in] PemSize Size of the PEM key data in bytes.
+ @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
+ @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
+ RSA private key component. Use RsaFree() function to free the
+ resource.
+ @retval TRUE RSA Private Key was retrieved successfully.
+ @retval FALSE Invalid PEM key data or incorrect password.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1781
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA512_INIT)(
- OUT VOID *Sha512Context
+(EFIAPI *EDKII_CRYPTO_RSA_GET_PRIVATE_KEY_FROM_PEM)(
+ IN CONST UINT8 *PemData,
+ IN UINTN PemSize,
+ IN CONST CHAR8 *Password,
+ OUT VOID **RsaContext
);
/**
- Makes a copy of an existing SHA-512 context.
-
- If Sha512Context is NULL, then return FALSE.
- If NewSha512Context is NULL, then return FALSE.
+ Retrieve the RSA Public Key from one DER-encoded X509 certificate.
+ If Cert is NULL, then return FALSE.
+ If RsaContext is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval TRUE SHA-512 context copy succeeded.
- @retval FALSE SHA-512 context copy failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
+ RSA public key component. Use RsaFree() function to free the
+ resource.
+ @retval TRUE RSA Public Key was retrieved successfully.
+ @retval FALSE Fail to retrieve RSA public key from X509 certificate.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1808
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA512_DUPLICATE)(
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
+(EFIAPI *EDKII_CRYPTO_RSA_GET_PUBLIC_KEY_FROM_X509)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT VOID **RsaContext
);
/**
- Digests the input data and updates SHA-512 context.
-
- This function performs SHA-512 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
- by Sha512Final(). Behavior with invalid context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-512 data digest succeeded.
- @retval FALSE SHA-512 data digest failed.
-
+ Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ encrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - X509 key size does not match any known key size.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ - Data size is too large for the provided key size (max size is a function of key size
+ and hash digest size).
+ @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
+ provisioned with a public key using RsaSetKey().
+ @param[in] InData Data to be encrypted.
+ @param[in] InDataSize Size of the data buffer.
+ @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
+ to be used when initializing the PRNG. NULL otherwise.
+ @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
+ 0 otherwise.
+ @param[in] DigestLen [Optional] If provided, size of the hash used:
+ SHA1_DIGEST_SIZE
+ SHA256_DIGEST_SIZE
+ SHA384_DIGEST_SIZE
+ SHA512_DIGEST_SIZE
+ 0 to use default (SHA1)
+ @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] EncryptedDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
**/
+// FROM BaseCryptLib.h:2185
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA512_UPDATE)(
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+(EFIAPI *EDKII_CRYPTO_RSA_OAEP_ENCRYPT)(
+ IN VOID *RsaContext,
+ IN UINT8 *InData,
+ IN UINTN InDataSize,
+ IN CONST UINT8 *PrngSeed OPTIONAL,
+ IN UINTN PrngSeedSize OPTIONAL,
+ IN UINT16 DigestLen OPTIONAL,
+ OUT UINT8 **EncryptedData,
+ OUT UINTN *EncryptedDataSize
);
/**
- Completes computation of the SHA-512 digest value.
-
- This function completes SHA-512 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-512 context cannot
- be used again.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
- finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
-
+ Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ decrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - Fail to parse private key.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
+ provisioned with a private key using RsaSetKey().
+ @param[in] EncryptedData Data to be decrypted.
+ @param[in] EncryptedDataSize Size of the encrypted buffer.
+ @param[in] DigestLen [Optional] If provided, size of the hash used:
+ SHA1_DIGEST_SIZE
+ SHA256_DIGEST_SIZE
+ SHA384_DIGEST_SIZE
+ SHA512_DIGEST_SIZE
+ 0 to use default (SHA1)
+ @param[out] OutData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] OutDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
**/
+// FROM BaseCryptLib.h:2257
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA512_FINAL)(
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_RSA_OAEP_DECRYPT)(
+ IN VOID *RsaContext,
+ IN UINT8 *EncryptedData,
+ IN UINTN EncryptedDataSize,
+ IN UINT16 DigestLen OPTIONAL,
+ OUT UINT8 **OutData,
+ OUT UINTN *OutDataSize
);
-/**
- Computes the SHA-512 message digest of a input data buffer.
-
- This function performs the SHA-512 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
- @retval FALSE This interface is not supported.
+// =============================================================================
+// SHA1 functions
+// =============================================================================
+/**
+ Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
+ If this interface is not supported, then return zero.
+ @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
+ @retval 0 This interface is not supported.
**/
+// FROM BaseCryptLib.h:244
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SHA512_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+UINTN
+(EFIAPI *EDKII_CRYPTO_SHA1_GET_CONTEXT_SIZE)(
+ VOID
);
-// ----------------------------------------------------------------------------
-// X509
-// ----------------------------------------------------------------------------
-
-/**
- Retrieve the subject bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If SubjectSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
- @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate subject retrieved successfully.
- @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
- The SubjectSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
+/**
+ Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
+ subsequent use.
+ If Sha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[out] Sha1Context Pointer to SHA-1 context being initialized.
+ @retval TRUE SHA-1 context initialization succeeded.
+ @retval FALSE SHA-1 context initialization failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:264
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_SUBJECT_NAME)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertSubject,
- IN OUT UINTN *SubjectSize
+(EFIAPI *EDKII_CRYPTO_SHA1_INIT)(
+ OUT VOID *Sha1Context
);
/**
- Retrieve the common name (CN) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string (UTF8). At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If CommonNameSize is NULL.
- If CommonName is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no CommonName entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
+ Makes a copy of an existing SHA-1 context.
+ If Sha1Context is NULL, then return FALSE.
+ If NewSha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Sha1Context Pointer to SHA-1 context being copied.
+ @param[out] NewSha1Context Pointer to new SHA-1 context.
+ @retval TRUE SHA-1 context copy succeeded.
+ @retval FALSE SHA-1 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:285
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_X509_GET_COMMON_NAME)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *CommonName OPTIONAL,
- IN OUT UINTN *CommonNameSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SHA1_DUPLICATE)(
+ IN CONST VOID *Sha1Context,
+ OUT VOID *NewSha1Context
);
/**
- Retrieve the organization name (O) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] NameBuffer Buffer to contain the retrieved certificate organization
- name string. At most NameBufferSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] NameBufferSiz e The size in bytes of the Name buffer on input,
- and the size of buffer returned Name on output.
- If NameBuffer is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If NameBufferSize is NULL.
- If NameBuffer is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no Organization Name entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the NameBuffer is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
+ Digests the input data and updates SHA-1 context.
+ This function performs SHA-1 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
+ by Sha1Final(). Behavior with invalid context is undefined.
+ If Sha1Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] Sha1Context Pointer to the SHA-1 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-1 data digest succeeded.
+ @retval FALSE SHA-1 data digest failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:312
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_X509_GET_ORGANIZATION_NAME)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *NameBuffer OPTIONAL,
- IN OUT UINTN *NameBufferSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SHA1_UPDATE)(
+ IN OUT VOID *Sha1Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
);
/**
- Verify one X509 certificate was issued by the trusted CA.
-
- If Cert is NULL, then return FALSE.
- If CACert is NULL, then return FALSE.
+ Completes computation of the SHA-1 digest value.
+ This function completes SHA-1 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-1 context cannot
+ be used again.
+ SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
+ finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
+ If Sha1Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
- @param[in] CACertSize Size of the CA Certificate in bytes.
-
- @retval TRUE The certificate was issued by the trusted CA.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
- @retval FALSE This interface is not supported.
-
+ @param[in, out] Sha1Context Pointer to the SHA-1 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
+ value (20 bytes).
+ @retval TRUE SHA-1 digest computation succeeded.
+ @retval FALSE SHA-1 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:342
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_VERIFY_CERT)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *CACert,
- IN UINTN CACertSize
+(EFIAPI *EDKII_CRYPTO_SHA1_FINAL)(
+ IN OUT VOID *Sha1Context,
+ OUT UINT8 *HashValue
);
/**
- Construct a X509 object from DER-encoded certificate data.
-
- If Cert is NULL, then return FALSE.
- If SingleX509Cert is NULL, then return FALSE.
+ Computes the SHA-1 message digest of a input data buffer.
+ This function performs the SHA-1 message digest of a given data buffer, and places
+ the digest value into the specified memory.
If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded certificate data.
- @param[in] CertSize The size of certificate data in bytes.
- @param[out] SingleX509Cert The generated X509 object.
-
- @retval TRUE The X509 object generation succeeded.
- @retval FALSE The operation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
+ value (20 bytes).
+ @retval TRUE SHA-1 digest computation succeeded.
+ @retval FALSE SHA-1 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:367
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **SingleX509Cert
+(EFIAPI *EDKII_CRYPTO_SHA1_HASH_ALL)(
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
);
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param ... A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
+// =============================================================================
+// SHA256 functions
+// =============================================================================
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
+/**
+ Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
+ @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
+**/
+// FROM BaseCryptLib.h:383
+typedef
+UINTN
+(EFIAPI *EDKII_CRYPTO_SHA256_GET_CONTEXT_SIZE)(
+ VOID
+ );
+/**
+ Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
+ subsequent use.
+ If Sha256Context is NULL, then return FALSE.
+ @param[out] Sha256Context Pointer to SHA-256 context being initialized.
+ @retval TRUE SHA-256 context initialization succeeded.
+ @retval FALSE SHA-256 context initialization failed.
**/
+// FROM BaseCryptLib.h:401
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK)(
- IN OUT UINT8 **X509Stack,
- ...
+(EFIAPI *EDKII_CRYPTO_SHA256_INIT)(
+ OUT VOID *Sha256Context
);
/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
+ Makes a copy of an existing SHA-256 context.
+ If Sha256Context is NULL, then return FALSE.
+ If NewSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] Sha256Context Pointer to SHA-256 context being copied.
+ @param[out] NewSha256Context Pointer to new SHA-256 context.
+ @retval TRUE SHA-256 context copy succeeded.
+ @retval FALSE SHA-256 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:422
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK_V)(
- IN OUT UINT8 **X509Stack,
- IN VA_LIST Args
+(EFIAPI *EDKII_CRYPTO_SHA256_DUPLICATE)(
+ IN CONST VOID *Sha256Context,
+ OUT VOID *NewSha256Context
);
/**
- Release the specified X509 object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Cert Pointer to the X509 object to be released.
-
+ Digests the input data and updates SHA-256 context.
+ This function performs SHA-256 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
+ by Sha256Final(). Behavior with invalid context is undefined.
+ If Sha256Context is NULL, then return FALSE.
+ @param[in, out] Sha256Context Pointer to the SHA-256 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-256 data digest succeeded.
+ @retval FALSE SHA-256 data digest failed.
**/
+// FROM BaseCryptLib.h:447
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_X509_FREE)(
- IN VOID *X509Cert
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SHA256_UPDATE)(
+ IN OUT VOID *Sha256Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
);
/**
- Release the specified X509 stack object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Stack Pointer to the X509 stack object to be released.
-
+ Completes computation of the SHA-256 digest value.
+ This function completes SHA-256 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-256 context cannot
+ be used again.
+ SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
+ finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
+ If Sha256Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sha256Context Pointer to the SHA-256 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
+ value (32 bytes).
+ @retval TRUE SHA-256 digest computation succeeded.
+ @retval FALSE SHA-256 digest computation failed.
**/
+// FROM BaseCryptLib.h:475
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_X509_STACK_FREE)(
- IN VOID *X509Stack
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SHA256_FINAL)(
+ IN OUT VOID *Sha256Context,
+ OUT UINT8 *HashValue
);
/**
- Retrieve the TBSCertificate from one given X.509 certificate.
-
- @param[in] Cert Pointer to the given DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
- @param[out] TBSCertSize Size of the TBS certificate in bytes.
-
- If Cert is NULL, then return FALSE.
- If TBSCert is NULL, then return FALSE.
- If TBSCertSize is NULL, then return FALSE.
+ Computes the SHA-256 message digest of a input data buffer.
+ This function performs the SHA-256 message digest of a given data buffer, and places
+ the digest value into the specified memory.
If this interface is not supported, then return FALSE.
-
- @retval TRUE The TBSCertificate was retrieved successfully.
- @retval FALSE Invalid X.509 certificate.
-
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
+ value (32 bytes).
+ @retval TRUE SHA-256 digest computation succeeded.
+ @retval FALSE SHA-256 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:500
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_TBS_CERT)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **TBSCert,
- OUT UINTN *TBSCertSize
+(EFIAPI *EDKII_CRYPTO_SHA256_HASH_ALL)(
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
);
-/**
- Retrieve the version from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Version Pointer to the retrieved version integer.
-
- @retval TRUE The certificate version retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- @retval FALSE The operation is not supported.
+// =============================================================================
+// SHA384 functions
+// =============================================================================
+/**
+ Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
+ @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
**/
+// FROM BaseCryptLib.h:514
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_VERSION)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Version
+UINTN
+(EFIAPI *EDKII_CRYPTO_SHA384_GET_CONTEXT_SIZE)(
+ VOID
);
/**
- Retrieve the serialNumber from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
- @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
- and the size of buffer returned SerialNumber on output.
-
- @retval TRUE The certificate serialNumber retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- If SerialNumberSize is NULL.
- If Certificate is invalid.
- @retval FALSE If no SerialNumber exists.
- @retval FALSE If the SerialNumber is NULL. The required buffer size
- (including the final null) is returned in the
- SerialNumberSize parameter.
- @retval FALSE The operation is not supported.
+ Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
+ subsequent use.
+ If Sha384Context is NULL, then return FALSE.
+ @param[out] Sha384Context Pointer to SHA-384 context being initialized.
+ @retval TRUE SHA-384 context initialization succeeded.
+ @retval FALSE SHA-384 context initialization failed.
**/
+// FROM BaseCryptLib.h:532
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_SERIAL_NUMBER)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *SerialNumber, OPTIONAL
- IN OUT UINTN *SerialNumberSize
+(EFIAPI *EDKII_CRYPTO_SHA384_INIT)(
+ OUT VOID *Sha384Context
);
/**
- Retrieve the issuer bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
+ Makes a copy of an existing SHA-384 context.
+ If Sha384Context is NULL, then return FALSE.
+ If NewSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
- @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate issuer retrieved successfully.
- @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
- The CertIssuerSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
+ @param[in] Sha384Context Pointer to SHA-384 context being copied.
+ @param[out] NewSha384Context Pointer to new SHA-384 context.
+ @retval TRUE SHA-384 context copy succeeded.
+ @retval FALSE SHA-384 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:553
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_ISSUER_NAME)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertIssuer,
- IN OUT UINTN *CertIssuerSize
+(EFIAPI *EDKII_CRYPTO_SHA384_DUPLICATE)(
+ IN CONST VOID *Sha384Context,
+ OUT VOID *NewSha384Context
);
/**
- Retrieve the Signature Algorithm from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Oid Signature Algorithm Object identifier buffer.
- @param[in,out] OidSize Signature Algorithm Object identifier buffer size
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If OidSize is NULL.
- If Oid is not NULL and *OidSize is 0.
- If Certificate is invalid.
- @retval FALSE If no SignatureType.
- @retval FALSE If the Oid is NULL. The required buffer size
- is returned in the OidSize.
- @retval FALSE The operation is not supported.
+ Digests the input data and updates SHA-384 context.
+ This function performs SHA-384 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
+ by Sha384Final(). Behavior with invalid context is undefined.
+ If Sha384Context is NULL, then return FALSE.
+ @param[in, out] Sha384Context Pointer to the SHA-384 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-384 data digest succeeded.
+ @retval FALSE SHA-384 data digest failed.
**/
+// FROM BaseCryptLib.h:578
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_SIGNATURE_ALGORITHM)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Oid, OPTIONAL
- IN OUT UINTN *OidSize
+(EFIAPI *EDKII_CRYPTO_SHA384_UPDATE)(
+ IN OUT VOID *Sha384Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
);
/**
- Retrieve Extension data from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] Oid Object identifier buffer
- @param[in] OidSize Object identifier buffer size
- @param[out] ExtensionData Extension bytes.
- @param[in, out] ExtensionDataSize Extension bytes size.
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If ExtensionDataSize is NULL.
- If ExtensionData is not NULL and *ExtensionDataSize is 0.
- If Certificate is invalid.
- @retval FALSE If no Extension entry match Oid.
- @retval FALSE If the ExtensionData is NULL. The required buffer size
- is returned in the ExtensionDataSize parameter.
- @retval FALSE The operation is not supported.
+ Completes computation of the SHA-384 digest value.
+ This function completes SHA-384 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-384 context cannot
+ be used again.
+ SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
+ finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
+ If Sha384Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sha384Context Pointer to the SHA-384 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
+ value (48 bytes).
+ @retval TRUE SHA-384 digest computation succeeded.
+ @retval FALSE SHA-384 digest computation failed.
**/
+// FROM BaseCryptLib.h:606
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENSION_DATA)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *Oid,
- IN UINTN OidSize,
- OUT UINT8 *ExtensionData,
- IN OUT UINTN *ExtensionDataSize
+(EFIAPI *EDKII_CRYPTO_SHA384_FINAL)(
+ IN OUT VOID *Sha384Context,
+ OUT UINT8 *HashValue
);
/**
- Retrieve the Extended Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage bytes.
- @param[in, out] UsageSize Key Usage buffer sizs in bytes.
-
- @retval TRUE The Usage bytes retrieve successfully.
- @retval FALSE If Cert is NULL.
- If CertSize is NULL.
- If Usage is not NULL and *UsageSize is 0.
- If Cert is invalid.
- @retval FALSE If the Usage is NULL. The required buffer size
- is returned in the UsageSize parameter.
- @retval FALSE The operation is not supported.
+ Computes the SHA-384 message digest of a input data buffer.
+ This function performs the SHA-384 message digest of a given data buffer, and places
+ the digest value into the specified memory.
+ If this interface is not supported, then return FALSE.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
+ value (48 bytes).
+ @retval TRUE SHA-384 digest computation succeeded.
+ @retval FALSE SHA-384 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:631
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENDED_KEY_USAGE)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Usage,
- IN OUT UINTN *UsageSize
+(EFIAPI *EDKII_CRYPTO_SHA384_HASH_ALL)(
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
);
-/**
- Retrieve the Validity from one X.509 certificate
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] From notBefore Pointer to DateTime object.
- @param[in,out] FromSize notBefore DateTime object size.
- @param[out] To notAfter Pointer to DateTime object.
- @param[in,out] ToSize notAfter DateTime object size.
-
- Note: X509CompareDateTime to compare DateTime oject
- x509SetDateTime to get a DateTime object from a DateTimeStr
+// =============================================================================
+// SHA512 functions
+// =============================================================================
- @retval TRUE The certificate Validity retrieved successfully.
- @retval FALSE Invalid certificate, or Validity retrieve failed.
- @retval FALSE This interface is not supported.
+/**
+ Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
+ @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
**/
+// FROM BaseCryptLib.h:645
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_VALIDITY)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN UINT8 *From,
- IN OUT UINTN *FromSize,
- IN UINT8 *To,
- IN OUT UINTN *ToSize
+UINTN
+(EFIAPI *EDKII_CRYPTO_SHA512_GET_CONTEXT_SIZE)(
+ VOID
);
/**
- Format a DateTimeStr to DataTime object in DataTime Buffer
-
- If DateTimeStr is NULL, then return FALSE.
- If DateTimeSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
- Ref: https://www.w3.org/TR/NOTE-datetime
- Z stand for UTC time
- @param[in,out] DateTime Pointer to a DateTime object.
- @param[in,out] DateTimeSize DateTime object buffer size.
-
- @retval TRUE The DateTime object create successfully.
- @retval FALSE If DateTimeStr is NULL.
- If DateTimeSize is NULL.
- If DateTime is not NULL and *DateTimeSize is 0.
- If Year Month Day Hour Minute Second combination is invalid datetime.
- @retval FALSE If the DateTime is NULL. The required buffer size
- (including the final null) is returned in the
- DateTimeSize parameter.
- @retval FALSE The operation is not supported.
+ Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
+ subsequent use.
+ If Sha512Context is NULL, then return FALSE.
+ @param[out] Sha512Context Pointer to SHA-512 context being initialized.
+ @retval TRUE SHA-512 context initialization succeeded.
+ @retval FALSE SHA-512 context initialization failed.
**/
+// FROM BaseCryptLib.h:663
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_FORMAT_DATE_TIME)(
- IN CONST CHAR8 *DateTimeStr,
- OUT VOID *DateTime,
- IN OUT UINTN *DateTimeSize
+(EFIAPI *EDKII_CRYPTO_SHA512_INIT)(
+ OUT VOID *Sha512Context
);
/**
- Compare DateTime1 object and DateTime2 object.
-
- If DateTime1 is NULL, then return -2.
- If DateTime2 is NULL, then return -2.
- If DateTime1 == DateTime2, then return 0
- If DateTime1 > DateTime2, then return 1
- If DateTime1 < DateTime2, then return -1
-
- @param[in] DateTime1 Pointer to a DateTime Ojbect
- @param[in] DateTime2 Pointer to a DateTime Object
-
- @retval 0 If DateTime1 == DateTime2
- @retval 1 If DateTime1 > DateTime2
- @retval -1 If DateTime1 < DateTime2
+ Makes a copy of an existing SHA-512 context.
+ If Sha512Context is NULL, then return FALSE.
+ If NewSha512Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Sha512Context Pointer to SHA-512 context being copied.
+ @param[out] NewSha512Context Pointer to new SHA-512 context.
+ @retval TRUE SHA-512 context copy succeeded.
+ @retval FALSE SHA-512 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:684
typedef
-INT32
-(EFIAPI *EDKII_CRYPTO_X509_COMPARE_DATE_TIME)(
- IN CONST VOID *DateTime1,
- IN CONST VOID *DateTime2
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SHA512_DUPLICATE)(
+ IN CONST VOID *Sha512Context,
+ OUT VOID *NewSha512Context
);
/**
- Retrieve the Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
-
- @retval TRUE The certificate Key Usage retrieved successfully.
- @retval FALSE Invalid certificate, or Usage is NULL
- @retval FALSE This interface is not supported.
+ Digests the input data and updates SHA-512 context.
+ This function performs SHA-512 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
+ by Sha512Final(). Behavior with invalid context is undefined.
+ If Sha512Context is NULL, then return FALSE.
+ @param[in, out] Sha512Context Pointer to the SHA-512 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-512 data digest succeeded.
+ @retval FALSE SHA-512 data digest failed.
**/
+// FROM BaseCryptLib.h:709
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_KEY_USAGE)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Usage
+(EFIAPI *EDKII_CRYPTO_SHA512_UPDATE)(
+ IN OUT VOID *Sha512Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
);
/**
- Verify one X509 certificate was issued by the trusted CA.
-
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] RootCert Trusted Root Certificate buffer
-
- @param[in] RootCertLength Trusted Root Certificate buffer length
-
- @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
+ Completes computation of the SHA-512 digest value.
+ This function completes SHA-512 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-512 context cannot
+ be used again.
+ SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
+ finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
+ If Sha512Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sha512Context Pointer to the SHA-512 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
+ value (64 bytes).
+ @retval TRUE SHA-512 digest computation succeeded.
+ @retval FALSE SHA-512 digest computation failed.
**/
+// FROM BaseCryptLib.h:737
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_VERIFY_CERT_CHAIN)(
- IN CONST UINT8 *RootCert,
- IN UINTN RootCertLength,
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength
+(EFIAPI *EDKII_CRYPTO_SHA512_FINAL)(
+ IN OUT VOID *Sha512Context,
+ OUT UINT8 *HashValue
);
/**
- Get one X509 certificate from CertChain.
-
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] CertIndex Index of certificate.
-
- @param[out] Cert The certificate at the index of CertChain.
- @param[out] CertLength The length certificate at the index of CertChain.
-
- @retval TRUE Success.
- @retval FALSE Failed to get certificate from certificate chain.
+ Computes the SHA-512 message digest of a input data buffer.
+ This function performs the SHA-512 message digest of a given data buffer, and places
+ the digest value into the specified memory.
+ If this interface is not supported, then return FALSE.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
+ value (64 bytes).
+ @retval TRUE SHA-512 digest computation succeeded.
+ @retval FALSE SHA-512 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:762
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_CERT_FROM_CERT_CHAIN)(
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength,
- IN CONST INT32 CertIndex,
- OUT CONST UINT8 **Cert,
- OUT UINTN *CertLength
+(EFIAPI *EDKII_CRYPTO_SHA512_HASH_ALL)(
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
);
-/**
- Retrieve the tag and length of the tag.
-
- @param Ptr The position in the ASN.1 data
- @param End End of data
- @param Length The variable that will receive the length
- @param Tag The expected tag
+// =============================================================================
+// PARALLELHASH256 functions
+// =============================================================================
- @retval TRUE Get tag successful
- @retval FALSe Failed to get tag or tag not match
+/**
+ Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
+ published December 2016.
+ @param[in] Input Pointer to the input message (X).
+ @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
+ @param[in] BlockSize The size of each block (B).
+ @param[out] Output Pointer to the output buffer.
+ @param[in] OutputByteLen The desired number of output bytes (L).
+ @param[in] Customization Pointer to the customization string (S).
+ @param[in] CustomByteLen The length of the customization string in bytes.
+ @retval TRUE ParallelHash256 digest computation succeeded.
+ @retval FALSE ParallelHash256 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:787
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_ASN1_GET_TAG)(
- IN OUT UINT8 **Ptr,
- IN CONST UINT8 *End,
- OUT UINTN *Length,
- IN UINT32 Tag
+(EFIAPI *EDKII_CRYPTO_PARALLEL_HASH256_HASH_ALL)(
+ IN CONST VOID *Input,
+ IN UINTN InputByteLen,
+ IN UINTN BlockSize,
+ OUT VOID *Output,
+ IN UINTN OutputByteLen,
+ IN CONST VOID *Customization,
+ IN UINTN CustomByteLen
);
-/**
- Retrieve the basic constraints from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize size of the X509 certificate in bytes.
- @param[out] BasicConstraints basic constraints bytes.
- @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
+// =============================================================================
+// AEADAESGCM functions
+// =============================================================================
- @retval TRUE The basic constraints retrieve successfully.
- @retval FALSE If cert is NULL.
- If cert_size is NULL.
- If basic_constraints is not NULL and *basic_constraints_size is 0.
- If cert is invalid.
- @retval FALSE The required buffer size is small.
- The return buffer size is basic_constraints_size parameter.
- @retval FALSE If no Extension entry match oid.
- @retval FALSE The operation is not supported.
- **/
+/**
+ Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
+ IvSize must be 12, otherwise FALSE is returned.
+ KeySize must be 16, 24 or 32, otherwise FALSE is returned.
+ TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
+ @param[in] Key Pointer to the encryption key.
+ @param[in] KeySize Size of the encryption key in bytes.
+ @param[in] Iv Pointer to the IV value.
+ @param[in] IvSize Size of the IV value in bytes.
+ @param[in] AData Pointer to the additional authenticated data (AAD).
+ @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
+ @param[in] DataIn Pointer to the input data buffer to be encrypted.
+ @param[in] DataInSize Size of the input data buffer in bytes.
+ @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
+ @param[in] TagSize Size of the authentication tag in bytes.
+ @param[out] DataOut Pointer to a buffer that receives the encryption output.
+ @param[out] DataOutSize Size of the output data buffer in bytes.
+ @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
+ @retval FALSE AEAD AES-GCM authenticated encryption failed.
+**/
+// FROM BaseCryptLib.h:1405
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENDED_BASIC_CONSTRAINTS)(
- CONST UINT8 *Cert,
- UINTN CertSize,
- UINT8 *BasicConstraints,
- UINTN *BasicConstraintsSize
+(EFIAPI *EDKII_CRYPTO_AEAD_AES_GCM_ENCRYPT)(
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Iv,
+ IN UINTN IvSize,
+ IN CONST UINT8 *AData,
+ IN UINTN ADataSize,
+ IN CONST UINT8 *DataIn,
+ IN UINTN DataInSize,
+ OUT UINT8 *TagOut,
+ IN UINTN TagSize,
+ OUT UINT8 *DataOut,
+ OUT UINTN *DataOutSize
);
-// =====================================================================================
-// Symmetric Cryptography Primitive
-// =====================================================================================
-
/**
- TDES is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
+ Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
+ IvSize must be 12, otherwise FALSE is returned.
+ KeySize must be 16, 24 or 32, otherwise FALSE is returned.
+ TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
+ If additional authenticated data verification fails, FALSE is returned.
+ @param[in] Key Pointer to the encryption key.
+ @param[in] KeySize Size of the encryption key in bytes.
+ @param[in] Iv Pointer to the IV value.
+ @param[in] IvSize Size of the IV value in bytes.
+ @param[in] AData Pointer to the additional authenticated data (AAD).
+ @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
+ @param[in] DataIn Pointer to the input data buffer to be decrypted.
+ @param[in] DataInSize Size of the input data buffer in bytes.
+ @param[in] Tag Pointer to a buffer that contains the authentication tag.
+ @param[in] TagSize Size of the authentication tag in bytes.
+ @param[out] DataOut Pointer to a buffer that receives the decryption output.
+ @param[out] DataOutSize Size of the output data buffer in bytes.
+ @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
+ @retval FALSE AEAD AES-GCM authenticated decryption failed.
**/
-typedef
-UINTN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_GET_CONTEXT_SIZE)(
- VOID
- );
-
+// FROM BaseCryptLib.h:1447
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_INIT)(
- OUT VOID *TdesContext,
+(EFIAPI *EDKII_CRYPTO_AEAD_AES_GCM_DECRYPT)(
IN CONST UINT8 *Key,
- IN UINTN KeyLength
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_ECB_ENCRYPT)(
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
+ IN UINTN KeySize,
+ IN CONST UINT8 *Iv,
+ IN UINTN IvSize,
+ IN CONST UINT8 *AData,
+ IN UINTN ADataSize,
+ IN CONST UINT8 *DataIn,
+ IN UINTN DataInSize,
+ IN CONST UINT8 *Tag,
+ IN UINTN TagSize,
+ OUT UINT8 *DataOut,
+ OUT UINTN *DataOutSize
);
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_ECB_DECRYPT)(
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- );
+// =============================================================================
+// X509 functions
+// =============================================================================
+/**
+ Retrieve the subject bytes from one X.509 certificate.
+ If Cert is NULL, then return FALSE.
+ If SubjectSize is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
+ @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
+ and the size of buffer returned CertSubject on output.
+ @retval TRUE The certificate subject retrieved successfully.
+ @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
+ The SubjectSize will be updated with the required size.
+ @retval FALSE This interface is not supported.
+**/
+// FROM BaseCryptLib.h:1835
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_CBC_ENCRYPT)(
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
+(EFIAPI *EDKII_CRYPTO_X509_GET_SUBJECT_NAME)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *CertSubject,
+ IN OUT UINTN *SubjectSize
);
+/**
+ Retrieve the common name (CN) string from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] CommonName Buffer to contain the retrieved certificate common
+ name string (UTF8). At most CommonNameSize bytes will be
+ written and the string will be null terminated. May be
+ NULL in order to determine the size buffer needed.
+ @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
+ and the size of buffer returned CommonName on output.
+ If CommonName is NULL then the amount of space needed
+ in buffer (including the final null) is returned.
+ @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
+ @retval RETURN_INVALID_PARAMETER If Cert is NULL.
+ If CommonNameSize is NULL.
+ If CommonName is not NULL and *CommonNameSize is 0.
+ If Certificate is invalid.
+ @retval RETURN_NOT_FOUND If no CommonName entry exists.
+ @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
+ (including the final null) is returned in the
+ CommonNameSize parameter.
+ @retval RETURN_UNSUPPORTED The operation is not supported.
+**/
+// FROM BaseCryptLib.h:1870
typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_CBC_DECRYPT)(
- IN VOID *TdesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
+RETURN_STATUS
+(EFIAPI *EDKII_CRYPTO_X509_GET_COMMON_NAME)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT CHAR8 *CommonName OPTIONAL,
+ IN OUT UINTN *CommonNameSize
);
/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for AES operations.
- @retval 0 This interface is not supported.
-
+ Retrieve the organization name (O) string from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] NameBuffer Buffer to contain the retrieved certificate organization
+ name string. At most NameBufferSize bytes will be
+ written and the string will be null terminated. May be
+ NULL in order to determine the size buffer needed.
+ @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,
+ and the size of buffer returned Name on output.
+ If NameBuffer is NULL then the amount of space needed
+ in buffer (including the final null) is returned.
+ @retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.
+ @retval RETURN_INVALID_PARAMETER If Cert is NULL.
+ If NameBufferSize is NULL.
+ If NameBuffer is not NULL and *CommonNameSize is 0.
+ If Certificate is invalid.
+ @retval RETURN_NOT_FOUND If no Organization Name entry exists.
+ @retval RETURN_BUFFER_TOO_SMALL If the NameBuffer is NULL. The required buffer size
+ (including the final null) is returned in the
+ CommonNameSize parameter.
+ @retval RETURN_UNSUPPORTED The operation is not supported.
**/
+// FROM BaseCryptLib.h:1905
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_AES_GET_CONTEXT_SIZE)(
- VOID
+RETURN_STATUS
+(EFIAPI *EDKII_CRYPTO_X509_GET_ORGANIZATION_NAME)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT CHAR8 *NameBuffer OPTIONAL,
+ IN OUT UINTN *NameBufferSize
);
/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- This function initializes user-supplied memory pointed by AesContext as AES context.
- In addition, it sets up all AES key materials for subsequent encryption and decryption
- operations.
- There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
-
- If AesContext is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeyLength is not valid, then return FALSE.
+ Verify one X509 certificate was issued by the trusted CA.
+ If Cert is NULL, then return FALSE.
+ If CACert is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval TRUE AES context initialization succeeded.
- @retval FALSE AES context initialization failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
+ @param[in] CACertSize Size of the CA Certificate in bytes.
+ @retval TRUE The certificate was issued by the trusted CA.
+ @retval FALSE Invalid certificate or the certificate was not issued by the given
+ trusted CA.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1932
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_AES_INIT)(
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
+(EFIAPI *EDKII_CRYPTO_X509_VERIFY_CERT)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ IN CONST UINT8 *CACert,
+ IN UINTN CACertSize
);
/**
- AES ECB Mode is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
+ Construct a X509 object from DER-encoded certificate data.
+ If Cert is NULL, then return FALSE.
+ If SingleX509Cert is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded certificate data.
+ @param[in] CertSize The size of certificate data in bytes.
+ @param[out] SingleX509Cert The generated X509 object.
+ @retval TRUE The X509 object generation succeeded.
+ @retval FALSE The operation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1957
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_AES_ECB_ENCRYPT)(
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- );
-
-typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_AES_ECB_DECRYPT)(
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
+(EFIAPI *EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 **SingleX509Cert
);
/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES encryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
+ Construct a X509 stack object from a list of DER-encoded certificate data.
+ If X509Stack is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES encryption succeeded.
- @retval FALSE AES encryption failed.
- @retval FALSE This interface is not supported.
-
+ @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
+ On output, pointer to the X509 stack object with new
+ inserted X509 certificate.
+ @param[in] Args VA_LIST marker for the variable argument list.
+ A list of DER-encoded single certificate data followed
+ by certificate size. A NULL terminates the list. The
+ pairs are the arguments to X509ConstructCertificate().
+ @retval TRUE The X509 stack construction succeeded.
+ @retval FALSE The construction operation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1984
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_AES_CBC_ENCRYPT)(
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
+(EFIAPI *EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK_V)(
+ IN OUT UINT8 **X509Stack,
+ IN VA_LIST Args
);
/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES decryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
+ Construct a X509 stack object from a list of DER-encoded certificate data.
+ If X509Stack is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES decryption succeeded.
- @retval FALSE AES decryption failed.
- @retval FALSE This interface is not supported.
-
+ @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
+ On output, pointer to the X509 stack object with new
+ inserted X509 certificate.
+ @param ... A list of DER-encoded single certificate data followed
+ by certificate size. A NULL terminates the list. The
+ pairs are the arguments to X509ConstructCertificate().
+ @retval TRUE The X509 stack construction succeeded.
+ @retval FALSE The construction operation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2009
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_AES_CBC_DECRYPT)(
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
+(EFIAPI *EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK)(
+ IN OUT UINT8 **X509Stack,
+ ...
);
/**
- ARC4 is deprecated and unsupported any longer.
- Keep the function field for binary compability.
-
+ Release the specified X509 object.
+ If the interface is not supported, then ASSERT().
+ @param[in] X509Cert Pointer to the X509 object to be released.
**/
+// FROM BaseCryptLib.h:2024
typedef
-UINTN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_ARC4_GET_CONTEXT_SIZE)(
- VOID
+VOID
+(EFIAPI *EDKII_CRYPTO_X509_FREE)(
+ IN VOID *X509Cert
);
+/**
+ Release the specified X509 stack object.
+ If the interface is not supported, then ASSERT().
+ @param[in] X509Stack Pointer to the X509 stack object to be released.
+**/
+// FROM BaseCryptLib.h:2038
typedef
-BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_ARC4_INIT)(
- OUT VOID *Arc4Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
+VOID
+(EFIAPI *EDKII_CRYPTO_X509_STACK_FREE)(
+ IN VOID *X509Stack
);
+/**
+ Retrieve the TBSCertificate from one given X.509 certificate.
+ @param[in] Cert Pointer to the given DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
+ @param[out] TBSCertSize Size of the TBS certificate in bytes.
+ If Cert is NULL, then return FALSE.
+ If TBSCert is NULL, then return FALSE.
+ If TBSCertSize is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @retval TRUE The TBSCertificate was retrieved successfully.
+ @retval FALSE Invalid X.509 certificate.
+**/
+// FROM BaseCryptLib.h:2061
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_ARC4_ENCRYPT)(
- IN OUT VOID *Arc4Context,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
+(EFIAPI *EDKII_CRYPTO_X509_GET_TBSCERT)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 **TBSCert,
+ OUT UINTN *TBSCertSize
);
+/**
+ Retrieve the version from one X.509 certificate.
+ If Cert is NULL, then return FALSE.
+ If CertSize is 0, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] Version Pointer to the retrieved version integer.
+ @retval TRUE The certificate version retrieved successfully.
+ @retval FALSE If Cert is NULL or CertSize is Zero.
+ @retval FALSE The operation is not supported.
+**/
+// FROM BaseCryptLib.h:2612
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_ARC4_DECRYPT)(
- IN OUT VOID *Arc4Context,
- IN UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
+(EFIAPI *EDKII_CRYPTO_X509_GET_VERSION)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINTN *Version
);
+/**
+ Retrieve the serialNumber from one X.509 certificate.
+ If Cert is NULL, then return FALSE.
+ If CertSize is 0, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
+ @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
+ and the size of buffer returned SerialNumber on output.
+ @retval TRUE The certificate serialNumber retrieved successfully.
+ @retval FALSE If Cert is NULL or CertSize is Zero.
+ If SerialNumberSize is NULL.
+ If Certificate is invalid.
+ @retval FALSE If no SerialNumber exists.
+ @retval FALSE If the SerialNumber is NULL. The required buffer size
+ (including the final null) is returned in the
+ SerialNumberSize parameter.
+ @retval FALSE The operation is not supported.
+**/
+// FROM BaseCryptLib.h:2643
typedef
BOOLEAN
-(EFIAPI *DEPRECATED_EDKII_CRYPTO_ARC4_RESET)(
- IN OUT VOID *Arc4Context
+(EFIAPI *EDKII_CRYPTO_X509_GET_SERIAL_NUMBER)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *SerialNumber, OPTIONAL
+ IN OUT UINTN *SerialNumberSize
);
/**
- Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for SM3 hash operations.
- @retval 0 This interface is not supported.
-
+ Retrieve the issuer bytes from one X.509 certificate.
+ If Cert is NULL, then return FALSE.
+ If CertIssuerSize is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
+ @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
+ and the size of buffer returned CertSubject on output.
+ @retval TRUE The certificate issuer retrieved successfully.
+ @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
+ The CertIssuerSize will be updated with the required size.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2671
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_SM3_GET_CONTEXT_SIZE)(
- VOID
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_X509_GET_ISSUER_NAME)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *CertIssuer,
+ IN OUT UINTN *CertIssuerSize
);
/**
- Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
- subsequent use.
-
- If Sm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Sm3Context Pointer to SM3 context being initialized.
-
- @retval TRUE SM3 context initialization succeeded.
- @retval FALSE SM3 context initialization failed.
- @retval FALSE This interface is not supported.
-
+ Retrieve the Signature Algorithm from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] Oid Signature Algorithm Object identifier buffer.
+ @param[in,out] OidSize Signature Algorithm Object identifier buffer size
+ @retval TRUE The certificate Extension data retrieved successfully.
+ @retval FALSE If Cert is NULL.
+ If OidSize is NULL.
+ If Oid is not NULL and *OidSize is 0.
+ If Certificate is invalid.
+ @retval FALSE If no SignatureType.
+ @retval FALSE If the Oid is NULL. The required buffer size
+ is returned in the OidSize.
+ @retval FALSE The operation is not supported.
**/
+// FROM BaseCryptLib.h:2698
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SM3_INIT)(
- OUT VOID *Sm3Context
+(EFIAPI *EDKII_CRYPTO_X509_GET_SIGNATURE_ALGORITHM)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *Oid, OPTIONAL
+ IN OUT UINTN *OidSize
);
/**
- Makes a copy of an existing SM3 context.
-
- If Sm3Context is NULL, then return FALSE.
- If NewSm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sm3Context Pointer to SM3 context being copied.
- @param[out] NewSm3Context Pointer to new SM3 context.
-
- @retval TRUE SM3 context copy succeeded.
- @retval FALSE SM3 context copy failed.
- @retval FALSE This interface is not supported.
-
+ Retrieve Extension data from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[in] Oid Object identifier buffer
+ @param[in] OidSize Object identifier buffer size
+ @param[out] ExtensionData Extension bytes.
+ @param[in, out] ExtensionDataSize Extension bytes size.
+ @retval TRUE The certificate Extension data retrieved successfully.
+ @retval FALSE If Cert is NULL.
+ If ExtensionDataSize is NULL.
+ If ExtensionData is not NULL and *ExtensionDataSize is 0.
+ If Certificate is invalid.
+ @retval FALSE If no Extension entry match Oid.
+ @retval FALSE If the ExtensionData is NULL. The required buffer size
+ is returned in the ExtensionDataSize parameter.
+ @retval FALSE The operation is not supported.
**/
+// FROM BaseCryptLib.h:2727
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SM3_DUPLICATE)(
- IN CONST VOID *Sm3Context,
- OUT VOID *NewSm3Context
+(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENSION_DATA)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ IN CONST UINT8 *Oid,
+ IN UINTN OidSize,
+ OUT UINT8 *ExtensionData,
+ IN OUT UINTN *ExtensionDataSize
);
/**
- Digests the input data and updates SM3 context.
-
- This function performs SM3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
- by Sm3Final(). Behavior with invalid context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SM3 data digest succeeded.
- @retval FALSE SM3 data digest failed.
- @retval FALSE This interface is not supported.
-
+ Retrieve the Validity from one X.509 certificate
+ If Cert is NULL, then return FALSE.
+ If CertIssuerSize is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[in] From notBefore Pointer to DateTime object.
+ @param[in,out] FromSize notBefore DateTime object size.
+ @param[in] To notAfter Pointer to DateTime object.
+ @param[in,out] ToSize notAfter DateTime object size.
+ Note: X509CompareDateTime to compare DateTime oject
+ x509SetDateTime to get a DateTime object from a DateTimeStr
+ @retval TRUE The certificate Validity retrieved successfully.
+ @retval FALSE Invalid certificate, or Validity retrieve failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2759
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SM3_UPDATE)(
- IN OUT VOID *Sm3Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+(EFIAPI *EDKII_CRYPTO_X509_GET_VALIDITY)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ IN UINT8 *From,
+ IN OUT UINTN *FromSize,
+ IN UINT8 *To,
+ IN OUT UINTN *ToSize
);
/**
- Completes computation of the SM3 digest value.
-
- This function completes SM3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SM3 context cannot
- be used again.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be
- finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
+ Format a DateTimeStr to DataTime object in DataTime Buffer
+ If DateTimeStr is NULL, then return FALSE.
+ If DateTimeSize is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (16 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
+ Ref: https://www.w3.org/TR/NOTE-datetime
+ Z stand for UTC time
+ @param[out] DateTime Pointer to a DateTime object.
+ @param[in,out] DateTimeSize DateTime object buffer size.
+ @retval TRUE The DateTime object create successfully.
+ @retval FALSE If DateTimeStr is NULL.
+ If DateTimeSize is NULL.
+ If DateTime is not NULL and *DateTimeSize is 0.
+ If Year Month Day Hour Minute Second combination is invalid datetime.
+ @retval FALSE If the DateTime is NULL. The required buffer size
+ (including the final null) is returned in the
+ DateTimeSize parameter.
+ @retval FALSE The operation is not supported.
**/
+// FROM BaseCryptLib.h:2793
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SM3_FINAL)(
- IN OUT VOID *Sm3Context,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_X509_FORMAT_DATE_TIME)(
+ IN CONST CHAR8 *DateTimeStr,
+ OUT VOID *DateTime,
+ IN OUT UINTN *DateTimeSize
);
/**
- Computes the SM3 message digest of a input data buffer.
-
- This function performs the SM3 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (16 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ Retrieve the Key Usage from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
+ @retval TRUE The certificate Key Usage retrieved successfully.
+ @retval FALSE Invalid certificate, or Usage is NULL
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:2835
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_SM3_HASH_ALL)(
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+(EFIAPI *EDKII_CRYPTO_X509_GET_KEY_USAGE)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINTN *Usage
);
/**
- Derive key data using HMAC-SHA256 based KDF.
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Retrieve the Extended Key Usage from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] Usage Key Usage bytes.
+ @param[in, out] UsageSize Key Usage buffer sizs in bytes.
+ @retval TRUE The Usage bytes retrieve successfully.
+ @retval FALSE If Cert is NULL.
+ If CertSize is NULL.
+ If Usage is not NULL and *UsageSize is 0.
+ If Cert is invalid.
+ @retval FALSE If the Usage is NULL. The required buffer size
+ is returned in the UsageSize parameter.
+ @retval FALSE The operation is not supported.
**/
+// FROM BaseCryptLib.h:2860
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_HKDF_SHA_256_EXTRACT_AND_EXPAND)(
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENDED_KEY_USAGE)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *Usage,
+ IN OUT UINTN *UsageSize
);
/**
- Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
+ Verify one X509 certificate was issued by the trusted CA.
+ @param[in] RootCert Trusted Root Certificate buffer
+ @param[in] RootCertLength Trusted Root Certificate buffer length
+ @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
+ where the first certificate is signed by the Root
+ Certificate or is the Root Cerificate itself. and
+ subsequent cerificate is signed by the preceding
+ cerificate.
+ @param[in] CertChainLength Total length of the certificate chain, in bytes.
+ @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
+ @retval FALSE Invalid certificate or the certificate was not issued by the given
+ trusted CA.
**/
+// FROM BaseCryptLib.h:2885
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_HKDF_SHA_256_EXTRACT)(
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
+(EFIAPI *EDKII_CRYPTO_X509_VERIFY_CERT_CHAIN)(
+ IN CONST UINT8 *RootCert,
+ IN UINTN RootCertLength,
+ IN CONST UINT8 *CertChain,
+ IN UINTN CertChainLength
);
/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Get one X509 certificate from CertChain.
+ @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
+ where the first certificate is signed by the Root
+ Certificate or is the Root Cerificate itself. and
+ subsequent cerificate is signed by the preceding
+ cerificate.
+ @param[in] CertChainLength Total length of the certificate chain, in bytes.
+ @param[in] CertIndex Index of certificate. If index is -1 indecate the
+ last certificate in CertChain.
+ @param[out] Cert The certificate at the index of CertChain.
+ @param[out] CertLength The length certificate at the index of CertChain.
+ @retval TRUE Success.
+ @retval FALSE Failed to get certificate from certificate chain.
**/
+// FROM BaseCryptLib.h:2913
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_HKDF_SHA_256_EXPAND)(
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+(EFIAPI *EDKII_CRYPTO_X509_GET_CERT_FROM_CERT_CHAIN)(
+ IN CONST UINT8 *CertChain,
+ IN UINTN CertChainLength,
+ IN CONST INT32 CertIndex,
+ OUT CONST UINT8 **Cert,
+ OUT UINTN *CertLength
);
/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
+ Retrieve the basic constraints from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize size of the X509 certificate in bytes.
+ @param[out] BasicConstraints basic constraints bytes.
+ @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
+ @retval TRUE The basic constraints retrieve successfully.
+ @retval FALSE If cert is NULL.
+ If cert_size is NULL.
+ If basic_constraints is not NULL and *basic_constraints_size is 0.
+ If cert is invalid.
+ @retval FALSE The required buffer size is small.
+ The return buffer size is basic_constraints_size parameter.
+ @retval FALSE If no Extension entry match oid.
+ @retval FALSE The operation is not supported.
+ **/
+// FROM BaseCryptLib.h:2961
+typedef
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_X509_GET_EXTENDED_BASIC_CONSTRAINTS)(
+ CONST UINT8 *Cert,
+ UINTN CertSize,
+ UINT8 *BasicConstraints,
+ UINTN *BasicConstraintsSize
+ );
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
+// =============================================================================
+// ASN1 functions
+// =============================================================================
+/**
+ Retrieve the tag and length of the tag.
+ @param Ptr The position in the ASN.1 data
+ @param End End of data
+ @param Length The variable that will receive the length
+ @param Tag The expected tag
+ @retval TRUE Get tag successful
+ @retval FALSe Failed to get tag or tag not match
**/
+// FROM BaseCryptLib.h:2934
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_HKDF_SHA_384_EXTRACT_AND_EXPAND)(
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+(EFIAPI *EDKII_CRYPTO_ASN1_GET_TAG)(
+ IN OUT UINT8 **Ptr,
+ IN CONST UINT8 *End,
+ OUT UINTN *Length,
+ IN UINT32 Tag
);
-/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
+// =============================================================================
+// BIGNUM functions
+// =============================================================================
+/**
+ Allocate new Big Number.
+ @retval New BigNum opaque structure or NULL on failure.
**/
+// FROM BaseCryptLib.h:3356
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_HKDF_SHA_384_EXTRACT)(
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
+VOID *
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_INIT)(
+ VOID
);
/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Allocate new Big Number and assign the provided value to it.
+ @param[in] Buf Big endian encoded buffer.
+ @param[in] Len Buffer length.
+ @retval New BigNum opaque structure or NULL on failure.
**/
+// FROM BaseCryptLib.h:3370
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_HKDF_SHA_384_EXPAND)(
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+VOID *
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_FROM_BIN)(
+ IN CONST UINT8 *Buf,
+ IN UINTN Len
);
/**
- Initializes the OpenSSL library.
-
- This function registers ciphers and digests used directly and indirectly
- by SSL/TLS, and initializes the readable error messages.
- This function must be called before any other action takes places.
-
- @retval TRUE The OpenSSL library has been initialized.
- @retval FALSE Failed to initialize the OpenSSL library.
-
+ Convert the absolute value of Bn into big-endian form and store it at Buf.
+ The Buf array should have at least BigNumBytes() in it.
+ @param[in] Bn Big number to convert.
+ @param[out] Buf Output buffer.
+ @retval The length of the big-endian number placed at Buf or -1 on error.
**/
+// FROM BaseCryptLib.h:3386
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_TLS_INITIALIZE)(
- VOID
+INTN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_TO_BIN)(
+ IN CONST VOID *Bn,
+ OUT UINT8 *Buf
);
/**
- Free an allocated SSL_CTX object.
-
- @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
-
+ Free the Big Number.
+ @param[in] Bn Big number to free.
+ @param[in] Clear TRUE if the buffer should be cleared.
**/
+// FROM BaseCryptLib.h:3399
typedef
VOID
-(EFIAPI *EDKII_CRYPTO_TLS_CTX_FREE)(
- IN VOID *TlsCtx
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_FREE)(
+ IN VOID *Bn,
+ IN BOOLEAN Clear
);
/**
- Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
- connections.
-
- @param[in] MajorVer Major Version of TLS/SSL Protocol.
- @param[in] MinorVer Minor Version of TLS/SSL Protocol.
-
- @return Pointer to an allocated SSL_CTX object.
- If the creation failed, TlsCtxNew() returns NULL.
-
+ Calculate the sum of two Big Numbers.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result of BnA + BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3418
typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_TLS_CTX_NEW)(
- IN UINT8 MajorVer,
- IN UINT8 MinorVer
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_ADD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
);
/**
- Free an allocated TLS object.
-
- This function removes the TLS object pointed to by Tls and frees up the
- allocated memory. If Tls is NULL, nothing is done.
-
- @param[in] Tls Pointer to the TLS object to be freed.
-
+ Subtract two Big Numbers.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result of BnA - BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3438
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_TLS_FREE)(
- IN VOID *Tls
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_SUB)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
);
/**
- Create a new TLS object for a connection.
-
- This function creates a new TLS object for a connection. The new object
- inherits the setting of the underlying context TlsCtx: connection method,
- options, verification setting.
-
- @param[in] TlsCtx Pointer to the SSL_CTX object.
-
- @return Pointer to an allocated SSL object.
- If the creation failed, TlsNew() returns NULL.
-
+ Calculate remainder: BnRes = BnA % BnB.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result of BnA % BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3458
typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_TLS_NEW)(
- IN VOID *TlsCtx
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_MOD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
);
/**
- Checks if the TLS handshake was done.
-
- This function will check if the specified TLS handshake was done.
-
- @param[in] Tls Pointer to the TLS object for handshake state checking.
-
- @retval TRUE The TLS handshake was done.
- @retval FALSE The TLS handshake was not done.
-
+ Compute BnA to the BnP-th power modulo BnM.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnP Big number (power).
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result of (BnA ^ BnP) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3479
typedef
BOOLEAN
-(EFIAPI *EDKII_CRYPTO_TLS_IN_HANDSHAKE)(
- IN VOID *Tls
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_EXP_MOD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnP,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
);
/**
- Perform a TLS/SSL handshake.
-
- This function will perform a TLS/SSL handshake.
-
- @param[in] Tls Pointer to the TLS object for handshake operation.
- @param[in] BufferIn Pointer to the most recently received TLS Handshake packet.
- @param[in] BufferInSize Packet size in bytes for the most recently received TLS
- Handshake packet.
- @param[out] BufferOut Pointer to the buffer to hold the built packet.
- @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferIn is NULL but BufferInSize is NOT 0.
- BufferInSize is 0 but BufferIn is NOT NULL.
- BufferOutSize is NULL.
- BufferOut is NULL if *BufferOutSize is not zero.
- @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
- @retval EFI_ABORTED Something wrong during handshake.
-
+ Compute BnA inverse modulo BnM.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3500
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_DO_HANDSHAKE)(
- IN VOID *Tls,
- IN UINT8 *BufferIn OPTIONAL,
- IN UINTN BufferInSize OPTIONAL,
- OUT UINT8 *BufferOut OPTIONAL,
- IN OUT UINTN *BufferOutSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_INVERSE_MOD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
);
/**
- Handle Alert message recorded in BufferIn. If BufferIn is NULL and BufferInSize is zero,
- TLS session has errors and the response packet needs to be Alert message based on error type.
-
- @param[in] Tls Pointer to the TLS object for state checking.
- @param[in] BufferIn Pointer to the most recently received TLS Alert packet.
- @param[in] BufferInSize Packet size in bytes for the most recently received TLS
- Alert packet.
- @param[out] BufferOut Pointer to the buffer to hold the built packet.
- @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferIn is NULL but BufferInSize is NOT 0.
- BufferInSize is 0 but BufferIn is NOT NULL.
- BufferOutSize is NULL.
- BufferOut is NULL if *BufferOutSize is not zero.
- @retval EFI_ABORTED An error occurred.
- @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
-
+ Divide two Big Numbers.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result, such that BnA / BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3520
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_HANDLE_ALERT)(
- IN VOID *Tls,
- IN UINT8 *BufferIn OPTIONAL,
- IN UINTN BufferInSize OPTIONAL,
- OUT UINT8 *BufferOut OPTIONAL,
- IN OUT UINTN *BufferOutSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_DIV)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
);
/**
- Build the CloseNotify packet.
-
- @param[in] Tls Pointer to the TLS object for state checking.
- @param[in, out] Buffer Pointer to the buffer to hold the built packet.
- @param[in, out] BufferSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferSize is NULL.
- Buffer is NULL if *BufferSize is not zero.
- @retval EFI_BUFFER_TOO_SMALL BufferSize is too small to hold the response packet.
-
+ Multiply two Big Numbers modulo BnM.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA * BnB) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3541
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_CLOSE_NOTIFY)(
- IN VOID *Tls,
- IN OUT UINT8 *Buffer,
- IN OUT UINTN *BufferSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_MUL_MOD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
);
/**
- Attempts to read bytes from one TLS object and places the data in Buffer.
-
- This function will attempt to read BufferSize bytes from the TLS object
- and places the data in Buffer.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] Buffer Pointer to the buffer to store the data.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The amount of data successfully read from the TLS object.
- @retval <=0 No data was successfully read.
+ Compare two Big Numbers.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @retval 0 BnA == BnB.
+ @retval 1 BnA > BnB.
+ @retval -1 BnA < BnB.
+**/
+// FROM BaseCryptLib.h:3560
+typedef
+INTN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_CMP)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB
+ );
+/**
+ Get number of bits in Bn.
+ @param[in] Bn Big number.
+ @retval Number of bits.
**/
+// FROM BaseCryptLib.h:3575
typedef
-INTN
-(EFIAPI *EDKII_CRYPTO_TLS_CTRL_TRAFFIC_OUT)(
- IN VOID *Tls,
- IN OUT VOID *Buffer,
- IN UINTN BufferSize
+UINTN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_BITS)(
+ IN CONST VOID *Bn
);
/**
- Attempts to write data from the buffer to TLS object.
-
- This function will attempt to write BufferSize bytes data from the Buffer
- to the TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The amount of data successfully written to the TLS object.
- @retval <=0 No data was successfully written.
-
+ Get number of bytes in Bn.
+ @param[in] Bn Big number.
+ @retval Number of bytes.
**/
+// FROM BaseCryptLib.h:3588
typedef
-INTN
-(EFIAPI *EDKII_CRYPTO_TLS_CTRL_TRAFFIC_IN)(
- IN VOID *Tls,
- IN VOID *Buffer,
- IN UINTN BufferSize
+UINTN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_BYTES)(
+ IN CONST VOID *Bn
);
/**
- Attempts to read bytes from the specified TLS connection into the buffer.
-
- This function tries to read BufferSize bytes data from the specified TLS
- connection into the Buffer.
-
- @param[in] Tls Pointer to the TLS connection for data reading.
- @param[in,out] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The read operation was successful, and return value is the
- number of bytes actually read from the TLS connection.
- @retval <=0 The read operation was not successful.
-
+ Checks if Big Number equals to the given Num.
+ @param[in] Bn Big number.
+ @param[in] Num Number.
+ @retval TRUE iff Bn == Num.
+ @retval FALSE otherwise.
**/
+// FROM BaseCryptLib.h:3603
typedef
-INTN
-(EFIAPI *EDKII_CRYPTO_TLS_READ)(
- IN VOID *Tls,
- IN OUT VOID *Buffer,
- IN UINTN BufferSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_IS_WORD)(
+ IN CONST VOID *Bn,
+ IN UINTN Num
);
/**
- Attempts to write data to a TLS connection.
-
- This function tries to write BufferSize bytes data from the Buffer into the
- specified TLS connection.
-
- @param[in] Tls Pointer to the TLS connection for data writing.
- @param[in] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The write operation was successful, and return value is the
- number of bytes actually written to the TLS connection.
- @retval <=0 The write operation was not successful.
-
+ Checks if Big Number is odd.
+ @param[in] Bn Big number.
+ @retval TRUE Bn is odd (Bn % 2 == 1).
+ @retval FALSE otherwise.
**/
+// FROM BaseCryptLib.h:3618
typedef
-INTN
-(EFIAPI *EDKII_CRYPTO_TLS_WRITE)(
- IN VOID *Tls,
- IN VOID *Buffer,
- IN UINTN BufferSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_IS_ODD)(
+ IN CONST VOID *Bn
);
/**
- Shutdown a TLS connection.
-
- Shutdown the TLS connection without releasing the resources, meaning a new
- connection can be started without calling TlsNew() and without setting
- certificates etc.
-
- @param[in] Tls Pointer to the TLS object to shutdown.
-
- @retval EFI_SUCCESS The TLS is shutdown successfully.
- @retval EFI_INVALID_PARAMETER Tls is NULL.
- @retval EFI_PROTOCOL_ERROR Some other error occurred.
+ Copy Big number.
+ @param[out] BnDst Destination.
+ @param[in] BnSrc Source.
+ @retval BnDst on success.
+ @retval NULL otherwise.
**/
+// FROM BaseCryptLib.h:3633
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SHUTDOWN)(
- IN VOID *Tls
+VOID *
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_COPY)(
+ OUT VOID *BnDst,
+ IN CONST VOID *BnSrc
);
/**
- Set a new TLS/SSL method for a particular TLS object.
-
- This function sets a new TLS/SSL method for a particular TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] MajorVer Major Version of TLS/SSL Protocol.
- @param[in] MinorVer Minor Version of TLS/SSL Protocol.
-
- @retval EFI_SUCCESS The TLS/SSL method was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
-
+ Shift right Big Number.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] Bn Big number.
+ @param[in] N Number of bits to shift.
+ @param[out] BnRes The result.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3664
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_VERSION)(
- IN VOID *Tls,
- IN UINT8 MajorVer,
- IN UINT8 MinorVer
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_RSHIFT)(
+ IN CONST VOID *Bn,
+ IN UINTN N,
+ OUT VOID *BnRes
);
/**
- Set TLS object to work in client or server mode.
-
- This function prepares a TLS object to work in client or server mode.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] IsServer Work in server mode.
-
- @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
-
+ Mark Big Number for constant time computations.
+ This function should be called before any constant time computations are
+ performed on the given Big number.
+ @param[in] Bn Big number.
**/
+// FROM BaseCryptLib.h:3679
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_CONNECTION_END)(
- IN VOID *Tls,
- IN BOOLEAN IsServer
+VOID
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_CONST_TIME)(
+ IN VOID *Bn
);
/**
- Set the ciphers list to be used by the TLS object.
-
- This function sets the ciphers for use by a specified TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
- cipher identifier comes from the TLS Cipher Suite
- Registry of the IANA, interpreting Byte1 and Byte2
- in network (big endian) byte order.
- @param[in] CipherNum The number of cipher in the list.
-
- @retval EFI_SUCCESS The ciphers list was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
- @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
-
+ Calculate square modulo.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3697
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_CIPHER_LIST)(
- IN VOID *Tls,
- IN UINT16 *CipherId,
- IN UINTN CipherNum
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_SQR_MOD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
);
/**
- Set the compression method for TLS/SSL operations.
-
- This function handles TLS/SSL integrated compression methods.
-
- @param[in] CompMethod The compression method ID.
-
- @retval EFI_SUCCESS The compression method for the communication was
- set successfully.
- @retval EFI_UNSUPPORTED Unsupported compression method.
-
+ Create new Big Number computation context. This is an opaque structure
+ which should be passed to any function that requires it. The BN context is
+ needed to optimize calculations and expensive allocations.
+ @retval Big Number context struct or NULL on failure.
**/
+// FROM BaseCryptLib.h:3712
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_COMPRESSION_METHOD)(
- IN UINT8 CompMethod
+VOID *
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_NEW_CONTEXT)(
+ VOID
);
/**
- Set peer certificate verification mode for the TLS connection.
-
- This function sets the verification mode flags for the TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] VerifyMode A set of logically or'ed verification mode flags.
-
+ Free Big Number context that was allocated with BigNumNewContext().
+ @param[in] BnCtx Big number context to free.
**/
+// FROM BaseCryptLib.h:3723
typedef
VOID
-(EFIAPI *EDKII_CRYPTO_TLS_SET_VERIFY)(
- IN VOID *Tls,
- IN UINT32 VerifyMode
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_CONTEXT_FREE)(
+ IN VOID *BnCtx
);
/**
- Set the specified host name to be verified.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Flags The setting flags during the validation.
- @param[in] HostName The specified host name to be verified.
-
- @retval EFI_SUCCESS The HostName setting was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_ABORTED Invalid HostName setting.
-
+ Set Big Number to a given value.
+ @param[in] Bn Big number to set.
+ @param[in] Val Value to set.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3738
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_VERIFY_HOST)(
- IN VOID *Tls,
- IN UINT32 Flags,
- IN CHAR8 *HostName
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_SET_UINT)(
+ IN VOID *Bn,
+ IN UINTN Val
);
/**
- Sets a TLS/SSL session ID to be used during TLS/SSL connect.
+ Add two Big Numbers modulo BnM.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA + BnB) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
+**/
+// FROM BaseCryptLib.h:3756
+typedef
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_BIG_NUM_ADD_MOD)(
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
+ );
- This function sets a session ID to be used when the TLS/SSL connection is
- to be established.
+// =============================================================================
+// TDES functions
+// =============================================================================
+// =============================================================================
+// AES functions
+// =============================================================================
- @param[in] Tls Pointer to the TLS object.
- @param[in] SessionId Session ID data used for session resumption.
- @param[in] SessionIdLen Length of Session ID in bytes.
+/**
+ Retrieves the size, in bytes, of the context buffer required for AES operations.
+ If this interface is not supported, then return zero.
+ @return The size, in bytes, of the context buffer required for AES operations.
+ @retval 0 This interface is not supported.
+**/
+// FROM BaseCryptLib.h:1263
+typedef
+UINTN
+(EFIAPI *EDKII_CRYPTO_AES_GET_CONTEXT_SIZE)(
+ VOID
+ );
- @retval EFI_SUCCESS Session ID was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED No available session for ID setting.
+/**
+ Initializes user-supplied memory as AES context for subsequent use.
+ This function initializes user-supplied memory pointed by AesContext as AES context.
+ In addition, it sets up all AES key materials for subsequent encryption and decryption
+ operations.
+ There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
+ If AesContext is NULL, then return FALSE.
+ If Key is NULL, then return FALSE.
+ If KeyLength is not valid, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[out] AesContext Pointer to AES context being initialized.
+ @param[in] Key Pointer to the user-supplied AES key.
+ @param[in] KeyLength Length of AES key in bits.
+ @retval TRUE AES context initialization succeeded.
+ @retval FALSE AES context initialization failed.
+ @retval FALSE This interface is not supported.
+**/
+// FROM BaseCryptLib.h:1291
+typedef
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_AES_INIT)(
+ OUT VOID *AesContext,
+ IN CONST UINT8 *Key,
+ IN UINTN KeyLength
+ );
+/**
+ Performs AES encryption on a data buffer of the specified size in CBC mode.
+ This function performs AES encryption on data buffer pointed by Input, of specified
+ size of InputSize, in CBC mode.
+ InputSize must be multiple of block size (16 bytes). This function does not perform
+ padding. Caller must perform padding, if necessary, to ensure valid input data size.
+ Initialization vector should be one block size (16 bytes).
+ AesContext should be already correctly initialized by AesInit(). Behavior with
+ invalid AES context is undefined.
+ If AesContext is NULL, then return FALSE.
+ If Input is NULL, then return FALSE.
+ If InputSize is not multiple of block size (16 bytes), then return FALSE.
+ If Ivec is NULL, then return FALSE.
+ If Output is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] AesContext Pointer to the AES context.
+ @param[in] Input Pointer to the buffer containing the data to be encrypted.
+ @param[in] InputSize Size of the Input buffer in bytes.
+ @param[in] Ivec Pointer to initialization vector.
+ @param[out] Output Pointer to a buffer that receives the AES encryption output.
+ @retval TRUE AES encryption succeeded.
+ @retval FALSE AES encryption failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1328
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_SESSIONID)(
- IN VOID *Tls,
- IN UINT8 *SessionId,
- IN UINT16 SessionIdLen
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_AES_CBC_ENCRYPT)(
+ IN VOID *AesContext,
+ IN CONST UINT8 *Input,
+ IN UINTN InputSize,
+ IN CONST UINT8 *Ivec,
+ OUT UINT8 *Output
);
/**
- Adds the CA to the cert store when requesting Server or Client authentication.
-
- This function adds the CA certificate to the list of CAs when requesting
- Server or Client authentication for the chosen TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded binary
- X.509 certificate or PEM-encoded X.509 certificate.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
- @retval EFI_ABORTED Invalid X.509 certificate.
-
+ Performs AES decryption on a data buffer of the specified size in CBC mode.
+ This function performs AES decryption on data buffer pointed by Input, of specified
+ size of InputSize, in CBC mode.
+ InputSize must be multiple of block size (16 bytes). This function does not perform
+ padding. Caller must perform padding, if necessary, to ensure valid input data size.
+ Initialization vector should be one block size (16 bytes).
+ AesContext should be already correctly initialized by AesInit(). Behavior with
+ invalid AES context is undefined.
+ If AesContext is NULL, then return FALSE.
+ If Input is NULL, then return FALSE.
+ If InputSize is not multiple of block size (16 bytes), then return FALSE.
+ If Ivec is NULL, then return FALSE.
+ If Output is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] AesContext Pointer to the AES context.
+ @param[in] Input Pointer to the buffer containing the data to be encrypted.
+ @param[in] InputSize Size of the Input buffer in bytes.
+ @param[in] Ivec Pointer to initialization vector.
+ @param[out] Output Pointer to a buffer that receives the AES encryption output.
+ @retval TRUE AES decryption succeeded.
+ @retval FALSE AES decryption failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:1367
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_CA_CERTIFICATE)(
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_AES_CBC_DECRYPT)(
+ IN VOID *AesContext,
+ IN CONST UINT8 *Input,
+ IN UINTN InputSize,
+ IN CONST UINT8 *Ivec,
+ OUT UINT8 *Output
);
-/**
- Loads the local public certificate into the specified TLS object.
-
- This function loads the X.509 certificate into the specified TLS object
- for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded binary
- X.509 certificate or PEM-encoded X.509 certificate.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
- @retval EFI_ABORTED Invalid X.509 certificate.
+// =============================================================================
+// ARC4 functions
+// =============================================================================
+// =============================================================================
+// SM3 functions
+// =============================================================================
+/**
+ Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
+ @return The size, in bytes, of the context buffer required for SM3 hash operations.
**/
+// FROM BaseCryptLib.h:805
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PUBLIC_CERT)(
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
+UINTN
+(EFIAPI *EDKII_CRYPTO_SM3_GET_CONTEXT_SIZE)(
+ VOID
);
/**
- Adds the local private key to the specified TLS object.
-
- This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
- key) into the specified TLS object for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
- or PKCS#8 private key.
- @param[in] DataSize The size of data buffer in bytes.
- @param[in] Password Pointer to NULL-terminated private key password, set it to NULL
- if private key not encrypted.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid private key data.
-
+ Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
+ subsequent use.
+ If Sm3Context is NULL, then return FALSE.
+ @param[out] Sm3Context Pointer to SM3 context being initialized.
+ @retval TRUE SM3 context initialization succeeded.
+ @retval FALSE SM3 context initialization failed.
**/
+// FROM BaseCryptLib.h:823
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY_EX)(
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize,
- IN VOID *Password OPTIONAL
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SM3_INIT)(
+ OUT VOID *Sm3Context
);
/**
- Adds the local private key to the specified TLS object.
-
- This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
- key) into the specified TLS object for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
- or PKCS#8 private key.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid private key data.
-
+ Makes a copy of an existing SM3 context.
+ If Sm3Context is NULL, then return FALSE.
+ If NewSm3Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Sm3Context Pointer to SM3 context being copied.
+ @param[out] NewSm3Context Pointer to new SM3 context.
+ @retval TRUE SM3 context copy succeeded.
+ @retval FALSE SM3 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:844
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY)(
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SM3_DUPLICATE)(
+ IN CONST VOID *Sm3Context,
+ OUT VOID *NewSm3Context
);
/**
- Adds the CA-supplied certificate revocation list for certificate validation.
-
- This function adds the CA-supplied certificate revocation list data for
- certificate validity checking.
-
- @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid CRL data.
-
+ Digests the input data and updates SM3 context.
+ This function performs SM3 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
+ by Sm3Final(). Behavior with invalid context is undefined.
+ If Sm3Context is NULL, then return FALSE.
+ @param[in, out] Sm3Context Pointer to the SM3 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SM3 data digest succeeded.
+ @retval FALSE SM3 data digest failed.
**/
+// FROM BaseCryptLib.h:869
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_CERT_REVOCATION_LIST)(
- IN VOID *Data,
- IN UINTN DataSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SM3_UPDATE)(
+ IN OUT VOID *Sm3Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
);
/**
- Gets the protocol version used by the specified TLS connection.
-
- This function returns the protocol version used by the specified TLS
- connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The protocol version of the specified TLS connection.
-
+ Completes computation of the SM3 digest value.
+ This function completes SM3 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SM3 context cannot
+ be used again.
+ SM3 context should be already correctly initialized by Sm3Init(), and should not be
+ finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
+ If Sm3Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sm3Context Pointer to the SM3 context.
+ @param[out] HashValue Pointer to a buffer that receives the SM3 digest
+ value (32 bytes).
+ @retval TRUE SM3 digest computation succeeded.
+ @retval FALSE SM3 digest computation failed.
**/
+// FROM BaseCryptLib.h:897
typedef
-UINT16
-(EFIAPI *EDKII_CRYPTO_TLS_GET_VERSION)(
- IN VOID *Tls
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SM3_FINAL)(
+ IN OUT VOID *Sm3Context,
+ OUT UINT8 *HashValue
);
/**
- Gets the connection end of the specified TLS connection.
-
- This function returns the connection end (as client or as server) used by
- the specified TLS connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The connection end used by the specified TLS connection.
-
+ Computes the SM3 message digest of a input data buffer.
+ This function performs the SM3 message digest of a given data buffer, and places
+ the digest value into the specified memory.
+ If this interface is not supported, then return FALSE.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SM3 digest
+ value (32 bytes).
+ @retval TRUE SM3 digest computation succeeded.
+ @retval FALSE SM3 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// FROM BaseCryptLib.h:922
typedef
-UINT8
-(EFIAPI *EDKII_CRYPTO_TLS_GET_CONNECTION_END)(
- IN VOID *Tls
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_SM3_HASH_ALL)(
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
);
-/**
- Gets the cipher suite used by the specified TLS connection.
-
- This function returns current cipher suite used by the specified
- TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] CipherId The cipher suite used by the TLS object.
+// =============================================================================
+// HKDF functions
+// =============================================================================
- @retval EFI_SUCCESS The cipher suite was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported cipher suite.
+/**
+ Derive key data using HMAC-SHA256 based KDF.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize Salt size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
+**/
+// FROM BaseCryptLib.h:3205
+typedef
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_HKDF_SHA256_EXTRACT_AND_EXPAND)(
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
+ );
+/**
+ Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize salt size in bytes.
+ @param[out] PrkOut Pointer to buffer to receive hkdf value.
+ @param[in] PrkOutSize size of hkdf bytes to generate.
+ @retval true Hkdf generated successfully.
+ @retval false Hkdf generation failed.
**/
+// FROM BaseCryptLib.h:3232
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_CURRENT_CIPHER)(
- IN VOID *Tls,
- IN OUT UINT16 *CipherId
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_HKDF_SHA256_EXTRACT)(
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ OUT UINT8 *PrkOut,
+ UINTN PrkOutSize
);
/**
- Gets the compression methods used by the specified TLS connection.
-
- This function returns current integrated compression methods used by
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] CompressionId The current compression method used by
- the TLS object.
-
- @retval EFI_SUCCESS The compression method was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_ABORTED Invalid Compression method.
- @retval EFI_UNSUPPORTED This function is not supported.
-
+ Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
+ @param[in] Prk Pointer to the user-supplied key.
+ @param[in] PrkSize Key size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
+// FROM BaseCryptLib.h:3257
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_CURRENT_COMPRESSION_ID)(
- IN VOID *Tls,
- IN OUT UINT8 *CompressionId
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_HKDF_SHA256_EXPAND)(
+ IN CONST UINT8 *Prk,
+ IN UINTN PrkSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
);
/**
- Gets the verification mode currently set in the TLS connection.
-
- This function returns the peer verification mode currently set in the
- specified TLS connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The verification mode set in the specified TLS connection.
-
+ Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize Salt size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
+// FROM BaseCryptLib.h:3284
typedef
-UINT32
-(EFIAPI *EDKII_CRYPTO_TLS_GET_VERIFY)(
- IN VOID *Tls
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_HKDF_SHA384_EXTRACT_AND_EXPAND)(
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
);
/**
- Gets the session ID used by the specified TLS connection.
-
- This function returns the TLS/SSL session ID currently used by the
- specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] SessionId Buffer to contain the returned session ID.
- @param[in,out] SessionIdLen The length of Session ID in bytes.
-
- @retval EFI_SUCCESS The Session ID was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
-
+ Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize salt size in bytes.
+ @param[out] PrkOut Pointer to buffer to receive hkdf value.
+ @param[in] PrkOutSize size of hkdf bytes to generate.
+ @retval true Hkdf generated successfully.
+ @retval false Hkdf generation failed.
**/
+// FROM BaseCryptLib.h:3311
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_SESSION_ID)(
- IN VOID *Tls,
- IN OUT UINT8 *SessionId,
- IN OUT UINT16 *SessionIdLen
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_HKDF_SHA384_EXTRACT)(
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ OUT UINT8 *PrkOut,
+ UINTN PrkOutSize
);
/**
- Gets the client random data used in the specified TLS connection.
-
- This function returns the TLS/SSL client random data currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] ClientRandom Buffer to contain the returned client
- random data (32 bytes).
-
+ Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
+ @param[in] Prk Pointer to the user-supplied key.
+ @param[in] PrkSize Key size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
+// FROM BaseCryptLib.h:3336
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_TLS_GET_CLIENT_RANDOM)(
- IN VOID *Tls,
- IN OUT UINT8 *ClientRandom
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_HKDF_SHA384_EXPAND)(
+ IN CONST UINT8 *Prk,
+ IN UINTN PrkSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
);
-/**
- Gets the server random data used in the specified TLS connection.
-
- This function returns the TLS/SSL server random data currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] ServerRandom Buffer to contain the returned server
- random data (32 bytes).
+// =============================================================================
+// TLS functions
+// =============================================================================
+/**
+ Initializes the OpenSSL library.
+ This function registers ciphers and digests used directly and indirectly
+ by SSL/TLS, and initializes the readable error messages.
+ This function must be called before any other action takes places.
+ @retval TRUE The OpenSSL library has been initialized.
+ @retval FALSE Failed to initialize the OpenSSL library.
**/
+// FROM TlsLib.h:24
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_TLS_GET_SERVER_RANDOM)(
- IN VOID *Tls,
- IN OUT UINT8 *ServerRandom
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_TLS_INITIALIZE)(
+ VOID
);
/**
- Gets the master key data used in the specified TLS connection.
-
- This function returns the TLS/SSL master key material currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] KeyMaterial Buffer to contain the returned key material.
-
- @retval EFI_SUCCESS Key material was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
-
+ Free an allocated SSL_CTX object.
+ @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
**/
+// FROM TlsLib.h:36
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_KEY_MATERIAL)(
- IN VOID *Tls,
- IN OUT UINT8 *KeyMaterial
+VOID
+(EFIAPI *EDKII_CRYPTO_TLS_CTX_FREE)(
+ IN VOID *TlsCtx
);
/**
- Gets the CA Certificate from the cert store.
-
- This function returns the CA certificate for the chosen
- TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the CA
- certificate data sent to the client.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
+ connections.
+ @param[in] MajorVer Major Version of TLS/SSL Protocol.
+ @param[in] MinorVer Minor Version of TLS/SSL Protocol.
+ @return Pointer to an allocated SSL_CTX object.
+ If the creation failed, TlsCtxNew() returns NULL.
**/
+// FROM TlsLib.h:53
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_CA_CERTIFICATE)(
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+VOID *
+(EFIAPI *EDKII_CRYPTO_TLS_CTX_NEW)(
+ IN UINT8 MajorVer,
+ IN UINT8 MinorVer
);
/**
- Gets the local public Certificate set in the specified TLS object.
-
- This function returns the local public certificate which was currently set
- in the specified TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the local
- public certificate.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_NOT_FOUND The certificate is not found.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Free an allocated TLS object.
+ This function removes the TLS object pointed to by Tls and frees up the
+ allocated memory. If Tls is NULL, nothing is done.
+ @param[in] Tls Pointer to the TLS object to be freed.
**/
+// FROM TlsLib.h:69
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_HOST_PUBLIC_CERT)(
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+VOID
+(EFIAPI *EDKII_CRYPTO_TLS_FREE)(
+ IN VOID *Tls
);
/**
- Gets the local private key set in the specified TLS object.
-
- This function returns the local private key data which was currently set
- in the specified TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the local
- private key data.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Create a new TLS object for a connection.
+ This function creates a new TLS object for a connection. The new object
+ inherits the setting of the underlying context TlsCtx: connection method,
+ options, verification setting.
+ @param[in] TlsCtx Pointer to the SSL_CTX object.
+ @return Pointer to an allocated SSL object.
+ If the creation failed, TlsNew() returns NULL.
**/
+// FROM TlsLib.h:88
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_HOST_PRIVATE_KEY)(
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+VOID *
+(EFIAPI *EDKII_CRYPTO_TLS_NEW)(
+ IN VOID *TlsCtx
);
/**
- Set the signature algorithm list to used by the TLS object.
-
- This function sets the signature algorithms for use by a specified TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] Data Array of UINT8 of signature algorithms. The array consists of
- pairs of the hash algorithm and the signature algorithm as defined
- in RFC 5246
- @param[in] DataSize The length the SignatureAlgoList. Must be divisible by 2.
-
- @retval EFI_SUCCESS The signature algorithm list was set successfully.
- @retval EFI_INVALID_PARAMETER The parameters are invalid.
- @retval EFI_UNSUPPORTED No supported TLS signature algorithm was found in SignatureAlgoList
- @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
-
+ Checks if the TLS handshake was done.
+ This function will check if the specified TLS handshake was done.
+ @param[in] Tls Pointer to the TLS object for handshake state checking.
+ @retval TRUE The TLS handshake was done.
+ @retval FALSE The TLS handshake was not done.
**/
+// FROM TlsLib.h:105
typedef
-EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_SIGNATURE_ALGO_LIST)(
- IN VOID *Tls,
- IN UINT8 *Data,
- IN UINTN DataSize
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_TLS_IN_HANDSHAKE)(
+ IN VOID *Tls
);
/**
- Set the EC curve to be used for TLS flows
-
- This function sets the EC curve to be used for TLS flows.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] Data An EC named curve as defined in section 5.1.1 of RFC 4492.
- @param[in] DataSize Size of Data, it should be sizeof (UINT32)
-
- @retval EFI_SUCCESS The EC curve was set successfully.
- @retval EFI_INVALID_PARAMETER The parameters are invalid.
- @retval EFI_UNSUPPORTED The requested TLS EC curve is not supported
-
+ Perform a TLS/SSL handshake.
+ This function will perform a TLS/SSL handshake.
+ @param[in] Tls Pointer to the TLS object for handshake operation.
+ @param[in] BufferIn Pointer to the most recently received TLS Handshake packet.
+ @param[in] BufferInSize Packet size in bytes for the most recently received TLS
+ Handshake packet.
+ @param[out] BufferOut Pointer to the buffer to hold the built packet.
+ @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
+ the buffer size provided by the caller. On output, it
+ is the buffer size in fact needed to contain the
+ packet.
+ @retval EFI_SUCCESS The required TLS packet is built successfully.
+ @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
+ Tls is NULL.
+ BufferIn is NULL but BufferInSize is NOT 0.
+ BufferInSize is 0 but BufferIn is NOT NULL.
+ BufferOutSize is NULL.
+ BufferOut is NULL if *BufferOutSize is not zero.
+ @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
+ @retval EFI_ABORTED Something wrong during handshake.
**/
+// FROM TlsLib.h:137
typedef
EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_SET_EC_CURVE)(
+(EFIAPI *EDKII_CRYPTO_TLS_DO_HANDSHAKE)(
IN VOID *Tls,
- IN UINT8 *Data,
- IN UINTN DataSize
+ IN UINT8 *BufferIn OPTIONAL,
+ IN UINTN BufferInSize OPTIONAL,
+ OUT UINT8 *BufferOut OPTIONAL,
+ IN OUT UINTN *BufferOutSize
);
/**
- Derive keying material from a TLS connection.
-
- This function exports keying material using the mechanism described in RFC
- 5705.
-
- @param[in] Tls Pointer to the TLS object
- @param[in] Label Description of the key for the PRF function
- @param[in] Context Optional context
- @param[in] ContextLen The length of the context value in bytes
- @param[out] KeyBuffer Buffer to hold the output of the TLS-PRF
- @param[in] KeyBufferLen The length of the KeyBuffer
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The TLS object is invalid.
- @retval EFI_PROTOCOL_ERROR Some other error occurred.
-
+ Handle Alert message recorded in BufferIn. If BufferIn is NULL and BufferInSize is zero,
+ TLS session has errors and the response packet needs to be Alert message based on error type.
+ @param[in] Tls Pointer to the TLS object for state checking.
+ @param[in] BufferIn Pointer to the most recently received TLS Alert packet.
+ @param[in] BufferInSize Packet size in bytes for the most recently received TLS
+ Alert packet.
+ @param[out] BufferOut Pointer to the buffer to hold the built packet.
+ @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
+ the buffer size provided by the caller. On output, it
+ is the buffer size in fact needed to contain the
+ packet.
+ @retval EFI_SUCCESS The required TLS packet is built successfully.
+ @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
+ Tls is NULL.
+ BufferIn is NULL but BufferInSize is NOT 0.
+ BufferInSize is 0 but BufferIn is NOT NULL.
+ BufferOutSize is NULL.
+ BufferOut is NULL if *BufferOutSize is not zero.
+ @retval EFI_ABORTED An error occurred.
+ @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
**/
+// FROM TlsLib.h:172
typedef
EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_EXPORT_KEY)(
- IN VOID *Tls,
- IN CONST VOID *Label,
- IN CONST VOID *Context,
- IN UINTN ContextLen,
- OUT VOID *KeyBuffer,
- IN UINTN KeyBufferLen
+(EFIAPI *EDKII_CRYPTO_TLS_HANDLE_ALERT)(
+ IN VOID *Tls,
+ IN UINT8 *BufferIn OPTIONAL,
+ IN UINTN BufferInSize OPTIONAL,
+ OUT UINT8 *BufferOut OPTIONAL,
+ IN OUT UINTN *BufferOutSize
);
/**
- Gets the CA-supplied certificate revocation list data set in the specified
- TLS object.
-
- This function returns the CA-supplied certificate revocation list data which
- was currently set in the specified TLS object.
-
- @param[out] Data Pointer to the data buffer to receive the CRL data.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Build the CloseNotify packet.
+ @param[in] Tls Pointer to the TLS object for state checking.
+ @param[in, out] Buffer Pointer to the buffer to hold the built packet.
+ @param[in, out] BufferSize Pointer to the buffer size in bytes. On input, it is
+ the buffer size provided by the caller. On output, it
+ is the buffer size in fact needed to contain the
+ packet.
+ @retval EFI_SUCCESS The required TLS packet is built successfully.
+ @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
+ Tls is NULL.
+ BufferSize is NULL.
+ Buffer is NULL if *BufferSize is not zero.
+ @retval EFI_BUFFER_TOO_SMALL BufferSize is too small to hold the response packet.
**/
+// FROM TlsLib.h:200
typedef
EFI_STATUS
-(EFIAPI *EDKII_CRYPTO_TLS_GET_CERT_REVOCATION_LIST)(
- OUT VOID *DATA,
- IN OUT UINTN *DataSize
+(EFIAPI *EDKII_CRYPTO_TLS_CLOSE_NOTIFY)(
+ IN VOID *Tls,
+ IN OUT UINT8 *Buffer,
+ IN OUT UINTN *BufferSize
);
/**
- Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
- RFC 8017.
- Mask generation function is the same as the message digest algorithm.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If Message is NULL, then return FALSE.
- If MsgSize is zero or > INT_MAX, then return FALSE.
- If DigestLen is NOT 32, 48 or 64, return FALSE.
- If SaltLen is not equal to DigestLen, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] Message Pointer to octet message to be signed.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
- @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
- @param[out] Signature Pointer to buffer to receive RSA PSS signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in RSASSA-PSS.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
+ Attempts to read bytes from one TLS object and places the data in Buffer.
+ This function will attempt to read BufferSize bytes from the TLS object
+ and places the data in Buffer.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] Buffer Pointer to the buffer to store the data.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The amount of data successfully read from the TLS object.
+ @retval <=0 No data was successfully read.
**/
+// FROM TlsLib.h:222
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_PSS_SIGN)(
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
+INTN
+(EFIAPI *EDKII_CRYPTO_TLS_CTRL_TRAFFIC_OUT)(
+ IN VOID *Tls,
+ IN OUT VOID *Buffer,
+ IN UINTN BufferSize
);
/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
+ Attempts to write data from the buffer to TLS object.
+ This function will attempt to write BufferSize bytes data from the Buffer
+ to the TLS object.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Buffer Pointer to the data buffer.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The amount of data successfully written to the TLS object.
+ @retval <=0 No data was successfully written.
**/
+// FROM TlsLib.h:244
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_RSA_PSS_VERIFY)(
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
+INTN
+(EFIAPI *EDKII_CRYPTO_TLS_CTRL_TRAFFIC_IN)(
+ IN VOID *Tls,
+ IN VOID *Buffer,
+ IN UINTN BufferSize
);
/**
- Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
- published December 2016.
-
- @param[in] Input Pointer to the input message (X).
- @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
- @param[in] BlockSize The size of each block (B).
- @param[out] Output Pointer to the output buffer.
- @param[in] OutputByteLen The desired number of output bytes (L).
- @param[in] Customization Pointer to the customization string (S).
- @param[in] CustomByteLen The length of the customization string in bytes.
-
- @retval TRUE ParallelHash256 digest computation succeeded.
- @retval FALSE ParallelHash256 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ Attempts to read bytes from the specified TLS connection into the buffer.
+ This function tries to read BufferSize bytes data from the specified TLS
+ connection into the Buffer.
+ @param[in] Tls Pointer to the TLS connection for data reading.
+ @param[in,out] Buffer Pointer to the data buffer.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The read operation was successful, and return value is the
+ number of bytes actually read from the TLS connection.
+ @retval <=0 The read operation was not successful.
**/
+// FROM TlsLib.h:267
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_PARALLEL_HASH_ALL)(
- IN CONST VOID *Input,
- IN UINTN InputByteLen,
- IN UINTN BlockSize,
- OUT VOID *Output,
- IN UINTN OutputByteLen,
- IN CONST VOID *Customization,
- IN UINTN CustomByteLen
+INTN
+(EFIAPI *EDKII_CRYPTO_TLS_READ)(
+ IN VOID *Tls,
+ IN OUT VOID *Buffer,
+ IN UINTN BufferSize
);
/**
- Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be encrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the encryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated encryption failed.
-
+ Attempts to write data to a TLS connection.
+ This function tries to write BufferSize bytes data from the Buffer into the
+ specified TLS connection.
+ @param[in] Tls Pointer to the TLS connection for data writing.
+ @param[in] Buffer Pointer to the data buffer.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The write operation was successful, and return value is the
+ number of bytes actually written to the TLS connection.
+ @retval <=0 The write operation was not successful.
**/
+// FROM TlsLib.h:290
typedef
-BOOLEAN
-(EFIAPI *EDKII_AEAD_AES_GCM_ENCRYPT)(
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- OUT UINT8 *TagOut,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
+INTN
+(EFIAPI *EDKII_CRYPTO_TLS_WRITE)(
+ IN VOID *Tls,
+ IN VOID *Buffer,
+ IN UINTN BufferSize
);
/**
- Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
- If additional authenticated data verification fails, FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be decrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[in] Tag Pointer to a buffer that contains the authentication tag.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the decryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated decryption failed.
-
+ Shutdown a TLS connection.
+ Shutdown the TLS connection without releasing the resources, meaning a new
+ connection can be started without calling TlsNew() and without setting
+ certificates etc.
+ @param[in] Tls Pointer to the TLS object to shutdown.
+ @retval EFI_SUCCESS The TLS is shutdown successfully.
+ @retval EFI_INVALID_PARAMETER Tls is NULL.
+ @retval EFI_PROTOCOL_ERROR Some other error occurred.
**/
+// FROM TlsLib.h:311
typedef
-BOOLEAN
-(EFIAPI *EDKII_AEAD_AES_GCM_DECRYPT)(
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- IN CONST UINT8 *Tag,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SHUTDOWN)(
+ IN VOID *Tls
);
-// =====================================================================================
-// Big Number Primitive
-// =====================================================================================
+// =============================================================================
+// TLSSET functions
+// =============================================================================
/**
- Allocate new Big Number.
-
- @retval New BigNum opaque structure or NULL on failure.
+ Set a new TLS/SSL method for a particular TLS object.
+ This function sets a new TLS/SSL method for a particular TLS object.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] MajorVer Major Version of TLS/SSL Protocol.
+ @param[in] MinorVer Minor Version of TLS/SSL Protocol.
+ @retval EFI_SUCCESS The TLS/SSL method was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
**/
+// FROM TlsLib.h:331
typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_BIGNUM_INIT)(
- VOID
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_VERSION)(
+ IN VOID *Tls,
+ IN UINT8 MajorVer,
+ IN UINT8 MinorVer
);
/**
- Allocate new Big Number and assign the provided value to it.
-
- @param[in] Buf Big endian encoded buffer.
- @param[in] Len Buffer length.
-
- @retval New EDKII_CRYPTO_BIGNUM_ opaque structure or NULL on failure.
+ Set TLS object to work in client or server mode.
+ This function prepares a TLS object to work in client or server mode.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] IsServer Work in server mode.
+ @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
**/
+// FROM TlsLib.h:352
typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_BIGNUM_FROM_BIN)(
- IN CONST UINT8 *Buf,
- IN UINTN Len
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_CONNECTION_END)(
+ IN VOID *Tls,
+ IN BOOLEAN IsServer
);
/**
- Convert the absolute value of Bn into big-endian form and store it at Buf.
- The Buf array should have at least EDKII_CRYPTO_BIGNUM_Bytes() in it.
-
- @param[in] Bn Big number to convert.
- @param[out] Buf Output buffer.
-
- @retval The length of the big-endian number placed at Buf or -1 on error.
+ Set the ciphers list to be used by the TLS object.
+ This function sets the ciphers for use by a specified TLS object.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
+ cipher identifier comes from the TLS Cipher Suite
+ Registry of the IANA, interpreting Byte1 and Byte2
+ in network (big endian) byte order.
+ @param[in] CipherNum The number of cipher in the list.
+ @retval EFI_SUCCESS The ciphers list was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
**/
+// FROM TlsLib.h:377
typedef
-INTN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_TO_BIN)(
- IN CONST VOID *Bn,
- OUT UINT8 *Buf
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_CIPHER_LIST)(
+ IN VOID *Tls,
+ IN UINT16 *CipherId,
+ IN UINTN CipherNum
);
/**
- Free the Big Number.
+ Set the compression method for TLS/SSL operations.
+ This function handles TLS/SSL integrated compression methods.
+ @param[in] CompMethod The compression method ID.
+ @retval EFI_SUCCESS The compression method for the communication was
+ set successfully.
+ @retval EFI_UNSUPPORTED Unsupported compression method.
+**/
+// FROM TlsLib.h:397
+typedef
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_COMPRESSION_METHOD)(
+ IN UINT8 CompMethod
+ );
- @param[in] Bn Big number to free.
- @param[in] Clear TRUE if the buffer should be cleared.
+/**
+ Set peer certificate verification mode for the TLS connection.
+ This function sets the verification mode flags for the TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] VerifyMode A set of logically or'ed verification mode flags.
**/
+// FROM TlsLib.h:412
typedef
VOID
-(EFIAPI *EDKII_CRYPTO_BIGNUM_FREE)(
- IN VOID *Bn,
- IN BOOLEAN Clear
+(EFIAPI *EDKII_CRYPTO_TLS_SET_VERIFY)(
+ IN VOID *Tls,
+ IN UINT32 VerifyMode
);
/**
- Calculate the sum of two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA + BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Set the specified host name to be verified.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Flags The setting flags during the validation.
+ @param[in] HostName The specified host name to be verified.
+ @retval EFI_SUCCESS The HostName setting was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_ABORTED Invalid HostName setting.
**/
+// FROM TlsLib.h:431
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_ADD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_VERIFY_HOST)(
+ IN VOID *Tls,
+ IN UINT32 Flags,
+ IN CHAR8 *HostName
);
/**
- Subtract two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA - BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Sets a TLS/SSL session ID to be used during TLS/SSL connect.
+ This function sets a session ID to be used when the TLS/SSL connection is
+ to be established.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] SessionId Session ID data used for session resumption.
+ @param[in] SessionIdLen Length of Session ID in bytes.
+ @retval EFI_SUCCESS Session ID was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED No available session for ID setting.
**/
+// FROM TlsLib.h:454
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_SUB)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_SESSION_ID)(
+ IN VOID *Tls,
+ IN UINT8 *SessionId,
+ IN UINT16 SessionIdLen
);
/**
- Calculate remainder: BnRes = BnA % BnB.
+ Adds the CA to the cert store when requesting Server or Client authentication.
+ This function adds the CA certificate to the list of CAs when requesting
+ Server or Client authentication for the chosen TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded binary
+ X.509 certificate or PEM-encoded X.509 certificate.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
+ @retval EFI_ABORTED Invalid X.509 certificate.
+**/
+// FROM TlsLib.h:479
+typedef
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_CA_CERTIFICATE)(
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize
+ );
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA % BnB.
+/**
+ Loads the local public certificate into the specified TLS object.
+ This function loads the X.509 certificate into the specified TLS object
+ for TLS negotiation.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded binary
+ X.509 certificate or PEM-encoded X.509 certificate.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
+ @retval EFI_ABORTED Invalid X.509 certificate.
+**/
+// FROM TlsLib.h:504
+typedef
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PUBLIC_CERT)(
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize
+ );
- @retval TRUE On success.
- @retval FALSE Otherwise.
+/**
+ Adds the local private key to the specified TLS object.
+ This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
+ key) into the specified TLS object for TLS negotiation.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
+ or PKCS#8 private key.
+ @param[in] DataSize The size of data buffer in bytes.
+ @param[in] Password Pointer to NULL-terminated private key password, set it to NULL
+ if private key not encrypted.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_ABORTED Invalid private key data.
**/
+// FROM TlsLib.h:530
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_MOD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY_EX)(
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize,
+ IN VOID *Password OPTIONAL
);
/**
- Compute BnA to the BnP-th power modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnP Big number (power).
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result of BnA ^ BnP % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Adds the local private key to the specified TLS object.
+ This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
+ key) into the specified TLS object for TLS negotiation.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
+ or PKCS#8 private key.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_ABORTED Invalid private key data.
**/
+// FROM TlsLib.h:555
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_EXP_MOD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnP,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY)(
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize
);
/**
- Compute BnA inverse modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Adds the CA-supplied certificate revocation list for certificate validation.
+ This function adds the CA-supplied certificate revocation list data for
+ certificate validity checking.
+ @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_ABORTED Invalid CRL data.
**/
+// FROM TlsLib.h:577
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_INVERSE_MOD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_CERT_REVOCATION_LIST)(
+ IN VOID *Data,
+ IN UINTN DataSize
);
/**
- Divide two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result, such that BnA / BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Set the signature algorithm list to used by the TLS object.
+ This function sets the signature algorithms for use by a specified TLS object.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] Data Array of UINT8 of signature algorithms. The array consists of
+ pairs of the hash algorithm and the signature algorithm as defined
+ in RFC 5246
+ @param[in] DataSize The length the SignatureAlgoList. Must be divisible by 2.
+ @retval EFI_SUCCESS The signature algorithm list was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameters are invalid.
+ @retval EFI_UNSUPPORTED No supported TLS signature algorithm was found in SignatureAlgoList
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
**/
+// FROM TlsLib.h:601
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_DIV)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_SIGNATURE_ALGO_LIST)(
+ IN VOID *Tls,
+ IN UINT8 *Data,
+ IN UINTN DataSize
);
/**
- Multiply two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Set the EC curve to be used for TLS flows
+ This function sets the EC curve to be used for TLS flows.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] Data An EC named curve as defined in section 5.1.1 of RFC 4492.
+ @param[in] DataSize Size of Data, it should be sizeof (UINT32)
+ @retval EFI_SUCCESS The EC curve was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameters are invalid.
+ @retval EFI_UNSUPPORTED The requested TLS EC curve is not supported
**/
+// FROM TlsLib.h:623
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_MUL_MOD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_SET_EC_CURVE)(
+ IN VOID *Tls,
+ IN UINT8 *Data,
+ IN UINTN DataSize
);
-/**
- Compare two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
+// =============================================================================
+// TLSGET functions
+// =============================================================================
- @retval 0 BnA == BnB.
- @retval 1 BnA > BnB.
- @retval -1 BnA < BnB.
+/**
+ Gets the protocol version used by the specified TLS connection.
+ This function returns the protocol version used by the specified TLS
+ connection.
+ If Tls is NULL, then ASSERT().
+ @param[in] Tls Pointer to the TLS object.
+ @return The protocol version of the specified TLS connection.
**/
+// FROM TlsLib.h:644
typedef
-INTN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_CMP)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB
+UINT16
+(EFIAPI *EDKII_CRYPTO_TLS_GET_VERSION)(
+ IN VOID *Tls
);
/**
- Get number of bits in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bits.
+ Gets the connection end of the specified TLS connection.
+ This function returns the connection end (as client or as server) used by
+ the specified TLS connection.
+ If Tls is NULL, then ASSERT().
+ @param[in] Tls Pointer to the TLS object.
+ @return The connection end used by the specified TLS connection.
**/
+// FROM TlsLib.h:663
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_BITS)(
- IN CONST VOID *Bn
+UINT8
+(EFIAPI *EDKII_CRYPTO_TLS_GET_CONNECTION_END)(
+ IN VOID *Tls
);
/**
- Get number of bytes in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bytes.
+ Gets the cipher suite used by the specified TLS connection.
+ This function returns current cipher suite used by the specified
+ TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] CipherId The cipher suite used by the TLS object.
+ @retval EFI_SUCCESS The cipher suite was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Unsupported cipher suite.
**/
+// FROM TlsLib.h:683
typedef
-UINTN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_BYTES)(
- IN CONST VOID *Bn
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_CURRENT_CIPHER)(
+ IN VOID *Tls,
+ IN OUT UINT16 *CipherId
);
/**
- Checks if Big Number equals to the given Num.
-
- @param[in] Bn Big number.
- @param[in] Num Number.
-
- @retval TRUE iff Bn == Num.
- @retval FALSE otherwise.
+ Gets the compression methods used by the specified TLS connection.
+ This function returns current integrated compression methods used by
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] CompressionId The current compression method used by
+ the TLS object.
+ @retval EFI_SUCCESS The compression method was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_ABORTED Invalid Compression method.
+ @retval EFI_UNSUPPORTED This function is not supported.
**/
+// FROM TlsLib.h:706
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_IS_WORD)(
- IN CONST VOID *Bn,
- IN UINTN Num
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_CURRENT_COMPRESSION_ID)(
+ IN VOID *Tls,
+ IN OUT UINT8 *CompressionId
);
/**
- Checks if Big Number is odd.
-
- @param[in] Bn Big number.
-
- @retval TRUE Bn is odd (Bn % 2 == 1).
- @retval FALSE otherwise.
+ Gets the verification mode currently set in the TLS connection.
+ This function returns the peer verification mode currently set in the
+ specified TLS connection.
+ If Tls is NULL, then ASSERT().
+ @param[in] Tls Pointer to the TLS object.
+ @return The verification mode set in the specified TLS connection.
**/
+// FROM TlsLib.h:726
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_IS_ODD)(
- IN CONST VOID *Bn
+UINT32
+(EFIAPI *EDKII_CRYPTO_TLS_GET_VERIFY)(
+ IN VOID *Tls
);
/**
- Copy Big number.
-
- @param[out] BnDst Destination.
- @param[in] BnSrc Source.
-
- @retval BnDst on success.
- @retval NULL otherwise.
+ Gets the session ID used by the specified TLS connection.
+ This function returns the TLS/SSL session ID currently used by the
+ specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] SessionId Buffer to contain the returned session ID.
+ @param[in,out] SessionIdLen The length of Session ID in bytes.
+ @retval EFI_SUCCESS The Session ID was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
**/
+// FROM TlsLib.h:747
typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_BIGNUM_COPY)(
- OUT VOID *BnDst,
- IN CONST VOID *BnSrc
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_SESSION_ID)(
+ IN VOID *Tls,
+ IN OUT UINT8 *SessionId,
+ IN OUT UINT16 *SessionIdLen
);
/**
- Get constant Big number with value of "1".
- This may be used to save expensive allocations.
-
- @retval Big Number with value of 1.
+ Gets the client random data used in the specified TLS connection.
+ This function returns the TLS/SSL client random data currently used in
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] ClientRandom Buffer to contain the returned client
+ random data (32 bytes).
**/
+// FROM TlsLib.h:766
typedef
-CONST VOID *
-(EFIAPI *EDKII_CRYPTO_BIGNUM_VALUE_ONE)(
- VOID
+VOID
+(EFIAPI *EDKII_CRYPTO_TLS_GET_CLIENT_RANDOM)(
+ IN VOID *Tls,
+ IN OUT UINT8 *ClientRandom
);
/**
- Shift right Big Number.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] Bn Big number.
- @param[in] N Number of bits to shift.
- @param[out] BnRes The result.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Gets the server random data used in the specified TLS connection.
+ This function returns the TLS/SSL server random data currently used in
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] ServerRandom Buffer to contain the returned server
+ random data (32 bytes).
**/
+// FROM TlsLib.h:784
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_R_SHIFT)(
- IN CONST VOID *Bn,
- IN UINTN N,
- OUT VOID *BnRes
+VOID
+(EFIAPI *EDKII_CRYPTO_TLS_GET_SERVER_RANDOM)(
+ IN VOID *Tls,
+ IN OUT UINT8 *ServerRandom
);
/**
- Mark Big Number for constant time computations.
- This function should be called before any constant time computations are
- performed on the given Big number.
-
- @param[in] Bn Big number.
+ Gets the master key data used in the specified TLS connection.
+ This function returns the TLS/SSL master key material currently used in
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] KeyMaterial Buffer to contain the returned key material.
+ @retval EFI_SUCCESS Key material was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
**/
+// FROM TlsLib.h:805
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_BIGNUM_CONST_TIME)(
- IN VOID *Bn
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_KEY_MATERIAL)(
+ IN VOID *Tls,
+ IN OUT UINT8 *KeyMaterial
);
/**
- Calculate square modulo.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Gets the CA Certificate from the cert store.
+ This function returns the CA certificate for the chosen
+ TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[out] Data Pointer to the data buffer to receive the CA
+ certificate data sent to the client.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
+// FROM TlsLib.h:828
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_SQR_MOD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_CA_CERTIFICATE)(
+ IN VOID *Tls,
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
);
/**
- Create new Big Number computation context. This is an opaque structure.
- which should be passed to any function that requires it. The BN context is
- needed to optimize calculations and expensive allocations.
-
- @retval Big Number context struct or NULL on failure.
+ Gets the local public Certificate set in the specified TLS object.
+ This function returns the local public certificate which was currently set
+ in the specified TLS object.
+ @param[in] Tls Pointer to the TLS object.
+ @param[out] Data Pointer to the data buffer to receive the local
+ public certificate.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_NOT_FOUND The certificate is not found.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
+// FROM TlsLib.h:853
typedef
-VOID *
-(EFIAPI *EDKII_CRYPTO_BIGNUM_NEW_CONTEXT)(
- VOID
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_HOST_PUBLIC_CERT)(
+ IN VOID *Tls,
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
);
/**
- Free Big Number context that was allocated with EDKII_CRYPTO_BIGNUM_NewContext().
-
- @param[in] BnCtx Big number context to free.
+ Gets the local private key set in the specified TLS object.
+ This function returns the local private key data which was currently set
+ in the specified TLS object.
+ @param[in] Tls Pointer to the TLS object.
+ @param[out] Data Pointer to the data buffer to receive the local
+ private key data.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
+// FROM TlsLib.h:877
typedef
-VOID
-(EFIAPI *EDKII_CRYPTO_BIGNUM_CONTEXT_FREE)(
- IN VOID *BnCtx
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_HOST_PRIVATE_KEY)(
+ IN VOID *Tls,
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
);
/**
- Set Big Number to a given value.
-
- @param[in] Bn Big number to set.
- @param[in] Val Value to set.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Gets the CA-supplied certificate revocation list data set in the specified
+ TLS object.
+ This function returns the CA-supplied certificate revocation list data which
+ was currently set in the specified TLS object.
+ @param[out] Data Pointer to the data buffer to receive the CRL data.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
+// FROM TlsLib.h:900
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_SET_UINT)(
- IN VOID *Bn,
- IN UINTN Val
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_CERT_REVOCATION_LIST)(
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
);
/**
- Add two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA + BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Derive keying material from a TLS connection.
+ This function exports keying material using the mechanism described in RFC
+ 5705.
+ @param[in] Tls Pointer to the TLS object
+ @param[in] Label Description of the key for the PRF function
+ @param[in] Context Optional context
+ @param[in] ContextLen The length of the context value in bytes
+ @param[out] KeyBuffer Buffer to hold the output of the TLS-PRF
+ @param[in] KeyBufferLen The length of the KeyBuffer
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The TLS object is invalid.
+ @retval EFI_PROTOCOL_ERROR Some other error occurred.
**/
+// FROM TlsLib.h:925
typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_BIGNUM_ADD_MOD)(
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+EFI_STATUS
+(EFIAPI *EDKII_CRYPTO_TLS_GET_EXPORT_KEY)(
+ IN VOID *Tls,
+ IN CONST VOID *Label,
+ IN CONST VOID *Context,
+ IN UINTN ContextLen,
+ OUT VOID *KeyBuffer,
+ IN UINTN KeyBufferLen
);
+// =============================================================================
+// EC functions
+// =============================================================================
+
/**
Initialize new opaque EcGroup object. This object represents an EC curve and
and is used for calculation within this group. This object should be freed
using EcGroupFree() function.
-
@param[in] CryptoNid Identifying number for the ECC curve (Defined in
BaseCryptLib.h).
-
- @retval EcGroup object On success
- @retval NULL On failure
+ @retval EcGroup object On success.
+ @retval NULL On failure.
**/
+// FROM BaseCryptLib.h:3780
typedef
VOID *
(EFIAPI *EDKII_CRYPTO_EC_GROUP_INIT)(
@@ -4912,24 +4051,23 @@ VOID *
This function will set the provided Big Number objects to the corresponding
values. The caller needs to make sure all the "out" BigNumber parameters
are properly initialized.
-
@param[in] EcGroup EC group object.
@param[out] BnPrime Group prime number.
@param[out] BnA A coefficient.
@param[out] BnB B coefficient.
@param[in] BnCtx BN context.
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3801
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_GROUP_GET_CURVE)(
- IN CONST VOID *EcGroup,
- OUT VOID *BnPrime,
- OUT VOID *BnA,
- OUT VOID *BnB,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ OUT VOID *BnPrime,
+ OUT VOID *BnA,
+ OUT VOID *BnB,
+ IN VOID *BnCtx
);
/**
@@ -4937,57 +4075,55 @@ BOOLEAN
This function will set the provided Big Number object to the corresponding
value. The caller needs to make sure that the "out" BigNumber parameter
is properly initialized.
-
- @param[in] EcGroup EC group object
- @param[out] BnOrder Group prime number
-
+ @param[in] EcGroup EC group object.
+ @param[out] BnOrder Group prime number.
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3823
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_GROUP_GET_ORDER)(
- IN VOID *EcGroup,
- OUT VOID *BnOrder
+ IN VOID *EcGroup,
+ OUT VOID *BnOrder
);
/**
- Free previously allocated EC group object using EcGroupInit()
-
- @param[in] EcGroup EC group object to free
+ Free previously allocated EC group object using EcGroupInit().
+ @param[in] EcGroup EC group object to free.
**/
+// FROM BaseCryptLib.h:3835
typedef
VOID
(EFIAPI *EDKII_CRYPTO_EC_GROUP_FREE)(
- IN VOID *EcGroup
+ IN VOID *EcGroup
);
/**
Initialize new opaque EC Point object. This object represents an EC point
within the given EC group (curve).
-
- @param[in] EC Group, properly initialized using EcGroupInit()
-
- @retval EC Point object On success
- @retval NULL On failure
+ @param[in] EC Group, properly initialized using EcGroupInit().
+ @retval EC Point object On success.
+ @retval NULL On failure.
**/
+// FROM BaseCryptLib.h:3850
typedef
VOID *
(EFIAPI *EDKII_CRYPTO_EC_POINT_INIT)(
- IN CONST VOID *EcGroup
+ IN CONST VOID *EcGroup
);
/**
- Free previously allocated EC Point object using EcPointInit()
-
- @param[in] EcPoint EC Point to free
- @param[in] Clear TRUE iff the memory should be cleared
+ Free previously allocated EC Point object using EcPointInit().
+ @param[in] EcPoint EC Point to free.
+ @param[in] Clear TRUE iff the memory should be cleared.
**/
+// FROM BaseCryptLib.h:3862
typedef
VOID
(EFIAPI *EDKII_CRYPTO_EC_POINT_DE_INIT)(
- IN VOID *EcPoint,
- IN BOOLEAN Clear
+ IN VOID *EcPoint,
+ IN BOOLEAN Clear
);
/**
@@ -4995,165 +4131,156 @@ VOID
This function will set the provided Big Number objects to the corresponding
values. The caller needs to make sure all the "out" BigNumber parameters
are properly initialized.
-
- @param[in] EcGroup EC group object
- @param[in] EcPoint EC point object
- @param[out] BnX X coordinate
- @param[out] BnY Y coordinate
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
+ @param[in] EcGroup EC group object.
+ @param[in] EcPoint EC point object.
+ @param[out] BnX X coordinate.
+ @param[out] BnY Y coordinate.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3884
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_GET_AFFINE_COORDINATES)(
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- OUT VOID *BnX,
- OUT VOID *BnY,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ IN CONST VOID *EcPoint,
+ OUT VOID *BnX,
+ OUT VOID *BnY,
+ IN VOID *BnCtx
);
/**
Set EC point affine (x,y) coordinates.
-
- @param[in] EcGroup EC group object
- @param[in] EcPoint EC point object
- @param[in] BnX X coordinate
- @param[in] BnY Y coordinate
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
+ @param[in] EcGroup EC group object.
+ @param[in] EcPoint EC point object.
+ @param[in] BnX X coordinate.
+ @param[in] BnY Y coordinate.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3906
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_SET_AFFINE_COORDINATES)(
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN CONST VOID *BnY,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ IN VOID *EcPoint,
+ IN CONST VOID *BnX,
+ IN CONST VOID *BnY,
+ IN VOID *BnCtx
);
/**
- EC Point addition. EcPointResult = EcPointA + EcPointB
-
- @param[in] EcGroup EC group object
+ EC Point addition. EcPointResult = EcPointA + EcPointB.
+ @param[in] EcGroup EC group object.
@param[out] EcPointResult EC point to hold the result. The point should
be properly initialized.
- @param[in] EcPointA EC Point
- @param[in] EcPointB EC Point
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
+ @param[in] EcPointA EC Point.
+ @param[in] EcPointB EC Point.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3929
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_ADD)(
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ OUT VOID *EcPointResult,
+ IN CONST VOID *EcPointA,
+ IN CONST VOID *EcPointB,
+ IN VOID *BnCtx
);
/**
- Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar
-
- @param[in] EcGroup EC group object
+ Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar.
+ @param[in] EcGroup EC group object.
@param[out] EcPointResult EC point to hold the result. The point should
be properly initialized.
- @param[in] EcPoint EC Point
- @param[in] BnPScalar P Scalar
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
+ @param[in] EcPoint EC Point.
+ @param[in] BnPScalar P Scalar.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3952
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_MUL)(
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPoint,
- IN CONST VOID *BnPScalar,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ OUT VOID *EcPointResult,
+ IN CONST VOID *EcPoint,
+ IN CONST VOID *BnPScalar,
+ IN VOID *BnCtx
);
/**
Calculate the inverse of the supplied EC point.
-
- @param[in] EcGroup EC group object
- @param[in,out] EcPoint EC point to invert
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
+ @param[in] EcGroup EC group object.
+ @param[in,out] EcPoint EC point to invert.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3972
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_INVERT)(
- IN CONST VOID *EcGroup,
- IN OUT VOID *EcPoint,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ IN OUT VOID *EcPoint,
+ IN VOID *BnCtx
);
/**
- Check if the supplied point is on EC curve
-
- @param[in] EcGroup EC group object
- @param[in] EcPoint EC point to check
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
- @retval TRUE On curve
- @retval FALSE Otherwise
+ Check if the supplied point is on EC curve.
+ @param[in] EcGroup EC group object.
+ @param[in] EcPoint EC point to check.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
+ @retval TRUE On curve.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:3990
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_IS_ON_CURVE)(
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ IN CONST VOID *EcPoint,
+ IN VOID *BnCtx
);
/**
- Check if the supplied point is at infinity
-
- @param[in] EcGroup EC group object
- @param[in] EcPoint EC point to check
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
- @retval TRUE At infinity
- @retval FALSE Otherwise
+ Check if the supplied point is at infinity.
+ @param[in] EcGroup EC group object.
+ @param[in] EcPoint EC point to check.
+ @retval TRUE At infinity.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:4007
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_IS_AT_INFINITY)(
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint
+ IN CONST VOID *EcGroup,
+ IN CONST VOID *EcPoint
);
/**
- Check if EC points are equal
-
- @param[in] EcGroup EC group object
- @param[in] EcPointA EC point A
- @param[in] EcPointB EC point B
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
- @retval TRUE A == B
- @retval FALSE Otherwise
+ Check if EC points are equal.
+ @param[in] EcGroup EC group object.
+ @param[in] EcPointA EC point A.
+ @param[in] EcPointB EC point B.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
+ @retval TRUE A == B.
+ @retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:4025
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_EQUAL)(
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ IN CONST VOID *EcPointA,
+ IN CONST VOID *EcPointB,
+ IN VOID *BnCtx
);
/**
@@ -5163,34 +4290,33 @@ BOOLEAN
values for y. Therefore, a point can be set using this function where BnX is
the x coordinate and YBit is a value 0 or 1 to identify which of the two
possible values for y should be used.
-
- @param[in] EcGroup EC group object
- @param[in] EcPoint EC Point
- @param[in] BnX X coordinate
- @param[in] YBit 0 or 1 to identify which Y value is used
- @param[in] BnCtx BN context, created with BigNumNewContext()
-
+ @param[in] EcGroup EC group object.
+ @param[in] EcPoint EC Point.
+ @param[in] BnX X coordinate.
+ @param[in] YBit 0 or 1 to identify which Y value is used.
+ @param[in] BnCtx BN context, created with BigNumNewContext().
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// FROM BaseCryptLib.h:4051
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_POINT_SET_COMPRESSED_COORDINATES)(
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN UINT8 YBit,
- IN VOID *BnCtx
+ IN CONST VOID *EcGroup,
+ IN VOID *EcPoint,
+ IN CONST VOID *BnX,
+ IN UINT8 YBit,
+ IN VOID *BnCtx
);
/**
Allocates and Initializes one Elliptic Curve Context for subsequent use
with the NID.
-
@param[in] Nid cipher NID
@return Pointer to the Elliptic Curve Context that has been initialized.
If the allocations fails, EcNewByNid() returns NULL.
**/
+// FROM BaseCryptLib.h:4073
typedef
VOID *
(EFIAPI *EDKII_CRYPTO_EC_NEW_BY_NID)(
@@ -5199,9 +4325,9 @@ VOID *
/**
Release the specified EC context.
-
@param[in] EcContext Pointer to the EC context to be released.
**/
+// FROM BaseCryptLib.h:4084
typedef
VOID
(EFIAPI *EDKII_CRYPTO_EC_FREE)(
@@ -5234,6 +4360,7 @@ VOID
@retval FALSE EC public X,Y generation failed.
@retval FALSE PublicKeySize is not large enough.
**/
+// FROM BaseCryptLib.h:4116
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_GENERATE_KEY)(
@@ -5256,6 +4383,7 @@ BOOLEAN
@retval TRUE EC key component was retrieved successfully.
@retval FALSE Invalid EC key component.
**/
+// FROM BaseCryptLib.h:4138
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_GET_PUB_KEY)(
@@ -5289,6 +4417,7 @@ BOOLEAN
@retval FALSE EC exchanged key generation failed.
@retval FALSE KeySize is not large enough.
**/
+// FROM BaseCryptLib.h:4171
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_DH_COMPUTE_KEY)(
@@ -5300,47 +4429,20 @@ BOOLEAN
IN OUT UINTN *KeySize
);
-/**
- Retrieve the EC Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC public key component. Use EcFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve EC public key from X509 certificate.
-
-**/
-typedef
-BOOLEAN
-(EFIAPI *EDKII_CRYPTO_EC_GET_PUBLIC_KEY_FROM_X509)(
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **EcContext
- );
-
/**
Retrieve the EC Private Key from the password-protected PEM key data.
-
@param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
@param[in] PemSize Size of the PEM key data in bytes.
@param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
@param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
EC private key component. Use EcFree() function to free the
resource.
-
If PemData is NULL, then return FALSE.
If EcContext is NULL, then return FALSE.
-
@retval TRUE EC Private Key was retrieved successfully.
@retval FALSE Invalid PEM key data or incorrect password.
-
**/
+// FROM BaseCryptLib.h:4199
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_GET_PRIVATE_KEY_FROM_PEM)(
@@ -5351,21 +4453,38 @@ BOOLEAN
);
/**
- Carries out the EC-DSA signature.
+ Retrieve the EC Public Key from one DER-encoded X509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
+ EC public key component. Use EcFree() function to free the
+ resource.
+ If Cert is NULL, then return FALSE.
+ If EcContext is NULL, then return FALSE.
+ @retval TRUE EC Public Key was retrieved successfully.
+ @retval FALSE Fail to retrieve EC public key from X509 certificate.
+**/
+// FROM BaseCryptLib.h:4224
+typedef
+BOOLEAN
+(EFIAPI *EDKII_CRYPTO_EC_GET_PUBLIC_KEY_FROM_X509)(
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT VOID **EcContext
+ );
+/**
+ Carries out the EC-DSA signature.
This function carries out the EC-DSA signature.
If the Signature buffer is too small to hold the contents of signature, FALSE
is returned and SigSize is set to the required buffer size to obtain the signature.
-
If EcContext is NULL, then return FALSE.
If MessageHash is NULL, then return FALSE.
If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
If SigSize is large enough but Signature is NULL, then return FALSE.
-
For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
@param[in] EcContext Pointer to EC context for signature generation.
@param[in] HashNid hash NID
@param[in] MessageHash Pointer to octet message hash to be signed.
@@ -5373,12 +4492,11 @@ BOOLEAN
@param[out] Signature Pointer to buffer to receive EC-DSA signature.
@param[in, out] SigSize On input, the size of Signature buffer in bytes.
On output, the size of data returned in Signature buffer in bytes.
-
@retval TRUE Signature successfully generated in EC-DSA.
@retval FALSE Signature generation failed.
@retval FALSE SigSize is too small.
-
**/
+// FROM BaseCryptLib.h:4261
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_DSA_SIGN)(
@@ -5392,27 +4510,23 @@ BOOLEAN
/**
Verifies the EC-DSA signature.
-
If EcContext is NULL, then return FALSE.
If MessageHash is NULL, then return FALSE.
If Signature is NULL, then return FALSE.
If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
-
For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
@param[in] EcContext Pointer to EC context for signature verification.
@param[in] HashNid hash NID
@param[in] MessageHash Pointer to octet message hash to be checked.
@param[in] HashSize Size of the message hash in bytes.
@param[in] Signature Pointer to EC-DSA signature to be verified.
@param[in] SigSize Size of signature in bytes.
-
@retval TRUE Valid signature encoded in EC-DSA.
@retval FALSE Invalid signature or invalid EC context.
-
**/
+// FROM BaseCryptLib.h:4295
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_EC_DSA_VERIFY)(
@@ -5428,67 +4542,48 @@ BOOLEAN
/// EDK II Crypto Protocol
///
struct _EDKII_CRYPTO_PROTOCOL {
- /// Version
+ // VERSION
EDKII_CRYPTO_GET_VERSION GetVersion;
- /// HMAC MD5 - deprecated and unsupported
- DEPRECATED_EDKII_CRYPTO_HMAC_MD5_NEW DeprecatedHmacMd5New;
- DEPRECATED_EDKII_CRYPTO_HMAC_MD5_FREE DeprecatedHmacMd5Free;
- DEPRECATED_EDKII_CRYPTO_HMAC_MD5_SET_KEY DeprecatedHmacMd5SetKey;
- DEPRECATED_EDKII_CRYPTO_HMAC_MD5_DUPLICATE DeprecatedHmacMd5Duplicate;
- DEPRECATED_EDKII_CRYPTO_HMAC_MD5_UPDATE DeprecatedHmacMd5Update;
- DEPRECATED_EDKII_CRYPTO_HMAC_MD5_FINAL DeprecatedHmacMd5Final;
- /// HMAC SHA1 - deprecated and unsupported
- DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_NEW DeprecatedHmacSha1New;
- DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FREE DeprecatedHmacSha1Free;
- DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_SET_KEY DeprecatedHmacSha1SetKey;
- DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_DUPLICATE DeprecatedHmacSha1Duplicate;
- DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_UPDATE DeprecatedHmacSha1Update;
- DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FINAL DeprecatedHmacSha1Final;
- /// HMAC SHA256
+ // HMACSHA256
EDKII_CRYPTO_HMAC_SHA256_NEW HmacSha256New;
EDKII_CRYPTO_HMAC_SHA256_FREE HmacSha256Free;
EDKII_CRYPTO_HMAC_SHA256_SET_KEY HmacSha256SetKey;
EDKII_CRYPTO_HMAC_SHA256_DUPLICATE HmacSha256Duplicate;
EDKII_CRYPTO_HMAC_SHA256_UPDATE HmacSha256Update;
EDKII_CRYPTO_HMAC_SHA256_FINAL HmacSha256Final;
- /// Md4 - deprecated and unsupported
- DEPRECATED_EDKII_CRYPTO_MD4_GET_CONTEXT_SIZE DeprecatedMd4GetContextSize;
- DEPRECATED_EDKII_CRYPTO_MD4_INIT DeprecatedMd4Init;
- DEPRECATED_EDKII_CRYPTO_MD4_DUPLICATE DeprecatedMd4Duplicate;
- DEPRECATED_EDKII_CRYPTO_MD4_UPDATE DeprecatedMd4Update;
- DEPRECATED_EDKII_CRYPTO_MD4_FINAL DeprecatedMd4Final;
- DEPRECATED_EDKII_CRYPTO_MD4_HASH_ALL DeprecatedMd4HashAll;
- /// Md5
- EDKII_CRYPTO_MD5_GET_CONTEXT_SIZE Md5GetContextSize;
- EDKII_CRYPTO_MD5_INIT Md5Init;
- EDKII_CRYPTO_MD5_DUPLICATE Md5Duplicate;
- EDKII_CRYPTO_MD5_UPDATE Md5Update;
- EDKII_CRYPTO_MD5_FINAL Md5Final;
- EDKII_CRYPTO_MD5_HASH_ALL Md5HashAll;
- /// Pkcs
- EDKII_CRYPTO_PKCS1_ENCRYPT_V2 Pkcs1v2Encrypt;
- EDKII_CRYPTO_PKCS5_PW_HASH Pkcs5HashPassword;
- EDKII_CRYPTO_PKCS7_VERIFY Pkcs7Verify;
- EDKII_CRYPTO_PKCS7_VERIFY_EKU VerifyEKUsInPkcs7Signature;
+ EDKII_CRYPTO_HMAC_SHA256_ALL HmacSha256All;
+ // HMACSHA384
+ EDKII_CRYPTO_HMAC_SHA384_NEW HmacSha384New;
+ EDKII_CRYPTO_HMAC_SHA384_FREE HmacSha384Free;
+ EDKII_CRYPTO_HMAC_SHA384_SET_KEY HmacSha384SetKey;
+ EDKII_CRYPTO_HMAC_SHA384_DUPLICATE HmacSha384Duplicate;
+ EDKII_CRYPTO_HMAC_SHA384_UPDATE HmacSha384Update;
+ EDKII_CRYPTO_HMAC_SHA384_FINAL HmacSha384Final;
+ EDKII_CRYPTO_HMAC_SHA384_ALL HmacSha384All;
+ // PKCS
+ EDKII_CRYPTO_PKCS5_HASH_PASSWORD Pkcs5HashPassword;
+ EDKII_CRYPTO_PKCS1V2_ENCRYPT Pkcs1v2Encrypt;
+ EDKII_CRYPTO_PKCS1V2_DECRYPT Pkcs1v2Decrypt;
EDKII_CRYPTO_PKCS7_GET_SIGNERS Pkcs7GetSigners;
EDKII_CRYPTO_PKCS7_FREE_SIGNERS Pkcs7FreeSigners;
+ EDKII_CRYPTO_PKCS7_GET_CERTIFICATES_LIST Pkcs7GetCertificatesList;
EDKII_CRYPTO_PKCS7_SIGN Pkcs7Sign;
+ EDKII_CRYPTO_PKCS7_VERIFY Pkcs7Verify;
+ EDKII_CRYPTO_VERIFY_EKUS_IN_PKCS7_SIGNATURE VerifyEKUsInPkcs7Signature;
EDKII_CRYPTO_PKCS7_GET_ATTACHED_CONTENT Pkcs7GetAttachedContent;
- EDKII_CRYPTO_PKCS7_GET_CERTIFICATES_LIST Pkcs7GetCertificatesList;
EDKII_CRYPTO_AUTHENTICODE_VERIFY AuthenticodeVerify;
EDKII_CRYPTO_IMAGE_TIMESTAMP_VERIFY ImageTimestampVerify;
- /// DH
+ // DH
EDKII_CRYPTO_DH_NEW DhNew;
EDKII_CRYPTO_DH_FREE DhFree;
EDKII_CRYPTO_DH_GENERATE_PARAMETER DhGenerateParameter;
EDKII_CRYPTO_DH_SET_PARAMETER DhSetParameter;
EDKII_CRYPTO_DH_GENERATE_KEY DhGenerateKey;
EDKII_CRYPTO_DH_COMPUTE_KEY DhComputeKey;
- /// Random
+ // RANDOM
EDKII_CRYPTO_RANDOM_SEED RandomSeed;
EDKII_CRYPTO_RANDOM_BYTES RandomBytes;
- /// RSA
- EDKII_CRYPTO_RSA_VERIFY_PKCS1 RsaVerifyPkcs1;
+ // RSA
EDKII_CRYPTO_RSA_NEW RsaNew;
EDKII_CRYPTO_RSA_FREE RsaFree;
EDKII_CRYPTO_RSA_SET_KEY RsaSetKey;
@@ -5497,78 +4592,117 @@ struct _EDKII_CRYPTO_PROTOCOL {
EDKII_CRYPTO_RSA_CHECK_KEY RsaCheckKey;
EDKII_CRYPTO_RSA_PKCS1_SIGN RsaPkcs1Sign;
EDKII_CRYPTO_RSA_PKCS1_VERIFY RsaPkcs1Verify;
+ EDKII_CRYPTO_RSA_PSS_SIGN RsaPssSign;
+ EDKII_CRYPTO_RSA_PSS_VERIFY RsaPssVerify;
EDKII_CRYPTO_RSA_GET_PRIVATE_KEY_FROM_PEM RsaGetPrivateKeyFromPem;
EDKII_CRYPTO_RSA_GET_PUBLIC_KEY_FROM_X509 RsaGetPublicKeyFromX509;
- /// Sha1
+ EDKII_CRYPTO_RSA_OAEP_ENCRYPT RsaOaepEncrypt;
+ EDKII_CRYPTO_RSA_OAEP_DECRYPT RsaOaepDecrypt;
+ // SHA1
EDKII_CRYPTO_SHA1_GET_CONTEXT_SIZE Sha1GetContextSize;
EDKII_CRYPTO_SHA1_INIT Sha1Init;
EDKII_CRYPTO_SHA1_DUPLICATE Sha1Duplicate;
EDKII_CRYPTO_SHA1_UPDATE Sha1Update;
EDKII_CRYPTO_SHA1_FINAL Sha1Final;
EDKII_CRYPTO_SHA1_HASH_ALL Sha1HashAll;
- /// Sha256
+ // SHA256
EDKII_CRYPTO_SHA256_GET_CONTEXT_SIZE Sha256GetContextSize;
EDKII_CRYPTO_SHA256_INIT Sha256Init;
EDKII_CRYPTO_SHA256_DUPLICATE Sha256Duplicate;
EDKII_CRYPTO_SHA256_UPDATE Sha256Update;
EDKII_CRYPTO_SHA256_FINAL Sha256Final;
EDKII_CRYPTO_SHA256_HASH_ALL Sha256HashAll;
- /// Sha384
+ // SHA384
EDKII_CRYPTO_SHA384_GET_CONTEXT_SIZE Sha384GetContextSize;
EDKII_CRYPTO_SHA384_INIT Sha384Init;
EDKII_CRYPTO_SHA384_DUPLICATE Sha384Duplicate;
EDKII_CRYPTO_SHA384_UPDATE Sha384Update;
EDKII_CRYPTO_SHA384_FINAL Sha384Final;
EDKII_CRYPTO_SHA384_HASH_ALL Sha384HashAll;
- /// Sha512
+ // SHA512
EDKII_CRYPTO_SHA512_GET_CONTEXT_SIZE Sha512GetContextSize;
EDKII_CRYPTO_SHA512_INIT Sha512Init;
EDKII_CRYPTO_SHA512_DUPLICATE Sha512Duplicate;
EDKII_CRYPTO_SHA512_UPDATE Sha512Update;
EDKII_CRYPTO_SHA512_FINAL Sha512Final;
EDKII_CRYPTO_SHA512_HASH_ALL Sha512HashAll;
- /// X509
+ // PARALLELHASH256
+ EDKII_CRYPTO_PARALLEL_HASH256_HASH_ALL ParallelHash256HashAll;
+ // AEADAESGCM
+ EDKII_CRYPTO_AEAD_AES_GCM_ENCRYPT AeadAesGcmEncrypt;
+ EDKII_CRYPTO_AEAD_AES_GCM_DECRYPT AeadAesGcmDecrypt;
+ // X509
EDKII_CRYPTO_X509_GET_SUBJECT_NAME X509GetSubjectName;
EDKII_CRYPTO_X509_GET_COMMON_NAME X509GetCommonName;
EDKII_CRYPTO_X509_GET_ORGANIZATION_NAME X509GetOrganizationName;
EDKII_CRYPTO_X509_VERIFY_CERT X509VerifyCert;
EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE X509ConstructCertificate;
+ EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK_V X509ConstructCertificateStackV;
EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK X509ConstructCertificateStack;
EDKII_CRYPTO_X509_FREE X509Free;
EDKII_CRYPTO_X509_STACK_FREE X509StackFree;
- EDKII_CRYPTO_X509_GET_TBS_CERT X509GetTBSCert;
- /// TDES - deprecated and unsupported
- DEPRECATED_EDKII_CRYPTO_TDES_GET_CONTEXT_SIZE DeprecatedTdesGetContextSize;
- DEPRECATED_EDKII_CRYPTO_TDES_INIT DeprecatedTdesInit;
- DEPRECATED_EDKII_CRYPTO_TDES_ECB_ENCRYPT DeprecatedTdesEcbEncrypt;
- DEPRECATED_EDKII_CRYPTO_TDES_ECB_DECRYPT DeprecatedTdesEcbDecrypt;
- DEPRECATED_EDKII_CRYPTO_TDES_CBC_ENCRYPT DeprecatedTdesCbcEncrypt;
- DEPRECATED_EDKII_CRYPTO_TDES_CBC_DECRYPT DeprecatedTdesCbcDecrypt;
- /// AES - ECB Mode is deprecated and unsupported
+ EDKII_CRYPTO_X509_GET_TBSCERT X509GetTBSCert;
+ EDKII_CRYPTO_X509_GET_VERSION X509GetVersion;
+ EDKII_CRYPTO_X509_GET_SERIAL_NUMBER X509GetSerialNumber;
+ EDKII_CRYPTO_X509_GET_ISSUER_NAME X509GetIssuerName;
+ EDKII_CRYPTO_X509_GET_SIGNATURE_ALGORITHM X509GetSignatureAlgorithm;
+ EDKII_CRYPTO_X509_GET_EXTENSION_DATA X509GetExtensionData;
+ EDKII_CRYPTO_X509_GET_VALIDITY X509GetValidity;
+ EDKII_CRYPTO_X509_FORMAT_DATE_TIME X509FormatDateTime;
+ EDKII_CRYPTO_X509_GET_KEY_USAGE X509GetKeyUsage;
+ EDKII_CRYPTO_X509_GET_EXTENDED_KEY_USAGE X509GetExtendedKeyUsage;
+ EDKII_CRYPTO_X509_VERIFY_CERT_CHAIN X509VerifyCertChain;
+ EDKII_CRYPTO_X509_GET_CERT_FROM_CERT_CHAIN X509GetCertFromCertChain;
+ EDKII_CRYPTO_X509_GET_EXTENDED_BASIC_CONSTRAINTS X509GetExtendedBasicConstraints;
+ // ASN1
+ EDKII_CRYPTO_ASN1_GET_TAG Asn1GetTag;
+ // BIGNUM
+ EDKII_CRYPTO_BIG_NUM_INIT BigNumInit;
+ EDKII_CRYPTO_BIG_NUM_FROM_BIN BigNumFromBin;
+ EDKII_CRYPTO_BIG_NUM_TO_BIN BigNumToBin;
+ EDKII_CRYPTO_BIG_NUM_FREE BigNumFree;
+ EDKII_CRYPTO_BIG_NUM_ADD BigNumAdd;
+ EDKII_CRYPTO_BIG_NUM_SUB BigNumSub;
+ EDKII_CRYPTO_BIG_NUM_MOD BigNumMod;
+ EDKII_CRYPTO_BIG_NUM_EXP_MOD BigNumExpMod;
+ EDKII_CRYPTO_BIG_NUM_INVERSE_MOD BigNumInverseMod;
+ EDKII_CRYPTO_BIG_NUM_DIV BigNumDiv;
+ EDKII_CRYPTO_BIG_NUM_MUL_MOD BigNumMulMod;
+ EDKII_CRYPTO_BIG_NUM_CMP BigNumCmp;
+ EDKII_CRYPTO_BIG_NUM_BITS BigNumBits;
+ EDKII_CRYPTO_BIG_NUM_BYTES BigNumBytes;
+ EDKII_CRYPTO_BIG_NUM_IS_WORD BigNumIsWord;
+ EDKII_CRYPTO_BIG_NUM_IS_ODD BigNumIsOdd;
+ EDKII_CRYPTO_BIG_NUM_COPY BigNumCopy;
+ EDKII_CRYPTO_BIG_NUM_RSHIFT BigNumRShift;
+ EDKII_CRYPTO_BIG_NUM_CONST_TIME BigNumConstTime;
+ EDKII_CRYPTO_BIG_NUM_SQR_MOD BigNumSqrMod;
+ EDKII_CRYPTO_BIG_NUM_NEW_CONTEXT BigNumNewContext;
+ EDKII_CRYPTO_BIG_NUM_CONTEXT_FREE BigNumContextFree;
+ EDKII_CRYPTO_BIG_NUM_SET_UINT BigNumSetUint;
+ EDKII_CRYPTO_BIG_NUM_ADD_MOD BigNumAddMod;
+ // TDES
+ // AES
EDKII_CRYPTO_AES_GET_CONTEXT_SIZE AesGetContextSize;
EDKII_CRYPTO_AES_INIT AesInit;
- DEPRECATED_EDKII_CRYPTO_AES_ECB_ENCRYPT DeprecatedAesEcbEncrypt;
- DEPRECATED_EDKII_CRYPTO_AES_ECB_DECRYPT DeprecatedAesEcbDecrypt;
EDKII_CRYPTO_AES_CBC_ENCRYPT AesCbcEncrypt;
EDKII_CRYPTO_AES_CBC_DECRYPT AesCbcDecrypt;
- /// Arc4 - deprecated and unsupported
- DEPRECATED_EDKII_CRYPTO_ARC4_GET_CONTEXT_SIZE DeprecatedArc4GetContextSize;
- DEPRECATED_EDKII_CRYPTO_ARC4_INIT DeprecatedArc4Init;
- DEPRECATED_EDKII_CRYPTO_ARC4_ENCRYPT DeprecatedArc4Encrypt;
- DEPRECATED_EDKII_CRYPTO_ARC4_DECRYPT DeprecatedArc4Decrypt;
- DEPRECATED_EDKII_CRYPTO_ARC4_RESET DeprecatedArc4Reset;
- /// SM3
+ // ARC4
+ // SM3
EDKII_CRYPTO_SM3_GET_CONTEXT_SIZE Sm3GetContextSize;
EDKII_CRYPTO_SM3_INIT Sm3Init;
EDKII_CRYPTO_SM3_DUPLICATE Sm3Duplicate;
EDKII_CRYPTO_SM3_UPDATE Sm3Update;
EDKII_CRYPTO_SM3_FINAL Sm3Final;
EDKII_CRYPTO_SM3_HASH_ALL Sm3HashAll;
- /// HKDF
- EDKII_CRYPTO_HKDF_SHA_256_EXTRACT_AND_EXPAND HkdfSha256ExtractAndExpand;
- /// X509 (Continued)
- EDKII_CRYPTO_X509_CONSTRUCT_CERTIFICATE_STACK_V X509ConstructCertificateStackV;
- /// TLS
+ // HKDF
+ EDKII_CRYPTO_HKDF_SHA256_EXTRACT_AND_EXPAND HkdfSha256ExtractAndExpand;
+ EDKII_CRYPTO_HKDF_SHA256_EXTRACT HkdfSha256Extract;
+ EDKII_CRYPTO_HKDF_SHA256_EXPAND HkdfSha256Expand;
+ EDKII_CRYPTO_HKDF_SHA384_EXTRACT_AND_EXPAND HkdfSha384ExtractAndExpand;
+ EDKII_CRYPTO_HKDF_SHA384_EXTRACT HkdfSha384Extract;
+ EDKII_CRYPTO_HKDF_SHA384_EXPAND HkdfSha384Expand;
+ // TLS
EDKII_CRYPTO_TLS_INITIALIZE TlsInitialize;
EDKII_CRYPTO_TLS_CTX_FREE TlsCtxFree;
EDKII_CRYPTO_TLS_CTX_NEW TlsCtxNew;
@@ -5582,19 +4716,23 @@ struct _EDKII_CRYPTO_PROTOCOL {
EDKII_CRYPTO_TLS_CTRL_TRAFFIC_IN TlsCtrlTrafficIn;
EDKII_CRYPTO_TLS_READ TlsRead;
EDKII_CRYPTO_TLS_WRITE TlsWrite;
- /// TLS Set
+ EDKII_CRYPTO_TLS_SHUTDOWN TlsShutdown;
+ // TLSSET
EDKII_CRYPTO_TLS_SET_VERSION TlsSetVersion;
EDKII_CRYPTO_TLS_SET_CONNECTION_END TlsSetConnectionEnd;
EDKII_CRYPTO_TLS_SET_CIPHER_LIST TlsSetCipherList;
EDKII_CRYPTO_TLS_SET_COMPRESSION_METHOD TlsSetCompressionMethod;
EDKII_CRYPTO_TLS_SET_VERIFY TlsSetVerify;
EDKII_CRYPTO_TLS_SET_VERIFY_HOST TlsSetVerifyHost;
- EDKII_CRYPTO_TLS_SET_SESSIONID TlsSetSessionId;
+ EDKII_CRYPTO_TLS_SET_SESSION_ID TlsSetSessionId;
EDKII_CRYPTO_TLS_SET_CA_CERTIFICATE TlsSetCaCertificate;
EDKII_CRYPTO_TLS_SET_HOST_PUBLIC_CERT TlsSetHostPublicCert;
+ EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY_EX TlsSetHostPrivateKeyEx;
EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY TlsSetHostPrivateKey;
EDKII_CRYPTO_TLS_SET_CERT_REVOCATION_LIST TlsSetCertRevocationList;
- /// TLS Get
+ EDKII_CRYPTO_TLS_SET_SIGNATURE_ALGO_LIST TlsSetSignatureAlgoList;
+ EDKII_CRYPTO_TLS_SET_EC_CURVE TlsSetEcCurve;
+ // TLSGET
EDKII_CRYPTO_TLS_GET_VERSION TlsGetVersion;
EDKII_CRYPTO_TLS_GET_CONNECTION_END TlsGetConnectionEnd;
EDKII_CRYPTO_TLS_GET_CURRENT_CIPHER TlsGetCurrentCipher;
@@ -5608,57 +4746,8 @@ struct _EDKII_CRYPTO_PROTOCOL {
EDKII_CRYPTO_TLS_GET_HOST_PUBLIC_CERT TlsGetHostPublicCert;
EDKII_CRYPTO_TLS_GET_HOST_PRIVATE_KEY TlsGetHostPrivateKey;
EDKII_CRYPTO_TLS_GET_CERT_REVOCATION_LIST TlsGetCertRevocationList;
- /// RSA PSS
- EDKII_CRYPTO_RSA_PSS_SIGN RsaPssSign;
- EDKII_CRYPTO_RSA_PSS_VERIFY RsaPssVerify;
- /// Parallel hash
- EDKII_CRYPTO_PARALLEL_HASH_ALL ParallelHash256HashAll;
- /// HMAC SHA256 (continued)
- EDKII_CRYPTO_HMAC_SHA256_ALL HmacSha256All;
- /// HMAC SHA384
- EDKII_CRYPTO_HMAC_SHA384_NEW HmacSha384New;
- EDKII_CRYPTO_HMAC_SHA384_FREE HmacSha384Free;
- EDKII_CRYPTO_HMAC_SHA384_SET_KEY HmacSha384SetKey;
- EDKII_CRYPTO_HMAC_SHA384_DUPLICATE HmacSha384Duplicate;
- EDKII_CRYPTO_HMAC_SHA384_UPDATE HmacSha384Update;
- EDKII_CRYPTO_HMAC_SHA384_FINAL HmacSha384Final;
- EDKII_CRYPTO_HMAC_SHA384_ALL HmacSha384All;
- /// HKDF (continued)
- EDKII_CRYPTO_HKDF_SHA_256_EXTRACT HkdfSha256Extract;
- EDKII_CRYPTO_HKDF_SHA_256_EXPAND HkdfSha256Expand;
- EDKII_CRYPTO_HKDF_SHA_384_EXTRACT_AND_EXPAND HkdfSha384ExtractAndExpand;
- EDKII_CRYPTO_HKDF_SHA_384_EXTRACT HkdfSha384Extract;
- EDKII_CRYPTO_HKDF_SHA_384_EXPAND HkdfSha384Expand;
- /// AEAD AES-GCM
- EDKII_AEAD_AES_GCM_ENCRYPT AeadAesGcmEncrypt;
- EDKII_AEAD_AES_GCM_DECRYPT AeadAesGcmDecrypt;
- /// BIGNUM
- EDKII_CRYPTO_BIGNUM_INIT BigNumInit;
- EDKII_CRYPTO_BIGNUM_FROM_BIN BigNumFromBin;
- EDKII_CRYPTO_BIGNUM_TO_BIN BigNumToBin;
- EDKII_CRYPTO_BIGNUM_FREE BigNumFree;
- EDKII_CRYPTO_BIGNUM_ADD BigNumAdd;
- EDKII_CRYPTO_BIGNUM_SUB BigNumSub;
- EDKII_CRYPTO_BIGNUM_MOD BigNumMod;
- EDKII_CRYPTO_BIGNUM_EXP_MOD BigNumExpMod;
- EDKII_CRYPTO_BIGNUM_INVERSE_MOD BigNumInverseMod;
- EDKII_CRYPTO_BIGNUM_DIV BigNumDiv;
- EDKII_CRYPTO_BIGNUM_MUL_MOD BigNumMulMod;
- EDKII_CRYPTO_BIGNUM_CMP BigNumCmp;
- EDKII_CRYPTO_BIGNUM_BITS BigNumBits;
- EDKII_CRYPTO_BIGNUM_BYTES BigNumBytes;
- EDKII_CRYPTO_BIGNUM_IS_WORD BigNumIsWord;
- EDKII_CRYPTO_BIGNUM_IS_ODD BigNumIsOdd;
- EDKII_CRYPTO_BIGNUM_COPY BigNumCopy;
- EDKII_CRYPTO_BIGNUM_VALUE_ONE BigNumValueOne;
- EDKII_CRYPTO_BIGNUM_R_SHIFT BigNumRShift;
- EDKII_CRYPTO_BIGNUM_CONST_TIME BigNumConstTime;
- EDKII_CRYPTO_BIGNUM_SQR_MOD BigNumSqrMod;
- EDKII_CRYPTO_BIGNUM_NEW_CONTEXT BigNumNewContext;
- EDKII_CRYPTO_BIGNUM_CONTEXT_FREE BigNumContextFree;
- EDKII_CRYPTO_BIGNUM_SET_UINT BigNumSetUint;
- EDKII_CRYPTO_BIGNUM_ADD_MOD BigNumAddMod;
- /// EC
+ EDKII_CRYPTO_TLS_GET_EXPORT_KEY TlsGetExportKey;
+ // EC
EDKII_CRYPTO_EC_GROUP_INIT EcGroupInit;
EDKII_CRYPTO_EC_GROUP_GET_CURVE EcGroupGetCurve;
EDKII_CRYPTO_EC_GROUP_GET_ORDER EcGroupGetOrder;
@@ -5679,39 +4768,16 @@ struct _EDKII_CRYPTO_PROTOCOL {
EDKII_CRYPTO_EC_GENERATE_KEY EcGenerateKey;
EDKII_CRYPTO_EC_GET_PUB_KEY EcGetPubKey;
EDKII_CRYPTO_EC_DH_COMPUTE_KEY EcDhComputeKey;
- /// TLS (continued)
- EDKII_CRYPTO_TLS_SHUTDOWN TlsShutdown;
- /// TLS Set (continued)
- EDKII_CRYPTO_TLS_SET_HOST_PRIVATE_KEY_EX TlsSetHostPrivateKeyEx;
- EDKII_CRYPTO_TLS_SET_SIGNATURE_ALGO_LIST TlsSetSignatureAlgoList;
- EDKII_CRYPTO_TLS_SET_EC_CURVE TlsSetEcCurve;
- /// TLS Get (continued)
- EDKII_CRYPTO_TLS_GET_EXPORT_KEY TlsGetExportKey;
- /// Ec (Continued)
- EDKII_CRYPTO_EC_GET_PUBLIC_KEY_FROM_X509 EcGetPublicKeyFromX509;
EDKII_CRYPTO_EC_GET_PRIVATE_KEY_FROM_PEM EcGetPrivateKeyFromPem;
+ EDKII_CRYPTO_EC_GET_PUBLIC_KEY_FROM_X509 EcGetPublicKeyFromX509;
EDKII_CRYPTO_EC_DSA_SIGN EcDsaSign;
EDKII_CRYPTO_EC_DSA_VERIFY EcDsaVerify;
- /// X509 (Continued)
- EDKII_CRYPTO_X509_GET_VERSION X509GetVersion;
- EDKII_CRYPTO_X509_GET_SERIAL_NUMBER X509GetSerialNumber;
- EDKII_CRYPTO_X509_GET_ISSUER_NAME X509GetIssuerName;
- EDKII_CRYPTO_X509_GET_SIGNATURE_ALGORITHM X509GetSignatureAlgorithm;
- EDKII_CRYPTO_X509_GET_EXTENSION_DATA X509GetExtensionData;
- EDKII_CRYPTO_X509_GET_EXTENDED_KEY_USAGE X509GetExtendedKeyUsage;
- EDKII_CRYPTO_X509_GET_VALIDITY X509GetValidity;
- EDKII_CRYPTO_X509_FORMAT_DATE_TIME X509FormatDateTime;
- EDKII_CRYPTO_X509_COMPARE_DATE_TIME X509CompareDateTime;
- EDKII_CRYPTO_X509_GET_KEY_USAGE X509GetKeyUsage;
- EDKII_CRYPTO_X509_VERIFY_CERT_CHAIN X509VerifyCertChain;
- EDKII_CRYPTO_X509_GET_CERT_FROM_CERT_CHAIN X509GetCertFromCertChain;
- EDKII_CRYPTO_ASN1_GET_TAG Asn1GetTag;
- EDKII_CRYPTO_X509_GET_EXTENDED_BASIC_CONSTRAINTS X509GetExtendedBasicConstraints;
- EDKII_CRYPTO_PKCS1V2_DECRYPT Pkcs1v2Decrypt;
- EDKII_CRYPTO_RSA_OAEP_ENCRYPT RsaOaepEncrypt;
- EDKII_CRYPTO_RSA_OAEP_DECRYPT RsaOaepDecrypt;
};
+// AUTOGEN ENDS
+// ****************************************************************************
+// MU_CHANGE [END]
+
extern GUID gEdkiiCryptoProtocolGuid;
#endif
diff --git a/CryptoPkg/Private/Protocol/SmmCrypto.h b/CryptoPkg/Include/Protocol/SmmCrypto.h
similarity index 83%
rename from CryptoPkg/Private/Protocol/SmmCrypto.h
rename to CryptoPkg/Include/Protocol/SmmCrypto.h
index fec5a45523..4baded7a47 100644
--- a/CryptoPkg/Private/Protocol/SmmCrypto.h
+++ b/CryptoPkg/Include/Protocol/SmmCrypto.h
@@ -1,7 +1,7 @@
/** @file
This Protocol provides Crypto services to SMM modules
- Copyright (C) Microsoft Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
deleted file mode 100644
index d8a9dbb3d9..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ /dev/null
@@ -1,121 +0,0 @@
-## @file
-# Cryptographic Library Instance for DXE_DRIVER.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Copyright (c) 2009 - 2022, Intel Corporation. All rights reserved.
-# Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
-# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = BaseCryptLib
- MODULE_UNI_FILE = BaseCryptLib.uni
- FILE_GUID = be3bb803-91b6-4da0-bd91-a8b21c18ca5d
- MODULE_TYPE = DXE_DRIVER
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|DXE_DRIVER DXE_CORE UEFI_APPLICATION UEFI_DRIVER
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 RISCV64 LOONGARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5Null.c ## MS_CHANGE_162948 MSChange - Remove support for deprecated crypto.
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSha512.c
- Hash/CryptSm3.c
- Hash/CryptSha3.c
- Hash/CryptXkcp.c
- Hash/CryptCShake256.c
- Hash/CryptParallelHash.c
- Hash/CryptDispatchApDxe.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcm.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExt.c
- Pk/CryptPkcs1Oaep.c
- Pk/CryptPkcs5Pbkdf2.c
- Pk/CryptPkcs7Sign.c
- Pk/CryptPkcs7VerifyCommon.c
- Pk/CryptPkcs7VerifyBase.c
- Pk/CryptPkcs7VerifyEku.c
- Pk/CryptDh.c
- Pk/CryptX509.c
- Pk/CryptAuthenticode.c
- Pk/CryptTs.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSign.c
- Pk/CryptEc.c
- Pem/CryptPem.c
- Bn/CryptBn.c
-
- SysCall/CrtWrapper.c
- SysCall/TimerWrapper.c
- SysCall/BaseMemAllocation.c
-
-[Sources.Ia32]
- Rand/CryptRandTsc.c
-
-[Sources.X64]
- Rand/CryptRandTsc.c
-
-[Sources.ARM]
- Rand/CryptRand.c
-
-[Sources.AARCH64]
- Rand/CryptRand.c
-
-[Sources.RISCV64]
- Rand/CryptRand.c
-
-[Sources.LOONGARCH64]
- Rand/CryptRand.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- UefiRuntimeServicesTableLib
- DebugLib
- OpensslLib
- IntrinsicLib
- PrintLib
- UefiBootServicesTableLib
- SynchronizationLib
-
-[Protocols]
- gEfiMpServiceProtocolGuid
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- # C4090: 'function' : different 'const' qualifiers
- #
- MSFT:*_*_*_CC_FLAGS = /wd4090
- MSFT:*_*_AARCH64_CC_FLAGS = /U_M_ARM64 /D_M_MS_ARM64 # MU_CHANGE - TCBZ2029
- MSFT:*_*_ARM_CC_FLAGS = /U_M_ARM /D_M_MS_ARM # MU_CHANGE - TCBZ2029
-
- GCC:*_CLANGDWARF_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.uni
deleted file mode 100644
index d9d53d099c..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.uni
+++ /dev/null
@@ -1,17 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for DXE_DRIVER.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for DXE_DRIVER"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow."
diff --git a/CryptoPkg/Library/BaseCryptLib/Bn/CryptBn.c b/CryptoPkg/Library/BaseCryptLib/Bn/CryptBn.c
deleted file mode 100644
index 282926ddcc..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Bn/CryptBn.c
+++ /dev/null
@@ -1,581 +0,0 @@
-/** @file Big number API implementation based on OpenSSL
-
- Copyright (c) 2022, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Allocate new Big Number.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumInit (
- VOID
- )
-{
- return BN_new ();
-}
-
-/**
- Allocate new Big Number and assign the provided value to it.
-
- @param[in] Buf Big endian encoded buffer.
- @param[in] Len Buffer length.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumFromBin (
- IN CONST UINT8 *Buf,
- IN UINTN Len
- )
-{
- return BN_bin2bn (Buf, (INT32)Len, NULL);
-}
-
-/**
- Convert the absolute value of Bn into big-endian form and store it at Buf.
- The Buf array should have at least BigNumBytes() in it.
-
- @param[in] Bn Big number to convert.
- @param[out] Buf Output buffer.
-
- @retval The length of the big-endian number placed at Buf or -1 on error.
-**/
-INTN
-EFIAPI
-BigNumToBin (
- IN CONST VOID *Bn,
- OUT UINT8 *Buf
- )
-{
- return BN_bn2bin (Bn, Buf);
-}
-
-/**
- Free the Big Number.
-
- @param[in] Bn Big number to free.
- @param[in] Clear TRUE if the buffer should be cleared.
-**/
-VOID
-EFIAPI
-BigNumFree (
- IN VOID *Bn,
- IN BOOLEAN Clear
- )
-{
- if (Clear) {
- BN_clear_free (Bn);
- } else {
- BN_free (Bn);
- }
-}
-
-/**
- Calculate the sum of two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA + BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumAdd (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- return (BOOLEAN)BN_add (BnRes, BnA, BnB);
-}
-
-/**
- Subtract two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA - BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSub (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- return (BOOLEAN)BN_sub (BnRes, BnA, BnB);
-}
-
-/**
- Calculate remainder: BnRes = BnA % BnB.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA % BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)BN_mod (BnRes, BnA, BnB, Ctx);
- BN_CTX_free (Ctx);
-
- return RetVal;
-}
-
-/**
- Compute BnA to the BnP-th power modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnP Big number (power).
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result of (BnA ^ BnP) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumExpMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnP,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)BN_mod_exp (BnRes, BnA, BnP, BnM, Ctx);
-
- BN_CTX_free (Ctx);
- return RetVal;
-}
-
-/**
- Compute BnA inverse modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumInverseMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = FALSE;
- if (BN_mod_inverse (BnRes, BnA, BnM, Ctx) != NULL) {
- RetVal = TRUE;
- }
-
- BN_CTX_free (Ctx);
- return RetVal;
-}
-
-/**
- Divide two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result, such that BnA / BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumDiv (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)BN_div (BnRes, NULL, BnA, BnB, Ctx);
- BN_CTX_free (Ctx);
-
- return RetVal;
-}
-
-/**
- Multiply two Big Numbers modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumMulMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)BN_mod_mul (BnRes, BnA, BnB, BnM, Ctx);
- BN_CTX_free (Ctx);
-
- return RetVal;
-}
-
-/**
- Compare two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
-
- @retval 0 BnA == BnB.
- @retval 1 BnA > BnB.
- @retval -1 BnA < BnB.
-**/
-INTN
-EFIAPI
-BigNumCmp (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB
- )
-{
- return BN_cmp (BnA, BnB);
-}
-
-/**
- Get number of bits in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bits.
-**/
-UINTN
-EFIAPI
-BigNumBits (
- IN CONST VOID *Bn
- )
-{
- return BN_num_bits (Bn);
-}
-
-/**
- Get number of bytes in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bytes.
-**/
-UINTN
-EFIAPI
-BigNumBytes (
- IN CONST VOID *Bn
- )
-{
- return BN_num_bytes (Bn);
-}
-
-/**
- Checks if Big Number equals to the given Num.
-
- @param[in] Bn Big number.
- @param[in] Num Number.
-
- @retval TRUE iff Bn == Num.
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumIsWord (
- IN CONST VOID *Bn,
- IN UINTN Num
- )
-{
- return (BOOLEAN)BN_is_word (Bn, Num);
-}
-
-/**
- Checks if Big Number is odd.
-
- @param[in] Bn Big number.
-
- @retval TRUE Bn is odd (Bn % 2 == 1).
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumIsOdd (
- IN CONST VOID *Bn
- )
-{
- return (BOOLEAN)BN_is_odd (Bn);
-}
-
-/**
- Copy Big number.
-
- @param[out] BnDst Destination.
- @param[in] BnSrc Source.
-
- @retval BnDst on success.
- @retval NULL otherwise.
-**/
-VOID *
-EFIAPI
-BigNumCopy (
- OUT VOID *BnDst,
- IN CONST VOID *BnSrc
- )
-{
- return BN_copy (BnDst, BnSrc);
-}
-
-/**
- Get constant Big number with value of "1".
- This may be used to save expensive allocations.
-
- @retval Big Number with value of 1.
-**/
-CONST VOID *
-EFIAPI
-BigNumValueOne (
- VOID
- )
-{
- return BN_value_one ();
-}
-
-/**
- Shift right Big Number.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] Bn Big number.
- @param[in] N Number of bits to shift.
- @param[out] BnRes The result.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumRShift (
- IN CONST VOID *Bn,
- IN UINTN N,
- OUT VOID *BnRes
- )
-{
- return (BOOLEAN)BN_rshift (BnRes, Bn, (INT32)N);
-}
-
-/**
- Mark Big Number for constant time computations.
- This function should be called before any constant time computations are
- performed on the given Big number.
-
- @param[in] Bn Big number
-**/
-VOID
-EFIAPI
-BigNumConstTime (
- IN VOID *Bn
- )
-{
- BN_set_flags (Bn, BN_FLG_CONSTTIME);
-}
-
-/**
- Calculate square modulo.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSqrMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)BN_mod_sqr (BnRes, BnA, BnM, Ctx);
- BN_CTX_free (Ctx);
-
- return RetVal;
-}
-
-/**
- Create new Big Number computation context. This is an opaque structure
- which should be passed to any function that requires it. The BN context is
- needed to optimize calculations and expensive allocations.
-
- @retval Big Number context struct or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumNewContext (
- VOID
- )
-{
- return BN_CTX_new ();
-}
-
-/**
- Free Big Number context that was allocated with BigNumNewContext().
-
- @param[in] BnCtx Big number context to free.
-**/
-VOID
-EFIAPI
-BigNumContextFree (
- IN VOID *BnCtx
- )
-{
- BN_CTX_free (BnCtx);
-}
-
-/**
- Set Big Number to a given value.
-
- @param[in] Bn Big number to set.
- @param[in] Val Value to set.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSetUint (
- IN VOID *Bn,
- IN UINTN Val
- )
-{
- return (BOOLEAN)BN_set_word (Bn, Val);
-}
-
-/**
- Add two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA + BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumAddMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- BOOLEAN RetVal;
- BN_CTX *Ctx;
-
- Ctx = BN_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)BN_mod_add (BnRes, BnA, BnB, BnM, Ctx);
- BN_CTX_free (Ctx);
-
- return RetVal;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Bn/CryptBnNull.c b/CryptoPkg/Library/BaseCryptLib/Bn/CryptBnNull.c
deleted file mode 100644
index 547401fa12..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Bn/CryptBnNull.c
+++ /dev/null
@@ -1,520 +0,0 @@
-/** @file
- Big number API implementation based on OpenSSL
-
- Copyright (c) 2022, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-/**
- Allocate new Big Number.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumInit (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Allocate new Big Number and assign the provided value to it.
-
- @param[in] Buf Big endian encoded buffer.
- @param[in] Len Buffer length.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumFromBin (
- IN CONST UINT8 *Buf,
- IN UINTN Len
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Convert the absolute value of Bn into big-endian form and store it at Buf.
- The Buf array should have at least BigNumBytes() in it.
-
- @param[in] Bn Big number to convert.
- @param[out] Buf Output buffer.
-
- @retval The length of the big-endian number placed at Buf or -1 on error.
-**/
-INTN
-EFIAPI
-BigNumToBin (
- IN CONST VOID *Bn,
- OUT UINT8 *Buf
- )
-{
- ASSERT (FALSE);
- return -1;
-}
-
-/**
- Free the Big Number.
-
- @param[in] Bn Big number to free.
- @param[in] Clear TRUE if the buffer should be cleared.
-**/
-VOID
-EFIAPI
-BigNumFree (
- IN VOID *Bn,
- IN BOOLEAN Clear
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Calculate the sum of two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA + BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumAdd (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Subtract two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA - BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSub (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Calculate remainder: BnRes = BnA % BnB.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA % BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compute BnA to the BnP-th power modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnP Big number (power).
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result of (BnA ^ BnP) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumExpMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnP,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compute BnA inverse modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumInverseMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Divide two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result, such that BnA / BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumDiv (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Multiply two Big Numbers modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumMulMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compare two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
-
- @retval 0 BnA == BnB.
- @retval 1 BnA > BnB.
- @retval -1 BnA < BnB.
-**/
-INTN
-EFIAPI
-BigNumCmp (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Get number of bits in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bits.
-**/
-UINTN
-EFIAPI
-BigNumBits (
- IN CONST VOID *Bn
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Get number of bytes in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bytes.
-**/
-UINTN
-EFIAPI
-BigNumBytes (
- IN CONST VOID *Bn
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Checks if Big Number equals to the given Num.
-
- @param[in] Bn Big number.
- @param[in] Num Number.
-
- @retval TRUE iff Bn == Num.
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumIsWord (
- IN CONST VOID *Bn,
- IN UINTN Num
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Checks if Big Number is odd.
-
- @param[in] Bn Big number.
-
- @retval TRUE Bn is odd (Bn % 2 == 1).
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumIsOdd (
- IN CONST VOID *Bn
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Copy Big number.
-
- @param[out] BnDst Destination.
- @param[in] BnSrc Source.
-
- @retval BnDst on success.
- @retval NULL otherwise.
-**/
-VOID *
-EFIAPI
-BigNumCopy (
- OUT VOID *BnDst,
- IN CONST VOID *BnSrc
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Get constant Big number with value of "1".
- This may be used to save expensive allocations.
-
- @retval Big Number with value of 1.
-**/
-CONST VOID *
-EFIAPI
-BigNumValueOne (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Shift right Big Number.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] Bn Big number.
- @param[in] N Number of bits to shift.
- @param[out] BnRes The result.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumRShift (
- IN CONST VOID *Bn,
- IN UINTN N,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Mark Big Number for constant time computations.
- This function should be called before any constant time computations are
- performed on the given Big number.
-
- @param[in] Bn Big number
-**/
-VOID
-EFIAPI
-BigNumConstTime (
- IN VOID *Bn
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Calculate square modulo.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSqrMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Create new Big Number computation context. This is an opaque structure
- which should be passed to any function that requires it. The BN context is
- needed to optimize calculations and expensive allocations.
-
- @retval Big Number context struct or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumNewContext (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Free Big Number context that was allocated with BigNumNewContext().
-
- @param[in] BnCtx Big number context to free.
-**/
-VOID
-EFIAPI
-BigNumContextFree (
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Set Big Number to a given value.
-
- @param[in] Bn Big number to set.
- @param[in] Val Value to set.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSetUint (
- IN VOID *Bn,
- IN UINTN Val
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Add two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA + BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumAddMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAeadAesGcm.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAeadAesGcm.c
deleted file mode 100644
index b4c93d47a9..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAeadAesGcm.c
+++ /dev/null
@@ -1,279 +0,0 @@
-/** @file
- AEAD (AES-GCM) Wrapper Implementation over OpenSSL.
-
- RFC 5116 - An Interface and Algorithms for Authenticated Encryption
- NIST SP800-38d - Cipher Modes of Operation: Galois / Counter Mode(GCM) and GMAC
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-
-/**
- Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be encrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the encryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AeadAesGcmEncrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- OUT UINT8 *TagOut,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- EVP_CIPHER_CTX *Ctx;
- CONST EVP_CIPHER *Cipher;
- UINTN TempOutSize;
- BOOLEAN RetValue;
-
- if (DataInSize > INT_MAX) {
- return FALSE;
- }
-
- if (ADataSize > INT_MAX) {
- return FALSE;
- }
-
- if (IvSize != 12) {
- return FALSE;
- }
-
- switch (KeySize) {
- case 16:
- Cipher = EVP_aes_128_gcm ();
- break;
- case 24:
- Cipher = EVP_aes_192_gcm ();
- break;
- case 32:
- Cipher = EVP_aes_256_gcm ();
- break;
- default:
- return FALSE;
- }
-
- if ((TagSize != 12) && (TagSize != 13) && (TagSize != 14) && (TagSize != 15) && (TagSize != 16)) {
- return FALSE;
- }
-
- if (DataOutSize != NULL) {
- if ((*DataOutSize > INT_MAX) || (*DataOutSize < DataInSize)) {
- return FALSE;
- }
- }
-
- Ctx = EVP_CIPHER_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetValue = (BOOLEAN)EVP_EncryptInit_ex (Ctx, Cipher, NULL, NULL, NULL);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_CIPHER_CTX_ctrl (Ctx, EVP_CTRL_GCM_SET_IVLEN, (INT32)IvSize, NULL);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_EncryptInit_ex (Ctx, NULL, NULL, Key, Iv);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_EncryptUpdate (Ctx, NULL, (INT32 *)&TempOutSize, AData, (INT32)ADataSize);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_EncryptUpdate (Ctx, DataOut, (INT32 *)&TempOutSize, DataIn, (INT32)DataInSize);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_EncryptFinal_ex (Ctx, DataOut, (INT32 *)&TempOutSize);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_CIPHER_CTX_ctrl (Ctx, EVP_CTRL_GCM_GET_TAG, (INT32)TagSize, (VOID *)TagOut);
-
-Done:
- EVP_CIPHER_CTX_free (Ctx);
- if (!RetValue) {
- return RetValue;
- }
-
- if (DataOutSize != NULL) {
- *DataOutSize = DataInSize;
- }
-
- return RetValue;
-}
-
-/**
- Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
- If additional authenticated data verification fails, FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be decrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[in] Tag Pointer to a buffer that contains the authentication tag.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the decryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated decryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AeadAesGcmDecrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- IN CONST UINT8 *Tag,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- EVP_CIPHER_CTX *Ctx;
- CONST EVP_CIPHER *Cipher;
- UINTN TempOutSize;
- BOOLEAN RetValue;
-
- if (DataInSize > INT_MAX) {
- return FALSE;
- }
-
- if (ADataSize > INT_MAX) {
- return FALSE;
- }
-
- if (IvSize != 12) {
- return FALSE;
- }
-
- switch (KeySize) {
- case 16:
- Cipher = EVP_aes_128_gcm ();
- break;
- case 24:
- Cipher = EVP_aes_192_gcm ();
- break;
- case 32:
- Cipher = EVP_aes_256_gcm ();
- break;
- default:
- return FALSE;
- }
-
- if ((TagSize != 12) && (TagSize != 13) && (TagSize != 14) && (TagSize != 15) && (TagSize != 16)) {
- return FALSE;
- }
-
- if (DataOutSize != NULL) {
- if ((*DataOutSize > INT_MAX) || (*DataOutSize < DataInSize)) {
- return FALSE;
- }
- }
-
- Ctx = EVP_CIPHER_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetValue = (BOOLEAN)EVP_DecryptInit_ex (Ctx, Cipher, NULL, NULL, NULL);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_CIPHER_CTX_ctrl (Ctx, EVP_CTRL_GCM_SET_IVLEN, (INT32)IvSize, NULL);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_DecryptInit_ex (Ctx, NULL, NULL, Key, Iv);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_DecryptUpdate (Ctx, NULL, (INT32 *)&TempOutSize, AData, (INT32)ADataSize);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_DecryptUpdate (Ctx, DataOut, (INT32 *)&TempOutSize, DataIn, (INT32)DataInSize);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_CIPHER_CTX_ctrl (Ctx, EVP_CTRL_GCM_SET_TAG, (INT32)TagSize, (VOID *)Tag);
- if (!RetValue) {
- goto Done;
- }
-
- RetValue = (BOOLEAN)EVP_DecryptFinal_ex (Ctx, DataOut, (INT32 *)&TempOutSize);
-
-Done:
- EVP_CIPHER_CTX_free (Ctx);
- if (!RetValue) {
- return RetValue;
- }
-
- if (DataOutSize != NULL) {
- *DataOutSize = DataInSize;
- }
-
- return RetValue;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAeadAesGcmNull.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAeadAesGcmNull.c
deleted file mode 100644
index b9f9d16ff9..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAeadAesGcmNull.c
+++ /dev/null
@@ -1,100 +0,0 @@
-/** @file
- AEAD Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be encrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the encryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AeadAesGcmEncrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- OUT UINT8 *TagOut,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
- If additional authenticated data verification fails, FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be decrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[in] Tag Pointer to a buffer that contains the authentication tag.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the decryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated decryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AeadAesGcmDecrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- IN CONST UINT8 *Tag,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
deleted file mode 100644
index 587885e33d..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
+++ /dev/null
@@ -1,205 +0,0 @@
-/** @file
- AES Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- @return The size, in bytes, of the context buffer required for AES operations.
-
-**/
-UINTN
-EFIAPI
-AesGetContextSize (
- VOID
- )
-{
- //
- // AES uses different key contexts for encryption and decryption, so here memory
- // for 2 copies of AES_KEY is allocated.
- //
- return (UINTN)(2 * sizeof (AES_KEY));
-}
-
-/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- This function initializes user-supplied memory pointed by AesContext as AES context.
- In addition, it sets up all AES key materials for subsequent encryption and decryption
- operations.
- There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
-
- If AesContext is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeyLength is not valid, then return FALSE.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval TRUE AES context initialization succeeded.
- @retval FALSE AES context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-AesInit (
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
- )
-{
- AES_KEY *AesKey;
-
- //
- // Check input parameters.
- //
- if ((AesContext == NULL) || (Key == NULL) || ((KeyLength != 128) && (KeyLength != 192) && (KeyLength != 256))) {
- return FALSE;
- }
-
- //
- // Initialize AES encryption & decryption key schedule.
- //
- AesKey = (AES_KEY *)AesContext;
- if (AES_set_encrypt_key (Key, (UINT32)KeyLength, AesKey) != 0) {
- return FALSE;
- }
-
- if (AES_set_decrypt_key (Key, (UINT32)KeyLength, AesKey + 1) != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES encryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES encryption succeeded.
- @retval FALSE AES encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- AES_KEY *AesKey;
- UINT8 IvecBuffer[AES_BLOCK_SIZE];
-
- //
- // Check input parameters.
- //
- if ((AesContext == NULL) || (Input == NULL) || ((InputSize % AES_BLOCK_SIZE) != 0)) {
- return FALSE;
- }
-
- if ((Ivec == NULL) || (Output == NULL) || (InputSize > INT_MAX)) {
- return FALSE;
- }
-
- AesKey = (AES_KEY *)AesContext;
- CopyMem (IvecBuffer, Ivec, AES_BLOCK_SIZE);
-
- //
- // Perform AES data encryption with CBC mode
- //
- AES_cbc_encrypt (Input, Output, (UINT32)InputSize, AesKey, IvecBuffer, AES_ENCRYPT);
-
- return TRUE;
-}
-
-/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES decryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES decryption succeeded.
- @retval FALSE AES decryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- AES_KEY *AesKey;
- UINT8 IvecBuffer[AES_BLOCK_SIZE];
-
- //
- // Check input parameters.
- //
- if ((AesContext == NULL) || (Input == NULL) || ((InputSize % AES_BLOCK_SIZE) != 0)) {
- return FALSE;
- }
-
- if ((Ivec == NULL) || (Output == NULL) || (InputSize > INT_MAX)) {
- return FALSE;
- }
-
- AesKey = (AES_KEY *)AesContext;
- CopyMem (IvecBuffer, Ivec, AES_BLOCK_SIZE);
-
- //
- // Perform AES data decryption with CBC mode
- //
- AES_cbc_encrypt (Input, Output, (UINT32)InputSize, AesKey + 1, IvecBuffer, AES_DECRYPT);
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c
deleted file mode 100644
index d235422e7a..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c
+++ /dev/null
@@ -1,107 +0,0 @@
-/** @file
- AES Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- Return zero to indicate this interface is not supported.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-AesGetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesInit (
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptCShake256.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptCShake256.c
deleted file mode 100644
index 2a9eaf9eec..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptCShake256.c
+++ /dev/null
@@ -1,282 +0,0 @@
-/** @file
- cSHAKE-256 Digest Wrapper Implementations.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "CryptParallelHash.h"
-
-#define CSHAKE256_SECURITY_STRENGTH 256
-#define CSHAKE256_RATE_IN_BYTES 136
-
-CONST CHAR8 mZeroPadding[CSHAKE256_RATE_IN_BYTES] = { 0 };
-
-/**
- CShake256 initial function.
-
- Initializes user-supplied memory pointed by CShake256Context as cSHAKE-256 hash context for
- subsequent use.
-
- @param[out] CShake256Context Pointer to cSHAKE-256 context being initialized.
- @param[in] OutputLen The desired number of output length in bytes.
- @param[in] Name Pointer to the function name string.
- @param[in] NameLen The length of the function name in bytes.
- @param[in] Customization Pointer to the customization string.
- @param[in] CustomizationLen The length of the customization string in bytes.
-
- @retval TRUE cSHAKE-256 context initialization succeeded.
- @retval FALSE cSHAKE-256 context initialization failed.
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-CShake256Init (
- OUT VOID *CShake256Context,
- IN UINTN OutputLen,
- IN CONST VOID *Name,
- IN UINTN NameLen,
- IN CONST VOID *Customization,
- IN UINTN CustomizationLen
- )
-{
- BOOLEAN Status;
- UINT8 EncBuf[sizeof (UINTN) + 1];
- UINTN EncLen;
- UINTN AbsorbLen;
- UINTN PadLen;
-
- //
- // Check input parameters.
- //
- if ((CShake256Context == NULL) || (OutputLen == 0) || ((NameLen != 0) && (Name == NULL)) || ((CustomizationLen != 0) && (Customization == NULL))) {
- return FALSE;
- }
-
- //
- // Initialize KECCAK context with pad value and block size.
- //
- if ((NameLen == 0) && (CustomizationLen == 0)) {
- //
- // When N and S are both empty strings, cSHAKE(X, L, N, S) is equivalent to
- // SHAKE as defined in FIPS 202.
- //
- Status = (BOOLEAN)KeccakInit (
- (Keccak1600_Ctx *)CShake256Context,
- '\x1f',
- (KECCAK1600_WIDTH - CSHAKE256_SECURITY_STRENGTH * 2) / 8,
- OutputLen
- );
-
- return Status;
- } else {
- Status = (BOOLEAN)KeccakInit (
- (Keccak1600_Ctx *)CShake256Context,
- '\x04',
- (KECCAK1600_WIDTH - CSHAKE256_SECURITY_STRENGTH * 2) / 8,
- OutputLen
- );
- if (!Status) {
- return FALSE;
- }
-
- AbsorbLen = 0;
- //
- // Absorb Absorb bytepad(.., rate).
- //
- EncLen = LeftEncode (EncBuf, CSHAKE256_RATE_IN_BYTES);
- Status = (BOOLEAN)Sha3Update ((Keccak1600_Ctx *)CShake256Context, EncBuf, EncLen);
- if (!Status) {
- return FALSE;
- }
-
- AbsorbLen += EncLen;
-
- //
- // Absorb encode_string(N).
- //
- EncLen = LeftEncode (EncBuf, NameLen * 8);
- Status = (BOOLEAN)Sha3Update ((Keccak1600_Ctx *)CShake256Context, EncBuf, EncLen);
- if (!Status) {
- return FALSE;
- }
-
- AbsorbLen += EncLen;
- Status = (BOOLEAN)Sha3Update ((Keccak1600_Ctx *)CShake256Context, Name, NameLen);
- if (!Status) {
- return FALSE;
- }
-
- AbsorbLen += NameLen;
-
- //
- // Absorb encode_string(S).
- //
- EncLen = LeftEncode (EncBuf, CustomizationLen * 8);
- Status = (BOOLEAN)Sha3Update ((Keccak1600_Ctx *)CShake256Context, EncBuf, EncLen);
- if (!Status) {
- return FALSE;
- }
-
- AbsorbLen += EncLen;
- Status = (BOOLEAN)Sha3Update ((Keccak1600_Ctx *)CShake256Context, Customization, CustomizationLen);
- if (!Status) {
- return FALSE;
- }
-
- AbsorbLen += CustomizationLen;
-
- //
- // Absorb zero padding up to rate.
- //
- PadLen = CSHAKE256_RATE_IN_BYTES - AbsorbLen % CSHAKE256_RATE_IN_BYTES;
- Status = (BOOLEAN)Sha3Update ((Keccak1600_Ctx *)CShake256Context, mZeroPadding, PadLen);
- if (!Status) {
- return FALSE;
- }
-
- return TRUE;
- }
-}
-
-/**
- Digests the input data and updates cSHAKE-256 context.
-
- This function performs cSHAKE-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- cSHAKE-256 context should be already correctly initialized by CShake256Init(), and should not be finalized
- by CShake256Final(). Behavior with invalid context is undefined.
-
- @param[in, out] CShake256Context Pointer to the cSHAKE-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE cSHAKE-256 data digest succeeded.
- @retval FALSE cSHAKE-256 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CShake256Update (
- IN OUT VOID *CShake256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (CShake256Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL.
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- return (BOOLEAN)(Sha3Update ((Keccak1600_Ctx *)CShake256Context, Data, DataSize));
-}
-
-/**
- Completes computation of the cSHAKE-256 digest value.
-
- This function completes cSHAKE-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the cSHAKE-256 context cannot
- be used again.
- cSHAKE-256 context should be already correctly initialized by CShake256Init(), and should not be
- finalized by CShake256Final(). Behavior with invalid cSHAKE-256 context is undefined.
-
- @param[in, out] CShake256Context Pointer to the cSHAKE-256 context.
- @param[out] HashValue Pointer to a buffer that receives the cSHAKE-256 digest
- value.
-
- @retval TRUE cSHAKE-256 digest computation succeeded.
- @retval FALSE cSHAKE-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CShake256Final (
- IN OUT VOID *CShake256Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((CShake256Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // cSHAKE-256 Hash Finalization.
- //
- return (BOOLEAN)(Sha3Final ((Keccak1600_Ctx *)CShake256Context, HashValue));
-}
-
-/**
- Computes the CSHAKE-256 message digest of a input data buffer.
-
- This function performs the CSHAKE-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] OutputLen Size of output in bytes.
- @param[in] Name Pointer to the function name string.
- @param[in] NameLen Size of the function name in bytes.
- @param[in] Customization Pointer to the customization string.
- @param[in] CustomizationLen Size of the customization string in bytes.
- @param[out] HashValue Pointer to a buffer that receives the CSHAKE-256 digest
- value.
-
- @retval TRUE CSHAKE-256 digest computation succeeded.
- @retval FALSE CSHAKE-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CShake256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN UINTN OutputLen,
- IN CONST VOID *Name,
- IN UINTN NameLen,
- IN CONST VOID *Customization,
- IN UINTN CustomizationLen,
- OUT UINT8 *HashValue
- )
-{
- BOOLEAN Status;
- Keccak1600_Ctx Ctx;
-
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Status = CShake256Init (&Ctx, OutputLen, Name, NameLen, Customization, CustomizationLen);
- if (!Status) {
- return FALSE;
- }
-
- Status = CShake256Update (&Ctx, Data, DataSize);
- if (!Status) {
- return FALSE;
- }
-
- return CShake256Final (&Ctx, HashValue);
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApDxe.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApDxe.c
deleted file mode 100644
index 607aa7cd48..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApDxe.c
+++ /dev/null
@@ -1,49 +0,0 @@
-/** @file
- Dispatch Block to Aps in Dxe phase for parallelhash algorithm.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "CryptParallelHash.h"
-#include
-#include
-
-/**
- Dispatch the block task to each AP in PEI phase.
-
-**/
-VOID
-EFIAPI
-DispatchBlockToAp (
- VOID
- )
-{
- EFI_STATUS Status;
- EFI_MP_SERVICES_PROTOCOL *MpServices;
-
- Status = gBS->LocateProtocol (
- &gEfiMpServiceProtocolGuid,
- NULL,
- (VOID **)&MpServices
- );
- if (EFI_ERROR (Status)) {
- //
- // Failed to locate MpServices Protocol, do parallel hash by one core.
- //
- DEBUG ((DEBUG_ERROR, "[DispatchBlockToApDxe] Failed to locate MpServices Protocol. Status = %r\n", Status));
- return;
- }
-
- Status = MpServices->StartupAllAPs (
- MpServices,
- ParallelHashApExecute,
- FALSE,
- NULL,
- 0,
- NULL,
- NULL
- );
- return;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApMm.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApMm.c
deleted file mode 100644
index 0237fb38bc..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApMm.c
+++ /dev/null
@@ -1,35 +0,0 @@
-/** @file
- Dispatch the block task to each AP in Smm mode for parallelhash algorithm.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "CryptParallelHash.h"
-#include
-
-/**
- Dispatch the block task to each AP in SMM mode.
-
-**/
-VOID
-EFIAPI
-DispatchBlockToAp (
- VOID
- )
-{
- UINTN Index;
-
- if (gMmst == NULL) {
- return;
- }
-
- for (Index = 0; Index < gMmst->NumberOfCpus; Index++) {
- if (Index != gMmst->CurrentlyExecutingCpu) {
- gMmst->MmStartupThisAp (ParallelHashApExecute, Index, NULL);
- }
- }
-
- return;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApPei.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApPei.c
deleted file mode 100644
index 9ddd23d320..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptDispatchApPei.c
+++ /dev/null
@@ -1,54 +0,0 @@
-/** @file
- Dispatch Block to Aps in Pei phase for parallelhash algorithm.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "CryptParallelHash.h"
-#include
-#include
-#include
-#include
-
-/**
- Dispatch the block task to each AP in PEI phase.
-
-**/
-VOID
-EFIAPI
-DispatchBlockToAp (
- VOID
- )
-{
- EFI_STATUS Status;
- CONST EFI_PEI_SERVICES **PeiServices;
- EFI_PEI_MP_SERVICES_PPI *MpServicesPpi;
-
- PeiServices = GetPeiServicesTablePointer ();
- Status = (*PeiServices)->LocatePpi (
- PeiServices,
- &gEfiPeiMpServicesPpiGuid,
- 0,
- NULL,
- (VOID **)&MpServicesPpi
- );
- if (EFI_ERROR (Status)) {
- //
- // Failed to locate MpServices Ppi, do parallel hash by one core.
- //
- DEBUG ((DEBUG_ERROR, "[DispatchBlockToApPei] Failed to locate MpServices Ppi. Status = %r\n", Status));
- return;
- }
-
- Status = MpServicesPpi->StartupAllAPs (
- (CONST EFI_PEI_SERVICES **)PeiServices,
- MpServicesPpi,
- ParallelHashApExecute,
- FALSE,
- 0,
- NULL
- );
- return;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c
deleted file mode 100644
index f749c7f6e3..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c
+++ /dev/null
@@ -1,228 +0,0 @@
-/** @file
- MD5 Digest Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-#ifdef ENABLE_MD5_DEPRECATED_INTERFACES
-
-/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
-
-**/
-UINTN
-EFIAPI
-Md5GetContextSize (
- VOID
- )
-{
- //
- // Retrieves the OpenSSL MD5 Context Size
- //
- return (UINTN)(sizeof (MD5_CTX));
-}
-
-/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Init (
- OUT VOID *Md5Context
- )
-{
- //
- // Check input parameters.
- //
- if (Md5Context == NULL) {
- return FALSE;
- }
-
- //
- // OpenSSL MD5 Context Initialization
- //
- return (BOOLEAN)(MD5_Init ((MD5_CTX *)Md5Context));
-}
-
-/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
- )
-{
- //
- // Check input parameters.
- //
- if ((Md5Context == NULL) || (NewMd5Context == NULL)) {
- return FALSE;
- }
-
- CopyMem (NewMd5Context, Md5Context, sizeof (MD5_CTX));
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly initialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Update (
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (Md5Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL MD5 Hash Update
- //
- return (BOOLEAN)(MD5_Update ((MD5_CTX *)Md5Context, Data, DataSize));
-}
-
-/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly initialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((Md5Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // OpenSSL MD5 Hash Finalization
- //
- return (BOOLEAN)(MD5_Final (HashValue, (MD5_CTX *)Md5Context));
-}
-
-/**
- Computes the MD5 message digest of a input data buffer.
-
- This function performs the MD5 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Md5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL MD5 Hash Computation.
- //
- if (MD5 (Data, DataSize, HashValue) == NULL) {
- return FALSE;
- } else {
- return TRUE;
- }
-}
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5Null.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5Null.c
deleted file mode 100644
index 45fd385222..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5Null.c
+++ /dev/null
@@ -1,165 +0,0 @@
-/** @file -- CryptMd5Null.c
-MS_CHANGE_162948
-MSChange [ALL] - Deprecated version of CryptMd5.c
-
-MD5 Digest Wrapper Implementation over OpenSSL.
-
-Copyright (c) Microsoft Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
-
-**/
-UINTN
-EFIAPI
-Md5GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Init (
- OUT VOID *Md5Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly intialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Update (
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly intialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
-Computes the MD5 message digest of a input data buffer.
-
-This function performs the MD5 message digest of a given data buffer, and places
-the digest value into the specified memory.
-
-If this interface is not supported, then return FALSE.
-
-@param[in] Data Pointer to the buffer containing the data to be hashed.
-@param[in] DataSize Size of Data buffer in bytes.
-@param[out] HashValue Pointer to a buffer that receives the MD5 digest
-value (16 bytes).
-
-@retval TRUE MD5 digest computation succeeded.
-@retval FALSE MD5 digest computation failed.
-@retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Md5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHash.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHash.c
deleted file mode 100644
index 2931123736..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHash.c
+++ /dev/null
@@ -1,254 +0,0 @@
-/** @file
- ParallelHash Implementation.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "CryptParallelHash.h"
-#include
-
-#define PARALLELHASH_CUSTOMIZATION "ParallelHash"
-
-UINTN mBlockNum;
-UINTN mBlockSize;
-UINTN mLastBlockSize;
-UINT8 *mInput;
-UINTN mBlockResultSize;
-UINT8 *mBlockHashResult;
-BOOLEAN *mBlockIsCompleted;
-SPIN_LOCK *mSpinLockList;
-
-/**
- Complete computation of digest of each block.
-
- Each AP perform the function called by BSP.
-
- @param[in] ProcedureArgument Argument of the procedure.
-**/
-VOID
-EFIAPI
-ParallelHashApExecute (
- IN VOID *ProcedureArgument
- )
-{
- UINTN Index;
- BOOLEAN Status;
-
- for (Index = 0; Index < mBlockNum; Index++) {
- if (AcquireSpinLockOrFail (&mSpinLockList[Index])) {
- //
- // Completed, try next one.
- //
- if (mBlockIsCompleted[Index]) {
- ReleaseSpinLock (&mSpinLockList[Index]);
- continue;
- }
-
- //
- // Calculate CShake256 for this block.
- //
- Status = CShake256HashAll (
- mInput + Index * mBlockSize,
- (Index == (mBlockNum - 1)) ? mLastBlockSize : mBlockSize,
- mBlockResultSize,
- NULL,
- 0,
- NULL,
- 0,
- mBlockHashResult + Index * mBlockResultSize
- );
- if (!EFI_ERROR (Status)) {
- mBlockIsCompleted[Index] = TRUE;
- }
-
- ReleaseSpinLock (&mSpinLockList[Index]);
- }
- }
-}
-
-/**
- Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
- published December 2016.
-
- @param[in] Input Pointer to the input message (X).
- @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
- @param[in] BlockSize The size of each block (B).
- @param[out] Output Pointer to the output buffer.
- @param[in] OutputByteLen The desired number of output bytes (L).
- @param[in] Customization Pointer to the customization string (S).
- @param[in] CustomByteLen The length of the customization string in bytes.
-
- @retval TRUE ParallelHash256 digest computation succeeded.
- @retval FALSE ParallelHash256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-ParallelHash256HashAll (
- IN CONST VOID *Input,
- IN UINTN InputByteLen,
- IN UINTN BlockSize,
- OUT VOID *Output,
- IN UINTN OutputByteLen,
- IN CONST VOID *Customization,
- IN UINTN CustomByteLen
- )
-{
- UINT8 EncBufB[sizeof (UINTN)+1];
- UINTN EncSizeB;
- UINT8 EncBufN[sizeof (UINTN)+1];
- UINTN EncSizeN;
- UINT8 EncBufL[sizeof (UINTN)+1];
- UINTN EncSizeL;
- UINTN Index;
- UINT8 *CombinedInput;
- UINTN CombinedInputSize;
- BOOLEAN AllCompleted;
- UINTN Offset;
- BOOLEAN ReturnValue;
-
- if ((InputByteLen == 0) || (OutputByteLen == 0) || (BlockSize == 0)) {
- return FALSE;
- }
-
- if ((Input == NULL) || (Output == NULL)) {
- return FALSE;
- }
-
- if ((CustomByteLen != 0) && (Customization == NULL)) {
- return FALSE;
- }
-
- mBlockSize = BlockSize;
-
- //
- // Calculate block number n.
- //
- mBlockNum = InputByteLen % mBlockSize == 0 ? InputByteLen / mBlockSize : InputByteLen / mBlockSize + 1;
-
- //
- // Set hash result size of each block in bytes.
- //
- mBlockResultSize = OutputByteLen;
-
- //
- // Encode B, n, L to string and record size.
- //
- EncSizeB = LeftEncode (EncBufB, mBlockSize);
- EncSizeN = RightEncode (EncBufN, mBlockNum);
- EncSizeL = RightEncode (EncBufL, OutputByteLen * CHAR_BIT);
-
- //
- // Allocate buffer for combined input (newX), Block completed flag and SpinLock.
- //
- CombinedInputSize = EncSizeB + EncSizeN + EncSizeL + mBlockNum * mBlockResultSize;
- CombinedInput = AllocateZeroPool (CombinedInputSize);
- mBlockIsCompleted = AllocateZeroPool (mBlockNum * sizeof (BOOLEAN));
- mSpinLockList = AllocatePool (mBlockNum * sizeof (SPIN_LOCK));
- if ((CombinedInput == NULL) || (mBlockIsCompleted == NULL) || (mSpinLockList == NULL)) {
- ReturnValue = FALSE;
- goto Exit;
- }
-
- //
- // Fill LeftEncode(B).
- //
- CopyMem (CombinedInput, EncBufB, EncSizeB);
-
- //
- // Prepare for parallel hash.
- //
- mBlockHashResult = CombinedInput + EncSizeB;
- mInput = (UINT8 *)Input;
- mLastBlockSize = InputByteLen % mBlockSize == 0 ? mBlockSize : InputByteLen % mBlockSize;
-
- //
- // Initialize SpinLock for each result block.
- //
- for (Index = 0; Index < mBlockNum; Index++) {
- InitializeSpinLock (&mSpinLockList[Index]);
- }
-
- //
- // Dispatch blocklist to each AP.
- //
- DispatchBlockToAp ();
-
- //
- // Wait until all block hash completed.
- //
- do {
- AllCompleted = TRUE;
- for (Index = 0; Index < mBlockNum; Index++) {
- if (AcquireSpinLockOrFail (&mSpinLockList[Index])) {
- if (!mBlockIsCompleted[Index]) {
- AllCompleted = FALSE;
- ReturnValue = CShake256HashAll (
- mInput + Index * mBlockSize,
- (Index == (mBlockNum - 1)) ? mLastBlockSize : mBlockSize,
- mBlockResultSize,
- NULL,
- 0,
- NULL,
- 0,
- mBlockHashResult + Index * mBlockResultSize
- );
- if (ReturnValue) {
- mBlockIsCompleted[Index] = TRUE;
- }
-
- ReleaseSpinLock (&mSpinLockList[Index]);
- break;
- }
-
- ReleaseSpinLock (&mSpinLockList[Index]);
- } else {
- AllCompleted = FALSE;
- break;
- }
- }
- } while (!AllCompleted);
-
- //
- // Fill LeftEncode(n).
- //
- Offset = EncSizeB + mBlockNum * mBlockResultSize;
- CopyMem (CombinedInput + Offset, EncBufN, EncSizeN);
-
- //
- // Fill LeftEncode(L).
- //
- Offset += EncSizeN;
- CopyMem (CombinedInput + Offset, EncBufL, EncSizeL);
-
- ReturnValue = CShake256HashAll (
- CombinedInput,
- CombinedInputSize,
- OutputByteLen,
- PARALLELHASH_CUSTOMIZATION,
- AsciiStrLen (PARALLELHASH_CUSTOMIZATION),
- Customization,
- CustomByteLen,
- Output
- );
-
-Exit:
- ZeroMem (CombinedInput, CombinedInputSize);
-
- if (CombinedInput != NULL) {
- FreePool (CombinedInput);
- }
-
- if (mSpinLockList != NULL) {
- FreePool ((VOID *)mSpinLockList);
- }
-
- if (mBlockIsCompleted != NULL) {
- FreePool (mBlockIsCompleted);
- }
-
- return ReturnValue;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHash.h b/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHash.h
deleted file mode 100644
index 03a1a58cb8..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHash.h
+++ /dev/null
@@ -1,226 +0,0 @@
-/** @file
- ParallelHash related function and type declaration.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
-Licensed under the OpenSSL license (the "License"). You may not use
-this file except in compliance with the License. You can obtain a copy
-in the file LICENSE in the source distribution or at
-https://www.openssl.org/source/license.html
-
-Copyright 2022 The eXtended Keccak Code Package (XKCP)
-https://github.com/XKCP/XKCP
-Keccak, designed by Guido Bertoni, Joan Daemen, Michael Peeters and Gilles Van Assche.
-Implementation by the designers, hereby denoted as "the implementer".
-For more information, feedback or questions, please refer to the Keccak Team website:
-https://keccak.team/
-To the extent possible under law, the implementer has waived all copyright
-and related or neighboring rights to the source code in this file.
-http://creativecommons.org/publicdomain/zero/1.0/
-**/
-
-#include "InternalCryptLib.h"
-
-#define KECCAK1600_WIDTH 1600
-
-typedef UINT64 uint64_t;
-
-//
-// This struct referring to m_sha3.c from opessl and modified its type name.
-//
-typedef struct {
- uint64_t A[5][5];
- size_t block_size; /* cached ctx->digest->block_size */
- size_t md_size; /* output length, variable in XOF */
- size_t num; /* used bytes in below buffer */
- unsigned char buf[KECCAK1600_WIDTH / 8 - 32];
- unsigned char pad;
-} Keccak1600_Ctx;
-
-/**
- SHA3_absorb can be called multiple times, but at each invocation
- largest multiple of |r| out of |len| bytes are processed. Then
- remaining amount of bytes is returned. This is done to spare caller
- trouble of calculating the largest multiple of |r|. |r| can be viewed
- as blocksize. It is commonly (1600 - 256*n)/8, e.g. 168, 136, 104,
- 72, but can also be (1600 - 448)/8 = 144. All this means that message
- padding and intermediate sub-block buffering, byte- or bitwise, is
- caller's responsibility.
-**/
-size_t
-SHA3_absorb (
- uint64_t A[5][5],
- const unsigned char *inp,
- size_t len,
- size_t r
- );
-
-/**
- SHA3_squeeze is called once at the end to generate |out| hash value
- of |len| bytes.
-**/
-void
-SHA3_squeeze (
- uint64_t A[5][5],
- unsigned char *out,
- size_t len,
- size_t r
- );
-
-/**
- Encode function from XKCP.
-
- Encodes the input as a byte string in a way that can be unambiguously parsed
- from the beginning of the string by inserting the length of the byte string
- before the byte string representation of input.
-
- @param[out] EncBuf Result of left encode.
- @param[in] Value Input of left encode.
-
- @retval EncLen Size of encode result in bytes.
-**/
-UINTN
-EFIAPI
-LeftEncode (
- OUT UINT8 *EncBuf,
- IN UINTN Value
- );
-
-/**
- Encode function from XKCP.
-
- Encodes the input as a byte string in a way that can be unambiguously parsed
- from the end of the string by inserting the length of the byte string after
- the byte string representation of input.
-
- @param[out] EncBuf Result of right encode.
- @param[in] Value Input of right encode.
-
- @retval EncLen Size of encode result in bytes.
-**/
-UINTN
-EFIAPI
-RightEncode (
- OUT UINT8 *EncBuf,
- IN UINTN Value
- );
-
-/**
- Keccak initial fuction.
-
- Set up state with specified capacity.
-
- @param[out] Context Pointer to the context being initialized.
- @param[in] Pad Delimited Suffix.
- @param[in] BlockSize Size of context block.
- @param[in] MessageDigestLen Size of message digest in bytes.
-
- @retval 1 Initialize successfully.
- @retval 0 Fail to initialize.
-**/
-UINT8
-EFIAPI
-KeccakInit (
- OUT Keccak1600_Ctx *Context,
- IN UINT8 Pad,
- IN UINTN BlockSize,
- IN UINTN MessageDigstLen
- );
-
-/**
- Sha3 update fuction.
-
- This function performs Sha3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
-
- @param[in,out] Context Pointer to the Keccak context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval 1 Update successfully.
-**/
-UINT8
-EFIAPI
-Sha3Update (
- IN OUT Keccak1600_Ctx *Context,
- IN const VOID *Data,
- IN UINTN DataSize
- );
-
-/**
- Completes computation of Sha3 message digest.
-
- This function completes sha3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the keccak context cannot
- be used again.
-
- @param[in, out] Context Pointer to the keccak context.
- @param[out] MessageDigest Pointer to a buffer that receives the message digest.
-
- @retval 1 Meaasge digest computation succeeded.
-**/
-UINT8
-EFIAPI
-Sha3Final (
- IN OUT Keccak1600_Ctx *Context,
- OUT UINT8 *MessageDigest
- );
-
-/**
- Computes the CSHAKE-256 message digest of a input data buffer.
-
- This function performs the CSHAKE-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] OutputLen Size of output in bytes.
- @param[in] Name Pointer to the function name string.
- @param[in] NameLen Size of the function name in bytes.
- @param[in] Customization Pointer to the customization string.
- @param[in] CustomizationLen Size of the customization string in bytes.
- @param[out] HashValue Pointer to a buffer that receives the CSHAKE-256 digest
- value.
-
- @retval TRUE CSHAKE-256 digest computation succeeded.
- @retval FALSE CSHAKE-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-CShake256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN UINTN OutputLen,
- IN CONST VOID *Name,
- IN UINTN NameLen,
- IN CONST VOID *Customization,
- IN UINTN CustomizationLen,
- OUT UINT8 *HashValue
- );
-
-/**
- Complete computation of digest of each block.
-
- Each AP perform the function called by BSP.
-
- @param[in] ProcedureArgument Argument of the procedure.
-**/
-VOID
-EFIAPI
-ParallelHashApExecute (
- IN VOID *ProcedureArgument
- );
-
-/**
- Dispatch the block task to each AP.
-
-**/
-VOID
-EFIAPI
-DispatchBlockToAp (
- VOID
- );
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHashNull.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHashNull.c
deleted file mode 100644
index 2bf89594de..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptParallelHashNull.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/** @file
- ParallelHash Implementation which does not provide real capabilities.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
- published December 2016.
-
- @param[in] Input Pointer to the input message (X).
- @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
- @param[in] BlockSize The size of each block (B).
- @param[out] Output Pointer to the output buffer.
- @param[in] OutputByteLen The desired number of output bytes (L).
- @param[in] Customization Pointer to the customization string (S).
- @param[in] CustomByteLen The length of the customization string in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-ParallelHash256HashAll (
- IN CONST VOID *Input,
- IN UINTN InputByteLen,
- IN UINTN BlockSize,
- OUT VOID *Output,
- IN UINTN OutputByteLen,
- IN CONST VOID *Customization,
- IN UINTN CustomByteLen
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c
deleted file mode 100644
index cfe1f4bc44..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1.c
+++ /dev/null
@@ -1,238 +0,0 @@
-/** @file
- SHA-1 Digest Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha1GetContextSize (
- VOID
- )
-{
- //
- // Retrieves OpenSSL SHA Context Size
- //
- return (UINTN)(sizeof (SHA_CTX));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Init (
- OUT VOID *Sha1Context
- )
-{
- //
- // Check input parameters.
- //
- if (Sha1Context == NULL) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-1 Context Initialization
- //
- return (BOOLEAN)(SHA1_Init ((SHA_CTX *)Sha1Context));
-}
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha1Context == NULL) || (NewSha1Context == NULL)) {
- return FALSE;
- }
-
- CopyMem (NewSha1Context, Sha1Context, sizeof (SHA_CTX));
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Update (
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (Sha1Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-1 Hash Update
- //
- return (BOOLEAN)(SHA1_Update ((SHA_CTX *)Sha1Context, Data, DataSize));
-}
-
-/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha1Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-1 Hash Finalization
- //
- return (BOOLEAN)(SHA1_Final (HashValue, (SHA_CTX *)Sha1Context));
-}
-
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- SHA_CTX Context;
-
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-1 Hash Computation.
- //
- if (!SHA1_Init (&Context)) {
- return FALSE;
- }
-
- if (!SHA1_Update (&Context, Data, DataSize)) {
- return FALSE;
- }
-
- if (!SHA1_Final (HashValue, &Context)) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1Null.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1Null.c
deleted file mode 100644
index d9b4610af0..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha1Null.c
+++ /dev/null
@@ -1,166 +0,0 @@
-/** @file
- SHA-1 Digest Wrapper Null Implementation.
-
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha1GetContextSize (
- VOID
- )
-{
- //
- // Retrieves SHA Context Size
- //
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Init (
- OUT VOID *Sha1Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
- )
-{
- ASSERT (FALSE);
-
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Update (
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha256.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha256.c
deleted file mode 100644
index 4d7d92812c..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha256.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/** @file
- SHA-256 Digest Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha256GetContextSize (
- VOID
- )
-{
- //
- // Retrieves OpenSSL SHA-256 Context Size
- //
- return (UINTN)(sizeof (SHA256_CTX));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Init (
- OUT VOID *Sha256Context
- )
-{
- //
- // Check input parameters.
- //
- if (Sha256Context == NULL) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-256 Context Initialization
- //
- return (BOOLEAN)(SHA256_Init ((SHA256_CTX *)Sha256Context));
-}
-
-/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Duplicate (
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha256Context == NULL) || (NewSha256Context == NULL)) {
- return FALSE;
- }
-
- CopyMem (NewSha256Context, Sha256Context, sizeof (SHA256_CTX));
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Update (
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (Sha256Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-256 Hash Update
- //
- return (BOOLEAN)(SHA256_Update ((SHA256_CTX *)Sha256Context, Data, DataSize));
-}
-
-/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Final (
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha256Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-256 Hash Finalization
- //
- return (BOOLEAN)(SHA256_Final (HashValue, (SHA256_CTX *)Sha256Context));
-}
-
-/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- SHA256_CTX Context;
-
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-256 Hash Computation.
- //
- if (!SHA256_Init (&Context)) {
- return FALSE;
- }
-
- if (!SHA256_Update (&Context, Data, DataSize)) {
- return FALSE;
- }
-
- if (!SHA256_Final (HashValue, &Context)) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha256Null.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha256Null.c
deleted file mode 100644
index cf994e8e06..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha256Null.c
+++ /dev/null
@@ -1,162 +0,0 @@
-/** @file
- SHA-256 Digest Wrapper Null Implementation.
-
-Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha256GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Init (
- OUT VOID *Sha256Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Duplicate (
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Update (
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Final (
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha3.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha3.c
deleted file mode 100644
index 6abafc3c00..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha3.c
+++ /dev/null
@@ -1,166 +0,0 @@
-/** @file
- SHA3 realted functions from OpenSSL.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
-Licensed under the OpenSSL license (the "License"). You may not use
-this file except in compliance with the License. You can obtain a copy
-in the file LICENSE in the source distribution or at
-https://www.openssl.org/source/license.html
-**/
-
-#include "CryptParallelHash.h"
-
-/**
- Keccak initial fuction.
-
- Set up state with specified capacity.
-
- @param[out] Context Pointer to the context being initialized.
- @param[in] Pad Delimited Suffix.
- @param[in] BlockSize Size of context block.
- @param[in] MessageDigestLen Size of message digest in bytes.
-
- @retval 1 Initialize successfully.
- @retval 0 Fail to initialize.
-**/
-UINT8
-EFIAPI
-KeccakInit (
- OUT Keccak1600_Ctx *Context,
- IN UINT8 Pad,
- IN UINTN BlockSize,
- IN UINTN MessageDigestLen
- )
-{
- if (BlockSize <= sizeof (Context->buf)) {
- memset (Context->A, 0, sizeof (Context->A));
-
- Context->num = 0;
- Context->block_size = BlockSize;
- Context->md_size = MessageDigestLen;
- Context->pad = Pad;
-
- return 1;
- }
-
- return 0;
-}
-
-/**
- Sha3 update fuction.
-
- This function performs Sha3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
-
- @param[in,out] Context Pointer to the Keccak context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval 1 Update successfully.
-**/
-UINT8
-EFIAPI
-Sha3Update (
- IN OUT Keccak1600_Ctx *Context,
- IN const VOID *Data,
- IN UINTN DataSize
- )
-{
- const UINT8 *DataCopy;
- UINTN BlockSize;
- UINTN Num;
- UINTN Rem;
-
- DataCopy = Data;
- BlockSize = (UINT8)(Context->block_size);
-
- if (DataSize == 0) {
- return 1;
- }
-
- if ((Num = Context->num) != 0) {
- //
- // process intermediate buffer
- //
- Rem = BlockSize - Num;
-
- if (DataSize < Rem) {
- memcpy (Context->buf + Num, DataCopy, DataSize);
- Context->num += DataSize;
- return 1;
- }
-
- //
- // We have enough data to fill or overflow the intermediate
- // buffer. So we append |Rem| bytes and process the block,
- // leaving the rest for later processing.
- //
- memcpy (Context->buf + Num, DataCopy, Rem);
- DataCopy += Rem;
- DataSize -= Rem;
- (void)SHA3_absorb (Context->A, Context->buf, BlockSize, BlockSize);
- Context->num = 0;
- // Context->buf is processed, Context->num is guaranteed to be zero.
- }
-
- if (DataSize >= BlockSize) {
- Rem = SHA3_absorb (Context->A, DataCopy, DataSize, BlockSize);
- } else {
- Rem = DataSize;
- }
-
- if (Rem > 0) {
- memcpy (Context->buf, DataCopy + DataSize - Rem, Rem);
- Context->num = Rem;
- }
-
- return 1;
-}
-
-/**
- Completes computation of Sha3 message digest.
-
- This function completes sha3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the keccak context cannot
- be used again.
-
- @param[in, out] Context Pointer to the keccak context.
- @param[out] MessageDigest Pointer to a buffer that receives the message digest.
-
- @retval 1 Meaasge digest computation succeeded.
-**/
-UINT8
-EFIAPI
-Sha3Final (
- IN OUT Keccak1600_Ctx *Context,
- OUT UINT8 *MessageDigest
- )
-{
- UINTN BlockSize;
- UINTN Num;
-
- BlockSize = Context->block_size;
- Num = Context->num;
-
- if (Context->md_size == 0) {
- return 1;
- }
-
- //
- // Pad the data with 10*1. Note that |Num| can be |BlockSize - 1|
- // in which case both byte operations below are performed on
- // same byte.
- //
- memset (Context->buf + Num, 0, BlockSize - Num);
- Context->buf[Num] = Context->pad;
- Context->buf[BlockSize - 1] |= 0x80;
-
- (void)SHA3_absorb (Context->A, Context->buf, BlockSize, BlockSize);
-
- SHA3_squeeze (Context->A, MessageDigest, Context->md_size, BlockSize);
-
- return 1;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512.c
deleted file mode 100644
index dee8f35c41..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512.c
+++ /dev/null
@@ -1,462 +0,0 @@
-/** @file
- SHA-384 and SHA-512 Digest Wrapper Implementations over OpenSSL.
-
-Copyright (c) 2014 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha384GetContextSize (
- VOID
- )
-{
- //
- // Retrieves OpenSSL SHA-384 Context Size
- //
- return (UINTN)(sizeof (SHA512_CTX));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval TRUE SHA-384 context initialization succeeded.
- @retval FALSE SHA-384 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Init (
- OUT VOID *Sha384Context
- )
-{
- //
- // Check input parameters.
- //
- if (Sha384Context == NULL) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-384 Context Initialization
- //
- return (BOOLEAN)(SHA384_Init ((SHA512_CTX *)Sha384Context));
-}
-
-/**
- Makes a copy of an existing SHA-384 context.
-
- If Sha384Context is NULL, then return FALSE.
- If NewSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval TRUE SHA-384 context copy succeeded.
- @retval FALSE SHA-384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Duplicate (
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha384Context == NULL) || (NewSha384Context == NULL)) {
- return FALSE;
- }
-
- CopyMem (NewSha384Context, Sha384Context, sizeof (SHA512_CTX));
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-384 context.
-
- This function performs SHA-384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
- by Sha384Final(). Behavior with invalid context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-384 data digest succeeded.
- @retval FALSE SHA-384 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Update (
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (Sha384Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-384 Hash Update
- //
- return (BOOLEAN)(SHA384_Update ((SHA512_CTX *)Sha384Context, Data, DataSize));
-}
-
-/**
- Completes computation of the SHA-384 digest value.
-
- This function completes SHA-384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-384 context cannot
- be used again.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
- finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Final (
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha384Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-384 Hash Finalization
- //
- return (BOOLEAN)(SHA384_Final (HashValue, (SHA512_CTX *)Sha384Context));
-}
-
-/**
- Computes the SHA-384 message digest of a input data buffer.
-
- This function performs the SHA-384 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- SHA512_CTX Context;
-
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-384 Hash Computation.
- //
- if (!SHA384_Init (&Context)) {
- return FALSE;
- }
-
- if (!SHA384_Update (&Context, Data, DataSize)) {
- return FALSE;
- }
-
- if (!SHA384_Final (HashValue, &Context)) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha512GetContextSize (
- VOID
- )
-{
- //
- // Retrieves OpenSSL SHA-512 Context Size
- //
- return (UINTN)(sizeof (SHA512_CTX));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval TRUE SHA-512 context initialization succeeded.
- @retval FALSE SHA-512 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Init (
- OUT VOID *Sha512Context
- )
-{
- //
- // Check input parameters.
- //
- if (Sha512Context == NULL) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-512 Context Initialization
- //
- return (BOOLEAN)(SHA512_Init ((SHA512_CTX *)Sha512Context));
-}
-
-/**
- Makes a copy of an existing SHA-512 context.
-
- If Sha512Context is NULL, then return FALSE.
- If NewSha512Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval TRUE SHA-512 context copy succeeded.
- @retval FALSE SHA-512 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Duplicate (
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha512Context == NULL) || (NewSha512Context == NULL)) {
- return FALSE;
- }
-
- CopyMem (NewSha512Context, Sha512Context, sizeof (SHA512_CTX));
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-512 context.
-
- This function performs SHA-512 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
- by Sha512Final(). Behavior with invalid context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-512 data digest succeeded.
- @retval FALSE SHA-512 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Update (
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (Sha512Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-512 Hash Update
- //
- return (BOOLEAN)(SHA512_Update ((SHA512_CTX *)Sha512Context, Data, DataSize));
-}
-
-/**
- Completes computation of the SHA-512 digest value.
-
- This function completes SHA-512 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-512 context cannot
- be used again.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
- finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Final (
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((Sha512Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-512 Hash Finalization
- //
- return (BOOLEAN)(SHA384_Final (HashValue, (SHA512_CTX *)Sha512Context));
-}
-
-/**
- Computes the SHA-512 message digest of a input data buffer.
-
- This function performs the SHA-512 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- SHA512_CTX Context;
-
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL SHA-512 Hash Computation.
- //
- if (!SHA512_Init (&Context)) {
- return FALSE;
- }
-
- if (!SHA512_Update (&Context, Data, DataSize)) {
- return FALSE;
- }
-
- if (!SHA512_Final (HashValue, &Context)) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512Null.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512Null.c
deleted file mode 100644
index a6c861d7d1..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSha512Null.c
+++ /dev/null
@@ -1,275 +0,0 @@
-/** @file
- SHA-384 and SHA-512 Digest Wrapper Implementations which does not provide real capabilities.
-
-Copyright (c) 2014 - 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
-
- Return zero to indicate this interface is not supported.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-Sha384GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Init (
- OUT VOID *Sha384Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-384 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Duplicate (
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-384 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Update (
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-384 digest value.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Final (
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-384 message digest of a input data buffer.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- Return zero to indicate this interface is not supported.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-Sha512GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Init (
- OUT VOID *Sha512Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-512 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Duplicate (
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-512 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Update (
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-512 digest value.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Final (
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-512 message digest of a input data buffer.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSm3.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSm3.c
deleted file mode 100644
index 03b168b9e2..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSm3.c
+++ /dev/null
@@ -1,235 +0,0 @@
-/** @file
- SM3 Digest Wrapper Implementations over openssl.
-
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include "internal/sm3.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
-
- @return The size, in bytes, of the context buffer required for SM3 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sm3GetContextSize (
- VOID
- )
-{
- //
- // Retrieves Openssl SM3 Context Size
- //
- return (UINTN)(sizeof (SM3_CTX));
-}
-
-/**
- Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
- subsequent use.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[out] Sm3Context Pointer to SM3 context being initialized.
-
- @retval TRUE SM3 context initialization succeeded.
- @retval FALSE SM3 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Init (
- OUT VOID *Sm3Context
- )
-{
- //
- // Check input parameters.
- //
- if (Sm3Context == NULL) {
- return FALSE;
- }
-
- //
- // Openssl SM3 Context Initialization
- //
- ossl_sm3_init ((SM3_CTX *)Sm3Context);
- return TRUE;
-}
-
-/**
- Makes a copy of an existing SM3 context.
-
- If Sm3Context is NULL, then return FALSE.
- If NewSm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sm3Context Pointer to SM3 context being copied.
- @param[out] NewSm3Context Pointer to new SM3 context.
-
- @retval TRUE SM3 context copy succeeded.
- @retval FALSE SM3 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Duplicate (
- IN CONST VOID *Sm3Context,
- OUT VOID *NewSm3Context
- )
-{
- //
- // Check input parameters.
- //
- if ((Sm3Context == NULL) || (NewSm3Context == NULL)) {
- return FALSE;
- }
-
- CopyMem (NewSm3Context, Sm3Context, sizeof (SM3_CTX));
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SM3 context.
-
- This function performs SM3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
- by Sm3Final(). Behavior with invalid context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SM3 data digest succeeded.
- @retval FALSE SM3 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Update (
- IN OUT VOID *Sm3Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (Sm3Context == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in Openssl
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // Openssl SM3 Hash Update
- //
- ossl_sm3_update ((SM3_CTX *)Sm3Context, Data, DataSize);
-
- return TRUE;
-}
-
-/**
- Completes computation of the SM3 digest value.
-
- This function completes SM3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SM3 context cannot
- be used again.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be
- finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Final (
- IN OUT VOID *Sm3Context,
- OUT UINT8 *HashValue
- )
-{
- //
- // Check input parameters.
- //
- if ((Sm3Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- //
- // Openssl SM3 Hash Finalization
- //
- ossl_sm3_final (HashValue, (SM3_CTX *)Sm3Context);
-
- return TRUE;
-}
-
-/**
- Computes the SM3 message digest of a input data buffer.
-
- This function performs the SM3 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- SM3_CTX Ctx;
-
- //
- // Check input parameters.
- //
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // SM3 Hash Computation.
- //
- ossl_sm3_init (&Ctx);
-
- ossl_sm3_update (&Ctx, Data, DataSize);
-
- ossl_sm3_final (HashValue, &Ctx);
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSm3Null.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptSm3Null.c
deleted file mode 100644
index 0f3c89b465..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptSm3Null.c
+++ /dev/null
@@ -1,164 +0,0 @@
-/** @file
- SM3 Digest Wrapper Null Implementation.
-
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
-
- @return The size, in bytes, of the context buffer required for SM3 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sm3GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
- subsequent use.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[out] Sm3Context Pointer to SM3 context being initialized.
-
- @retval TRUE SM3 context initialization succeeded.
- @retval FALSE SM3 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Init (
- OUT VOID *Sm3Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SM3 context.
-
- If Sm3Context is NULL, then return FALSE.
- If NewSm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sm3Context Pointer to SM3 context being copied.
- @param[out] NewSm3Context Pointer to new SM3 context.
-
- @retval TRUE SM3 context copy succeeded.
- @retval FALSE SM3 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Duplicate (
- IN CONST VOID *Sm3Context,
- OUT VOID *NewSm3Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SM3 context.
-
- This function performs SM3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
- by Sm3Final(). Behavior with invalid context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SM3 data digest succeeded.
- @retval FALSE SM3 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Update (
- IN OUT VOID *Sm3Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SM3 digest value.
-
- This function completes SM3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SM3 context cannot
- be used again.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be
- finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Final (
- IN OUT VOID *Sm3Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SM3 message digest of a input data buffer.
-
- This function performs the SM3 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hash/CryptXkcp.c b/CryptoPkg/Library/BaseCryptLib/Hash/CryptXkcp.c
deleted file mode 100644
index 12c46cfbcd..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hash/CryptXkcp.c
+++ /dev/null
@@ -1,107 +0,0 @@
-/** @file
- Encode realted functions from Xkcp.
-
-Copyright (c) 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-Copyright 2022 The eXtended Keccak Code Package (XKCP)
-https://github.com/XKCP/XKCP
-Keccak, designed by Guido Bertoni, Joan Daemen, Michael Peeters and Gilles Van Assche.
-Implementation by the designers, hereby denoted as "the implementer".
-For more information, feedback or questions, please refer to the Keccak Team website:
-https://keccak.team/
-To the extent possible under law, the implementer has waived all copyright
-and related or neighboring rights to the source code in this file.
-http://creativecommons.org/publicdomain/zero/1.0/
-
-**/
-
-#include "CryptParallelHash.h"
-
-/**
- Encode function from XKCP.
-
- Encodes the input as a byte string in a way that can be unambiguously parsed
- from the beginning of the string by inserting the length of the byte string
- before the byte string representation of input.
-
- @param[out] EncBuf Result of left encode.
- @param[in] Value Input of left encode.
-
- @retval EncLen Size of encode result in bytes.
-**/
-UINTN
-EFIAPI
-LeftEncode (
- OUT UINT8 *EncBuf,
- IN UINTN Value
- )
-{
- UINT32 BlockNum;
- UINT32 EncLen;
- UINT32 Index;
- UINTN ValueCopy;
-
- for ( ValueCopy = Value, BlockNum = 0; ValueCopy && (BlockNum < sizeof (UINTN)); ++BlockNum, ValueCopy >>= 8 ) {
- //
- // Empty
- //
- }
-
- if (BlockNum == 0) {
- BlockNum = 1;
- }
-
- for (Index = 1; Index <= BlockNum; ++Index) {
- EncBuf[Index] = (UINT8)(Value >> (8 * (BlockNum - Index)));
- }
-
- EncBuf[0] = (UINT8)BlockNum;
- EncLen = BlockNum + 1;
-
- return EncLen;
-}
-
-/**
- Encode function from XKCP.
-
- Encodes the input as a byte string in a way that can be unambiguously parsed
- from the end of the string by inserting the length of the byte string after
- the byte string representation of input.
-
- @param[out] EncBuf Result of right encode.
- @param[in] Value Input of right encode.
-
- @retval EncLen Size of encode result in bytes.
-**/
-UINTN
-EFIAPI
-RightEncode (
- OUT UINT8 *EncBuf,
- IN UINTN Value
- )
-{
- UINT32 BlockNum;
- UINT32 EncLen;
- UINT32 Index;
- UINTN ValueCopy;
-
- for (ValueCopy = Value, BlockNum = 0; ValueCopy && (BlockNum < sizeof (UINTN)); ++BlockNum, ValueCopy >>= 8) {
- //
- // Empty
- //
- }
-
- if (BlockNum == 0) {
- BlockNum = 1;
- }
-
- for (Index = 1; Index <= BlockNum; ++Index) {
- EncBuf[Index-1] = (UINT8)(Value >> (8 * (BlockNum-Index)));
- }
-
- EncBuf[BlockNum] = (UINT8)BlockNum;
- EncLen = BlockNum + 1;
-
- return EncLen;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmac.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmac.c
deleted file mode 100644
index 1ae33b6709..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmac.c
+++ /dev/null
@@ -1,636 +0,0 @@
-/** @file
- HMAC-SHA256/SHA384 Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacMdNew() returns NULL.
-
-**/
-STATIC
-VOID *
-HmacMdNew (
- VOID
- )
-{
- //
- // Allocates & Initializes HMAC_CTX Context by OpenSSL HMAC_CTX_new()
- //
- return (VOID *)HMAC_CTX_new ();
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacMdCtx Pointer to the HMAC_CTX context to be released.
-
-**/
-STATIC
-VOID
-HmacMdFree (
- IN VOID *HmacMdCtx
- )
-{
- //
- // Free OpenSSL HMAC_CTX Context
- //
- HMAC_CTX_free ((HMAC_CTX *)HmacMdCtx);
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacMdUpdate().
-
- If HmacMdContext is NULL, then return FALSE.
-
- @param[in] Md Message Digest.
- @param[out] HmacMdContext Pointer to HMAC-MD context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
-
-**/
-STATIC
-BOOLEAN
-HmacMdSetKey (
- IN CONST EVP_MD *Md,
- OUT VOID *HmacMdContext,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- //
- // Check input parameters.
- //
- if ((HmacMdContext == NULL) || (KeySize > INT_MAX)) {
- return FALSE;
- }
-
- if (HMAC_Init_ex ((HMAC_CTX *)HmacMdContext, Key, (UINT32)KeySize, Md, NULL) != 1) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Makes a copy of an existing HMAC-MD context.
-
- If HmacMdContext is NULL, then return FALSE.
- If NewHmacMdContext is NULL, then return FALSE.
-
- @param[in] HmacMdContext Pointer to HMAC-MD context being copied.
- @param[out] NewHmacMdContext Pointer to new HMAC-MD context.
-
- @retval TRUE HMAC-MD context copy succeeded.
- @retval FALSE HMAC-MD context copy failed.
-
-**/
-STATIC
-BOOLEAN
-HmacMdDuplicate (
- IN CONST VOID *HmacMdContext,
- OUT VOID *NewHmacMdContext
- )
-{
- //
- // Check input parameters.
- //
- if ((HmacMdContext == NULL) || (NewHmacMdContext == NULL)) {
- return FALSE;
- }
-
- if (HMAC_CTX_copy ((HMAC_CTX *)NewHmacMdContext, (HMAC_CTX *)HmacMdContext) != 1) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates HMAC-MD context.
-
- This function performs HMAC-MD digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-MD context should be initialized by HmacMdNew(), and should not be finalized
- by HmacMdFinal(). Behavior with invalid context is undefined.
-
- If HmacMdContext is NULL, then return FALSE.
-
- @param[in, out] HmacMdContext Pointer to the HMAC-MD context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-MD data digest succeeded.
- @retval FALSE HMAC-MD data digest failed.
-
-**/
-STATIC
-BOOLEAN
-HmacMdUpdate (
- IN OUT VOID *HmacMdContext,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- //
- // Check input parameters.
- //
- if (HmacMdContext == NULL) {
- return FALSE;
- }
-
- //
- // Check invalid parameters, in case that only DataLength was checked in OpenSSL
- //
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- //
- // OpenSSL HMAC-MD digest update
- //
- if (HMAC_Update ((HMAC_CTX *)HmacMdContext, Data, DataSize) != 1) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the HMAC-MD digest value.
-
- This function completes HMAC-MD hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-MD context cannot
- be used again.
- HMAC-MD context should be initialized by HmacMdNew(), and should not be finalized
- by HmacMdFinal(). Behavior with invalid HMAC-MD context is undefined.
-
- If HmacMdContext is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
-
- @param[in, out] HmacMdContext Pointer to the HMAC-MD context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-MD digest
- value.
-
- @retval TRUE HMAC-MD digest computation succeeded.
- @retval FALSE HMAC-MD digest computation failed.
-
-**/
-STATIC
-BOOLEAN
-HmacMdFinal (
- IN OUT VOID *HmacMdContext,
- OUT UINT8 *HmacValue
- )
-{
- UINT32 Length;
-
- //
- // Check input parameters.
- //
- if ((HmacMdContext == NULL) || (HmacValue == NULL)) {
- return FALSE;
- }
-
- //
- // OpenSSL HMAC-MD digest finalization
- //
- if (HMAC_Final ((HMAC_CTX *)HmacMdContext, HmacValue, &Length) != 1) {
- return FALSE;
- }
-
- if (HMAC_CTX_reset ((HMAC_CTX *)HmacMdContext) != 1) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the HMAC-MD digest of a input data buffer.
-
- This function performs the HMAC-MD digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Md Message Digest.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-MD digest
- value.
-
- @retval TRUE HMAC-MD digest computation succeeded.
- @retval FALSE HMAC-MD digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-STATIC
-BOOLEAN
-HmacMdAll (
- IN CONST EVP_MD *Md,
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- UINT32 Length;
- HMAC_CTX *Ctx;
- BOOLEAN RetVal;
-
- Ctx = HMAC_CTX_new ();
- if (Ctx == NULL) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)HMAC_CTX_reset (Ctx);
- if (!RetVal) {
- goto Done;
- }
-
- RetVal = (BOOLEAN)HMAC_Init_ex (Ctx, Key, (UINT32)KeySize, Md, NULL);
- if (!RetVal) {
- goto Done;
- }
-
- RetVal = (BOOLEAN)HMAC_Update (Ctx, Data, DataSize);
- if (!RetVal) {
- goto Done;
- }
-
- RetVal = (BOOLEAN)HMAC_Final (Ctx, HmacValue, &Length);
- if (!RetVal) {
- goto Done;
- }
-
-Done:
- HMAC_CTX_free (Ctx);
-
- return RetVal;
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha256New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha256New (
- VOID
- )
-{
- return HmacMdNew ();
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha256Free (
- IN VOID *HmacSha256Ctx
- )
-{
- HmacMdFree (HmacSha256Ctx);
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha256Update().
-
- If HmacSha256Context is NULL, then return FALSE.
-
- @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256SetKey (
- OUT VOID *HmacSha256Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return HmacMdSetKey (EVP_sha256 (), HmacSha256Context, Key, KeySize);
-}
-
-/**
- Makes a copy of an existing HMAC-SHA256 context.
-
- If HmacSha256Context is NULL, then return FALSE.
- If NewHmacSha256Context is NULL, then return FALSE.
-
- @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
- @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
- @retval TRUE HMAC-SHA256 context copy succeeded.
- @retval FALSE HMAC-SHA256 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Duplicate (
- IN CONST VOID *HmacSha256Context,
- OUT VOID *NewHmacSha256Context
- )
-{
- return HmacMdDuplicate (HmacSha256Context, NewHmacSha256Context);
-}
-
-/**
- Digests the input data and updates HMAC-SHA256 context.
-
- This function performs HMAC-SHA256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA256 data digest succeeded.
- @retval FALSE HMAC-SHA256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Update (
- IN OUT VOID *HmacSha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return HmacMdUpdate (HmacSha256Context, Data, DataSize);
-}
-
-/**
- Completes computation of the HMAC-SHA256 digest value.
-
- This function completes HMAC-SHA256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA256 context cannot
- be used again.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid HMAC-SHA256 context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Final (
- IN OUT VOID *HmacSha256Context,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdFinal (HmacSha256Context, HmacValue);
-}
-
-/**
- Computes the HMAC-SHA256 digest of a input data buffer.
-
- This function performs the HMAC-SHA256 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdAll (EVP_sha256 (), Data, DataSize, Key, KeySize, HmacValue);
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha384New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha384New (
- VOID
- )
-{
- return HmacMdNew ();
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha384Free (
- IN VOID *HmacSha384Ctx
- )
-{
- HmacMdFree (HmacSha384Ctx);
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha384Update().
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384SetKey (
- OUT VOID *HmacSha384Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return HmacMdSetKey (EVP_sha384 (), HmacSha384Context, Key, KeySize);
-}
-
-/**
- Makes a copy of an existing HMAC-SHA384 context.
-
- If HmacSha384Context is NULL, then return FALSE.
- If NewHmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
- @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
- @retval TRUE HMAC-SHA384 context copy succeeded.
- @retval FALSE HMAC-SHA384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Duplicate (
- IN CONST VOID *HmacSha384Context,
- OUT VOID *NewHmacSha384Context
- )
-{
- return HmacMdDuplicate (HmacSha384Context, NewHmacSha384Context);
-}
-
-/**
- Digests the input data and updates HMAC-SHA384 context.
-
- This function performs HMAC-SHA384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA384 data digest succeeded.
- @retval FALSE HMAC-SHA384 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Update (
- IN OUT VOID *HmacSha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return HmacMdUpdate (HmacSha384Context, Data, DataSize);
-}
-
-/**
- Completes computation of the HMAC-SHA384 digest value.
-
- This function completes HMAC-SHA384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA384 context cannot
- be used again.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Final (
- IN OUT VOID *HmacSha384Context,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdFinal (HmacSha384Context, HmacValue);
-}
-
-/**
- Computes the HMAC-SHA384 digest of a input data buffer.
-
- This function performs the HMAC-SHA384 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdAll (EVP_sha384 (), Data, DataSize, Key, KeySize, HmacValue);
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacNull.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacNull.c
deleted file mode 100644
index 0a76db41ec..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacNull.c
+++ /dev/null
@@ -1,359 +0,0 @@
-/** @file
- HMAC-SHA256/SHA384 Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2016 - 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
- Return NULL to indicate this interface is not supported.
-
- @return NULL This interface is not supported..
-
-**/
-VOID *
-EFIAPI
-HmacSha256New (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- This function will do nothing.
-
- @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha256Free (
- IN VOID *HmacSha256Ctx
- )
-{
- ASSERT (FALSE);
- return;
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha256Update().
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256SetKey (
- OUT VOID *HmacSha256Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing HMAC-SHA256 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
- @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Duplicate (
- IN CONST VOID *HmacSha256Context,
- OUT VOID *NewHmacSha256Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates HMAC-SHA256 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Update (
- IN OUT VOID *HmacSha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the HMAC-SHA256 digest value.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Final (
- IN OUT VOID *HmacSha256Context,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the HMAC-SHA256 digest of a input data buffer.
-
- This function performs the HMAC-SHA256 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha384New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha384New (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha384Free (
- IN VOID *HmacSha384Ctx
- )
-{
- ASSERT (FALSE);
- return;
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha384Update().
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384SetKey (
- OUT VOID *HmacSha384Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing HMAC-SHA384 context.
-
- If HmacSha384Context is NULL, then return FALSE.
- If NewHmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
- @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
- @retval TRUE HMAC-SHA384 context copy succeeded.
- @retval FALSE HMAC-SHA384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Duplicate (
- IN CONST VOID *HmacSha384Context,
- OUT VOID *NewHmacSha384Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates HMAC-SHA384 context.
-
- This function performs HMAC-SHA384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA384 data digest succeeded.
- @retval FALSE HMAC-SHA384 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Update (
- IN OUT VOID *HmacSha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the HMAC-SHA384 digest value.
-
- This function completes HMAC-SHA384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA384 context cannot
- be used again.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Final (
- IN OUT VOID *HmacSha384Context,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the HMAC-SHA384 digest of a input data buffer.
-
- This function performs the HMAC-SHA384 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h b/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h
deleted file mode 100644
index 477e3ae5f1..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/** @file
- Internal include file for BaseCryptLib.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#ifndef __INTERNAL_CRYPT_LIB_H__
-#define __INTERNAL_CRYPT_LIB_H__
-
-#undef _WIN32
-#undef _WIN64
-
-#include
-#include
-#include
-#include
-#include
-
-#include "CrtLibSupport.h"
-
-#define OPENSSL_NO_DEPRECATED 0
-
-#include
-
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define OBJ_get0_data(o) ((o)->data)
-#define OBJ_length(o) ((o)->length)
-#endif
-
-/**
- Check input P7Data is a wrapped ContentInfo structure or not. If not construct
- a new structure to wrap P7Data.
-
- Caution: This function may receive untrusted input.
- UEFI Authenticated Variable is external input, so this function will do basic
- check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] WrapFlag If TRUE P7Data is a ContentInfo structure, otherwise
- return FALSE.
- @param[out] WrapData If return status of this function is TRUE:
- 1) when WrapFlag is TRUE, pointer to P7Data.
- 2) when WrapFlag is FALSE, pointer to a new ContentInfo
- structure. It's caller's responsibility to free this
- buffer.
- @param[out] WrapDataSize Length of ContentInfo structure in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE The operation is failed due to lack of resources.
-
-**/
-BOOLEAN
-WrapPkcs7Data (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT BOOLEAN *WrapFlag,
- OUT UINT8 **WrapData,
- OUT UINTN *WrapDataSize
- );
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c
deleted file mode 100644
index 34e81246ed..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c
+++ /dev/null
@@ -1,421 +0,0 @@
-/** @file
- HMAC-SHA256 KDF Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2018 - 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-
-/**
- Derive HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Md Message Digest.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-STATIC
-BOOLEAN
-HkdfMdExtractAndExpand (
- IN CONST EVP_MD *Md,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- EVP_PKEY_CTX *pHkdfCtx;
- BOOLEAN Result;
-
- if ((Key == NULL) || (Salt == NULL) || (Info == NULL) || (Out == NULL) ||
- (KeySize > INT_MAX) || (SaltSize > INT_MAX) || (InfoSize > INT_MAX) || (OutSize > INT_MAX))
- {
- return FALSE;
- }
-
- pHkdfCtx = EVP_PKEY_CTX_new_id (EVP_PKEY_HKDF, NULL);
- if (pHkdfCtx == NULL) {
- return FALSE;
- }
-
- Result = EVP_PKEY_derive_init (pHkdfCtx) > 0;
- if (Result) {
- Result = EVP_PKEY_CTX_set_hkdf_md (pHkdfCtx, Md) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set1_hkdf_salt (pHkdfCtx, Salt, (UINT32)SaltSize) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set1_hkdf_key (pHkdfCtx, Key, (UINT32)KeySize) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_add1_hkdf_info (pHkdfCtx, Info, (UINT32)InfoSize) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_derive (pHkdfCtx, Out, &OutSize) > 0;
- }
-
- EVP_PKEY_CTX_free (pHkdfCtx);
- pHkdfCtx = NULL;
- return Result;
-}
-
-/**
- Derive HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Md message digest.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-STATIC
-BOOLEAN
-HkdfMdExtract (
- IN CONST EVP_MD *Md,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- EVP_PKEY_CTX *pHkdfCtx;
- BOOLEAN Result;
-
- if ((Key == NULL) || (Salt == NULL) || (PrkOut == NULL) ||
- (KeySize > INT_MAX) || (SaltSize > INT_MAX) ||
- (PrkOutSize > INT_MAX))
- {
- return FALSE;
- }
-
- pHkdfCtx = EVP_PKEY_CTX_new_id (EVP_PKEY_HKDF, NULL);
- if (pHkdfCtx == NULL) {
- return FALSE;
- }
-
- Result = EVP_PKEY_derive_init (pHkdfCtx) > 0;
- if (Result) {
- Result = EVP_PKEY_CTX_set_hkdf_md (pHkdfCtx, Md) > 0;
- }
-
- if (Result) {
- Result =
- EVP_PKEY_CTX_hkdf_mode (
- pHkdfCtx,
- EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY
- ) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set1_hkdf_salt (
- pHkdfCtx,
- Salt,
- (uint32_t)SaltSize
- ) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set1_hkdf_key (
- pHkdfCtx,
- Key,
- (uint32_t)KeySize
- ) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_derive (pHkdfCtx, PrkOut, &PrkOutSize) > 0;
- }
-
- EVP_PKEY_CTX_free (pHkdfCtx);
- pHkdfCtx = NULL;
- return Result;
-}
-
-/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Md Message Digest.
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-STATIC
-BOOLEAN
-HkdfMdExpand (
- IN CONST EVP_MD *Md,
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- EVP_PKEY_CTX *pHkdfCtx;
- BOOLEAN Result;
-
- if ((Prk == NULL) || (Info == NULL) || (Out == NULL) ||
- (PrkSize > INT_MAX) || (InfoSize > INT_MAX) || (OutSize > INT_MAX))
- {
- return FALSE;
- }
-
- pHkdfCtx = EVP_PKEY_CTX_new_id (EVP_PKEY_HKDF, NULL);
- if (pHkdfCtx == NULL) {
- return FALSE;
- }
-
- Result = EVP_PKEY_derive_init (pHkdfCtx) > 0;
- if (Result) {
- Result = EVP_PKEY_CTX_set_hkdf_md (pHkdfCtx, Md) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_hkdf_mode (pHkdfCtx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set1_hkdf_key (pHkdfCtx, Prk, (UINT32)PrkSize) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_add1_hkdf_info (pHkdfCtx, Info, (UINT32)InfoSize) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_derive (pHkdfCtx, Out, &OutSize) > 0;
- }
-
- EVP_PKEY_CTX_free (pHkdfCtx);
- pHkdfCtx = NULL;
- return Result;
-}
-
-/**
- Derive HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExtractAndExpand (EVP_sha256 (), Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize);
-}
-
-/**
- Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- return HkdfMdExtract (
- EVP_sha256 (),
- Key,
- KeySize,
- Salt,
- SaltSize,
- PrkOut,
- PrkOutSize
- );
-}
-
-/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExpand (EVP_sha256 (), Prk, PrkSize, Info, InfoSize, Out, OutSize);
-}
-
-/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExtractAndExpand (EVP_sha384 (), Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize);
-}
-
-/**
- Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- return HkdfMdExtract (
- EVP_sha384 (),
- Key,
- KeySize,
- Salt,
- SaltSize,
- PrkOut,
- PrkOutSize
- );
-}
-
-/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExpand (EVP_sha384 (), Prk, PrkSize, Info, InfoSize, Out, OutSize);
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c
deleted file mode 100644
index d8c967d669..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c
+++ /dev/null
@@ -1,192 +0,0 @@
-/** @file
- HMAC-SHA256 KDF Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2018 - 2022, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-/**
- Derive key data using HMAC-SHA256 based KDF.
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
deleted file mode 100644
index dd907deaca..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ /dev/null
@@ -1,109 +0,0 @@
-## @file
-# Cryptographic Library Instance for PEIM.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Note:
-# HMAC-SHA256 functions, AES functions, RSA external
-# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509
-# certificate handler functions, authenticode signature verification functions,
-# PEM handler functions, and pseudorandom number generator functions are not
-# supported in this instance.
-#
-# Copyright (c) 2010 - 2022, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = PeiCryptLib
- MODULE_UNI_FILE = PeiCryptLib.uni
- FILE_GUID = 9a2a4375-194c-4e97-9f67-547ec98d96ca
- MODULE_TYPE = PEIM
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|PEIM PEI_CORE
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5Null.c ## MS_CHANGE_162948 MSChange - Remove support for deprecated crypto.
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSm3.c
- Hash/CryptSha512.c
- Hash/CryptSha3.c
- Hash/CryptXkcp.c
- Hash/CryptCShake256.c
- Hash/CryptParallelHash.c
- Hash/CryptDispatchApPei.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyCommon.c
- Pk/CryptPkcs7VerifyBase.c
- Pk/CryptPkcs7VerifyEku.c
- Pk/CryptDhNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSignNull.c
- Pk/CryptEcNull.c
- Pem/CryptPemNull.c
- Rand/CryptRandNull.c
- Bn/CryptBnNull.c
-
- SysCall/CrtWrapper.c
- SysCall/ConstantTimeClock.c
- SysCall/BaseMemAllocation.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- DebugLib
- OpensslLib
- IntrinsicLib
- PrintLib
- PeiServicesTablePointerLib
- PeiServicesLib
- SynchronizationLib
-
-[Ppis]
- gEfiPeiMpServicesPpiGuid
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- # C4090: 'function' : different 'const' qualifiers
- # C4718: 'function call' : recursive call has no side effects, deleting
- #
- MSFT:*_*_*_CC_FLAGS = /wd4090 /wd4718 /U_M_ARM /U_M_ARM64 # MU_CHANGE - TCBZ2029
- MSFT:*_*_ARM64_CC_FLAGS = /D_M_MS_ARM64 # MU_CHANGE - TCBZ2029
- MSFT:*_*_ARM_CC_FLAGS = /D_M_MS_ARM # MU_CHANGE - TCBZ2029
-
- GCC:*_CLANGDWARF_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
deleted file mode 100644
index 8cffc00daf..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
+++ /dev/null
@@ -1,23 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for PEIM.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Note: AES
-// functions, RSA external functions, PKCS#7 SignedData sign functions,
-// Diffie-Hellman functions, X.509 certificate handler functions, authenticode
-// signature verification functions, PEM handler functions, and pseudorandom number
-// generator functions are not supported in this instance.
-//
-// Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for PEIM"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c b/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
deleted file mode 100644
index d64cf3d680..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
+++ /dev/null
@@ -1,211 +0,0 @@
-/** @file
- PEM (Privacy Enhanced Mail) Format Handler Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Callback function for password phrase conversion used for retrieving the encrypted PEM.
-
- @param[out] Buf Pointer to the buffer to write the passphrase to.
- @param[in] Size Maximum length of the passphrase (i.e. the size of Buf).
- @param[in] Flag A flag which is set to 0 when reading and 1 when writing.
- @param[in] Key Key data to be passed to the callback routine.
-
- @retval The number of characters in the passphrase or 0 if an error occurred.
-
-**/
-INTN
-PasswordCallback (
- OUT CHAR8 *Buf,
- IN INTN Size,
- IN INTN Flag,
- IN VOID *Key
- )
-{
- INTN KeyLength;
-
- ZeroMem ((VOID *)Buf, (UINTN)Size);
- if (Key != NULL) {
- //
- // Duplicate key phrase directly.
- //
- KeyLength = (INTN)AsciiStrLen ((CHAR8 *)Key);
- KeyLength = (KeyLength > Size) ? Size : KeyLength;
- CopyMem (Buf, Key, (UINTN)KeyLength);
- return KeyLength;
- } else {
- return 0;
- }
-}
-
-/**
- Retrieve the RSA Private Key from the password-protected PEM key data.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA private key component. Use RsaFree() function to free the
- resource.
-
- If PemData is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
-
- @retval TRUE RSA Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **RsaContext
- )
-{
- BOOLEAN Status;
- BIO *PemBio;
-
- //
- // Check input parameters.
- //
- if ((PemData == NULL) || (RsaContext == NULL) || (PemSize > INT_MAX)) {
- return FALSE;
- }
-
- //
- // Add possible block-cipher descriptor for PEM data decryption.
- // NOTE: Only support most popular ciphers AES for the encrypted PEM.
- //
- if (EVP_add_cipher (EVP_aes_128_cbc ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_cipher (EVP_aes_192_cbc ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_cipher (EVP_aes_256_cbc ()) == 0) {
- return FALSE;
- }
-
- Status = FALSE;
-
- //
- // Read encrypted PEM Data.
- //
- PemBio = BIO_new (BIO_s_mem ());
- if (PemBio == NULL) {
- goto _Exit;
- }
-
- if (BIO_write (PemBio, PemData, (int)PemSize) <= 0) {
- goto _Exit;
- }
-
- //
- // Retrieve RSA Private Key from encrypted PEM data.
- //
- *RsaContext = PEM_read_bio_RSAPrivateKey (PemBio, NULL, (pem_password_cb *)&PasswordCallback, (void *)Password);
- if (*RsaContext != NULL) {
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- BIO_free (PemBio);
-
- return Status;
-}
-
-/**
- Retrieve the EC Private Key from the password-protected PEM key data.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC private key component. Use EcFree() function to free the
- resource.
-
- If PemData is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **EcContext
- )
-{
- BOOLEAN Status;
- BIO *PemBio;
-
- //
- // Check input parameters.
- //
- if ((PemData == NULL) || (EcContext == NULL) || (PemSize > INT_MAX)) {
- return FALSE;
- }
-
- //
- // Add possible block-cipher descriptor for PEM data decryption.
- // NOTE: Only support most popular ciphers AES for the encrypted PEM.
- //
- if (EVP_add_cipher (EVP_aes_128_cbc ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_cipher (EVP_aes_192_cbc ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_cipher (EVP_aes_256_cbc ()) == 0) {
- return FALSE;
- }
-
- Status = FALSE;
-
- //
- // Read encrypted PEM Data.
- //
- PemBio = BIO_new (BIO_s_mem ());
- if (PemBio == NULL) {
- goto _Exit;
- }
-
- if (BIO_write (PemBio, PemData, (int)PemSize) <= 0) {
- goto _Exit;
- }
-
- //
- // Retrieve EC Private Key from encrypted PEM data.
- //
- *EcContext = PEM_read_bio_ECPrivateKey (PemBio, NULL, (pem_password_cb *)&PasswordCallback, (void *)Password);
- if (*EcContext != NULL) {
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- BIO_free (PemBio);
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPemNull.c b/CryptoPkg/Library/BaseCryptLib/Pem/CryptPemNull.c
deleted file mode 100644
index 4ca9357c96..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPemNull.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/** @file
- PEM (Privacy Enhanced Mail) Format Handler Wrapper Implementation which does
- not provide real capabilities.
-
-Copyright (c) 2012, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieve the RSA Private Key from the password-protected PEM key data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA private key component. Use RsaFree() function to free the
- resource.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **RsaContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the EC Private Key from the password-protected PEM key data.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC private key component. Use EcFree() function to free the
- resource.
-
- If PemData is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **EcContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
deleted file mode 100644
index ee940eb5e0..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ /dev/null
@@ -1,195 +0,0 @@
-/** @file
- Authenticode Portable Executable Signature Verification over OpenSSL.
-
- Caution: This module requires additional review when modified.
- This library will have external input - signature (e.g. PE/COFF Authenticode).
- This external input must be validated carefully to avoid security issue like
- buffer overflow, integer overflow.
-
- AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for
- data structure.
-
-Copyright (c) 2011 - 2020, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-
-//
-// OID ASN.1 Value for SPC_INDIRECT_DATA_OBJID
-//
-GLOBAL_REMOVE_IF_UNREFERENCED const UINT8 mSpcIndirectOidValue[] = {
- 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x04
-};
-
-/**
- Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
- Authenticode Portable Executable Signature Format".
-
- If AuthData is NULL, then return FALSE.
- If ImageHash is NULL, then return FALSE.
-
- Caution: This function may receive untrusted input.
- PE/COFF Authenticode is external input, so this function will do basic check for
- Authenticode data structure.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[in] ImageHash Pointer to the original image file hash value. The procedure
- for calculating the image hash value is described in Authenticode
- specification.
- @param[in] HashSize Size of Image hash value in bytes.
-
- @retval TRUE The specified Authenticode Signature is valid.
- @retval FALSE Invalid Authenticode Signature.
-
-**/
-BOOLEAN
-EFIAPI
-AuthenticodeVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertSize,
- IN CONST UINT8 *ImageHash,
- IN UINTN HashSize
- )
-{
- BOOLEAN Status;
- PKCS7 *Pkcs7;
- CONST UINT8 *Temp;
- CONST UINT8 *OrigAuthData;
- UINT8 *SpcIndirectDataContent;
- UINT8 Asn1Byte;
- UINTN ContentSize;
- CONST UINT8 *SpcIndirectDataOid;
-
- //
- // Check input parameters.
- //
- if ((AuthData == NULL) || (TrustedCert == NULL) || (ImageHash == NULL)) {
- return FALSE;
- }
-
- if ((DataSize > INT_MAX) || (CertSize > INT_MAX) || (HashSize > INT_MAX)) {
- return FALSE;
- }
-
- Status = FALSE;
- Pkcs7 = NULL;
- OrigAuthData = AuthData;
-
- //
- // Retrieve & Parse PKCS#7 Data (DER encoding) from Authenticode Signature
- //
- Temp = AuthData;
- Pkcs7 = d2i_PKCS7 (NULL, &Temp, (int)DataSize);
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // Check if it's PKCS#7 Signed Data (for Authenticode Scenario)
- //
- if (!PKCS7_type_is_signed (Pkcs7) || PKCS7_get_detached (Pkcs7)) {
- goto _Exit;
- }
-
- //
- // NOTE: OpenSSL PKCS7 Decoder didn't work for Authenticode-format signed data due to
- // some authenticode-specific structure. Use opaque ASN.1 string to retrieve
- // PKCS#7 ContentInfo here.
- //
- SpcIndirectDataOid = OBJ_get0_data (Pkcs7->d.sign->contents->type);
- // MU_CHANGE [BEGIN] - CodeQL change
- if (SpcIndirectDataOid == NULL) {
- goto _Exit;
- }
-
- // MU_CHANGE [END] - CodeQL change
- if ((OBJ_length (Pkcs7->d.sign->contents->type) != sizeof (mSpcIndirectOidValue)) ||
- (CompareMem (
- SpcIndirectDataOid,
- mSpcIndirectOidValue,
- sizeof (mSpcIndirectOidValue)
- ) != 0))
- {
- //
- // Un-matched SPC_INDIRECT_DATA_OBJID.
- //
- goto _Exit;
- }
-
- SpcIndirectDataContent = (UINT8 *)(Pkcs7->d.sign->contents->d.other->value.asn1_string->data);
-
- //
- // Retrieve the SEQUENCE data size from ASN.1-encoded SpcIndirectDataContent.
- //
- Asn1Byte = *(SpcIndirectDataContent + 1);
-
- if ((Asn1Byte & 0x80) == 0) {
- //
- // Short Form of Length Encoding (Length < 128)
- //
- ContentSize = (UINTN)(Asn1Byte & 0x7F);
- //
- // Skip the SEQUENCE Tag;
- //
- SpcIndirectDataContent += 2;
- } else if ((Asn1Byte & 0x81) == 0x81) {
- //
- // Long Form of Length Encoding (128 <= Length < 255, Single Octet)
- //
- ContentSize = (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 2));
- //
- // Skip the SEQUENCE Tag;
- //
- SpcIndirectDataContent += 3;
- } else if ((Asn1Byte & 0x82) == 0x82) {
- //
- // Long Form of Length Encoding (Length > 255, Two Octet)
- //
- ContentSize = (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 2));
- ContentSize = (ContentSize << 8) + (UINTN)(*(UINT8 *)(SpcIndirectDataContent + 3));
- //
- // Skip the SEQUENCE Tag;
- //
- SpcIndirectDataContent += 4;
- } else {
- goto _Exit;
- }
-
- //
- // Compare the original file hash value to the digest retrieve from SpcIndirectDataContent
- // defined in Authenticode
- // NOTE: Need to double-check HashLength here!
- //
- if (CompareMem (SpcIndirectDataContent + ContentSize - HashSize, ImageHash, HashSize) != 0) {
- //
- // Un-matched PE/COFF Hash Value
- //
- goto _Exit;
- }
-
- //
- // Verifies the PKCS#7 Signed Data in PE/COFF Authenticode Signature
- //
- Status = (BOOLEAN)Pkcs7Verify (OrigAuthData, DataSize, TrustedCert, CertSize, SpcIndirectDataContent, ContentSize);
-
-_Exit:
- //
- // Release Resources
- //
- PKCS7_free (Pkcs7);
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticodeNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticodeNull.c
deleted file mode 100644
index 62e8400c4c..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticodeNull.c
+++ /dev/null
@@ -1,45 +0,0 @@
-/** @file
- Authenticode Portable Executable Signature Verification which does not provide
- real capabilities.
-
-Copyright (c) 2012, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
- Authenticode Portable Executable Signature Format".
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[in] ImageHash Pointer to the original image file hash value. The procedure
- for calculating the image hash value is described in Authenticode
- specification.
- @param[in] HashSize Size of Image hash value in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AuthenticodeVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertSize,
- IN CONST UINT8 *ImageHash,
- IN UINTN HashSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
deleted file mode 100644
index 6224aa1842..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
+++ /dev/null
@@ -1,315 +0,0 @@
-/** @file
- Diffie-Hellman Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-
-/**
- Allocates and Initializes one Diffie-Hellman Context for subsequent use.
-
- @return Pointer to the Diffie-Hellman Context that has been initialized.
- If the allocations fails, DhNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-DhNew (
- VOID
- )
-{
- //
- // Allocates & Initializes DH Context by OpenSSL DH_new()
- //
- return (VOID *)DH_new ();
-}
-
-/**
- Release the specified DH context.
-
- If DhContext is NULL, then return FALSE.
-
- @param[in] DhContext Pointer to the DH context to be released.
-
-**/
-VOID
-EFIAPI
-DhFree (
- IN VOID *DhContext
- )
-{
- //
- // Free OpenSSL DH Context
- //
- DH_free ((DH *)DhContext);
-}
-
-/**
- Generates DH parameter.
-
- Given generator g, and length of prime number p in bits, this function generates p,
- and sets DH context according to value of g and p.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[out] Prime Pointer to the buffer to receive the generated prime number.
-
- @retval TRUE DH parameter generation succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE PRNG fails to generate random prime number with PrimeLength.
-
-**/
-BOOLEAN
-EFIAPI
-DhGenerateParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- OUT UINT8 *Prime
- )
-{
- BOOLEAN RetVal;
- BIGNUM *BnP;
-
- //
- // Check input parameters.
- //
- if ((DhContext == NULL) || (Prime == NULL) || (PrimeLength > INT_MAX)) {
- return FALSE;
- }
-
- if ((Generator != DH_GENERATOR_2) && (Generator != DH_GENERATOR_5)) {
- return FALSE;
- }
-
- RetVal = (BOOLEAN)DH_generate_parameters_ex (DhContext, (UINT32)PrimeLength, (UINT32)Generator, NULL);
- if (!RetVal) {
- return FALSE;
- }
-
- DH_get0_pqg (DhContext, (const BIGNUM **)&BnP, NULL, NULL);
- BN_bn2bin (BnP, Prime);
-
- return TRUE;
-}
-
-/**
- Sets generator and prime parameters for DH.
-
- Given generator g, and prime number p, this function and sets DH
- context accordingly.
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[in] Prime Pointer to the prime number.
-
- @retval TRUE DH parameter setting succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE Value of Generator is not suitable for the Prime.
- @retval FALSE Value of Prime is not a prime number.
- @retval FALSE Value of Prime is not a safe prime number.
-
-**/
-BOOLEAN
-EFIAPI
-DhSetParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- IN CONST UINT8 *Prime
- )
-{
- DH *Dh;
- BIGNUM *BnP;
- BIGNUM *BnG;
-
- //
- // Check input parameters.
- //
- if ((DhContext == NULL) || (Prime == NULL) || (PrimeLength > INT_MAX)) {
- return FALSE;
- }
-
- if ((Generator != DH_GENERATOR_2) && (Generator != DH_GENERATOR_5)) {
- return FALSE;
- }
-
- //
- // Set the generator and prime parameters for DH object.
- //
- Dh = (DH *)DhContext;
- BnP = BN_bin2bn ((const unsigned char *)Prime, (int)(PrimeLength / 8), NULL);
- BnG = BN_bin2bn ((const unsigned char *)&Generator, 1, NULL);
- if ((BnP == NULL) || (BnG == NULL) || !DH_set0_pqg (Dh, BnP, NULL, BnG)) {
- goto Error;
- }
-
- return TRUE;
-
-Error:
- // MU_CHANGE [BEGIN] - CodeQL change
- if (BnP != NULL) {
- BN_free (BnP);
- }
-
- if (BnG != NULL) {
- BN_free (BnG);
- }
-
- // MU_CHANGE [END] - CodeQL change
-
- return FALSE;
-}
-
-/**
- Generates DH public key.
-
- This function generates random secret exponent, and computes the public key, which is
- returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
- If the PublicKey buffer is too small to hold the public key, FALSE is returned and
- PublicKeySize is set to the required buffer size to obtain the public key.
-
- If DhContext is NULL, then return FALSE.
- If PublicKeySize is NULL, then return FALSE.
- If PublicKeySize is large enough but PublicKey is NULL, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[out] PublicKey Pointer to the buffer to receive generated public key.
- @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
- On output, the size of data returned in PublicKey buffer in bytes.
-
- @retval TRUE DH public key generation succeeded.
- @retval FALSE DH public key generation failed.
- @retval FALSE PublicKeySize is not large enough.
-
-**/
-BOOLEAN
-EFIAPI
-DhGenerateKey (
- IN OUT VOID *DhContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- BOOLEAN RetVal;
- DH *Dh;
- BIGNUM *DhPubKey;
- INTN Size;
-
- //
- // Check input parameters.
- //
- if ((DhContext == NULL) || (PublicKeySize == NULL)) {
- return FALSE;
- }
-
- if ((PublicKey == NULL) && (*PublicKeySize != 0)) {
- return FALSE;
- }
-
- Dh = (DH *)DhContext;
-
- RetVal = (BOOLEAN)DH_generate_key (DhContext);
- if (RetVal) {
- DH_get0_key (Dh, (const BIGNUM **)&DhPubKey, NULL);
- Size = BN_num_bytes (DhPubKey);
- if ((Size > 0) && (*PublicKeySize < (UINTN)Size)) {
- *PublicKeySize = Size;
- return FALSE;
- }
-
- if (PublicKey != NULL) {
- BN_bn2bin (DhPubKey, PublicKey);
- }
-
- *PublicKeySize = Size;
- }
-
- return RetVal;
-}
-
-/**
- Computes exchanged common key.
-
- Given peer's public key, this function computes the exchanged common key, based on its own
- context including value of prime modulus and random secret exponent.
-
- If DhContext is NULL, then return FALSE.
- If PeerPublicKey is NULL, then return FALSE.
- If KeySize is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] PeerPublicKey Pointer to the peer's public key.
- @param[in] PeerPublicKeySize Size of peer's public key in bytes.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
-
- @retval TRUE DH exchanged key generation succeeded.
- @retval FALSE DH exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
-
-**/
-BOOLEAN
-EFIAPI
-DhComputeKey (
- IN OUT VOID *DhContext,
- IN CONST UINT8 *PeerPublicKey,
- IN UINTN PeerPublicKeySize,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- BIGNUM *Bn;
- INTN Size;
-
- //
- // Check input parameters.
- //
- if ((DhContext == NULL) || (PeerPublicKey == NULL) || (KeySize == NULL) || (Key == NULL)) {
- return FALSE;
- }
-
- if (PeerPublicKeySize > INT_MAX) {
- return FALSE;
- }
-
- Bn = BN_bin2bn (PeerPublicKey, (UINT32)PeerPublicKeySize, NULL);
- if (Bn == NULL) {
- return FALSE;
- }
-
- Size = DH_compute_key (Key, Bn, DhContext);
- if (Size < 0) {
- BN_free (Bn);
- return FALSE;
- }
-
- if (*KeySize < (UINTN)Size) {
- *KeySize = Size;
- BN_free (Bn);
- return FALSE;
- }
-
- *KeySize = Size;
- BN_free (Bn);
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDhNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDhNull.c
deleted file mode 100644
index 8987084122..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDhNull.c
+++ /dev/null
@@ -1,150 +0,0 @@
-/** @file
- Diffie-Hellman Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Allocates and Initializes one Diffie-Hellman Context for subsequent use.
-
- @return Pointer to the Diffie-Hellman Context that has been initialized.
- If the interface is not supported, DhNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-DhNew (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified DH context.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] DhContext Pointer to the DH context to be released.
-
-**/
-VOID
-EFIAPI
-DhFree (
- IN VOID *DhContext
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Generates DH parameter.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[out] Prime Pointer to the buffer to receive the generated prime number.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhGenerateParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- OUT UINT8 *Prime
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Sets generator and prime parameters for DH.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[in] Prime Pointer to the prime number.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhSetParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- IN CONST UINT8 *Prime
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Generates DH public key.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[out] PublicKey Pointer to the buffer to receive generated public key.
- @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
- On output, the size of data returned in PublicKey buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhGenerateKey (
- IN OUT VOID *DhContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes exchanged common key.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] PeerPublicKey Pointer to the peer's public key.
- @param[in] PeerPublicKeySize Size of peer's public key in bytes.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhComputeKey (
- IN OUT VOID *DhContext,
- IN CONST UINT8 *PeerPublicKey,
- IN UINTN PeerPublicKeySize,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptEc.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptEc.c
deleted file mode 100644
index fc95075dff..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptEc.c
+++ /dev/null
@@ -1,1036 +0,0 @@
-/** @file
- Elliptic Curve and ECDH API implementation based on OpenSSL
-
- Copyright (c) 2022, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-#include
-
-// =====================================================================================
-// Basic Elliptic Curve Primitives
-// =====================================================================================
-
-/**
- Return the Nid of certain ECC curve.
-
- @param[in] CryptoNid Identifying number for the ECC curve (Defined in
- BaseCryptLib.h).
-
- @retval !=-1 On success.
- @retval -1 ECC curve not supported.
-**/
-STATIC
-INT32
-CryptoNidToOpensslNid (
- IN UINTN CryptoNid
- )
-{
- INT32 Nid;
-
- switch (CryptoNid) {
- case CRYPTO_NID_SECP256R1:
- Nid = NID_X9_62_prime256v1;
- break;
- case CRYPTO_NID_SECP384R1:
- Nid = NID_secp384r1;
- break;
- case CRYPTO_NID_SECP521R1:
- Nid = NID_secp521r1;
- break;
- default:
- return -1;
- }
-
- return Nid;
-}
-
-/**
- Initialize new opaque EcGroup object. This object represents an EC curve and
- and is used for calculation within this group. This object should be freed
- using EcGroupFree() function.
-
- @param[in] CryptoNid Identifying number for the ECC curve (Defined in
- BaseCryptLib.h).
-
- @retval EcGroup object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-EcGroupInit (
- IN UINTN CryptoNid
- )
-{
- INT32 Nid;
-
- Nid = CryptoNidToOpensslNid (CryptoNid);
-
- if (Nid < 0) {
- return NULL;
- }
-
- return EC_GROUP_new_by_curve_name (Nid);
-}
-
-/**
- Get EC curve parameters. While elliptic curve equation is Y^2 mod P = (X^3 + AX + B) Mod P.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnPrime Group prime number.
- @param[out] BnA A coefficient.
- @param[out] BnB B coefficient..
- @param[in] BnCtx BN context.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcGroupGetCurve (
- IN CONST VOID *EcGroup,
- OUT VOID *BnPrime,
- OUT VOID *BnA,
- OUT VOID *BnB,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_GROUP_get_curve (EcGroup, BnPrime, BnA, BnB, BnCtx);
-}
-
-/**
- Get EC group order.
- This function will set the provided Big Number object to the corresponding
- value. The caller needs to make sure that the "out" BigNumber parameter
- is properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnOrder Group prime number.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcGroupGetOrder (
- IN VOID *EcGroup,
- OUT VOID *BnOrder
- )
-{
- return (BOOLEAN)EC_GROUP_get_order (EcGroup, BnOrder, NULL);
-}
-
-/**
- Free previously allocated EC group object using EcGroupInit().
-
- @param[in] EcGroup EC group object to free.
-**/
-VOID
-EFIAPI
-EcGroupFree (
- IN VOID *EcGroup
- )
-{
- EC_GROUP_free (EcGroup);
-}
-
-/**
- Initialize new opaque EC Point object. This object represents an EC point
- within the given EC group (curve).
-
- @param[in] EC Group, properly initialized using EcGroupInit().
-
- @retval EC Point object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-EcPointInit (
- IN CONST VOID *EcGroup
- )
-{
- return EC_POINT_new (EcGroup);
-}
-
-/**
- Free previously allocated EC Point object using EcPointInit().
-
- @param[in] EcPoint EC Point to free.
- @param[in] Clear TRUE iff the memory should be cleared.
-**/
-VOID
-EFIAPI
-EcPointDeInit (
- IN VOID *EcPoint,
- IN BOOLEAN Clear
- )
-{
- if (Clear) {
- EC_POINT_clear_free (EcPoint);
- } else {
- EC_POINT_free (EcPoint);
- }
-}
-
-/**
- Get EC point affine (x,y) coordinates.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[out] BnX X coordinate.
- @param[out] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointGetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- OUT VOID *BnX,
- OUT VOID *BnY,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_POINT_get_affine_coordinates (EcGroup, EcPoint, BnX, BnY, BnCtx);
-}
-
-/**
- Set EC point affine (x,y) coordinates.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[in] BnX X coordinate.
- @param[in] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointSetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN CONST VOID *BnY,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_POINT_set_affine_coordinates (EcGroup, EcPoint, BnX, BnY, BnCtx);
-}
-
-/**
- EC Point addition. EcPointResult = EcPointA + EcPointB.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPointA EC Point.
- @param[in] EcPointB EC Point.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointAdd (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_POINT_add (EcGroup, EcPointResult, EcPointA, EcPointB, BnCtx);
-}
-
-/**
- Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPoint EC Point.
- @param[in] BnPScalar P Scalar.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointMul (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPoint,
- IN CONST VOID *BnPScalar,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_POINT_mul (EcGroup, EcPointResult, NULL, EcPoint, BnPScalar, BnCtx);
-}
-
-/**
- Calculate the inverse of the supplied EC point.
-
- @param[in] EcGroup EC group object.
- @param[in,out] EcPoint EC point to invert.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointInvert (
- IN CONST VOID *EcGroup,
- IN OUT VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_POINT_invert (EcGroup, EcPoint, BnCtx);
-}
-
-/**
- Check if the supplied point is on EC curve.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On curve.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointIsOnCurve (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- return EC_POINT_is_on_curve (EcGroup, EcPoint, BnCtx) == 1;
-}
-
-/**
- Check if the supplied point is at infinity.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
-
- @retval TRUE At infinity.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointIsAtInfinity (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint
- )
-{
- return EC_POINT_is_at_infinity (EcGroup, EcPoint) == 1;
-}
-
-/**
- Check if EC points are equal.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPointA EC point A.
- @param[in] EcPointB EC point B.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE A == B.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointEqual (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- return EC_POINT_cmp (EcGroup, EcPointA, EcPointB, BnCtx) == 0;
-}
-
-/**
- Set EC point compressed coordinates. Points can be described in terms of
- their compressed coordinates. For a point (x, y), for any given value for x
- such that the point is on the curve there will only ever be two possible
- values for y. Therefore, a point can be set using this function where BnX is
- the x coordinate and YBit is a value 0 or 1 to identify which of the two
- possible values for y should be used.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC Point.
- @param[in] BnX X coordinate.
- @param[in] YBit 0 or 1 to identify which Y value is used.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointSetCompressedCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN UINT8 YBit,
- IN VOID *BnCtx
- )
-{
- return (BOOLEAN)EC_POINT_set_compressed_coordinates (EcGroup, EcPoint, BnX, YBit, BnCtx);
-}
-
-// =====================================================================================
-// Elliptic Curve Diffie Hellman Primitives
-// =====================================================================================
-
-/**
- Allocates and Initializes one Elliptic Curve Context for subsequent use
- with the NID.
-
- @param[in] Nid Identifying number for the ECC curve (Defined in
- BaseCryptLib.h).
- @return Pointer to the Elliptic Curve Context that has been initialized.
- If the allocations fails, EcNewByNid() returns NULL.
-**/
-VOID *
-EFIAPI
-EcNewByNid (
- IN UINTN Nid
- )
-{
- INT32 OpenSslNid;
-
- OpenSslNid = CryptoNidToOpensslNid (Nid);
- if (OpenSslNid < 0) {
- return NULL;
- }
-
- return (VOID *)EC_KEY_new_by_curve_name (OpenSslNid);
-}
-
-/**
- Release the specified EC context.
-
- @param[in] EcContext Pointer to the EC context to be released.
-**/
-VOID
-EFIAPI
-EcFree (
- IN VOID *EcContext
- )
-{
- EC_KEY_free ((EC_KEY *)EcContext);
-}
-
-/**
- Generates EC key and returns EC public key (X, Y), Please note, this function uses
- pseudo random number generator. The caller must make sure RandomSeed()
- function was properly called before.
- The Ec context should be correctly initialized by EcNewByNid.
- This function generates random secret, and computes the public key (X, Y), which is
- returned via parameter Public, PublicSize.
- X is the first half of Public with size being PublicSize / 2,
- Y is the second half of Public with size being PublicSize / 2.
- EC context is updated accordingly.
- If the Public buffer is too small to hold the public X, Y, FALSE is returned and
- PublicSize is set to the required buffer size to obtain the public X, Y.
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- If EcContext is NULL, then return FALSE.
- If PublicSize is NULL, then return FALSE.
- If PublicSize is large enough but Public is NULL, then return FALSE.
- @param[in, out] EcContext Pointer to the EC context.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC public X,Y generation succeeded.
- @retval FALSE EC public X,Y generation failed.
- @retval FALSE PublicKeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-EcGenerateKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- EC_KEY *EcKey;
- CONST EC_GROUP *Group;
- CONST EC_POINT *EcPoint;
- BOOLEAN RetVal;
- BIGNUM *BnX;
- BIGNUM *BnY;
- UINTN HalfSize;
- INTN XSize;
- INTN YSize;
-
- if ((EcContext == NULL) || (PublicKeySize == NULL)) {
- return FALSE;
- }
-
- if ((PublicKey == NULL) && (*PublicKeySize != 0)) {
- return FALSE;
- }
-
- EcKey = (EC_KEY *)EcContext;
- Group = EC_KEY_get0_group (EcKey);
- HalfSize = (EC_GROUP_get_degree (Group) + 7) / 8;
-
- // Assume RAND_seed was called
- if (EC_KEY_generate_key (EcKey) != 1) {
- return FALSE;
- }
-
- if (*PublicKeySize < HalfSize * 2) {
- *PublicKeySize = HalfSize * 2;
- return FALSE;
- }
-
- *PublicKeySize = HalfSize * 2;
-
- EcPoint = EC_KEY_get0_public_key (EcKey);
- if (EcPoint == NULL) {
- return FALSE;
- }
-
- RetVal = FALSE;
- BnX = BN_new ();
- BnY = BN_new ();
- if ((BnX == NULL) || (BnY == NULL)) {
- goto fail;
- }
-
- if (EC_POINT_get_affine_coordinates (Group, EcPoint, BnX, BnY, NULL) != 1) {
- goto fail;
- }
-
- XSize = BN_num_bytes (BnX);
- YSize = BN_num_bytes (BnY);
- if ((XSize <= 0) || (YSize <= 0)) {
- goto fail;
- }
-
- ASSERT ((UINTN)XSize <= HalfSize && (UINTN)YSize <= HalfSize);
-
- ZeroMem (PublicKey, *PublicKeySize);
- BN_bn2bin (BnX, &PublicKey[0 + HalfSize - XSize]);
- BN_bn2bin (BnY, &PublicKey[HalfSize + HalfSize - YSize]);
-
- RetVal = TRUE;
-
-fail:
- BN_free (BnX);
- BN_free (BnY);
- return RetVal;
-}
-
-/**
- Gets the public key component from the established EC context.
- The Ec context should be correctly initialized by EcNewByNid, and successfully
- generate key pair from EcGenerateKey().
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to EC context being set.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC key component was retrieved successfully.
- @retval FALSE Invalid EC key component.
-**/
-BOOLEAN
-EFIAPI
-EcGetPubKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- EC_KEY *EcKey;
- CONST EC_GROUP *Group;
- CONST EC_POINT *EcPoint;
- BIGNUM *BnX;
- BIGNUM *BnY;
- UINTN HalfSize;
- INTN XSize;
- INTN YSize;
- BOOLEAN RetVal;
-
- if ((EcContext == NULL) || (PublicKeySize == NULL)) {
- return FALSE;
- }
-
- if ((PublicKey == NULL) && (*PublicKeySize != 0)) {
- return FALSE;
- }
-
- // MU_CHANGE [BEGIN] - CodeQL change
- BnX = NULL;
- BnY = NULL;
- // MU_CHANGE [END] - CodeQL change
-
- EcKey = (EC_KEY *)EcContext;
- Group = EC_KEY_get0_group (EcKey);
- HalfSize = (EC_GROUP_get_degree (Group) + 7) / 8;
- if (*PublicKeySize < HalfSize * 2) {
- *PublicKeySize = HalfSize * 2;
- return FALSE;
- }
-
- *PublicKeySize = HalfSize * 2;
-
- EcPoint = EC_KEY_get0_public_key (EcKey);
- if (EcPoint == NULL) {
- return FALSE;
- }
-
- RetVal = FALSE;
- BnX = BN_new ();
- BnY = BN_new ();
- if ((BnX == NULL) || (BnY == NULL)) {
- goto fail;
- }
-
- if (EC_POINT_get_affine_coordinates (Group, EcPoint, BnX, BnY, NULL) != 1) {
- goto fail;
- }
-
- XSize = BN_num_bytes (BnX);
- YSize = BN_num_bytes (BnY);
- if ((XSize <= 0) || (YSize <= 0)) {
- goto fail;
- }
-
- ASSERT ((UINTN)XSize <= HalfSize && (UINTN)YSize <= HalfSize);
-
- if (PublicKey != NULL) {
- ZeroMem (PublicKey, *PublicKeySize);
- BN_bn2bin (BnX, &PublicKey[0 + HalfSize - XSize]);
- BN_bn2bin (BnY, &PublicKey[HalfSize + HalfSize - YSize]);
- }
-
- RetVal = TRUE;
-
-fail:
- // MU_CHANGE [BEGIN] - CodeQL change
- if (BnX != NULL) {
- BN_free (BnX);
- }
-
- if (BnY != NULL) {
- BN_free (BnY);
- }
-
- // MU_CHANGE [END] - CodeQL change
- return RetVal;
-}
-
-/**
- Computes exchanged common key.
- Given peer's public key (X, Y), this function computes the exchanged common key,
- based on its own context including value of curve parameter and random secret.
- X is the first half of PeerPublic with size being PeerPublicSize / 2,
- Y is the second half of PeerPublic with size being PeerPublicSize / 2.
- If public key is compressed, the PeerPublic will only contain half key (X).
- If EcContext is NULL, then return FALSE.
- If PeerPublic is NULL, then return FALSE.
- If PeerPublicSize is 0, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- For P-256, the PeerPublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PeerPublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PeerPublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to the EC context.
- @param[in] PeerPublic Pointer to the peer's public X,Y.
- @param[in] PeerPublicSize Size of peer's public X,Y in bytes.
- @param[in] CompressFlag Flag of PeerPublic is compressed or not.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
- @retval TRUE EC exchanged key generation succeeded.
- @retval FALSE EC exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-EcDhComputeKey (
- IN OUT VOID *EcContext,
- IN CONST UINT8 *PeerPublic,
- IN UINTN PeerPublicSize,
- IN CONST INT32 *CompressFlag,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- EC_KEY *EcKey;
- EC_KEY *PeerEcKey;
- CONST EC_GROUP *Group;
- BOOLEAN RetVal;
- BIGNUM *BnX;
- BIGNUM *BnY;
- EC_POINT *Point;
- INT32 OpenSslNid;
- UINTN HalfSize;
-
- if ((EcContext == NULL) || (PeerPublic == NULL) || (KeySize == NULL)) {
- return FALSE;
- }
-
- if ((Key == NULL) && (*KeySize != 0)) {
- return FALSE;
- }
-
- if (PeerPublicSize > INT_MAX) {
- return FALSE;
- }
-
- EcKey = (EC_KEY *)EcContext;
- Group = EC_KEY_get0_group (EcKey);
- HalfSize = (EC_GROUP_get_degree (Group) + 7) / 8;
- if ((CompressFlag == NULL) && (PeerPublicSize != HalfSize * 2)) {
- return FALSE;
- }
-
- if ((CompressFlag != NULL) && (PeerPublicSize != HalfSize)) {
- return FALSE;
- }
-
- if (*KeySize < HalfSize) {
- *KeySize = HalfSize;
- return FALSE;
- }
-
- *KeySize = HalfSize;
-
- RetVal = FALSE;
- Point = NULL;
- BnX = BN_bin2bn (PeerPublic, (INT32)HalfSize, NULL);
- BnY = NULL;
- Point = EC_POINT_new (Group);
- PeerEcKey = NULL;
- if ((BnX == NULL) || (Point == NULL)) {
- goto fail;
- }
-
- if (CompressFlag == NULL) {
- BnY = BN_bin2bn (PeerPublic + HalfSize, (INT32)HalfSize, NULL);
- if (BnY == NULL) {
- goto fail;
- }
-
- if (EC_POINT_set_affine_coordinates (Group, Point, BnX, BnY, NULL) != 1) {
- goto fail;
- }
- } else {
- if (EC_POINT_set_compressed_coordinates (Group, Point, BnX, *CompressFlag, NULL) != 1) {
- goto fail;
- }
- }
-
- // Validate NIST ECDH public key
- OpenSslNid = EC_GROUP_get_curve_name (Group);
- PeerEcKey = EC_KEY_new_by_curve_name (OpenSslNid);
- if (PeerEcKey == NULL) {
- goto fail;
- }
-
- if (EC_KEY_set_public_key (PeerEcKey, Point) != 1) {
- goto fail;
- }
-
- if (EC_KEY_check_key (PeerEcKey) != 1) {
- goto fail;
- }
-
- if (ECDH_compute_key (Key, *KeySize, Point, EcKey, NULL) <= 0) {
- goto fail;
- }
-
- RetVal = TRUE;
-
-fail:
- BN_free (BnX);
- BN_free (BnY);
- EC_POINT_free (Point);
- EC_KEY_free (PeerEcKey);
- return RetVal;
-}
-
-/**
- Carries out the EC-DSA signature.
-
- This function carries out the EC-DSA signature.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
- If SigSize is large enough but Signature is NULL, then return FALSE.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature generation.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive EC-DSA signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in EC-DSA.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
-
-**/
-BOOLEAN
-EFIAPI
-EcDsaSign (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- EC_KEY *EcKey;
- ECDSA_SIG *EcDsaSig;
- INT32 OpenSslNid;
- UINT8 HalfSize;
- BIGNUM *R;
- BIGNUM *S;
- INTN RSize;
- INTN SSize;
-
- if ((EcContext == NULL) || (MessageHash == NULL)) {
- return FALSE;
- }
-
- if (Signature == NULL) {
- return FALSE;
- }
-
- EcKey = (EC_KEY *)EcContext;
- OpenSslNid = EC_GROUP_get_curve_name (EC_KEY_get0_group (EcKey));
- switch (OpenSslNid) {
- case NID_X9_62_prime256v1:
- HalfSize = 32;
- break;
- case NID_secp384r1:
- HalfSize = 48;
- break;
- case NID_secp521r1:
- HalfSize = 66;
- break;
- default:
- return FALSE;
- }
-
- if (*SigSize < (UINTN)(HalfSize * 2)) {
- *SigSize = HalfSize * 2;
- return FALSE;
- }
-
- *SigSize = HalfSize * 2;
- ZeroMem (Signature, *SigSize);
-
- switch (HashNid) {
- case CRYPTO_NID_SHA256:
- if (HashSize != SHA256_DIGEST_SIZE) {
- return FALSE;
- }
-
- break;
-
- case CRYPTO_NID_SHA384:
- if (HashSize != SHA384_DIGEST_SIZE) {
- return FALSE;
- }
-
- break;
-
- case CRYPTO_NID_SHA512:
- if (HashSize != SHA512_DIGEST_SIZE) {
- return FALSE;
- }
-
- break;
-
- default:
- return FALSE;
- }
-
- EcDsaSig = ECDSA_do_sign (
- MessageHash,
- (UINT32)HashSize,
- (EC_KEY *)EcContext
- );
- if (EcDsaSig == NULL) {
- return FALSE;
- }
-
- ECDSA_SIG_get0 (EcDsaSig, (CONST BIGNUM **)&R, (CONST BIGNUM **)&S);
-
- RSize = BN_num_bytes (R);
- SSize = BN_num_bytes (S);
- if ((RSize <= 0) || (SSize <= 0)) {
- ECDSA_SIG_free (EcDsaSig);
- return FALSE;
- }
-
- ASSERT ((UINTN)RSize <= HalfSize && (UINTN)SSize <= HalfSize);
-
- BN_bn2bin (R, &Signature[0 + HalfSize - RSize]);
- BN_bn2bin (S, &Signature[HalfSize + HalfSize - SSize]);
-
- ECDSA_SIG_free (EcDsaSig);
-
- return TRUE;
-}
-
-/**
- Verifies the EC-DSA signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature verification.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to EC-DSA signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in EC-DSA.
- @retval FALSE Invalid signature or invalid EC context.
-
-**/
-BOOLEAN
-EFIAPI
-EcDsaVerify (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- INT32 Result;
- EC_KEY *EcKey;
- ECDSA_SIG *EcDsaSig;
- INT32 OpenSslNid;
- UINT8 HalfSize;
- BIGNUM *R;
- BIGNUM *S;
-
- if ((EcContext == NULL) || (MessageHash == NULL) || (Signature == NULL)) {
- return FALSE;
- }
-
- if ((SigSize > INT_MAX) || (SigSize == 0)) {
- return FALSE;
- }
-
- EcKey = (EC_KEY *)EcContext;
- OpenSslNid = EC_GROUP_get_curve_name (EC_KEY_get0_group (EcKey));
- switch (OpenSslNid) {
- case NID_X9_62_prime256v1:
- HalfSize = 32;
- break;
- case NID_secp384r1:
- HalfSize = 48;
- break;
- case NID_secp521r1:
- HalfSize = 66;
- break;
- default:
- return FALSE;
- }
-
- if (SigSize != (UINTN)(HalfSize * 2)) {
- return FALSE;
- }
-
- switch (HashNid) {
- case CRYPTO_NID_SHA256:
- if (HashSize != SHA256_DIGEST_SIZE) {
- return FALSE;
- }
-
- break;
-
- case CRYPTO_NID_SHA384:
- if (HashSize != SHA384_DIGEST_SIZE) {
- return FALSE;
- }
-
- break;
-
- case CRYPTO_NID_SHA512:
- if (HashSize != SHA512_DIGEST_SIZE) {
- return FALSE;
- }
-
- break;
-
- default:
- return FALSE;
- }
-
- EcDsaSig = ECDSA_SIG_new ();
- if (EcDsaSig == NULL) {
- ECDSA_SIG_free (EcDsaSig);
- return FALSE;
- }
-
- R = BN_bin2bn (Signature, (UINT32)HalfSize, NULL);
- S = BN_bin2bn (Signature + HalfSize, (UINT32)HalfSize, NULL);
- if ((R == NULL) || (S == NULL)) {
- ECDSA_SIG_free (EcDsaSig);
- return FALSE;
- }
-
- ECDSA_SIG_set0 (EcDsaSig, R, S);
-
- Result = ECDSA_do_verify (
- MessageHash,
- (UINT32)HashSize,
- EcDsaSig,
- (EC_KEY *)EcContext
- );
-
- ECDSA_SIG_free (EcDsaSig);
-
- return (Result == 1);
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptEcNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptEcNull.c
deleted file mode 100644
index 1129fa7696..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptEcNull.c
+++ /dev/null
@@ -1,578 +0,0 @@
-/** @file
- Elliptic Curve and ECDH API implementation based on OpenSSL
-
- Copyright (c) 2022, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-/**
- Initialize new opaque EcGroup object. This object represents an EC curve and
- and is used for calculation within this group. This object should be freed
- using EcGroupFree() function.
-
- @param[in] CryptoNid Identifying number for the ECC curve (Defined in
- BaseCryptLib.h).
-
- @retval EcGroup object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-EcGroupInit (
- IN UINTN CryptoNid
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Get EC curve parameters. While elliptic curve equation is Y^2 mod P = (X^3 + AX + B) Mod P.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnPrime Group prime number.
- @param[out] BnA A coefficient.
- @param[out] BnB B coefficient..
- @param[in] BnCtx BN context.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcGroupGetCurve (
- IN CONST VOID *EcGroup,
- OUT VOID *BnPrime,
- OUT VOID *BnA,
- OUT VOID *BnB,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Get EC group order.
- This function will set the provided Big Number object to the corresponding
- value. The caller needs to make sure that the "out" BigNumber parameter
- is properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnOrder Group prime number.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcGroupGetOrder (
- IN VOID *EcGroup,
- OUT VOID *BnOrder
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Free previously allocated EC group object using EcGroupInit().
-
- @param[in] EcGroup EC group object to free.
-**/
-VOID
-EFIAPI
-EcGroupFree (
- IN VOID *EcGroup
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Initialize new opaque EC Point object. This object represents an EC point
- within the given EC group (curve).
-
- @param[in] EC Group, properly initialized using EcGroupInit().
-
- @retval EC Point object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-EcPointInit (
- IN CONST VOID *EcGroup
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Free previously allocated EC Point object using EcPointInit().
-
- @param[in] EcPoint EC Point to free.
- @param[in] Clear TRUE iff the memory should be cleared.
-**/
-VOID
-EFIAPI
-EcPointDeInit (
- IN VOID *EcPoint,
- IN BOOLEAN Clear
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Get EC point affine (x,y) coordinates.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[out] BnX X coordinate.
- @param[out] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointGetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- OUT VOID *BnX,
- OUT VOID *BnY,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Set EC point affine (x,y) coordinates.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[in] BnX X coordinate.
- @param[in] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointSetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN CONST VOID *BnY,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- EC Point addition. EcPointResult = EcPointA + EcPointB.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPointA EC Point.
- @param[in] EcPointB EC Point.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointAdd (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPoint EC Point.
- @param[in] BnPScalar P Scalar.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointMul (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPoint,
- IN CONST VOID *BnPScalar,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Calculate the inverse of the supplied EC point.
-
- @param[in] EcGroup EC group object.
- @param[in,out] EcPoint EC point to invert.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointInvert (
- IN CONST VOID *EcGroup,
- IN OUT VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Check if the supplied point is on EC curve.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On curve.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointIsOnCurve (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Check if the supplied point is at infinity.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
-
- @retval TRUE At infinity.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointIsAtInfinity (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Check if EC points are equal.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPointA EC point A.
- @param[in] EcPointB EC point B.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE A == B.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointEqual (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Set EC point compressed coordinates. Points can be described in terms of
- their compressed coordinates. For a point (x, y), for any given value for x
- such that the point is on the curve there will only ever be two possible
- values for y. Therefore, a point can be set using this function where BnX is
- the x coordinate and YBit is a value 0 or 1 to identify which of the two
- possible values for y should be used.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC Point.
- @param[in] BnX X coordinate.
- @param[in] YBit 0 or 1 to identify which Y value is used.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointSetCompressedCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN UINT8 YBit,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Allocates and Initializes one Elliptic Curve Context for subsequent use
- with the NID.
-
- @param[in] Nid cipher NID
- @return Pointer to the Elliptic Curve Context that has been initialized.
- If the allocations fails, EcNewByNid() returns NULL.
-**/
-VOID *
-EFIAPI
-EcNewByNid (
- IN UINTN Nid
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified EC context.
-
- @param[in] EcContext Pointer to the EC context to be released.
-**/
-VOID
-EFIAPI
-EcFree (
- IN VOID *EcContext
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Generates EC key and returns EC public key (X, Y), Please note, this function uses
- pseudo random number generator. The caller must make sure RandomSeed()
- function was properly called before.
- The Ec context should be correctly initialized by EcNewByNid.
- This function generates random secret, and computes the public key (X, Y), which is
- returned via parameter Public, PublicSize.
- X is the first half of Public with size being PublicSize / 2,
- Y is the second half of Public with size being PublicSize / 2.
- EC context is updated accordingly.
- If the Public buffer is too small to hold the public X, Y, FALSE is returned and
- PublicSize is set to the required buffer size to obtain the public X, Y.
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- If EcContext is NULL, then return FALSE.
- If PublicSize is NULL, then return FALSE.
- If PublicSize is large enough but Public is NULL, then return FALSE.
- @param[in, out] EcContext Pointer to the EC context.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC public X,Y generation succeeded.
- @retval FALSE EC public X,Y generation failed.
- @retval FALSE PublicKeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-EcGenerateKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Gets the public key component from the established EC context.
- The Ec context should be correctly initialized by EcNewByNid, and successfully
- generate key pair from EcGenerateKey().
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to EC context being set.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC key component was retrieved successfully.
- @retval FALSE Invalid EC key component.
-**/
-BOOLEAN
-EFIAPI
-EcGetPubKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes exchanged common key.
- Given peer's public key (X, Y), this function computes the exchanged common key,
- based on its own context including value of curve parameter and random secret.
- X is the first half of PeerPublic with size being PeerPublicSize / 2,
- Y is the second half of PeerPublic with size being PeerPublicSize / 2.
- If EcContext is NULL, then return FALSE.
- If PeerPublic is NULL, then return FALSE.
- If PeerPublicSize is 0, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- For P-256, the PeerPublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PeerPublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PeerPublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to the EC context.
- @param[in] PeerPublic Pointer to the peer's public X,Y.
- @param[in] PeerPublicSize Size of peer's public X,Y in bytes.
- @param[in] CompressFlag Flag of PeerPublic is compressed or not.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
- @retval TRUE EC exchanged key generation succeeded.
- @retval FALSE EC exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-EcDhComputeKey (
- IN OUT VOID *EcContext,
- IN CONST UINT8 *PeerPublic,
- IN UINTN PeerPublicSize,
- IN CONST INT32 *CompressFlag,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Carries out the EC-DSA signature.
-
- This function carries out the EC-DSA signature.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
- If SigSize is large enough but Signature is NULL, then return FALSE.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature generation.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive EC-DSA signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in EC-DSA.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
-
-**/
-BOOLEAN
-EFIAPI
-EcDsaSign (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verifies the EC-DSA signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature verification.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to EC-DSA signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in EC-DSA.
- @retval FALSE Invalid signature or invalid EC context.
-
-**/
-BOOLEAN
-EFIAPI
-EcDsaVerify (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs1Oaep.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs1Oaep.c
deleted file mode 100644
index 7634ab1f6f..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs1Oaep.c
+++ /dev/null
@@ -1,714 +0,0 @@
-/** @file
- This file contains UEFI wrapper functions for RSA PKCS1v2 OAEP encryption routines.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2019, Intel Corporation. All rights reserved.
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-#include
-#include
-
-/**
- Retrieve a pointer to EVP message digest object.
-
- @param[in] DigestLen Length of the message digest.
-
-**/
-STATIC
-const
-EVP_MD *
-GetEvpMD (
- IN UINT16 DigestLen
- )
-{
- switch (DigestLen) {
- case SHA1_DIGEST_SIZE:
- return EVP_sha1 ();
- break;
- case SHA256_DIGEST_SIZE:
- return EVP_sha256 ();
- break;
- case SHA384_DIGEST_SIZE:
- return EVP_sha384 ();
- break;
- case SHA512_DIGEST_SIZE:
- return EVP_sha512 ();
- break;
- default:
- return NULL;
- }
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to parse X509 certificate.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] Pkey A pointer to an EVP_PKEY struct that
- will be used to encrypt the data.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-InternalPkcs1v2Encrypt (
- EVP_PKEY *Pkey,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- BOOLEAN Result;
- EVP_PKEY_CTX *PkeyCtx;
- UINT8 *OutData;
- UINTN OutDataSize;
- CONST EVP_MD *HashAlg;
-
- //
- // Check input parameters.
- //
- if ((Pkey == NULL) || (InData == NULL) ||
- (EncryptedData == NULL) || (EncryptedDataSize == NULL))
- {
- return FALSE;
- }
-
- *EncryptedData = NULL;
- *EncryptedDataSize = 0;
- Result = FALSE;
- PkeyCtx = NULL;
- OutData = NULL;
- OutDataSize = 0;
-
- //
- // If it provides a seed then use it.
- // Ohterwise, we'll seed with fixed values and hope that the PRNG has already been
- // used enough to generate sufficient entropy.
- //
- if (PrngSeed != NULL) {
- RandomSeed (PrngSeed, PrngSeedSize);
- } else {
- RandomSeed (NULL, 0);
- }
-
- //
- // Create a context for the public key operation.
- //
- PkeyCtx = EVP_PKEY_CTX_new (Pkey, NULL);
- if (PkeyCtx == NULL) {
- //
- // Fail to create contex.
- //
- goto _Exit;
- }
-
- //
- // Initialize the context and set the desired padding.
- //
- if ((EVP_PKEY_encrypt_init (PkeyCtx) <= 0) ||
- (EVP_PKEY_CTX_set_rsa_padding (PkeyCtx, RSA_PKCS1_OAEP_PADDING) <= 0))
- {
- //
- // Fail to initialize the context.
- //
- goto _Exit;
- }
-
- if (DigestLen != 0) {
- HashAlg = GetEvpMD (DigestLen);
- if (HashAlg == NULL) {
- goto _Exit;
- }
-
- if (EVP_PKEY_CTX_set_rsa_oaep_md (PkeyCtx, HashAlg) <= 0) {
- goto _Exit;
- }
-
- if (EVP_PKEY_CTX_set_rsa_mgf1_md (PkeyCtx, HashAlg) <= 0) {
- goto _Exit;
- }
- }
-
- //
- // Determine the required buffer length for malloc'ing.
- //
- if (EVP_PKEY_encrypt (PkeyCtx, NULL, &OutDataSize, InData, InDataSize) <= 0) {
- //
- // Fail to determine output buffer size.
- //
- goto _Exit;
- }
-
- //
- // Allocate a buffer for the output data.
- //
- OutData = AllocatePool (OutDataSize);
- if (OutData == NULL) {
- //
- // Fail to allocate the output buffer.
- //
- goto _Exit;
- }
-
- //
- // Encrypt Data.
- //
- if (EVP_PKEY_encrypt (PkeyCtx, OutData, &OutDataSize, InData, InDataSize) <= 0) {
- //
- // Fail to encrypt data, need to free the output buffer.
- //
- FreePool (OutData);
- OutData = NULL;
- OutDataSize = 0;
- goto _Exit;
- }
-
- //
- // Encrypt done.
- //
- *EncryptedData = OutData;
- *EncryptedDataSize = OutDataSize;
- Result = TRUE;
-
-_Exit:
- //
- // Release Resources
- //
- if (PkeyCtx != NULL) {
- EVP_PKEY_CTX_free (PkeyCtx);
- }
-
- return Result;
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to parse X509 certificate.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
- will be used to encrypt the data.
- @param[in] PublicKeySize Size of the X509 cert buffer.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Encrypt (
- IN CONST UINT8 *PublicKey,
- IN UINTN PublicKeySize,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- BOOLEAN Result;
- CONST UINT8 *TempPointer;
- X509 *CertData;
- EVP_PKEY *Pkey;
-
- //
- // Check input parameters.
- //
- if ((PublicKey == NULL) || (InData == NULL) ||
- (EncryptedData == NULL) || (EncryptedDataSize == NULL))
- {
- return FALSE;
- }
-
- //
- // Check public key size.
- //
- if (PublicKeySize > 0xFFFFFFFF) {
- //
- // Public key size is too large for implementation.
- //
- return FALSE;
- }
-
- *EncryptedData = NULL;
- *EncryptedDataSize = 0;
- Result = FALSE;
- TempPointer = NULL;
- CertData = NULL;
- Pkey = NULL;
-
- //
- // Parse the X509 cert and extract the public key.
- //
- TempPointer = PublicKey;
- CertData = d2i_X509 (&CertData, &TempPointer, (UINT32)PublicKeySize);
- if (CertData == NULL) {
- //
- // Fail to parse X509 cert.
- //
- goto _Exit;
- }
-
- //
- // Extract the public key from the x509 cert in a format that
- // OpenSSL can use.
- //
- Pkey = X509_get_pubkey (CertData);
- if (Pkey == NULL) {
- //
- // Fail to extract public key.
- //
- goto _Exit;
- }
-
- Result = InternalPkcs1v2Encrypt (Pkey, InData, InDataSize, PrngSeed, PrngSeedSize, 0, EncryptedData, EncryptedDataSize);
-
-_Exit:
- //
- // Release Resources
- //
- if (CertData != NULL) {
- X509_free (CertData);
- }
-
- if (Pkey != NULL) {
- EVP_PKEY_free (Pkey);
- }
-
- return Result;
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a public key using RsaSetKey().
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-RsaOaepEncrypt (
- IN VOID *RsaContext,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- BOOLEAN Result;
- EVP_PKEY *Pkey;
-
- //
- // Check input parameters.
- //
- if (((RsaContext == NULL) || (InData == NULL)) ||
- (EncryptedData == NULL) || (EncryptedDataSize == NULL))
- {
- return FALSE;
- }
-
- *EncryptedData = NULL;
- *EncryptedDataSize = 0;
- Result = FALSE;
- Pkey = NULL;
-
- Pkey = EVP_PKEY_new ();
- if (Pkey == NULL) {
- goto _Exit;
- }
-
- if (EVP_PKEY_set1_RSA (Pkey, (RSA *)RsaContext) == 0) {
- goto _Exit;
- }
-
- Result = InternalPkcs1v2Encrypt (Pkey, InData, InDataSize, PrngSeed, PrngSeedSize, DigestLen, EncryptedData, EncryptedDataSize);
-
-_Exit:
- //
- // Release Resources
- //
- if (Pkey != NULL) {
- EVP_PKEY_free (Pkey);
- }
-
- return Result;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] Pkey A pointer to an EVP_PKEY which will decrypt that data.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-InternalPkcs1v2Decrypt (
- EVP_PKEY *Pkey,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- BOOLEAN Result;
- EVP_PKEY_CTX *PkeyCtx;
- UINT8 *TempData;
- UINTN TempDataSize;
- INTN ReturnCode;
- CONST EVP_MD *HashAlg;
-
- //
- // Check input parameters.
- //
- if ((Pkey == NULL) || (EncryptedData == NULL) ||
- (OutData == NULL) || (OutDataSize == NULL))
- {
- return FALSE;
- }
-
- Result = FALSE;
- PkeyCtx = NULL;
- TempData = NULL;
- TempDataSize = 0;
-
- //
- // Create a context for the decryption operation.
- //
- PkeyCtx = EVP_PKEY_CTX_new (Pkey, NULL);
- if (PkeyCtx == NULL) {
- //
- // Fail to create contex.
- //
- DEBUG ((DEBUG_ERROR, "[%a] EVP_PKEY_CTK_new() failed\n", __func__));
- goto _Exit;
- }
-
- //
- // Initialize the context and set the desired padding.
- //
- if ((EVP_PKEY_decrypt_init (PkeyCtx) <= 0) ||
- (EVP_PKEY_CTX_set_rsa_padding (PkeyCtx, RSA_PKCS1_OAEP_PADDING) <= 0))
- {
- //
- // Fail to initialize the context.
- //
- DEBUG ((DEBUG_ERROR, "[%a] EVP_PKEY_decrypt_init() failed\n", __func__));
- goto _Exit;
- }
-
- if (DigestLen != 0) {
- HashAlg = GetEvpMD (DigestLen);
- if (HashAlg == NULL) {
- goto _Exit;
- }
-
- if (EVP_PKEY_CTX_set_rsa_oaep_md (PkeyCtx, HashAlg) <= 0) {
- goto _Exit;
- }
-
- if (EVP_PKEY_CTX_set_rsa_mgf1_md (PkeyCtx, HashAlg) <= 0) {
- goto _Exit;
- }
- }
-
- //
- // Determine the required buffer length for malloc'ing.
- //
- ReturnCode = EVP_PKEY_decrypt (PkeyCtx, NULL, &TempDataSize, EncryptedData, EncryptedDataSize);
- if (ReturnCode <= 0) {
- //
- // Fail to determine output buffer size.
- //
- DEBUG ((DEBUG_ERROR, "[%a] EVP_PKEY_decrypt() failed to determine output buffer size (rc=%d)\n", __func__, ReturnCode));
- goto _Exit;
- }
-
- //
- // Allocate a buffer for the output data.
- //
- TempData = AllocatePool (TempDataSize);
- if (TempData == NULL) {
- //
- // Fail to allocate the output buffer.
- //
- goto _Exit;
- }
-
- //
- // Decrypt Data.
- //
- ReturnCode = EVP_PKEY_decrypt (PkeyCtx, TempData, &TempDataSize, EncryptedData, EncryptedDataSize);
- if (ReturnCode <= 0) {
- //
- // Fail to decrypt data, need to free the output buffer.
- //
- FreePool (TempData);
- TempData = NULL;
- TempDataSize = 0;
-
- DEBUG ((DEBUG_ERROR, "[%a] EVP_PKEY_decrypt(TempData) failed to decrypt (rc=%d)\n", __func__, ReturnCode));
- goto _Exit;
- }
-
- //
- // Decrypt done.
- //
- *OutData = TempData;
- *OutDataSize = TempDataSize;
- Result = TRUE;
-
-_Exit:
- if (PkeyCtx != NULL) {
- EVP_PKEY_CTX_free (PkeyCtx);
- }
-
- return Result;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] PrivateKey A pointer to the DER-encoded private key.
- @param[in] PrivateKeySize Size of the private key buffer.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Decrypt (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- BOOLEAN Result;
- EVP_PKEY *Pkey;
- CONST UINT8 *TempPointer;
-
- //
- // Check input parameters.
- //
- if ((PrivateKey == NULL) || (EncryptedData == NULL) ||
- (OutData == NULL) || (OutDataSize == NULL))
- {
- return FALSE;
- }
-
- Result = FALSE;
- Pkey = NULL;
- TempPointer = NULL;
-
- //
- // Parse the private key.
- //
- TempPointer = PrivateKey;
- Pkey = d2i_PrivateKey (EVP_PKEY_RSA, &Pkey, &TempPointer, (UINT32)PrivateKeySize);
- if (Pkey == NULL) {
- //
- // Fail to parse private key.
- //
- DEBUG ((DEBUG_ERROR, "[%a] d2i_PrivateKey() failed\n", __func__));
- goto _Exit;
- }
-
- Result = InternalPkcs1v2Decrypt (Pkey, EncryptedData, EncryptedDataSize, 0, OutData, OutDataSize);
-
-_Exit:
- if (Pkey != NULL) {
- EVP_PKEY_free (Pkey);
- }
-
- return Result;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a private key using RsaSetKey().
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-RsaOaepDecrypt (
- IN VOID *RsaContext,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- BOOLEAN Result;
- EVP_PKEY *Pkey;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (EncryptedData == NULL) ||
- (OutData == NULL) || (OutDataSize == NULL))
- {
- return FALSE;
- }
-
- Result = FALSE;
- Pkey = NULL;
-
- //
- // Create a context for the decryption operation.
- //
-
- Pkey = EVP_PKEY_new ();
- if (Pkey == NULL) {
- goto _Exit;
- }
-
- if (EVP_PKEY_set1_RSA (Pkey, (RSA *)RsaContext) == 0) {
- goto _Exit;
- }
-
- Result = InternalPkcs1v2Decrypt (Pkey, EncryptedData, EncryptedDataSize, DigestLen, OutData, OutDataSize);
-
-_Exit:
- if (Pkey != NULL) {
- EVP_PKEY_free (Pkey);
- }
-
- return Result;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs1OaepNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs1OaepNull.c
deleted file mode 100644
index 01d3c5a77f..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs1OaepNull.c
+++ /dev/null
@@ -1,178 +0,0 @@
-/** @file
- This file contains UEFI wrapper functions for RSA PKCS1v2 OAEP encryption routines.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2019, Intel Corporation. All rights reserved.
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
- will be used to encrypt the data.
- @param[in] PublicKeySize Size of the X509 cert buffer.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Encrypt (
- IN CONST UINT8 *PublicKey,
- IN UINTN PublicKeySize,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a public key using RsaSetKey().
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-RsaOaepEncrypt (
- IN VOID *RsaContext,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] PrivateKey A pointer to the DER-encoded private key.
- @param[in] PrivateKeySize Size of the private key buffer.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Decrypt (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a private key using RsaSetKey().
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-RsaOaepDecrypt (
- IN VOID *RsaContext,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs5Pbkdf2.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs5Pbkdf2.c
deleted file mode 100644
index 92e8b8c20b..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs5Pbkdf2.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/** @file
- PBKDF2 Key Derivation Function Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-
-/**
- Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
- password based encryption key derivation function PBKDF2, as specified in RFC 2898.
-
- If Password or Salt or OutKey is NULL, then return FALSE.
- If the hash algorithm could not be determined, then return FALSE.
-
- @param[in] PasswordLength Length of input password in bytes.
- @param[in] Password Pointer to the array for the password.
- @param[in] SaltLength Size of the Salt in bytes.
- @param[in] Salt Pointer to the Salt.
- @param[in] IterationCount Number of iterations to perform. Its value should be
- greater than or equal to 1.
- @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
- NOTE: DigestSize will be used to determine the hash algorithm.
- Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
- @param[in] KeyLength Size of the derived key buffer in bytes.
- @param[out] OutKey Pointer to the output derived key buffer.
-
- @retval TRUE A key was derived successfully.
- @retval FALSE One of the pointers was NULL or one of the sizes was too large.
- @retval FALSE The hash algorithm could not be determined from the digest size.
- @retval FALSE The key derivation operation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs5HashPassword (
- IN UINTN PasswordLength,
- IN CONST CHAR8 *Password,
- IN UINTN SaltLength,
- IN CONST UINT8 *Salt,
- IN UINTN IterationCount,
- IN UINTN DigestSize,
- IN UINTN KeyLength,
- OUT UINT8 *OutKey
- )
-{
- CONST EVP_MD *HashAlg;
-
- HashAlg = NULL;
-
- //
- // Parameter Checking.
- //
- if ((Password == NULL) || (Salt == NULL) || (OutKey == NULL)) {
- return FALSE;
- }
-
- if ((PasswordLength == 0) || (PasswordLength > INT_MAX) ||
- (SaltLength == 0) || (SaltLength > INT_MAX) ||
- (KeyLength == 0) || (KeyLength > INT_MAX) ||
- (IterationCount < 1) || (IterationCount > INT_MAX))
- {
- return FALSE;
- }
-
- //
- // Make sure the digest algorithm is supported.
- //
- switch (DigestSize) {
- case SHA1_DIGEST_SIZE:
- HashAlg = EVP_sha1 ();
- break;
- case SHA256_DIGEST_SIZE:
- HashAlg = EVP_sha256 ();
- break;
- default:
- return FALSE;
- break;
- }
-
- //
- // Perform password-based key derivation routines.
- //
- return (BOOLEAN)PKCS5_PBKDF2_HMAC (
- (const char *)Password,
- (int)PasswordLength,
- (const unsigned char *)Salt,
- (int)SaltLength,
- (int)IterationCount,
- HashAlg,
- (int)KeyLength,
- (unsigned char *)OutKey
- );
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs5Pbkdf2Null.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs5Pbkdf2Null.c
deleted file mode 100644
index b8a41fbb20..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs5Pbkdf2Null.c
+++ /dev/null
@@ -1,50 +0,0 @@
-/** @file
- PBKDF2 Key Derivation Function Wrapper Implementation which does not provide real
- capabilities.
-
-Copyright (c) 2016, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-
-/**
- Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
- password based encryption key derivation function PBKDF2, as specified in RFC 2898.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PasswordLength Length of input password in bytes.
- @param[in] Password Pointer to the array for the password.
- @param[in] SaltLength Size of the Salt in bytes.
- @param[in] Salt Pointer to the Salt.
- @param[in] IterationCount Number of iterations to perform. Its value should be
- greater than or equal to 1.
- @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
- NOTE: DigestSize will be used to determine the hash algorithm.
- Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
- @param[in] KeyLength Size of the derived key buffer in bytes.
- @param[out] OutKey Pointer to the output derived key buffer.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs5HashPassword (
- IN UINTN PasswordLength,
- IN CONST CHAR8 *Password,
- IN UINTN SaltLength,
- IN CONST UINT8 *Salt,
- IN UINTN IterationCount,
- IN UINTN DigestSize,
- IN UINTN KeyLength,
- OUT UINT8 *OutKey
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
deleted file mode 100644
index 087c02da47..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
+++ /dev/null
@@ -1,220 +0,0 @@
-/** @file
- PKCS#7 SignedData Sign Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-
-/**
- Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
- Syntax Standard, version 1.5". This interface is only intended to be used for
- application to perform PKCS#7 functionality validation.
-
- @param[in] PrivateKey Pointer to the PEM-formatted private key data for
- data signing.
- @param[in] PrivateKeySize Size of the PEM private key data in bytes.
- @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
- key data.
- @param[in] InData Pointer to the content to be signed.
- @param[in] InDataSize Size of InData in bytes.
- @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
- @param[in] SignCertSize Size of signer's DER-encoded certificate to sign with. // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- @param[in] OtherCerts Pointer to an optional additional set of certificates to
- include in the PKCS#7 signedData (e.g. any intermediate
- CAs in the chain).
- @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
- responsibility to free the buffer with FreePool().
- @param[out] SignedDataSize Size of SignedData in bytes.
-
- @retval TRUE PKCS#7 data signing succeeded.
- @retval FALSE PKCS#7 data signing failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Sign (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN CONST UINT8 *KeyPassword,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *SignCert, // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- IN UINTN SignCertSize, // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- IN UINT8 *OtherCerts OPTIONAL,
- OUT UINT8 **SignedData,
- OUT UINTN *SignedDataSize
- )
-{
- BOOLEAN Status;
- X509 *Cert; // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- EVP_PKEY *Key;
- BIO *DataBio;
- PKCS7 *Pkcs7;
- UINT8 *RsaContext;
- UINT8 *P7Data;
- UINTN P7DataSize;
- UINT8 *Tmp;
-
- //
- // Check input parameters.
- //
- if ((PrivateKey == NULL) || (KeyPassword == NULL) || (InData == NULL) ||
- (SignCert == NULL) || (SignedData == NULL) || (SignedDataSize == NULL) || (InDataSize > INT_MAX))
- {
- return FALSE;
- }
-
- RsaContext = NULL;
- Cert = NULL; // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- Key = NULL;
- Pkcs7 = NULL;
- DataBio = NULL;
- Status = FALSE;
-
- //
- // Retrieve RSA private key from PEM data.
- //
- Status = RsaGetPrivateKeyFromPem (
- PrivateKey,
- PrivateKeySize,
- (CONST CHAR8 *)KeyPassword,
- (VOID **)&RsaContext
- );
- if (!Status) {
- return Status;
- }
-
- Status = FALSE;
-
- //
- // Register & Initialize necessary digest algorithms and PRNG for PKCS#7 Handling
- //
- if (EVP_add_digest (EVP_md5 ()) == 0) {
- goto _Exit;
- }
-
- if (EVP_add_digest (EVP_sha1 ()) == 0) {
- goto _Exit;
- }
-
- if (EVP_add_digest (EVP_sha256 ()) == 0) {
- goto _Exit;
- }
-
- RandomSeed (NULL, 0);
-
- // MU_CHANGE [TCBZ3925] [BEGIN] - Pkcs7Sign is broken
- //
- // Read DER-encoded root certificate and Construct X509 Certificate
- //
- Cert = d2i_X509 (NULL, &SignCert, (long)SignCertSize);
- if (Cert == NULL) {
- goto _Exit;
- }
-
- // MU_CHANGE [TCBZ3925] [END] - Pkcs7Sign is broken
-
- //
- // Construct OpenSSL EVP_PKEY for private key.
- //
- Key = EVP_PKEY_new ();
- if (Key == NULL) {
- goto _Exit;
- }
-
- if (EVP_PKEY_assign_RSA (Key, (RSA *)RsaContext) == 0) {
- goto _Exit;
- }
-
- //
- // Convert the data to be signed to BIO format.
- //
- DataBio = BIO_new (BIO_s_mem ());
- if (DataBio == NULL) {
- goto _Exit;
- }
-
- if (BIO_write (DataBio, InData, (int)InDataSize) <= 0) {
- goto _Exit;
- }
-
- //
- // Create the PKCS#7 signedData structure.
- //
- Pkcs7 = PKCS7_sign (
- Cert, // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- Key,
- (STACK_OF (X509) *) OtherCerts,
- DataBio,
- PKCS7_BINARY | PKCS7_NOATTR | PKCS7_DETACHED
- );
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // Convert PKCS#7 signedData structure into DER-encoded buffer.
- //
- P7DataSize = i2d_PKCS7 (Pkcs7, NULL);
- if (P7DataSize <= 19) {
- goto _Exit;
- }
-
- P7Data = malloc (P7DataSize);
- if (P7Data == NULL) {
- goto _Exit;
- }
-
- Tmp = P7Data;
- P7DataSize = i2d_PKCS7 (Pkcs7, (unsigned char **)&Tmp);
- ASSERT (P7DataSize > 19);
-
- //
- // Strip ContentInfo to content only for signeddata. The data be trimmed off
- // is totally 19 bytes.
- //
- *SignedDataSize = P7DataSize - 19;
- *SignedData = AllocatePool (*SignedDataSize);
- if (*SignedData == NULL) {
- OPENSSL_free (P7Data);
- goto _Exit;
- }
-
- CopyMem (*SignedData, P7Data + 19, *SignedDataSize);
-
- OPENSSL_free (P7Data);
-
- Status = TRUE;
-
-_Exit:
- //
- // Release Resources
- //
- // MU_CHANGE [TCBZ3925] [BEGIN] - Pkcs7Sign is broken
- if (Cert != NULL) {
- X509_free (Cert);
- }
-
- // MU_CHANGE [TCBZ3925] [END] - Pkcs7Sign is broken
-
- if (Key != NULL) {
- EVP_PKEY_free (Key);
- }
-
- if (DataBio != NULL) {
- BIO_free (DataBio);
- }
-
- if (Pkcs7 != NULL) {
- PKCS7_free (Pkcs7);
- }
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7SignNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7SignNull.c
deleted file mode 100644
index 96f2bbf1e1..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7SignNull.c
+++ /dev/null
@@ -1,55 +0,0 @@
-/** @file
- PKCS#7 SignedData Sign Wrapper Implementation which does not provide real
- capabilities.
-
-Copyright (c) 2012, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
- Syntax Standard, version 1.5". This interface is only intended to be used for
- application to perform PKCS#7 functionality validation.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PrivateKey Pointer to the PEM-formatted private key data for
- data signing.
- @param[in] PrivateKeySize Size of the PEM private key data in bytes.
- @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
- key data.
- @param[in] InData Pointer to the content to be signed.
- @param[in] InDataSize Size of InData in bytes.
- @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
- @param[in] SignCertSize Size of signer's DER-encoded certificate to sign with. // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- @param[in] OtherCerts Pointer to an optional additional set of certificates to
- include in the PKCS#7 signedData (e.g. any intermediate
- CAs in the chain).
- @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
- responsibility to free the buffer with FreePool().
- @param[out] SignedDataSize Size of SignedData in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Sign (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN CONST UINT8 *KeyPassword,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *SignCert, // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- IN UINTN SignCertSize, // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
- IN UINT8 *OtherCerts OPTIONAL,
- OUT UINT8 **SignedData,
- OUT UINTN *SignedDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c
deleted file mode 100644
index aac98ae4f9..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyBase.c
+++ /dev/null
@@ -1,193 +0,0 @@
-/** @file
- Non-runtime specific implementation of PKCS#7 SignedData Verification Wrapper.
-
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-#include
-
-/**
- Check the contents of PKCS7 is not data.
-
- It is copied from PKCS7_type_is_other() in pk7_doit.c.
-
- @param[in] P7 Pointer to the location at which the PKCS7 is located.
-
- @retval TRUE If the type is others.
- @retval FALSE If the type is expected.
-**/
-STATIC
-BOOLEAN
-Pkcs7TypeIsOther (
- IN PKCS7 *P7
- )
-{
- BOOLEAN Others;
- INTN Nid = OBJ_obj2nid (P7->type);
-
- switch (Nid) {
- case NID_pkcs7_data:
- case NID_pkcs7_signed:
- case NID_pkcs7_enveloped:
- case NID_pkcs7_signedAndEnveloped:
- case NID_pkcs7_encrypted:
- Others = FALSE;
- break;
- default:
- Others = TRUE;
- }
-
- return Others;
-}
-
-/**
- Get the ASN.1 string for the PKCS7.
-
- It is copied from PKCS7_get_octet_string() in pk7_doit.c.
-
- @param[in] P7 Pointer to the location at which the PKCS7 is located.
-
- @return ASN1_OCTET_STRING ASN.1 string.
-**/
-STATIC
-ASN1_OCTET_STRING *
-Pkcs7GetOctetString (
- IN PKCS7 *P7
- )
-{
- if (PKCS7_type_is_data (P7)) {
- return P7->d.data;
- }
-
- if (Pkcs7TypeIsOther (P7) && (P7->d.other != NULL) &&
- (P7->d.other->type == V_ASN1_OCTET_STRING))
- {
- return P7->d.other->value.octet_string;
- }
-
- return NULL;
-}
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
- then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
-
- Caution: This function may receive untrusted input. So this function will do
- basic check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- BOOLEAN Status;
- PKCS7 *Pkcs7;
- UINT8 *SignedData;
- UINTN SignedDataSize;
- BOOLEAN Wrapped;
- CONST UINT8 *Temp;
- ASN1_OCTET_STRING *OctStr;
-
- //
- // Check input parameter.
- //
- if ((P7Data == NULL) || (P7Length > INT_MAX) || (Content == NULL) || (ContentSize == NULL)) {
- return FALSE;
- }
-
- *Content = NULL;
- Pkcs7 = NULL;
- SignedData = NULL;
- OctStr = NULL;
-
- Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
- if (!Status || (SignedDataSize > INT_MAX)) {
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Decoding PKCS#7 SignedData
- //
- Temp = SignedData;
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // The type of Pkcs7 must be signedData
- //
- if (!PKCS7_type_is_signed (Pkcs7)) {
- goto _Exit;
- }
-
- //
- // Check for detached or attached content
- //
- if (PKCS7_get_detached (Pkcs7)) {
- //
- // No Content supplied for PKCS7 detached signedData
- //
- *Content = NULL;
- *ContentSize = 0;
- } else {
- //
- // Retrieve the attached content in PKCS7 signedData
- //
- OctStr = Pkcs7GetOctetString (Pkcs7->d.sign->contents);
- if (OctStr == NULL) {
- goto _Exit;
- }
-
- if ((OctStr->length > 0) && (OctStr->data != NULL)) {
- *ContentSize = OctStr->length;
- *Content = AllocatePool (*ContentSize);
- if (*Content == NULL) {
- *ContentSize = 0;
- goto _Exit;
- }
-
- CopyMem (*Content, OctStr->data, *ContentSize);
- }
- }
-
- Status = TRUE;
-
-_Exit:
- //
- // Release Resources
- //
- PKCS7_free (Pkcs7);
-
- if (!Wrapped) {
- OPENSSL_free (SignedData);
- }
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
deleted file mode 100644
index 4e5a14e352..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
+++ /dev/null
@@ -1,928 +0,0 @@
-/** @file
- PKCS#7 SignedData Verification Wrapper Implementation over OpenSSL.
-
- Caution: This module requires additional review when modified.
- This library will have external input - signature (e.g. UEFI Authenticated
- Variable). It may by input in SMM mode.
- This external input must be validated carefully to avoid security issue like
- buffer overflow, integer overflow.
-
- WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenticated
- Variable and will do basic check for data structure.
-
-Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-#include
-
-GLOBAL_REMOVE_IF_UNREFERENCED const UINT8 mOidValue[9] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02 };
-
-/**
- Check input P7Data is a wrapped ContentInfo structure or not. If not construct
- a new structure to wrap P7Data.
-
- Caution: This function may receive untrusted input.
- UEFI Authenticated Variable is external input, so this function will do basic
- check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] WrapFlag If TRUE P7Data is a ContentInfo structure, otherwise
- return FALSE.
- @param[out] WrapData If return status of this function is TRUE:
- 1) when WrapFlag is TRUE, pointer to P7Data.
- 2) when WrapFlag is FALSE, pointer to a new ContentInfo
- structure. It's caller's responsibility to free this
- buffer.
- @param[out] WrapDataSize Length of ContentInfo structure in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE The operation is failed due to lack of resources.
-
-**/
-BOOLEAN
-WrapPkcs7Data (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT BOOLEAN *WrapFlag,
- OUT UINT8 **WrapData,
- OUT UINTN *WrapDataSize
- )
-{
- BOOLEAN Wrapped;
- UINT8 *SignedData;
-
- //
- // Check whether input P7Data is a wrapped ContentInfo structure or not.
- //
- Wrapped = FALSE;
- if ((P7Data[4] == 0x06) && (P7Data[5] == 0x09)) {
- if (CompareMem (P7Data + 6, mOidValue, sizeof (mOidValue)) == 0) {
- if ((P7Data[15] == 0xA0) && (P7Data[16] == 0x82)) {
- Wrapped = TRUE;
- }
- }
- }
-
- if (Wrapped) {
- *WrapData = (UINT8 *)P7Data;
- *WrapDataSize = P7Length;
- } else {
- //
- // Wrap PKCS#7 signeddata to a ContentInfo structure - add a header in 19 bytes.
- //
- *WrapDataSize = P7Length + 19;
- *WrapData = malloc (*WrapDataSize);
- if (*WrapData == NULL) {
- *WrapFlag = Wrapped;
- return FALSE;
- }
-
- SignedData = *WrapData;
-
- //
- // Part1: 0x30, 0x82.
- //
- SignedData[0] = 0x30;
- SignedData[1] = 0x82;
-
- //
- // Part2: Length1 = P7Length + 19 - 4, in big endian.
- //
- SignedData[2] = (UINT8)(((UINT16)(*WrapDataSize - 4)) >> 8);
- SignedData[3] = (UINT8)(((UINT16)(*WrapDataSize - 4)) & 0xff);
-
- //
- // Part3: 0x06, 0x09.
- //
- SignedData[4] = 0x06;
- SignedData[5] = 0x09;
-
- //
- // Part4: OID value -- 0x2A 0x86 0x48 0x86 0xF7 0x0D 0x01 0x07 0x02.
- //
- CopyMem (SignedData + 6, mOidValue, sizeof (mOidValue));
-
- //
- // Part5: 0xA0, 0x82.
- //
- SignedData[15] = 0xA0;
- SignedData[16] = 0x82;
-
- //
- // Part6: Length2 = P7Length, in big endian.
- //
- SignedData[17] = (UINT8)(((UINT16)P7Length) >> 8);
- SignedData[18] = (UINT8)(((UINT16)P7Length) & 0xff);
-
- //
- // Part7: P7Data.
- //
- CopyMem (SignedData + 19, P7Data, P7Length);
- }
-
- *WrapFlag = Wrapped;
- return TRUE;
-}
-
-/**
- Pop single certificate from STACK_OF(X509).
-
- If X509Stack, Cert, or CertSize is NULL, then return FALSE.
-
- @param[in] X509Stack Pointer to a X509 stack object.
- @param[out] Cert Pointer to a X509 certificate.
- @param[out] CertSize Length of output X509 certificate in bytes.
-
- @retval TRUE The X509 stack pop succeeded.
- @retval FALSE The pop operation failed.
-
-**/
-STATIC
-BOOLEAN
-X509PopCertificate (
- IN VOID *X509Stack,
- OUT UINT8 **Cert,
- OUT UINTN *CertSize
- )
-{
- BIO *CertBio;
- X509 *X509Cert;
-
- STACK_OF (X509) *CertStack;
- BOOLEAN Status;
- INT32 Result;
- BUF_MEM *Ptr;
- INT32 Length;
- VOID *Buffer;
-
- Status = FALSE;
-
- if ((X509Stack == NULL) || (Cert == NULL) || (CertSize == NULL)) {
- return Status;
- }
-
- CertStack = (STACK_OF (X509) *) X509Stack;
-
- X509Cert = sk_X509_pop (CertStack);
-
- if (X509Cert == NULL) {
- return Status;
- }
-
- Buffer = NULL;
-
- CertBio = BIO_new (BIO_s_mem ());
- if (CertBio == NULL) {
- return Status;
- }
-
- Result = i2d_X509_bio (CertBio, X509Cert);
- if (Result == 0) {
- goto _Exit;
- }
-
- BIO_get_mem_ptr (CertBio, &Ptr);
- Length = (INT32)(Ptr->length);
- if (Length <= 0) {
- goto _Exit;
- }
-
- Buffer = malloc (Length);
- if (Buffer == NULL) {
- goto _Exit;
- }
-
- Result = BIO_read (CertBio, Buffer, Length);
- if (Result != Length) {
- goto _Exit;
- }
-
- *Cert = Buffer;
- *CertSize = Length;
-
- Status = TRUE;
-
-_Exit:
-
- BIO_free (CertBio);
-
- if (!Status && (Buffer != NULL)) {
- free (Buffer);
- }
-
- return Status;
-}
-
-/**
- Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then
- return FALSE. If P7Length overflow, then return FALSE.
-
- Caution: This function may receive untrusted input.
- UEFI Authenticated Variable is external input, so this function will do basic
- check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] StackLength Length of signer's certificates in bytes.
- @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- @param[out] CertLength Length of the trusted certificate in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetSigners (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **CertStack,
- OUT UINTN *StackLength,
- OUT UINT8 **TrustedCert,
- OUT UINTN *CertLength
- )
-{
- PKCS7 *Pkcs7;
- BOOLEAN Status;
- UINT8 *SignedData;
- CONST UINT8 *Temp;
- UINTN SignedDataSize;
- BOOLEAN Wrapped;
-
- STACK_OF (X509) *Stack;
- UINT8 Index;
- UINT8 *CertBuf;
- UINT8 *OldBuf;
- UINTN BufferSize;
- UINTN OldSize;
- UINT8 *SingleCert;
- UINTN SingleCertSize;
-
- if ((P7Data == NULL) || (CertStack == NULL) || (StackLength == NULL) ||
- (TrustedCert == NULL) || (CertLength == NULL) || (P7Length > INT_MAX))
- {
- return FALSE;
- }
-
- Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
- if (!Status) {
- return Status;
- }
-
- Status = FALSE;
- Pkcs7 = NULL;
- Stack = NULL;
- CertBuf = NULL;
- OldBuf = NULL;
- SingleCert = NULL;
-
- //
- // Retrieve PKCS#7 Data (DER encoding)
- //
- if (SignedDataSize > INT_MAX) {
- goto _Exit;
- }
-
- Temp = SignedData;
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // Check if it's PKCS#7 Signed Data (for Authenticode Scenario)
- //
- if (!PKCS7_type_is_signed (Pkcs7)) {
- goto _Exit;
- }
-
- Stack = PKCS7_get0_signers (Pkcs7, NULL, PKCS7_BINARY);
- if (Stack == NULL) {
- goto _Exit;
- }
-
- //
- // Convert CertStack to buffer in following format:
- // UINT8 CertNumber;
- // UINT32 Cert1Length;
- // UINT8 Cert1[];
- // UINT32 Cert2Length;
- // UINT8 Cert2[];
- // ...
- // UINT32 CertnLength;
- // UINT8 Certn[];
- //
- BufferSize = sizeof (UINT8);
- OldSize = BufferSize;
-
- for (Index = 0; ; Index++) {
- Status = X509PopCertificate (Stack, &SingleCert, &SingleCertSize);
- if (!Status) {
- break;
- }
-
- OldSize = BufferSize;
- OldBuf = CertBuf;
- BufferSize = OldSize + SingleCertSize + sizeof (UINT32);
- CertBuf = malloc (BufferSize);
-
- if (CertBuf == NULL) {
- goto _Exit;
- }
-
- if (OldBuf != NULL) {
- CopyMem (CertBuf, OldBuf, OldSize);
- free (OldBuf);
- OldBuf = NULL;
- }
-
- WriteUnaligned32 ((UINT32 *)(CertBuf + OldSize), (UINT32)SingleCertSize);
- CopyMem (CertBuf + OldSize + sizeof (UINT32), SingleCert, SingleCertSize);
-
- free (SingleCert);
- SingleCert = NULL;
- }
-
- if (CertBuf != NULL) {
- //
- // Update CertNumber.
- //
- CertBuf[0] = Index;
-
- *CertLength = BufferSize - OldSize - sizeof (UINT32);
- *TrustedCert = malloc (*CertLength);
- if (*TrustedCert == NULL) {
- goto _Exit;
- }
-
- CopyMem (*TrustedCert, CertBuf + OldSize + sizeof (UINT32), *CertLength);
- *CertStack = CertBuf;
- *StackLength = BufferSize;
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources
- //
- if (!Wrapped) {
- free (SignedData);
- }
-
- if (Pkcs7 != NULL) {
- PKCS7_free (Pkcs7);
- }
-
- if (Stack != NULL) {
- sk_X509_pop_free (Stack, X509_free);
- }
-
- if (SingleCert != NULL) {
- free (SingleCert);
- }
-
- if (!Status && (CertBuf != NULL)) {
- free (CertBuf);
- *CertStack = NULL;
- }
-
- if (OldBuf != NULL) {
- free (OldBuf);
- }
-
- return Status;
-}
-
-/**
- Wrap function to use free() to free allocated memory for certificates.
-
- @param[in] Certs Pointer to the certificates to be freed.
-
-**/
-VOID
-EFIAPI
-Pkcs7FreeSigners (
- IN UINT8 *Certs
- )
-{
- if (Certs == NULL) {
- return;
- }
-
- free (Certs);
-}
-
-/**
- Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
- unchained to the signer's certificates.
- The input signed data could be wrapped in a ContentInfo structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
- certificate. It's caller's responsibility to free the buffer
- with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] ChainLength Length of the chained certificates list buffer in bytes.
- @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
- responsibility to free the buffer with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetCertificatesList (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **SignerChainCerts,
- OUT UINTN *ChainLength,
- OUT UINT8 **UnchainCerts,
- OUT UINTN *UnchainLength
- )
-{
- BOOLEAN Status;
- UINT8 *NewP7Data;
- UINTN NewP7Length;
- BOOLEAN Wrapped;
- UINT8 Index;
- PKCS7 *Pkcs7;
- X509_STORE_CTX *CertCtx;
-
- STACK_OF (X509) *CtxChain;
- STACK_OF (X509) *CtxUntrusted;
- X509 *CtxCert;
-
- STACK_OF (X509) *Signers;
- X509 *Signer;
- X509 *Cert;
- X509 *Issuer;
- X509_NAME *IssuerName;
- UINT8 *CertBuf;
- UINT8 *OldBuf;
- UINTN BufferSize;
- UINTN OldSize;
- UINT8 *SingleCert;
- UINTN CertSize;
-
- //
- // Initializations
- //
- Status = FALSE;
- NewP7Data = NULL;
- Pkcs7 = NULL;
- CertCtx = NULL;
- CtxChain = NULL;
- CtxCert = NULL;
- CtxUntrusted = NULL;
- Cert = NULL;
- SingleCert = NULL;
- CertBuf = NULL;
- OldBuf = NULL;
- Signers = NULL;
-
- //
- // Parameter Checking
- //
- if ((P7Data == NULL) || (SignerChainCerts == NULL) || (ChainLength == NULL) ||
- (UnchainCerts == NULL) || (UnchainLength == NULL) || (P7Length > INT_MAX))
- {
- return Status;
- }
-
- *SignerChainCerts = NULL;
- *ChainLength = 0;
- *UnchainCerts = NULL;
- *UnchainLength = 0;
-
- //
- // Construct a new PKCS#7 data wrapping with ContentInfo structure if needed.
- //
- Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &NewP7Data, &NewP7Length);
- if (!Status || (NewP7Length > INT_MAX)) {
- goto _Error;
- }
-
- //
- // Decodes PKCS#7 SignedData
- //
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&NewP7Data, (int)NewP7Length);
- if ((Pkcs7 == NULL) || (!PKCS7_type_is_signed (Pkcs7))) {
- goto _Error;
- }
-
- //
- // Obtains Signer's Certificate from PKCS#7 data
- // NOTE: Only one signer case will be handled in this function, which means SignerInfos
- // should include only one signer's certificate.
- //
- Signers = PKCS7_get0_signers (Pkcs7, NULL, PKCS7_BINARY);
- if ((Signers == NULL) || (sk_X509_num (Signers) != 1)) {
- goto _Error;
- }
-
- Signer = sk_X509_value (Signers, 0);
-
- CertCtx = X509_STORE_CTX_new ();
- if (CertCtx == NULL) {
- goto _Error;
- }
-
- if (!X509_STORE_CTX_init (CertCtx, NULL, Signer, Pkcs7->d.sign->cert)) {
- goto _Error;
- }
-
- //
- // Initialize Chained & Untrusted stack
- //
- CtxChain = X509_STORE_CTX_get0_chain (CertCtx);
- CtxCert = X509_STORE_CTX_get0_cert (CertCtx);
- if (CtxChain == NULL) {
- if (((CtxChain = sk_X509_new_null ()) == NULL) ||
- (!sk_X509_push (CtxChain, CtxCert)))
- {
- goto _Error;
- }
- }
-
- CtxUntrusted = X509_STORE_CTX_get0_untrusted (CertCtx);
- if (CtxUntrusted != NULL) {
- (VOID)sk_X509_delete_ptr (CtxUntrusted, Signer);
- }
-
- //
- // Build certificates stack chained from Signer's certificate.
- //
- Cert = Signer;
- for ( ; ;) {
- //
- // Self-Issue checking
- //
- Issuer = NULL;
- if (X509_STORE_CTX_get1_issuer (&Issuer, CertCtx, Cert) == 1) {
- if (X509_cmp (Issuer, Cert) == 0) {
- break;
- }
- }
-
- //
- // Found the issuer of the current certificate
- //
- if (CtxUntrusted != NULL) {
- Issuer = NULL;
- IssuerName = X509_get_issuer_name (Cert);
- Issuer = X509_find_by_subject (CtxUntrusted, IssuerName);
- if (Issuer != NULL) {
- if (!sk_X509_push (CtxChain, Issuer)) {
- goto _Error;
- }
-
- (VOID)sk_X509_delete_ptr (CtxUntrusted, Issuer);
-
- Cert = Issuer;
- continue;
- }
- }
-
- break;
- }
-
- //
- // Converts Chained and Untrusted Certificate to Certificate Buffer in following format:
- // UINT8 CertNumber;
- // UINT32 Cert1Length;
- // UINT8 Cert1[];
- // UINT32 Cert2Length;
- // UINT8 Cert2[];
- // ...
- // UINT32 CertnLength;
- // UINT8 Certn[];
- //
-
- if (CtxChain != NULL) {
- BufferSize = sizeof (UINT8);
- CertBuf = NULL;
-
- for (Index = 0; ; Index++) {
- Status = X509PopCertificate (CtxChain, &SingleCert, &CertSize);
- if (!Status) {
- break;
- }
-
- OldSize = BufferSize;
- OldBuf = CertBuf;
- BufferSize = OldSize + CertSize + sizeof (UINT32);
- CertBuf = malloc (BufferSize);
-
- if (CertBuf == NULL) {
- Status = FALSE;
- goto _Error;
- }
-
- if (OldBuf != NULL) {
- CopyMem (CertBuf, OldBuf, OldSize);
- free (OldBuf);
- OldBuf = NULL;
- }
-
- WriteUnaligned32 ((UINT32 *)(CertBuf + OldSize), (UINT32)CertSize);
- CopyMem (CertBuf + OldSize + sizeof (UINT32), SingleCert, CertSize);
-
- free (SingleCert);
- SingleCert = NULL;
- }
-
- if (CertBuf != NULL) {
- //
- // Update CertNumber.
- //
- CertBuf[0] = Index;
-
- *SignerChainCerts = CertBuf;
- *ChainLength = BufferSize;
- }
- }
-
- if (CtxUntrusted != NULL) {
- BufferSize = sizeof (UINT8);
- CertBuf = NULL;
-
- for (Index = 0; ; Index++) {
- Status = X509PopCertificate (CtxUntrusted, &SingleCert, &CertSize);
- if (!Status) {
- break;
- }
-
- OldSize = BufferSize;
- OldBuf = CertBuf;
- BufferSize = OldSize + CertSize + sizeof (UINT32);
- CertBuf = malloc (BufferSize);
-
- if (CertBuf == NULL) {
- Status = FALSE;
- goto _Error;
- }
-
- if (OldBuf != NULL) {
- CopyMem (CertBuf, OldBuf, OldSize);
- free (OldBuf);
- OldBuf = NULL;
- }
-
- WriteUnaligned32 ((UINT32 *)(CertBuf + OldSize), (UINT32)CertSize);
- CopyMem (CertBuf + OldSize + sizeof (UINT32), SingleCert, CertSize);
-
- free (SingleCert);
- SingleCert = NULL;
- }
-
- if (CertBuf != NULL) {
- //
- // Update CertNumber.
- //
- CertBuf[0] = Index;
-
- *UnchainCerts = CertBuf;
- *UnchainLength = BufferSize;
- }
- }
-
- Status = TRUE;
-
-_Error:
- //
- // Release Resources.
- //
- if (!Wrapped && (NewP7Data != NULL)) {
- free (NewP7Data);
- }
-
- if (Pkcs7 != NULL) {
- PKCS7_free (Pkcs7);
- }
-
- sk_X509_free (Signers);
-
- if (CertCtx != NULL) {
- X509_STORE_CTX_cleanup (CertCtx);
- X509_STORE_CTX_free (CertCtx);
- }
-
- if (SingleCert != NULL) {
- free (SingleCert);
- }
-
- if (OldBuf != NULL) {
- free (OldBuf);
- }
-
- if (!Status && (CertBuf != NULL)) {
- free (CertBuf);
- *SignerChainCerts = NULL;
- *UnchainCerts = NULL;
- }
-
- return Status;
-}
-
-/**
- Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, TrustedCert or InData is NULL, then return FALSE.
- If P7Length, CertLength or DataLength overflow, then return FALSE.
-
- Caution: This function may receive untrusted input.
- UEFI Authenticated Variable is external input, so this function will do basic
- check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertLength Length of the trusted certificate in bytes.
- @param[in] InData Pointer to the content to be verified.
- @param[in] DataLength Length of InData in bytes.
-
- @retval TRUE The specified PKCS#7 signed data is valid.
- @retval FALSE Invalid PKCS#7 signed data.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Verify (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertLength,
- IN CONST UINT8 *InData,
- IN UINTN DataLength
- )
-{
- PKCS7 *Pkcs7;
- BIO *DataBio;
- BOOLEAN Status;
- X509 *Cert;
- X509_STORE *CertStore;
- UINT8 *SignedData;
- CONST UINT8 *Temp;
- UINTN SignedDataSize;
- BOOLEAN Wrapped;
-
- //
- // Check input parameters.
- //
- if ((P7Data == NULL) || (TrustedCert == NULL) || (InData == NULL) ||
- (P7Length > INT_MAX) || (CertLength > INT_MAX) || (DataLength > INT_MAX))
- {
- return FALSE;
- }
-
- Pkcs7 = NULL;
- DataBio = NULL;
- Cert = NULL;
- CertStore = NULL;
-
- //
- // Register & Initialize necessary digest algorithms for PKCS#7 Handling
- //
- if (EVP_add_digest (EVP_md5 ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_digest (EVP_sha1 ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_digest (EVP_sha256 ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_digest (EVP_sha384 ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_digest (EVP_sha512 ()) == 0) {
- return FALSE;
- }
-
- if (EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA) == 0) {
- return FALSE;
- }
-
- Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);
- if (!Status) {
- return Status;
- }
-
- Status = FALSE;
-
- //
- // Retrieve PKCS#7 Data (DER encoding)
- //
- if (SignedDataSize > INT_MAX) {
- goto _Exit;
- }
-
- Temp = SignedData;
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)SignedDataSize);
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // Check if it's PKCS#7 Signed Data (for Authenticode Scenario)
- //
- if (!PKCS7_type_is_signed (Pkcs7)) {
- goto _Exit;
- }
-
- //
- // Read DER-encoded root certificate and Construct X509 Certificate
- //
- Temp = TrustedCert;
- Cert = d2i_X509 (NULL, &Temp, (long)CertLength);
- if (Cert == NULL) {
- goto _Exit;
- }
-
- //
- // Setup X509 Store for trusted certificate
- //
- CertStore = X509_STORE_new ();
- if (CertStore == NULL) {
- goto _Exit;
- }
-
- if (!(X509_STORE_add_cert (CertStore, Cert))) {
- goto _Exit;
- }
-
- //
- // For generic PKCS#7 handling, InData may be NULL if the content is present
- // in PKCS#7 structure. So ignore NULL checking here.
- //
- DataBio = BIO_new_mem_buf (InData, (int)DataLength);
- if (DataBio == NULL) {
- goto _Exit;
- }
-
- //
- // Allow partial certificate chains, terminated by a non-self-signed but
- // still trusted intermediate certificate. Also disable time checks.
- //
- X509_STORE_set_flags (
- CertStore,
- X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME
- );
-
- //
- // OpenSSL PKCS7 Verification by default checks for SMIME (email signing) and
- // doesn't support the extended key usage for Authenticode Code Signing.
- // Bypass the certificate purpose checking by enabling any purposes setting.
- //
- X509_STORE_set_purpose (CertStore, X509_PURPOSE_ANY);
-
- //
- // Verifies the PKCS#7 signedData structure
- //
- Status = (BOOLEAN)PKCS7_verify (Pkcs7, NULL, CertStore, DataBio, NULL, PKCS7_BINARY);
-
-_Exit:
- //
- // Release Resources
- //
- BIO_free (DataBio);
- X509_free (Cert);
- X509_STORE_free (CertStore);
- PKCS7_free (Pkcs7);
-
- if (!Wrapped) {
- OPENSSL_free (SignedData);
- }
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEku.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEku.c
deleted file mode 100644
index 63cd49434e..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEku.c
+++ /dev/null
@@ -1,526 +0,0 @@
-/** @file
- This module verifies that Enhanced Key Usages (EKU's) are present within
- a PKCS7 signature blob using OpenSSL.
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2019, Intel Corporation. All rights reserved.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include "InternalCryptLib.h"
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-
-/**
- This function will return the leaf signer certificate in a chain. This is
- required because certificate chains are not guaranteed to have the
- certificates in the order that they were issued.
-
- A typical certificate chain looks like this:
-
-
- ----------------------------
- | Root |
- ----------------------------
- ^
- |
- ----------------------------
- | Policy CA | <-- Typical Trust Anchor.
- ----------------------------
- ^
- |
- ----------------------------
- | Issuing CA |
- ----------------------------
- ^
- |
- -----------------------------
- / End-Entity (leaf) signer / <-- Bottom certificate.
- ----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"
- (Firmware Signing)
-
-
- @param[in] CertChain Certificate chain.
-
- @param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,
- this will be the end-entity (leaf) signer cert.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND The number of signers found was not 1.
-
-**/
-STATIC
-EFI_STATUS
-GetSignerCertificate (
- IN CONST PKCS7 *CertChain,
- OUT X509 **SignerCert
- )
-{
- EFI_STATUS Status;
-
- STACK_OF (X509) *Signers;
- INT32 NumberSigners;
-
- Status = EFI_SUCCESS;
- Signers = NULL;
- NumberSigners = 0;
-
- if ((CertChain == NULL) || (SignerCert == NULL)) {
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // Get the signers from the chain.
- //
- Signers = PKCS7_get0_signers ((PKCS7 *)CertChain, NULL, PKCS7_BINARY);
- if (Signers == NULL) {
- //
- // Fail to get signers form PKCS7
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // There should only be one signer in the PKCS7 stack.
- //
- NumberSigners = sk_X509_num (Signers);
- if (NumberSigners != 1) {
- //
- // The number of singers should have been 1
- //
- Status = EFI_NOT_FOUND;
- goto Exit;
- }
-
- *SignerCert = sk_X509_value (Signers, 0);
-
-Exit:
- //
- // Release Resources
- //
- if (Signers != NULL) {
- sk_X509_free (Signers);
- }
-
- return Status;
-}
-
-/**
- Determines if the specified EKU represented in ASN1 form is present
- in a given certificate.
-
- @param[in] Cert The certificate to check.
-
- @param[in] Asn1ToFind The EKU to look for.
-
- @retval EFI_SUCCESS We successfully identified the signing type.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-STATIC
-EFI_STATUS
-IsEkuInCertificate (
- IN CONST X509 *Cert,
- IN ASN1_OBJECT *Asn1ToFind
- )
-{
- EFI_STATUS Status;
- X509 *ClonedCert;
- X509_EXTENSION *Extension;
- EXTENDED_KEY_USAGE *Eku;
- INT32 ExtensionIndex;
- INTN NumExtensions;
- ASN1_OBJECT *Asn1InCert;
- INTN Index;
-
- Status = EFI_NOT_FOUND;
- ClonedCert = NULL;
- Extension = NULL;
- Eku = NULL;
- ExtensionIndex = -1;
- NumExtensions = 0;
- Asn1InCert = NULL;
-
- if ((Cert == NULL) || (Asn1ToFind == NULL)) {
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // Clone the certificate. This is required because the Extension API's
- // only work once per instance of an X509 object.
- //
- ClonedCert = X509_dup ((X509 *)Cert);
- if (ClonedCert == NULL) {
- //
- // Fail to duplicate cert.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // Look for the extended key usage.
- //
- ExtensionIndex = X509_get_ext_by_NID (ClonedCert, NID_ext_key_usage, -1);
-
- if (ExtensionIndex < 0) {
- //
- // Fail to find 'NID_ext_key_usage' in Cert.
- //
- goto Exit;
- }
-
- Extension = X509_get_ext (ClonedCert, ExtensionIndex);
- if (Extension == NULL) {
- //
- // Fail to get Extension form cert.
- //
- goto Exit;
- }
-
- Eku = (EXTENDED_KEY_USAGE *)X509V3_EXT_d2i (Extension);
- if (Eku == NULL) {
- //
- // Fail to get Eku from extension.
- //
- goto Exit;
- }
-
- NumExtensions = sk_ASN1_OBJECT_num (Eku);
-
- //
- // Now loop through the extensions, looking for the specified Eku.
- //
- for (Index = 0; Index < NumExtensions; Index++) {
- Asn1InCert = sk_ASN1_OBJECT_value (Eku, (INT32)Index);
- if (Asn1InCert == NULL) {
- //
- // Fail to get ASN object from Eku.
- //
- goto Exit;
- }
-
- if ((Asn1InCert->length == Asn1ToFind->length) &&
- (CompareMem (Asn1InCert->data, Asn1ToFind->data, Asn1InCert->length) == 0))
- {
- //
- // Found Eku in certificate.
- //
- Status = EFI_SUCCESS;
- goto Exit;
- }
- }
-
-Exit:
-
- //
- // Release Resources
- //
- if (ClonedCert != NULL) {
- X509_free (ClonedCert);
- }
-
- if (Eku != NULL) {
- sk_ASN1_OBJECT_pop_free (Eku, ASN1_OBJECT_free);
- }
-
- return Status;
-}
-
-/**
- Determines if the specified EKUs are present in a signing certificate.
-
- @param[in] SignerCert The certificate to check.
- @param[in] RequiredEKUs The EKUs to look for.
- @param[in] RequiredEKUsSize The number of EKUs
- @param[in] RequireAllPresent If TRUE, then all the specified EKUs
- must be present in the certificate.
-
- @retval EFI_SUCCESS We successfully identified the signing type.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-**/
-STATIC
-EFI_STATUS
-CheckEKUs (
- IN CONST X509 *SignerCert,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- EFI_STATUS Status;
- ASN1_OBJECT *Asn1ToFind;
- UINT32 NumEkusFound;
- UINT32 Index;
-
- Status = EFI_SUCCESS;
- Asn1ToFind = NULL;
- NumEkusFound = 0;
-
- if ((SignerCert == NULL) || (RequiredEKUs == NULL) || (RequiredEKUsSize == 0)) {
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- for (Index = 0; Index < RequiredEKUsSize; Index++) {
- //
- // Finding required EKU in cert.
- //
- if (Asn1ToFind != NULL) {
- ASN1_OBJECT_free (Asn1ToFind);
- Asn1ToFind = NULL;
- }
-
- Asn1ToFind = OBJ_txt2obj (RequiredEKUs[Index], 0);
- if (Asn1ToFind == NULL) {
- //
- // Fail to convert required EKU to ASN1.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- Status = IsEkuInCertificate (SignerCert, Asn1ToFind);
- if (Status == EFI_SUCCESS) {
- NumEkusFound++;
- if (!RequireAllPresent) {
- //
- // Found at least one, so we are done.
- //
- goto Exit;
- }
- } else {
- //
- // Fail to find Eku in cert
- break;
- }
- }
-
-Exit:
-
- if (Asn1ToFind != NULL) {
- ASN1_OBJECT_free (Asn1ToFind);
- }
-
- if (RequireAllPresent &&
- (NumEkusFound == RequiredEKUsSize))
- {
- //
- // Found all required EKUs in certificate.
- //
- Status = EFI_SUCCESS;
- }
-
- return Status;
-}
-
-/**
- This function receives a PKCS#7 formatted signature blob,
- looks for the EKU SEQUENCE blob, and if found then looks
- for all the required EKUs. This function was created so that
- the Surface team can cut down on the number of Certificate
- Authorities (CA's) by checking EKU's on leaf signers for
- a specific product. This prevents one product's certificate
- from signing another product's firmware or unlock blobs.
-
- Note that this function does not validate the certificate chain.
- That needs to be done before using this function.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-EFI_STATUS
-EFIAPI
-VerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- EFI_STATUS Status;
- PKCS7 *Pkcs7;
-
- STACK_OF (X509) *CertChain;
- INT32 SignatureType;
- INT32 NumberCertsInSignature;
- X509 *SignerCert;
- UINT8 *SignedData;
- UINT8 *Temp;
- UINTN SignedDataSize;
- BOOLEAN IsWrapped;
- BOOLEAN Ok;
-
- Status = EFI_SUCCESS;
- Pkcs7 = NULL;
- CertChain = NULL;
- SignatureType = 0;
- NumberCertsInSignature = 0;
- SignerCert = NULL;
- SignedData = NULL;
- SignedDataSize = 0;
- IsWrapped = FALSE;
- Ok = FALSE;
-
- //
- // Validate the input parameters.
- //
- if ((Pkcs7Signature == NULL) ||
- (SignatureSize == 0) ||
- (RequiredEKUs == NULL) ||
- (RequiredEKUsSize == 0))
- {
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- if (RequiredEKUsSize == 1) {
- RequireAllPresent = TRUE;
- }
-
- //
- // Wrap the PKCS7 data if needed.
- //
- Ok = WrapPkcs7Data (
- Pkcs7Signature,
- SignatureSize,
- &IsWrapped,
- &SignedData,
- &SignedDataSize
- );
- if (!Ok) {
- //
- // Fail to Wrap the PKCS7 data.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- Temp = SignedData;
-
- //
- // Create the PKCS7 object.
- //
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (INT32)SignedDataSize);
- if (Pkcs7 == NULL) {
- //
- // Fail to read PKCS7 data.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // Get the certificate chain.
- //
- SignatureType = OBJ_obj2nid (Pkcs7->type);
- switch (SignatureType) {
- case NID_pkcs7_signed:
- if (Pkcs7->d.sign != NULL) {
- CertChain = Pkcs7->d.sign->cert;
- }
-
- break;
- case NID_pkcs7_signedAndEnveloped:
- if (Pkcs7->d.signed_and_enveloped != NULL) {
- CertChain = Pkcs7->d.signed_and_enveloped->cert;
- }
-
- break;
- default:
- break;
- }
-
- //
- // Ensure we have a certificate stack
- //
- if (CertChain == NULL) {
- //
- // Fail to get the certificate stack from signature.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // Find out how many certificates were in the PKCS7 signature.
- //
- NumberCertsInSignature = sk_X509_num (CertChain);
-
- if (NumberCertsInSignature == 0) {
- //
- // Fail to find any certificates in signature.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- //
- // Get the leaf signer.
- //
- Status = GetSignerCertificate (Pkcs7, &SignerCert);
- if ((Status != EFI_SUCCESS) || (SignerCert == NULL)) {
- //
- // Fail to get the end-entity leaf signer certificate.
- //
- Status = EFI_INVALID_PARAMETER;
- goto Exit;
- }
-
- Status = CheckEKUs (SignerCert, RequiredEKUs, RequiredEKUsSize, RequireAllPresent);
- if (Status != EFI_SUCCESS) {
- goto Exit;
- }
-
-Exit:
-
- //
- // Release Resources
- //
- // If the signature was not wrapped, then the call to WrapData() will allocate
- // the data and add a header to it
- //
- if (!IsWrapped && SignedData) {
- free (SignedData);
- }
-
- if (Pkcs7 != NULL) {
- PKCS7_free (Pkcs7);
- }
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuNull.c
deleted file mode 100644
index c1d9837c51..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuNull.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/** @file
- PKCS7 Verify Null implementation.
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2019, Intel Corporation. All rights reserved.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- This function will return the leaf signer certificate in a chain. This is
- required because certificate chains are not guaranteed to have the
- certificates in the order that they were issued.
-
- A typical certificate chain looks like this:
-
-
- ----------------------------
- | Root |
- ----------------------------
- ^
- |
- ----------------------------
- | Policy CA | <-- Typical Trust Anchor.
- ----------------------------
- ^
- |
- ----------------------------
- | Issuing CA |
- ----------------------------
- ^
- |
- -----------------------------
- / End-Entity (leaf) signer / <-- Bottom certificate.
- ----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"
- (Firmware Signing)
-
-
- @param[in] CertChain Certificate chain.
-
- @param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,
- this will be the end-entity (leaf) signer cert.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND The number of signers found was not 1.
-
-**/
-EFI_STATUS
-GetSignerCertificate (
- IN CONST VOID *CertChain,
- OUT VOID **SignerCert
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
-
-/**
- Determines if the specified EKU represented in ASN1 form is present
- in a given certificate.
-
- @param[in] Cert The certificate to check.
-
- @param[in] Asn1ToFind The EKU to look for.
-
- @retval EFI_SUCCESS We successfully identified the signing type.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-EFI_STATUS
-IsEkuInCertificate (
- IN CONST VOID *Cert,
- IN VOID *Asn1ToFind
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
-
-/**
- Determines if the specified EKUs are present in a signing certificate.
-
- @param[in] SignerCert The certificate to check.
- @param[in] RequiredEKUs The EKUs to look for.
- @param[in] RequiredEKUsSize The number of EKUs
- @param[in] RequireAllPresent If TRUE, then all the specified EKUs
- must be present in the certificate.
-
- @retval EFI_SUCCESS We successfully identified the signing type.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-**/
-EFI_STATUS
-CheckEKUs (
- IN CONST VOID *SignerCert,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
-
-/**
- This function receives a PKCS#7 formatted signature blob,
- looks for the EKU SEQUENCE blob, and if found then looks
- for all the required EKUs. This function was created so that
- the Surface team can cut down on the number of Certificate
- Authorities (CA's) by checking EKU's on leaf signers for
- a specific product. This prevents one product's certificate
- from signing another product's firmware or unlock blobs.
-
- Note that this function does not validate the certificate chain.
- That needs to be done before using this function.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-EFI_STATUS
-EFIAPI
-VerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuRuntime.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuRuntime.c
deleted file mode 100644
index 9ac122ac07..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyEkuRuntime.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/** @file
- This module verifies that Enhanced Key Usages (EKU's) are present within
- a PKCS7 signature blob using OpenSSL.
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2019, Intel Corporation. All rights reserved.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- This function receives a PKCS#7 formatted signature blob,
- looks for the EKU SEQUENCE blob, and if found then looks
- for all the required EKUs. This function was created so that
- the Surface team can cut down on the number of Certificate
- Authorities (CA's) by checking EKU's on leaf signers for
- a specific product. This prevents one product's certificate
- from signing another product's firmware or unlock blobs.
-
- Return RETURN_UNSUPPORTED to indicate this interface is not supported.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in pPkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- All specified EKU's must be present in order to
- succeed.
- @param[in] RequiredEKUsSize Number of elements in the rgRequiredEKUs string.
- This parameter has a maximum of MAX_EKU_SEARCH.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-EFI_STATUS
-EFIAPI
-VerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- ASSERT (FALSE);
- return RETURN_UNSUPPORTED;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
deleted file mode 100644
index b9b7960126..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyNull.c
+++ /dev/null
@@ -1,163 +0,0 @@
-/** @file
- PKCS#7 SignedData Verification Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] StackLength Length of signer's certificates in bytes.
- @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- @param[out] CertLength Length of the trusted certificate in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetSigners (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **CertStack,
- OUT UINTN *StackLength,
- OUT UINT8 **TrustedCert,
- OUT UINTN *CertLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Wrap function to use free() to free allocated memory for certificates.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] Certs Pointer to the certificates to be freed.
-
-**/
-VOID
-EFIAPI
-Pkcs7FreeSigners (
- IN UINT8 *Certs
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
- unchained to the signer's certificates.
- The input signed data could be wrapped in a ContentInfo structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
- certificate. It's caller's responsibility to free the buffer
- with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] ChainLength Length of the chained certificates list buffer in bytes.
- @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
- responsibility to free the buffer with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetCertificatesList (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **SignerChainCerts,
- OUT UINTN *ChainLength,
- OUT UINT8 **UnchainCerts,
- OUT UINTN *UnchainLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertLength Length of the trusted certificate in bytes.
- @param[in] InData Pointer to the content to be verified.
- @param[in] DataLength Length of InData in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Verify (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertLength,
- IN CONST UINT8 *InData,
- IN UINTN DataLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyRuntime.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyRuntime.c
deleted file mode 100644
index 3c17b203aa..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyRuntime.c
+++ /dev/null
@@ -1,38 +0,0 @@
-/** @file
- Runtime specific implementation of PKCS#7 SignedData Verification Wrapper.
-
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
deleted file mode 100644
index 5bd740bf75..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
+++ /dev/null
@@ -1,336 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaNew
- 2) RsaFree
- 3) RsaSetKey
- 4) RsaPkcs1Verify
-
-Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-
-/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-RsaNew (
- VOID
- )
-{
- //
- // Allocates & Initializes RSA Context by OpenSSL RSA_new()
- //
- return (VOID *)RSA_new ();
-}
-
-/**
- Release the specified RSA context.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-VOID
-EFIAPI
-RsaFree (
- IN VOID *RsaContext
- )
-{
- //
- // Free OpenSSL RSA Context
- //
- RSA_free ((RSA *)RsaContext);
-}
-
-/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-BOOLEAN
-EFIAPI
-RsaSetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
- )
-{
- RSA *RsaKey;
- BIGNUM *BnN;
- BIGNUM *BnE;
- BIGNUM *BnD;
- BIGNUM *BnP;
- BIGNUM *BnQ;
- BIGNUM *BnDp;
- BIGNUM *BnDq;
- BIGNUM *BnQInv;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (BnSize > INT_MAX)) {
- return FALSE;
- }
-
- BnN = NULL;
- BnE = NULL;
- BnD = NULL;
- BnP = NULL;
- BnQ = NULL;
- BnDp = NULL;
- BnDq = NULL;
- BnQInv = NULL;
-
- //
- // Retrieve the components from RSA object.
- //
- RsaKey = (RSA *)RsaContext;
- RSA_get0_key (RsaKey, (const BIGNUM **)&BnN, (const BIGNUM **)&BnE, (const BIGNUM **)&BnD);
- RSA_get0_factors (RsaKey, (const BIGNUM **)&BnP, (const BIGNUM **)&BnQ);
- RSA_get0_crt_params (RsaKey, (const BIGNUM **)&BnDp, (const BIGNUM **)&BnDq, (const BIGNUM **)&BnQInv);
-
- //
- // Set RSA Key Components by converting octet string to OpenSSL BN representation.
- // NOTE: For RSA public key (used in signature verification), only public components
- // (N, e) are needed.
- //
- switch (KeyTag) {
- //
- // RSA Public Modulus (N), Public Exponent (e) and Private Exponent (d)
- //
- case RsaKeyN:
- case RsaKeyE:
- case RsaKeyD:
- if (BnN == NULL) {
- BnN = BN_new ();
- }
-
- if (BnE == NULL) {
- BnE = BN_new ();
- }
-
- if (BnD == NULL) {
- BnD = BN_new ();
- }
-
- if ((BnN == NULL) || (BnE == NULL) || (BnD == NULL)) {
- return FALSE;
- }
-
- switch (KeyTag) {
- case RsaKeyN:
- BnN = BN_bin2bn (BigNumber, (UINT32)BnSize, BnN);
- break;
- case RsaKeyE:
- BnE = BN_bin2bn (BigNumber, (UINT32)BnSize, BnE);
- break;
- case RsaKeyD:
- BnD = BN_bin2bn (BigNumber, (UINT32)BnSize, BnD);
- break;
- default:
- return FALSE;
- }
-
- if (RSA_set0_key (RsaKey, BN_dup (BnN), BN_dup (BnE), BN_dup (BnD)) == 0) {
- return FALSE;
- }
-
- break;
-
- //
- // RSA Secret Prime Factor of Modulus (p and q)
- //
- case RsaKeyP:
- case RsaKeyQ:
- if (BnP == NULL) {
- BnP = BN_new ();
- }
-
- if (BnQ == NULL) {
- BnQ = BN_new ();
- }
-
- if ((BnP == NULL) || (BnQ == NULL)) {
- return FALSE;
- }
-
- switch (KeyTag) {
- case RsaKeyP:
- BnP = BN_bin2bn (BigNumber, (UINT32)BnSize, BnP);
- break;
- case RsaKeyQ:
- BnQ = BN_bin2bn (BigNumber, (UINT32)BnSize, BnQ);
- break;
- default:
- return FALSE;
- }
-
- if (RSA_set0_factors (RsaKey, BN_dup (BnP), BN_dup (BnQ)) == 0) {
- return FALSE;
- }
-
- break;
-
- //
- // p's CRT Exponent (== d mod (p - 1)), q's CRT Exponent (== d mod (q - 1)),
- // and CRT Coefficient (== 1/q mod p)
- //
- case RsaKeyDp:
- case RsaKeyDq:
- case RsaKeyQInv:
- if (BnDp == NULL) {
- BnDp = BN_new ();
- }
-
- if (BnDq == NULL) {
- BnDq = BN_new ();
- }
-
- if (BnQInv == NULL) {
- BnQInv = BN_new ();
- }
-
- if ((BnDp == NULL) || (BnDq == NULL) || (BnQInv == NULL)) {
- return FALSE;
- }
-
- switch (KeyTag) {
- case RsaKeyDp:
- BnDp = BN_bin2bn (BigNumber, (UINT32)BnSize, BnDp);
- break;
- case RsaKeyDq:
- BnDq = BN_bin2bn (BigNumber, (UINT32)BnSize, BnDq);
- break;
- case RsaKeyQInv:
- BnQInv = BN_bin2bn (BigNumber, (UINT32)BnSize, BnQInv);
- break;
- default:
- return FALSE;
- }
-
- if (RSA_set0_crt_params (RsaKey, BN_dup (BnDp), BN_dup (BnDq), BN_dup (BnQInv)) == 0) {
- return FALSE;
- }
-
- break;
-
- default:
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256, SHA-384 or SHA-512 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Verify (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- INT32 DigestType;
- UINT8 *SigBuf;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (MessageHash == NULL) || (Signature == NULL)) {
- return FALSE;
- }
-
- if ((SigSize > INT_MAX) || (SigSize == 0)) {
- return FALSE;
- }
-
- //
- // Determine the message digest algorithm according to digest size.
- // Only MD5, SHA-1, SHA-256, SHA-384 or SHA-512 algorithm is supported.
- //
- switch (HashSize) {
- case MD5_DIGEST_SIZE:
- DigestType = NID_md5;
- break;
-
- case SHA1_DIGEST_SIZE:
- DigestType = NID_sha1;
- break;
-
- case SHA256_DIGEST_SIZE:
- DigestType = NID_sha256;
- break;
-
- case SHA384_DIGEST_SIZE:
- DigestType = NID_sha384;
- break;
-
- case SHA512_DIGEST_SIZE:
- DigestType = NID_sha512;
- break;
-
- default:
- return FALSE;
- }
-
- SigBuf = (UINT8 *)Signature;
- return (BOOLEAN)RSA_verify (
- DigestType,
- MessageHash,
- (UINT32)HashSize,
- SigBuf,
- (UINT32)SigSize,
- (RSA *)RsaContext
- );
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasicNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasicNull.c
deleted file mode 100644
index fd352e32dd..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasicNull.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Null Implementation.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaNew
- 2) RsaFree
- 3) RsaSetKey
- 4) RsaPkcs1Verify
-
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-RsaNew (
- VOID
- )
-{
- //
- // Allocates & Initializes RSA Context
- //
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified RSA context.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-VOID
-EFIAPI
-RsaFree (
- IN VOID *RsaContext
- )
-{
- //
- // Free RSA Context
- //
- ASSERT (FALSE);
-}
-
-/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-BOOLEAN
-EFIAPI
-RsaSetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Verify (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
deleted file mode 100644
index d414ce83f9..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
+++ /dev/null
@@ -1,365 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file implements following APIs which provide more capabilities for RSA:
- 1) RsaGetKey
- 2) RsaGenerateKey
- 3) RsaCheckKey
- 4) RsaPkcs1Sign
-
-Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-#include
-
-/**
- Gets the tag-designated RSA key component from the established RSA context.
-
- This function retrieves the tag-designated RSA key component from the
- established RSA context as a non-negative integer (octet string format
- represented in RSA PKCS#1).
- If specified key component has not been set or has been cleared, then returned
- BnSize is set to 0.
- If the BigNumber buffer is too small to hold the contents of the key, FALSE
- is returned and BnSize is set to the required buffer size to obtain the key.
-
- If RsaContext is NULL, then return FALSE.
- If BnSize is NULL, then return FALSE.
- If BnSize is large enough but BigNumber is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[out] BigNumber Pointer to octet integer buffer.
- @param[in, out] BnSize On input, the size of big number buffer in bytes.
- On output, the size of data returned in big number buffer in bytes.
-
- @retval TRUE RSA key component was retrieved successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE BnSize is too small.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- OUT UINT8 *BigNumber,
- IN OUT UINTN *BnSize
- )
-{
- RSA *RsaKey;
- BIGNUM *BnKey;
- UINTN Size;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (BnSize == NULL)) {
- return FALSE;
- }
-
- RsaKey = (RSA *)RsaContext;
- Size = *BnSize;
- *BnSize = 0;
- BnKey = NULL;
-
- switch (KeyTag) {
- //
- // RSA Public Modulus (N)
- //
- case RsaKeyN:
- RSA_get0_key (RsaKey, (const BIGNUM **)&BnKey, NULL, NULL);
- break;
-
- //
- // RSA Public Exponent (e)
- //
- case RsaKeyE:
- RSA_get0_key (RsaKey, NULL, (const BIGNUM **)&BnKey, NULL);
- break;
-
- //
- // RSA Private Exponent (d)
- //
- case RsaKeyD:
- RSA_get0_key (RsaKey, NULL, NULL, (const BIGNUM **)&BnKey);
- break;
-
- //
- // RSA Secret Prime Factor of Modulus (p)
- //
- case RsaKeyP:
- RSA_get0_factors (RsaKey, (const BIGNUM **)&BnKey, NULL);
- break;
-
- //
- // RSA Secret Prime Factor of Modules (q)
- //
- case RsaKeyQ:
- RSA_get0_factors (RsaKey, NULL, (const BIGNUM **)&BnKey);
- break;
-
- //
- // p's CRT Exponent (== d mod (p - 1))
- //
- case RsaKeyDp:
- RSA_get0_crt_params (RsaKey, (const BIGNUM **)&BnKey, NULL, NULL);
- break;
-
- //
- // q's CRT Exponent (== d mod (q - 1))
- //
- case RsaKeyDq:
- RSA_get0_crt_params (RsaKey, NULL, (const BIGNUM **)&BnKey, NULL);
- break;
-
- //
- // The CRT Coefficient (== 1/q mod p)
- //
- case RsaKeyQInv:
- RSA_get0_crt_params (RsaKey, NULL, NULL, (const BIGNUM **)&BnKey);
- break;
-
- default:
- return FALSE;
- }
-
- if (BnKey == NULL) {
- return FALSE;
- }
-
- *BnSize = Size;
- Size = BN_num_bytes (BnKey);
-
- if (*BnSize < Size) {
- *BnSize = Size;
- return FALSE;
- }
-
- if (BigNumber == NULL) {
- *BnSize = Size;
- return TRUE;
- }
-
- *BnSize = BN_bn2bin (BnKey, BigNumber);
-
- return TRUE;
-}
-
-/**
- Generates RSA key components.
-
- This function generates RSA key components. It takes RSA public exponent E and
- length in bits of RSA modulus N as input, and generates all key components.
- If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] ModulusLength Length of RSA modulus N in bits.
- @param[in] PublicExponent Pointer to RSA public exponent.
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
-
- @retval TRUE RSA key component was generated successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGenerateKey (
- IN OUT VOID *RsaContext,
- IN UINTN ModulusLength,
- IN CONST UINT8 *PublicExponent,
- IN UINTN PublicExponentSize
- )
-{
- BIGNUM *KeyE;
- BOOLEAN RetVal;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (ModulusLength > INT_MAX) || (PublicExponentSize > INT_MAX)) {
- return FALSE;
- }
-
- KeyE = BN_new ();
- if (KeyE == NULL) {
- return FALSE;
- }
-
- RetVal = FALSE;
-
- if (PublicExponent == NULL) {
- if (BN_set_word (KeyE, 0x10001) == 0) {
- goto _Exit;
- }
- } else {
- if (BN_bin2bn (PublicExponent, (UINT32)PublicExponentSize, KeyE) == NULL) {
- goto _Exit;
- }
- }
-
- if (RSA_generate_key_ex ((RSA *)RsaContext, (UINT32)ModulusLength, KeyE, NULL) == 1) {
- RetVal = TRUE;
- }
-
-_Exit:
- BN_free (KeyE);
- return RetVal;
-}
-
-/**
- Validates key components of RSA context.
- NOTE: This function performs integrity checks on all the RSA key material, so
- the RSA key structure must contain all the private key data.
-
- This function validates key components of RSA context in following aspects:
- - Whether p is a prime
- - Whether q is a prime
- - Whether n = p * q
- - Whether d*e = 1 mod lcm(p-1,q-1)
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context to check.
-
- @retval TRUE RSA key components are valid.
- @retval FALSE RSA key components are not valid.
-
-**/
-BOOLEAN
-EFIAPI
-RsaCheckKey (
- IN VOID *RsaContext
- )
-{
- UINTN Reason;
-
- //
- // Check input parameters.
- //
- if (RsaContext == NULL) {
- return FALSE;
- }
-
- if (RSA_check_key ((RSA *)RsaContext) != 1) {
- Reason = ERR_GET_REASON (ERR_peek_last_error ());
- if ((Reason == RSA_R_P_NOT_PRIME) ||
- (Reason == RSA_R_Q_NOT_PRIME) ||
- (Reason == RSA_R_N_DOES_NOT_EQUAL_P_Q) ||
- (Reason == RSA_R_D_E_NOT_CONGRUENT_TO_1))
- {
- return FALSE;
- }
- }
-
- return TRUE;
-}
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256, SHA-384 or SHA-512 digest, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in PKCS1-v1_5.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Sign (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- RSA *Rsa;
- UINTN Size;
- INT32 DigestType;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (MessageHash == NULL)) {
- return FALSE;
- }
-
- Rsa = (RSA *)RsaContext;
- Size = RSA_size (Rsa);
-
- if (*SigSize < Size) {
- *SigSize = Size;
- return FALSE;
- }
-
- if (Signature == NULL) {
- return FALSE;
- }
-
- //
- // Determine the message digest algorithm according to digest size.
- // Only MD5, SHA-1, SHA-256, SHA-384 or SHA-512 algorithm is supported.
- //
- switch (HashSize) {
- case MD5_DIGEST_SIZE:
- DigestType = NID_md5;
- break;
-
- case SHA1_DIGEST_SIZE:
- DigestType = NID_sha1;
- break;
-
- case SHA256_DIGEST_SIZE:
- DigestType = NID_sha256;
- break;
-
- case SHA384_DIGEST_SIZE:
- DigestType = NID_sha384;
- break;
-
- case SHA512_DIGEST_SIZE:
- DigestType = NID_sha512;
- break;
-
- default:
- return FALSE;
- }
-
- return (BOOLEAN)RSA_sign (
- DigestType,
- MessageHash,
- (UINT32)HashSize,
- Signature,
- (UINT32 *)SigSize,
- (RSA *)RsaContext
- );
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExtNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExtNull.c
deleted file mode 100644
index 9aeadcf96b..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExtNull.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file does not provide real capabilities for following APIs in RSA handling:
- 1) RsaGetKey
- 2) RsaGenerateKey
- 3) RsaCheckKey
- 4) RsaPkcs1Sign
-
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Gets the tag-designated RSA key component from the established RSA context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[out] BigNumber Pointer to octet integer buffer.
- @param[in, out] BnSize On input, the size of big number buffer in bytes.
- On output, the size of data returned in big number buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- OUT UINT8 *BigNumber,
- IN OUT UINTN *BnSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Generates RSA key components.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] ModulusLength Length of RSA modulus N in bits.
- @param[in] PublicExponent Pointer to RSA public exponent.
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGenerateKey (
- IN OUT VOID *RsaContext,
- IN UINTN ModulusLength,
- IN CONST UINT8 *PublicExponent,
- IN UINTN PublicExponentSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Validates key components of RSA context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] RsaContext Pointer to RSA context to check.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaCheckKey (
- IN VOID *RsaContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Sign (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPss.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPss.c
deleted file mode 100644
index bdc9155e1f..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPss.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaPssVerify
-
-Copyright (c) 2021, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-#include
-
-/**
- Retrieve a pointer to EVP message digest object.
-
- @param[in] DigestLen Length of the message digest.
-
-**/
-STATIC
-const
-EVP_MD *
-GetEvpMD (
- IN UINT16 DigestLen
- )
-{
- switch (DigestLen) {
- case SHA256_DIGEST_SIZE:
- return EVP_sha256 ();
- break;
- case SHA384_DIGEST_SIZE:
- return EVP_sha384 ();
- break;
- case SHA512_DIGEST_SIZE:
- return EVP_sha512 ();
- break;
- default:
- return NULL;
- }
-}
-
-/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssVerify (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
- )
-{
- BOOLEAN Result;
- EVP_PKEY *EvpRsaKey;
- EVP_MD_CTX *EvpVerifyCtx;
- EVP_PKEY_CTX *KeyCtx;
- CONST EVP_MD *HashAlg;
-
- Result = FALSE;
- EvpRsaKey = NULL;
- EvpVerifyCtx = NULL;
- KeyCtx = NULL;
- HashAlg = NULL;
-
- if (RsaContext == NULL) {
- return FALSE;
- }
-
- if ((Message == NULL) || (MsgSize == 0) || (MsgSize > INT_MAX)) {
- return FALSE;
- }
-
- if ((Signature == NULL) || (SigSize == 0) || (SigSize > INT_MAX)) {
- return FALSE;
- }
-
- if (SaltLen != DigestLen) {
- return FALSE;
- }
-
- HashAlg = GetEvpMD (DigestLen);
-
- if (HashAlg == NULL) {
- return FALSE;
- }
-
- EvpRsaKey = EVP_PKEY_new ();
- if (EvpRsaKey == NULL) {
- goto _Exit;
- }
-
- EVP_PKEY_set1_RSA (EvpRsaKey, RsaContext);
-
- EvpVerifyCtx = EVP_MD_CTX_create ();
- if (EvpVerifyCtx == NULL) {
- goto _Exit;
- }
-
- Result = EVP_DigestVerifyInit (EvpVerifyCtx, &KeyCtx, HashAlg, NULL, EvpRsaKey) > 0;
- if (KeyCtx == NULL) {
- goto _Exit;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set_rsa_padding (KeyCtx, RSA_PKCS1_PSS_PADDING) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set_rsa_pss_saltlen (KeyCtx, SaltLen) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set_rsa_mgf1_md (KeyCtx, HashAlg) > 0;
- }
-
- if (Result) {
- Result = EVP_DigestVerifyUpdate (EvpVerifyCtx, Message, (UINT32)MsgSize) > 0;
- }
-
- if (Result) {
- Result = EVP_DigestVerifyFinal (EvpVerifyCtx, Signature, (UINT32)SigSize) > 0;
- }
-
-_Exit:
- if (EvpRsaKey != NULL) {
- EVP_PKEY_free (EvpRsaKey);
- }
-
- if (EvpVerifyCtx != NULL) {
- EVP_MD_CTX_destroy (EvpVerifyCtx);
- }
-
- return Result;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssNull.c
deleted file mode 100644
index cc325c9291..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssNull.c
+++ /dev/null
@@ -1,46 +0,0 @@
-/** @file
- RSA-PSS Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file does not provide real capabilities for following APIs in RSA handling:
- 1) RsaPssVerify
-
-Copyright (c) 2021, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssVerify (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssSign.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssSign.c
deleted file mode 100644
index 07c24f6e8d..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssSign.c
+++ /dev/null
@@ -1,179 +0,0 @@
-/** @file
- RSA PSS Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaPssSign
-
-Copyright (c) 2021, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-#include
-
-/**
- Retrieve a pointer to EVP message digest object.
-
- @param[in] DigestLen Length of the message digest.
-
-**/
-STATIC
-const
-EVP_MD *
-GetEvpMD (
- IN UINT16 DigestLen
- )
-{
- switch (DigestLen) {
- case SHA256_DIGEST_SIZE:
- return EVP_sha256 ();
- break;
- case SHA384_DIGEST_SIZE:
- return EVP_sha384 ();
- break;
- case SHA512_DIGEST_SIZE:
- return EVP_sha512 ();
- break;
- default:
- return NULL;
- }
-}
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
- RFC 8017.
- Mask generation function is the same as the message digest algorithm.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If Message is NULL, then return FALSE.
- If MsgSize is zero or > INT_MAX, then return FALSE.
- If DigestLen is NOT 32, 48 or 64, return FALSE.
- If SaltLen is not equal to DigestLen, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] Message Pointer to octet message to be signed.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
- @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
- @param[out] Signature Pointer to buffer to receive RSA PSS signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in RSASSA-PSS.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssSign (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- BOOLEAN Result;
- UINTN RsaSigSize;
- EVP_PKEY *EvpRsaKey;
- EVP_MD_CTX *EvpVerifyCtx;
- EVP_PKEY_CTX *KeyCtx;
- CONST EVP_MD *HashAlg;
-
- Result = FALSE;
- EvpRsaKey = NULL;
- EvpVerifyCtx = NULL;
- KeyCtx = NULL;
- HashAlg = NULL;
-
- if (RsaContext == NULL) {
- return FALSE;
- }
-
- if ((Message == NULL) || (MsgSize == 0) || (MsgSize > INT_MAX)) {
- return FALSE;
- }
-
- RsaSigSize = RSA_size (RsaContext);
- if (*SigSize < RsaSigSize) {
- *SigSize = RsaSigSize;
- return FALSE;
- }
-
- if (Signature == NULL) {
- return FALSE;
- }
-
- if (SaltLen != DigestLen) {
- return FALSE;
- }
-
- HashAlg = GetEvpMD (DigestLen);
-
- if (HashAlg == NULL) {
- return FALSE;
- }
-
- EvpRsaKey = EVP_PKEY_new ();
- if (EvpRsaKey == NULL) {
- goto _Exit;
- }
-
- EVP_PKEY_set1_RSA (EvpRsaKey, RsaContext);
-
- EvpVerifyCtx = EVP_MD_CTX_create ();
- if (EvpVerifyCtx == NULL) {
- goto _Exit;
- }
-
- Result = EVP_DigestSignInit (EvpVerifyCtx, &KeyCtx, HashAlg, NULL, EvpRsaKey) > 0;
- if (KeyCtx == NULL) {
- goto _Exit;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set_rsa_padding (KeyCtx, RSA_PKCS1_PSS_PADDING) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set_rsa_pss_saltlen (KeyCtx, SaltLen) > 0;
- }
-
- if (Result) {
- Result = EVP_PKEY_CTX_set_rsa_mgf1_md (KeyCtx, HashAlg) > 0;
- }
-
- if (Result) {
- Result = EVP_DigestSignUpdate (EvpVerifyCtx, Message, (UINT32)MsgSize) > 0;
- }
-
- if (Result) {
- Result = EVP_DigestSignFinal (EvpVerifyCtx, Signature, SigSize) > 0;
- }
-
-_Exit:
- if (EvpRsaKey != NULL) {
- EVP_PKEY_free (EvpRsaKey);
- }
-
- if (EvpVerifyCtx != NULL) {
- EVP_MD_CTX_destroy (EvpVerifyCtx);
- }
-
- return Result;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssSignNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssSignNull.c
deleted file mode 100644
index 911b972521..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaPssSignNull.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/** @file
- RSA-PSS Asymmetric Cipher Wrapper Implementation over OpenSSL.
-
- This file does not provide real capabilities for following APIs in RSA handling:
- 1) RsaPssSign
-
-Copyright (c) 2021, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
- RFC 8017.
- Mask generation function is the same as the message digest algorithm.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If Message is NULL, then return FALSE.
- If MsgSize is zero or > INT_MAX, then return FALSE.
- If DigestLen is NOT 32, 48 or 64, return FALSE.
- If SaltLen is not equal to DigestLen, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] Message Pointer to octet message to be signed.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
- @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
- @param[out] Signature Pointer to buffer to receive RSA PSS signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in RSASSA-PSS.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssSign (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
deleted file mode 100644
index be389fa097..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
+++ /dev/null
@@ -1,708 +0,0 @@
-/** @file
- RFC3161 Timestamp Countersignature Verification over OpenSSL.
- The timestamp is generated by a TimeStamping Authority (TSA) and asserts that a
- publisher's signature existed before the specified time. The timestamp extends
- the lifetime of the signature when a signing certificate expires or is later
- revoked.
-
-Copyright (c) 2014 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-#include
-#include
-#include
-#include
-
-//
-// OID ASN.1 Value for SPC_RFC3161_OBJID ("1.3.6.1.4.1.311.3.3.1")
-//
-GLOBAL_REMOVE_IF_UNREFERENCED const UINT8 mSpcRFC3161OidValue[] = {
- 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x03, 0x03, 0x01
-};
-
-///
-/// The messageImprint field SHOULD contain the hash of the datum to be
-/// time-stamped. The hash is represented as an OCTET STRING. Its
-/// length MUST match the length of the hash value for that algorithm
-/// (e.g., 20 bytes for SHA-1 or 16 bytes for MD5).
-///
-/// MessageImprint ::= SEQUENCE {
-/// hashAlgorithm AlgorithmIdentifier,
-/// hashedMessage OCTET STRING }
-///
-typedef struct {
- X509_ALGOR *HashAlgorithm;
- ASN1_OCTET_STRING *HashedMessage;
-} TS_MESSAGE_IMPRINT;
-
-//
-// ASN.1 Functions for TS_MESSAGE_IMPRINT
-//
-GLOBAL_REMOVE_IF_UNREFERENCED
-DECLARE_ASN1_FUNCTIONS (
- TS_MESSAGE_IMPRINT
- )
-ASN1_SEQUENCE (TS_MESSAGE_IMPRINT) =
-{
- ASN1_SIMPLE (TS_MESSAGE_IMPRINT, HashAlgorithm, X509_ALGOR),
- ASN1_SIMPLE (TS_MESSAGE_IMPRINT, HashedMessage, ASN1_OCTET_STRING)
-}
-
-ASN1_SEQUENCE_END (TS_MESSAGE_IMPRINT)
-IMPLEMENT_ASN1_FUNCTIONS (TS_MESSAGE_IMPRINT)
-
-///
-/// Accuracy represents the time deviation around the UTC time contained
-/// in GeneralizedTime of time-stamp token.
-///
-/// Accuracy ::= SEQUENCE {
-/// seconds INTEGER OPTIONAL,
-/// millis [0] INTEGER (1..999) OPTIONAL,
-/// micros [1] INTEGER (1..999) OPTIONAL }
-///
-typedef struct {
- ASN1_INTEGER *Seconds;
- ASN1_INTEGER *Millis;
- ASN1_INTEGER *Micros;
-} TS_ACCURACY;
-
-//
-// ASN.1 Functions for TS_ACCURACY
-//
-GLOBAL_REMOVE_IF_UNREFERENCED
-DECLARE_ASN1_FUNCTIONS (
- TS_ACCURACY
- )
-ASN1_SEQUENCE (TS_ACCURACY) =
-{
- ASN1_OPT (TS_ACCURACY, Seconds, ASN1_INTEGER),
- ASN1_IMP_OPT (TS_ACCURACY, Millis, ASN1_INTEGER, 0),
- ASN1_IMP_OPT (TS_ACCURACY, Micros, ASN1_INTEGER, 1)
-}
-
-ASN1_SEQUENCE_END (TS_ACCURACY)
-IMPLEMENT_ASN1_FUNCTIONS (TS_ACCURACY)
-
-///
-/// The timestamp token info resulting from a successful timestamp request,
-/// as defined in RFC 3161.
-///
-/// TSTInfo ::= SEQUENCE {
-/// version INTEGER { v1(1) },
-/// policy TSAPolicyId,
-/// messageImprint MessageImprint,
-/// -- MUST have the same value as the similar field in
-/// -- TimeStampReq
-/// serialNumber INTEGER,
-/// -- Time-Stamping users MUST be ready to accommodate integers
-/// -- up to 160 bits.
-/// genTime GeneralizedTime,
-/// accuracy Accuracy OPTIONAL,
-/// ordering BOOLEAN DEFAULT FALSE,
-/// nonce INTEGER OPTIONAL,
-/// -- MUST be present if the similar field was present
-/// -- in TimeStampReq. In that case it MUST have the same value.
-/// tsa [0] GeneralName OPTIONAL,
-/// extensions [1] IMPLICIT Extensions OPTIONAL }
-///
-typedef struct {
- ASN1_INTEGER *Version;
- ASN1_OBJECT *Policy;
- TS_MESSAGE_IMPRINT *MessageImprint;
- ASN1_INTEGER *SerialNumber;
- ASN1_GENERALIZEDTIME *GenTime;
- TS_ACCURACY *Accuracy;
- ASN1_BOOLEAN Ordering;
- ASN1_INTEGER *Nonce;
- GENERAL_NAME *Tsa;
- STACK_OF (X509_EXTENSION) *Extensions;
-} TS_TST_INFO;
-
-//
-// ASN.1 Functions for TS_TST_INFO
-//
-GLOBAL_REMOVE_IF_UNREFERENCED
-DECLARE_ASN1_FUNCTIONS (
- TS_TST_INFO
- )
-ASN1_SEQUENCE (TS_TST_INFO) =
-{
- ASN1_SIMPLE (TS_TST_INFO, Version, ASN1_INTEGER),
- ASN1_SIMPLE (TS_TST_INFO, Policy, ASN1_OBJECT),
- ASN1_SIMPLE (TS_TST_INFO, MessageImprint, TS_MESSAGE_IMPRINT),
- ASN1_SIMPLE (TS_TST_INFO, SerialNumber, ASN1_INTEGER),
- ASN1_SIMPLE (TS_TST_INFO, GenTime, ASN1_GENERALIZEDTIME),
- ASN1_OPT (TS_TST_INFO, Accuracy, TS_ACCURACY),
- ASN1_OPT (TS_TST_INFO, Ordering, ASN1_FBOOLEAN),
- ASN1_OPT (TS_TST_INFO, Nonce, ASN1_INTEGER),
- ASN1_EXP_OPT (TS_TST_INFO, Tsa, GENERAL_NAME, 0),
- ASN1_IMP_SEQUENCE_OF_OPT (TS_TST_INFO, Extensions, X509_EXTENSION, 1)
-}
-
-ASN1_SEQUENCE_END (TS_TST_INFO)
-IMPLEMENT_ASN1_FUNCTIONS (TS_TST_INFO)
-
-/**
- Convert ASN.1 GeneralizedTime to EFI Time.
-
- @param[in] Asn1Time Pointer to the ASN.1 GeneralizedTime to be converted.
- @param[out] SigningTime Return the corresponding EFI Time.
-
- @retval TRUE The time conversion succeeds.
- @retval FALSE Invalid parameters.
-
-**/
-STATIC
-BOOLEAN
-ConvertAsn1TimeToEfiTime (
- IN ASN1_TIME *Asn1Time,
- OUT EFI_TIME *EfiTime
- )
-{
- CONST CHAR8 *Str;
- UINTN Index;
-
- if ((Asn1Time == NULL) || (EfiTime == NULL)) {
- return FALSE;
- }
-
- Str = (CONST CHAR8 *)Asn1Time->data;
- SetMem (EfiTime, sizeof (EFI_TIME), 0);
-
- Index = 0;
- if (Asn1Time->type == V_ASN1_UTCTIME) {
- /* two digit year */
- EfiTime->Year = (Str[Index++] - '0') * 10;
- EfiTime->Year += (Str[Index++] - '0');
- if (EfiTime->Year < 70) {
- EfiTime->Year += 100;
- }
- } else if (Asn1Time->type == V_ASN1_GENERALIZEDTIME) {
- /* four digit year */
- EfiTime->Year = (Str[Index++] - '0') * 1000;
- EfiTime->Year += (Str[Index++] - '0') * 100;
- EfiTime->Year += (Str[Index++] - '0') * 10;
- EfiTime->Year += (Str[Index++] - '0');
- if ((EfiTime->Year < 1900) || (EfiTime->Year > 9999)) {
- return FALSE;
- }
- }
-
- EfiTime->Month = (Str[Index++] - '0') * 10;
- EfiTime->Month += (Str[Index++] - '0');
- if ((EfiTime->Month < 1) || (EfiTime->Month > 12)) {
- return FALSE;
- }
-
- EfiTime->Day = (Str[Index++] - '0') * 10;
- EfiTime->Day += (Str[Index++] - '0');
- if ((EfiTime->Day < 1) || (EfiTime->Day > 31)) {
- return FALSE;
- }
-
- EfiTime->Hour = (Str[Index++] - '0') * 10;
- EfiTime->Hour += (Str[Index++] - '0');
- if (EfiTime->Hour > 23) {
- return FALSE;
- }
-
- EfiTime->Minute = (Str[Index++] - '0') * 10;
- EfiTime->Minute += (Str[Index++] - '0');
- if (EfiTime->Minute > 59) {
- return FALSE;
- }
-
- EfiTime->Second = (Str[Index++] - '0') * 10;
- EfiTime->Second += (Str[Index++] - '0');
- if (EfiTime->Second > 59) {
- return FALSE;
- }
-
- /* Note: we did not adjust the time based on time zone information */
-
- return TRUE;
-}
-
-/**
-
- Check the validity of TimeStamp Token Information.
-
- @param[in] TstInfo Pointer to the TS_TST_INFO structure.
- @param[in] TimestampedData Pointer to the data to be time-stamped.
- @param[in] DataSize Size of timestamped data in bytes.
-
- @retval TRUE The TimeStamp Token Information is valid.
- @retval FALSE Invalid TimeStamp Token Information.
-
-**/
-STATIC
-BOOLEAN
-CheckTSTInfo (
- IN CONST TS_TST_INFO *TstInfo,
- IN CONST UINT8 *TimestampedData,
- IN UINTN DataSize
- )
-{
- BOOLEAN Status;
- TS_MESSAGE_IMPRINT *Imprint;
- X509_ALGOR *HashAlgo;
- CONST EVP_MD *Md;
- EVP_MD_CTX *MdCtx;
- UINTN MdSize;
- UINT8 *HashedMsg;
-
- //
- // Initialization
- //
- Status = FALSE;
- HashAlgo = NULL;
- HashedMsg = NULL;
- MdCtx = NULL;
-
- //
- // -- Check version number of Timestamp:
- // The version field (currently v1) describes the version of the time-stamp token.
- // Conforming time-stamping servers MUST be able to provide version 1 time-stamp tokens.
- //
- if ((ASN1_INTEGER_get (TstInfo->Version)) != 1) {
- return FALSE;
- }
-
- //
- // -- Check Policies
- // The policy field MUST indicate the TSA's policy under which the response was produced.
- //
- if (TstInfo->Policy == NULL) {
- /// NOTE: Need to check if the requested and returned policies.
- /// We have no information about the Requested TSA Policy.
- return FALSE;
- }
-
- //
- // -- Compute & Check Message Imprint
- //
- Imprint = TstInfo->MessageImprint;
- HashAlgo = X509_ALGOR_dup (Imprint->HashAlgorithm);
- // MU_CHANGE [BEGIN] - CodeQL change
- if ((HashAlgo == NULL) || (HashAlgo->algorithm == NULL)) {
- goto _Exit;
- }
-
- // MU_CHANGE [END] - CodeQL change
-
- Md = EVP_get_digestbyobj (HashAlgo->algorithm);
- if (Md == NULL) {
- goto _Exit;
- }
-
- MdSize = EVP_MD_size (Md);
- HashedMsg = AllocateZeroPool (MdSize);
- if (HashedMsg == NULL) {
- goto _Exit;
- }
-
- MdCtx = EVP_MD_CTX_new ();
- if (MdCtx == NULL) {
- goto _Exit;
- }
-
- if ((EVP_DigestInit_ex (MdCtx, Md, NULL) != 1) ||
- (EVP_DigestUpdate (MdCtx, TimestampedData, DataSize) != 1) ||
- (EVP_DigestFinal (MdCtx, HashedMsg, NULL) != 1))
- {
- goto _Exit;
- }
-
- if ((MdSize == (UINTN)ASN1_STRING_length (Imprint->HashedMessage)) &&
- (CompareMem (HashedMsg, ASN1_STRING_get0_data (Imprint->HashedMessage), MdSize) != 0))
- {
- goto _Exit;
- }
-
- //
- // -- Check Nonces
- //
- if (TstInfo->Nonce != NULL) {
- //
- // Nonces is optional, No error if no nonce is returned;
- //
- }
-
- //
- // -- Check if the TSA name and signer certificate is matched.
- //
- if (TstInfo->Tsa != NULL) {
- //
- // Ignored the optional Tsa field checking.
- //
- }
-
- Status = TRUE;
-
-_Exit:
- X509_ALGOR_free (HashAlgo);
- EVP_MD_CTX_free (MdCtx);
- if (HashedMsg != NULL) {
- FreePool (HashedMsg);
- }
-
- return Status;
-}
-
-/**
- Verifies the validity of a TimeStamp Token as described in RFC 3161 ("Internet
- X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)").
-
- If TSToken is NULL, then return FALSE.
- If TimestampedData is NULL, then return FALSE.
-
- @param[in] TSToken Pointer to the RFC3161 TimeStamp Token, which is generated
- by a TSA and located in the software publisher's SignerInfo
- structure.
- @param[in] TokenSize Size of the TimeStamp Token in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER.
- @param[in] CertSize Size of the trusted TSA certificate in bytes.
- @param[in] TimestampedData Pointer to the data to be time-stamped.
- @param[in] DataSize Size of timestamped data in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval TRUE The specified timestamp token is valid.
- @retval FALSE Invalid timestamp token.
-
-**/
-STATIC
-BOOLEAN
-TimestampTokenVerify (
- IN CONST UINT8 *TSToken,
- IN UINTN TokenSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- IN CONST UINT8 *TimestampedData,
- IN UINTN DataSize,
- OUT EFI_TIME *SigningTime
- )
-{
- BOOLEAN Status;
- CONST UINT8 *TokenTemp;
- PKCS7 *Pkcs7;
- X509 *Cert;
- CONST UINT8 *CertTemp;
- X509_STORE *CertStore;
- BIO *OutBio;
- UINT8 *TstData;
- UINTN TstSize;
- CONST UINT8 *TstTemp;
- TS_TST_INFO *TstInfo;
-
- Status = FALSE;
-
- //
- // Check input parameters
- //
- if ((TSToken == NULL) || (TsaCert == NULL) || (TimestampedData == NULL) ||
- (TokenSize > INT_MAX) || (CertSize > INT_MAX) || (DataSize > INT_MAX))
- {
- return FALSE;
- }
-
- //
- // Initializations
- //
- if (SigningTime != NULL) {
- SetMem (SigningTime, sizeof (EFI_TIME), 0);
- }
-
- Pkcs7 = NULL;
- Cert = NULL;
- CertStore = NULL;
- OutBio = NULL;
- TstData = NULL;
- TstInfo = NULL;
-
- //
- // TimeStamp Token should contain one valid DER-encoded ASN.1 PKCS#7 structure.
- //
- TokenTemp = TSToken;
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&TokenTemp, (int)TokenSize);
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // The timestamp signature (TSA's response) will be one PKCS#7 signed data.
- //
- if (!PKCS7_type_is_signed (Pkcs7)) {
- goto _Exit;
- }
-
- //
- // Read the trusted TSA certificate (DER-encoded), and Construct X509 Certificate.
- //
- CertTemp = TsaCert;
- Cert = d2i_X509 (NULL, &CertTemp, (long)CertSize);
- if (Cert == NULL) {
- goto _Exit;
- }
-
- //
- // Setup X509 Store for trusted certificate.
- //
- CertStore = X509_STORE_new ();
- if ((CertStore == NULL) || !(X509_STORE_add_cert (CertStore, Cert))) {
- goto _Exit;
- }
-
- //
- // Allow partial certificate chains, terminated by a non-self-signed but
- // still trusted intermediate certificate. Also disable time checks.
- //
- X509_STORE_set_flags (
- CertStore,
- X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME
- );
-
- X509_STORE_set_purpose (CertStore, X509_PURPOSE_ANY);
-
- //
- // Verifies the PKCS#7 signedData structure, and output the signed contents.
- //
- OutBio = BIO_new (BIO_s_mem ());
- if (OutBio == NULL) {
- goto _Exit;
- }
-
- if (!PKCS7_verify (Pkcs7, NULL, CertStore, NULL, OutBio, PKCS7_BINARY)) {
- goto _Exit;
- }
-
- //
- // Read the signed contents detached in timestamp signature.
- //
- TstData = AllocateZeroPool (2048);
- if (TstData == NULL) {
- goto _Exit;
- }
-
- TstSize = BIO_read (OutBio, (void *)TstData, 2048);
-
- //
- // Construct TS_TST_INFO structure from the signed contents.
- //
- TstTemp = TstData;
- TstInfo = d2i_TS_TST_INFO (
- NULL,
- (const unsigned char **)&TstTemp,
- (int)TstSize
- );
- if (TstInfo == NULL) {
- goto _Exit;
- }
-
- //
- // Check TS_TST_INFO structure.
- //
- Status = CheckTSTInfo (TstInfo, TimestampedData, DataSize);
- if (!Status) {
- goto _Exit;
- }
-
- //
- // Retrieve the signing time from TS_TST_INFO structure.
- //
- if (SigningTime != NULL) {
- SetMem (SigningTime, sizeof (EFI_TIME), 0);
- Status = ConvertAsn1TimeToEfiTime (TstInfo->GenTime, SigningTime);
- }
-
-_Exit:
- //
- // Release Resources
- //
- PKCS7_free (Pkcs7);
- X509_free (Cert);
- X509_STORE_free (CertStore);
- BIO_free (OutBio);
- TS_TST_INFO_free (TstInfo);
-
- if (TstData != NULL) {
- FreePool (TstData);
- }
-
- return Status;
-}
-
-/**
- Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
- signature.
-
- If AuthData is NULL, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
- is used for TSA certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
- @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
-
-**/
-BOOLEAN
-EFIAPI
-ImageTimestampVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- OUT EFI_TIME *SigningTime
- )
-{
- BOOLEAN Status;
- PKCS7 *Pkcs7;
- CONST UINT8 *Temp;
-
- STACK_OF (PKCS7_SIGNER_INFO) *SignerInfos;
- PKCS7_SIGNER_INFO *SignInfo;
- UINTN Index;
-
- STACK_OF (X509_ATTRIBUTE) *Sk;
- X509_ATTRIBUTE *Xa;
- ASN1_OBJECT *XaObj;
- ASN1_TYPE *Asn1Type;
- ASN1_OCTET_STRING *EncDigest;
- UINT8 *TSToken;
- UINTN TokenSize;
-
- //
- // Input Parameters Checking.
- //
- if ((AuthData == NULL) || (TsaCert == NULL)) {
- return FALSE;
- }
-
- if ((DataSize > INT_MAX) || (CertSize > INT_MAX)) {
- return FALSE;
- }
-
- //
- // Register & Initialize necessary digest algorithms for PKCS#7 Handling.
- //
- if ((EVP_add_digest (EVP_md5 ()) == 0) || (EVP_add_digest (EVP_sha1 ()) == 0) ||
- (EVP_add_digest (EVP_sha256 ()) == 0) || (EVP_add_digest (EVP_sha384 ()) == 0) ||
- (EVP_add_digest (EVP_sha512 ()) == 0) || ((EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA)) == 0))
- {
- return FALSE;
- }
-
- //
- // Initialization.
- //
- Status = FALSE;
- Pkcs7 = NULL;
- SignInfo = NULL;
-
- //
- // Decode ASN.1-encoded Authenticode data into PKCS7 structure.
- //
- Temp = AuthData;
- Pkcs7 = d2i_PKCS7 (NULL, (const unsigned char **)&Temp, (int)DataSize);
- if (Pkcs7 == NULL) {
- goto _Exit;
- }
-
- //
- // Check if there is one and only one signer.
- //
- SignerInfos = PKCS7_get_signer_info (Pkcs7);
- if (!SignerInfos || (sk_PKCS7_SIGNER_INFO_num (SignerInfos) != 1)) {
- goto _Exit;
- }
-
- //
- // Locate the TimeStamp CounterSignature.
- //
- SignInfo = sk_PKCS7_SIGNER_INFO_value (SignerInfos, 0);
- if (SignInfo == NULL) {
- goto _Exit;
- }
-
- //
- // Locate Message Digest which will be the data to be time-stamped.
- //
- EncDigest = SignInfo->enc_digest;
- if (EncDigest == NULL) {
- goto _Exit;
- }
-
- //
- // The RFC3161 timestamp counterSignature is contained in unauthenticatedAttributes field
- // of SignerInfo.
- //
- Sk = SignInfo->unauth_attr;
- if (Sk == NULL) {
- // No timestamp counterSignature.
- goto _Exit;
- }
-
- Asn1Type = NULL;
- for (Index = 0; Index < (UINTN)sk_X509_ATTRIBUTE_num (Sk); Index++) {
- //
- // Search valid RFC3161 timestamp counterSignature based on OBJID.
- //
- Xa = sk_X509_ATTRIBUTE_value (Sk, (int)Index);
- if (Xa == NULL) {
- continue;
- }
-
- XaObj = X509_ATTRIBUTE_get0_object (Xa);
- if (XaObj == NULL) {
- continue;
- }
-
- if ((OBJ_length (XaObj) != sizeof (mSpcRFC3161OidValue)) ||
- (CompareMem (OBJ_get0_data (XaObj), mSpcRFC3161OidValue, sizeof (mSpcRFC3161OidValue)) != 0))
- {
- continue;
- }
-
- Asn1Type = X509_ATTRIBUTE_get0_type (Xa, 0);
- }
-
- if (Asn1Type == NULL) {
- Status = FALSE;
- goto _Exit;
- }
-
- TSToken = Asn1Type->value.octet_string->data;
- TokenSize = Asn1Type->value.octet_string->length;
-
- //
- // TimeStamp counterSignature (Token) verification.
- //
- Status = TimestampTokenVerify (
- TSToken,
- TokenSize,
- TsaCert,
- CertSize,
- EncDigest->data,
- EncDigest->length,
- SigningTime
- );
-
-_Exit:
- //
- // Release Resources
- //
- PKCS7_free (Pkcs7);
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTsNull.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTsNull.c
deleted file mode 100644
index 907988814a..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTsNull.c
+++ /dev/null
@@ -1,42 +0,0 @@
-/** @file
- RFC3161 Timestamp Countersignature Verification Wrapper Implementation which does
- not provide real capabilities.
-
-Copyright (c) 2014, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
- signature.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
- is used for TSA certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-ImageTimestampVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- OUT EFI_TIME *SigningTime
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
deleted file mode 100644
index 7f536249c8..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
+++ /dev/null
@@ -1,1984 +0,0 @@
-/** @file
- X.509 Certificate Handler Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-#include
-#include
-#include
-
-/* OID*/
-#define OID_EXT_KEY_USAGE { 0x55, 0x1D, 0x25 }
-#define OID_BASIC_CONSTRAINTS { 0x55, 0x1D, 0x13 }
-
-static CONST UINT8 mOidExtKeyUsage[] = OID_EXT_KEY_USAGE;
-static CONST UINT8 mOidBasicConstraints[] = OID_BASIC_CONSTRAINTS;
-
-#define CRYPTO_ASN1_TAG_CLASS_MASK 0xC0
-#define CRYPTO_ASN1_TAG_PC_MASK 0x20
-#define CRYPTO_ASN1_TAG_VALUE_MASK 0x1F
-
-/**
- Construct a X509 object from DER-encoded certificate data.
-
- If Cert is NULL, then return FALSE.
- If SingleX509Cert is NULL, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded certificate data.
- @param[in] CertSize The size of certificate data in bytes.
- @param[out] SingleX509Cert The generated X509 object.
-
- @retval TRUE The X509 object generation succeeded.
- @retval FALSE The operation failed.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificate (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **SingleX509Cert
- )
-{
- X509 *X509Cert;
- CONST UINT8 *Temp;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (SingleX509Cert == NULL) || (CertSize > INT_MAX)) {
- return FALSE;
- }
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Temp = Cert;
- X509Cert = d2i_X509 (NULL, &Temp, (long)CertSize);
- if (X509Cert == NULL) {
- return FALSE;
- }
-
- *SingleX509Cert = (UINT8 *)X509Cert;
-
- return TRUE;
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificateStackV (
- IN OUT UINT8 **X509Stack,
- IN VA_LIST Args
- )
-{
- UINT8 *Cert;
- UINTN CertSize;
- X509 *X509Cert;
-
- STACK_OF (X509) *CertStack;
- BOOLEAN Status;
- UINTN Index;
-
- //
- // Check input parameters.
- //
- if (X509Stack == NULL) {
- return FALSE;
- }
-
- Status = FALSE;
-
- //
- // Initialize X509 stack object.
- //
- CertStack = (STACK_OF (X509) *)(*X509Stack);
- if (CertStack == NULL) {
- CertStack = sk_X509_new_null ();
- if (CertStack == NULL) {
- return Status;
- }
- }
-
- for (Index = 0; ; Index++) {
- //
- // If Cert is NULL, then it is the end of the list.
- //
- Cert = VA_ARG (Args, UINT8 *);
- if (Cert == NULL) {
- break;
- }
-
- CertSize = VA_ARG (Args, UINTN);
- if (CertSize == 0) {
- break;
- }
-
- //
- // Construct X509 Object from the given DER-encoded certificate data.
- //
- X509Cert = NULL;
- Status = X509ConstructCertificate (
- (CONST UINT8 *)Cert,
- CertSize,
- (UINT8 **)&X509Cert
- );
- if (!Status) {
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- break;
- }
-
- //
- // Insert the new X509 object into X509 stack object.
- //
- sk_X509_push (CertStack, X509Cert);
- }
-
- if (!Status) {
- sk_X509_pop_free (CertStack, X509_free);
- } else {
- *X509Stack = (UINT8 *)CertStack;
- }
-
- return Status;
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param ... A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificateStack (
- IN OUT UINT8 **X509Stack,
- ...
- )
-{
- VA_LIST Args;
- BOOLEAN Result;
-
- VA_START (Args, X509Stack);
- Result = X509ConstructCertificateStackV (X509Stack, Args);
- VA_END (Args);
- return Result;
-}
-
-/**
- Release the specified X509 object.
-
- If X509Cert is NULL, then return FALSE.
-
- @param[in] X509Cert Pointer to the X509 object to be released.
-
-**/
-VOID
-EFIAPI
-X509Free (
- IN VOID *X509Cert
- )
-{
- //
- // Check input parameters.
- //
- if (X509Cert == NULL) {
- return;
- }
-
- //
- // Free OpenSSL X509 object.
- //
- X509_free ((X509 *)X509Cert);
-}
-
-/**
- Release the specified X509 stack object.
-
- If X509Stack is NULL, then return FALSE.
-
- @param[in] X509Stack Pointer to the X509 stack object to be released.
-
-**/
-VOID
-EFIAPI
-X509StackFree (
- IN VOID *X509Stack
- )
-{
- //
- // Check input parameters.
- //
- if (X509Stack == NULL) {
- return;
- }
-
- //
- // Free OpenSSL X509 stack object.
- //
- sk_X509_pop_free ((STACK_OF (X509) *) X509Stack, X509_free);
-}
-
-/**
- Retrieve the subject bytes from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
- @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
- and the size of buffer returned CertSubject on output.
-
- If Cert is NULL, then return FALSE.
- If SubjectSize is NULL, then return FALSE.
-
- @retval TRUE The certificate subject retrieved successfully.
- @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
- The SubjectSize will be updated with the required size.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetSubjectName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertSubject,
- IN OUT UINTN *SubjectSize
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
- X509_NAME *X509Name;
- UINTN X509NameSize;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (SubjectSize == NULL)) {
- return FALSE;
- }
-
- X509Cert = NULL;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Retrieve subject name from certificate object.
- //
- X509Name = X509_get_subject_name (X509Cert);
- if (X509Name == NULL) {
- goto _Exit;
- }
-
- X509NameSize = i2d_X509_NAME (X509Name, NULL);
- if (*SubjectSize < X509NameSize) {
- *SubjectSize = X509NameSize;
- goto _Exit;
- }
-
- *SubjectSize = X509NameSize;
- if (CertSubject != NULL) {
- i2d_X509_NAME (X509Name, &CertSubject);
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Retrieve a string from one X.509 certificate base on the Request_NID.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] Request_NID NID of string to obtain
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string (UTF8). At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If CommonNameSize is NULL.
- If CommonName is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no NID Name entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-STATIC
-RETURN_STATUS
-InternalX509GetNIDName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN INT32 Request_NID,
- OUT CHAR8 *CommonName OPTIONAL,
- IN OUT UINTN *CommonNameSize
- )
-{
- RETURN_STATUS ReturnStatus;
- BOOLEAN Status;
- X509 *X509Cert;
- X509_NAME *X509Name;
- INT32 Index;
- INTN Length;
- X509_NAME_ENTRY *Entry;
- ASN1_STRING *EntryData;
- UINT8 *UTF8Name;
-
- ReturnStatus = RETURN_INVALID_PARAMETER;
- UTF8Name = NULL;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (CertSize > INT_MAX) || (CommonNameSize == NULL)) {
- return ReturnStatus;
- }
-
- if ((CommonName != NULL) && (*CommonNameSize == 0)) {
- return ReturnStatus;
- }
-
- X509Cert = NULL;
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- //
- // Invalid X.509 Certificate
- //
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Retrieve subject name from certificate object.
- //
- X509Name = X509_get_subject_name (X509Cert);
- if (X509Name == NULL) {
- //
- // Fail to retrieve subject name content
- //
- goto _Exit;
- }
-
- //
- // Retrive the string from X.509 Subject base on the Request_NID
- //
- Index = X509_NAME_get_index_by_NID (X509Name, Request_NID, -1);
- if (Index < 0) {
- //
- // No Request_NID name entry exists in X509_NAME object
- //
- *CommonNameSize = 0;
- ReturnStatus = RETURN_NOT_FOUND;
- goto _Exit;
- }
-
- Entry = X509_NAME_get_entry (X509Name, Index);
- if (Entry == NULL) {
- //
- // Fail to retrieve name entry data
- //
- *CommonNameSize = 0;
- ReturnStatus = RETURN_NOT_FOUND;
- goto _Exit;
- }
-
- EntryData = X509_NAME_ENTRY_get_data (Entry);
- // MU_CHANGE [BEGIN] - CodeQL change
- if (EntryData == NULL) {
- //
- // Fail to retrieve name entry data
- //
- *CommonNameSize = 0;
- ReturnStatus = RETURN_NOT_FOUND;
- goto _Exit;
- }
-
- // MU_CHANGE [END] - CodeQL change
-
- Length = ASN1_STRING_to_UTF8 (&UTF8Name, EntryData);
- if (Length < 0) {
- //
- // Fail to convert the Name string
- //
- *CommonNameSize = 0;
- ReturnStatus = RETURN_INVALID_PARAMETER;
- goto _Exit;
- }
-
- if (CommonName == NULL) {
- *CommonNameSize = Length + 1;
- ReturnStatus = RETURN_BUFFER_TOO_SMALL;
- } else {
- *CommonNameSize = MIN ((UINTN)Length, *CommonNameSize - 1) + 1;
- CopyMem (CommonName, UTF8Name, *CommonNameSize - 1);
- CommonName[*CommonNameSize - 1] = '\0';
- ReturnStatus = RETURN_SUCCESS;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- if (UTF8Name != NULL) {
- OPENSSL_free (UTF8Name);
- }
-
- return ReturnStatus;
-}
-
-/**
- Retrieve the common name (CN) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string. At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If CommonNameSize is NULL.
- If CommonName is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no CommonName entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-X509GetCommonName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *CommonName OPTIONAL,
- IN OUT UINTN *CommonNameSize
- )
-{
- return InternalX509GetNIDName (Cert, CertSize, NID_commonName, CommonName, CommonNameSize);
-}
-
-/**
- Retrieve the organization name (O) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] NameBuffer Buffer to contain the retrieved certificate organization
- name string. At most NameBufferSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,
- and the size of buffer returned Name on output.
- If NameBuffer is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If NameBufferSize is NULL.
- If NameBuffer is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no Organization Name entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the NameBuffer is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-X509GetOrganizationName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *NameBuffer OPTIONAL,
- IN OUT UINTN *NameBufferSize
- )
-{
- return InternalX509GetNIDName (Cert, CertSize, NID_organizationName, NameBuffer, NameBufferSize);
-}
-
-/**
- Retrieve the RSA Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA public key component. Use RsaFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
-
- @retval TRUE RSA Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve RSA public key from X509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **RsaContext
- )
-{
- BOOLEAN Status;
- EVP_PKEY *Pkey;
- X509 *X509Cert;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (RsaContext == NULL)) {
- return FALSE;
- }
-
- Pkey = NULL;
- X509Cert = NULL;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Retrieve and check EVP_PKEY data from X509 Certificate.
- //
- Pkey = X509_get_pubkey (X509Cert);
- if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_RSA)) {
- goto _Exit;
- }
-
- //
- // Duplicate RSA Context from the retrieved EVP_PKEY.
- //
- if ((*RsaContext = RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey))) != NULL) {
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- if (Pkey != NULL) {
- EVP_PKEY_free (Pkey);
- }
-
- return Status;
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
- @param[in] CACertSize Size of the CA Certificate in bytes.
-
- If Cert is NULL, then return FALSE.
- If CACert is NULL, then return FALSE.
-
- @retval TRUE The certificate was issued by the trusted CA.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
-
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *CACert,
- IN UINTN CACertSize
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
- X509 *X509CACert;
- X509_STORE *CertStore;
- X509_STORE_CTX *CertCtx;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (CACert == NULL)) {
- return FALSE;
- }
-
- Status = FALSE;
- X509Cert = NULL;
- X509CACert = NULL;
- CertStore = NULL;
- CertCtx = NULL;
-
- //
- // Register & Initialize necessary digest algorithms for certificate verification.
- //
- if (EVP_add_digest (EVP_md5 ()) == 0) {
- goto _Exit;
- }
-
- if (EVP_add_digest (EVP_sha1 ()) == 0) {
- goto _Exit;
- }
-
- if (EVP_add_digest (EVP_sha256 ()) == 0) {
- goto _Exit;
- }
-
- //
- // Read DER-encoded certificate to be verified and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- //
- // Read DER-encoded root certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **)&X509CACert);
- if ((X509CACert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Set up X509 Store for trusted certificate.
- //
- CertStore = X509_STORE_new ();
- if (CertStore == NULL) {
- goto _Exit;
- }
-
- if (!(X509_STORE_add_cert (CertStore, X509CACert))) {
- goto _Exit;
- }
-
- //
- // Allow partial certificate chains, terminated by a non-self-signed but
- // still trusted intermediate certificate. Also disable time checks.
- //
- X509_STORE_set_flags (
- CertStore,
- X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME
- );
-
- //
- // Set up X509_STORE_CTX for the subsequent verification operation.
- //
- CertCtx = X509_STORE_CTX_new ();
- if (CertCtx == NULL) {
- goto _Exit;
- }
-
- if (!X509_STORE_CTX_init (CertCtx, CertStore, X509Cert, NULL)) {
- goto _Exit;
- }
-
- //
- // X509 Certificate Verification.
- //
- Status = (BOOLEAN)X509_verify_cert (CertCtx);
- X509_STORE_CTX_cleanup (CertCtx);
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- if (X509CACert != NULL) {
- X509_free (X509CACert);
- }
-
- if (CertStore != NULL) {
- X509_STORE_free (CertStore);
- }
-
- X509_STORE_CTX_free (CertCtx);
-
- return Status;
-}
-
-/**
- Retrieve the TBSCertificate from one given X.509 certificate.
-
- @param[in] Cert Pointer to the given DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
- @param[out] TBSCertSize Size of the TBS certificate in bytes.
-
- If Cert is NULL, then return FALSE.
- If TBSCert is NULL, then return FALSE.
- If TBSCertSize is NULL, then return FALSE.
-
- @retval TRUE The TBSCertificate was retrieved successfully.
- @retval FALSE Invalid X.509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetTBSCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **TBSCert,
- OUT UINTN *TBSCertSize
- )
-{
- CONST UINT8 *Temp;
- UINT32 Asn1Tag;
- UINT32 ObjClass;
- UINTN Length;
- UINTN Inf;
-
- // MU_CHANGE [BEGIN] - CodeQL change
- Asn1Tag = (UINT32)V_ASN1_UNDEF;
- // MU_CHANGE [END] - CodeQL change
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (TBSCert == NULL) ||
- (TBSCertSize == NULL) || (CertSize > INT_MAX))
- {
- return FALSE;
- }
-
- //
- // An X.509 Certificate is: (defined in RFC3280)
- // Certificate ::= SEQUENCE {
- // tbsCertificate TBSCertificate,
- // signatureAlgorithm AlgorithmIdentifier,
- // signature BIT STRING }
- //
- // and
- //
- // TBSCertificate ::= SEQUENCE {
- // version [0] Version DEFAULT v1,
- // ...
- // }
- //
- // So we can just ASN1-parse the x.509 DER-encoded data. If we strip
- // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.
- //
- Temp = Cert;
- Length = 0;
- Inf = ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)CertSize);
-
- if (((Inf & 0x80) == 0x00) && (Asn1Tag != V_ASN1_SEQUENCE)) {
- return FALSE;
- }
-
- *TBSCert = (UINT8 *)Temp;
-
- ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjClass, (long)Length);
- //
- // Verify the parsed TBSCertificate is one correct SEQUENCE data.
- //
- if (((Inf & 0x80) == 0x00) && (Asn1Tag != V_ASN1_SEQUENCE)) {
- return FALSE;
- }
-
- *TBSCertSize = Length + (Temp - *TBSCert);
-
- return TRUE;
-}
-
-/**
- Retrieve the EC Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC public key component. Use EcFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve EC public key from X509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **EcContext
- )
-{
- BOOLEAN Status;
- EVP_PKEY *Pkey;
- X509 *X509Cert;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (EcContext == NULL)) {
- return FALSE;
- }
-
- Pkey = NULL;
- X509Cert = NULL;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Retrieve and check EVP_PKEY data from X509 Certificate.
- //
- Pkey = X509_get_pubkey (X509Cert);
- if ((Pkey == NULL) || (EVP_PKEY_id (Pkey) != EVP_PKEY_EC)) {
- goto _Exit;
- }
-
- //
- // Duplicate EC Context from the retrieved EVP_PKEY.
- //
- if ((*EcContext = EC_KEY_dup (EVP_PKEY_get0_EC_KEY (Pkey))) != NULL) {
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- if (Pkey != NULL) {
- EVP_PKEY_free (Pkey);
- }
-
- return Status;
-}
-
-/**
- Retrieve the version from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Version Pointer to the retrieved version integer.
-
- @retval TRUE The certificate version retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- @retval FALSE The operation is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetVersion (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Version
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
-
- X509Cert = NULL;
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- //
- // Invalid X.509 Certificate
- //
- Status = FALSE;
- }
-
- if (Status) {
- *Version = X509_get_version (X509Cert);
- }
-
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Retrieve the serialNumber from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
- @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
- and the size of buffer returned SerialNumber on output.
-
- @retval TRUE The certificate serialNumber retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- If SerialNumberSize is NULL.
- If Certificate is invalid.
- @retval FALSE If no SerialNumber exists.
- @retval FALSE If the SerialNumber is NULL. The required buffer size
- (including the final null) is returned in the
- SerialNumberSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetSerialNumber (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *SerialNumber, OPTIONAL
- IN OUT UINTN *SerialNumberSize
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
- ASN1_INTEGER *Asn1Integer;
-
- Status = FALSE;
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (SerialNumberSize == NULL)) {
- return Status;
- }
-
- X509Cert = NULL;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- *SerialNumberSize = 0;
- Status = FALSE;
- goto _Exit;
- }
-
- //
- // Retrieve subject name from certificate object.
- //
- Asn1Integer = X509_get_serialNumber (X509Cert);
- if (Asn1Integer == NULL) {
- *SerialNumberSize = 0;
- Status = FALSE;
- goto _Exit;
- }
-
- if (*SerialNumberSize < (UINTN)Asn1Integer->length) {
- *SerialNumberSize = (UINTN)Asn1Integer->length;
- Status = FALSE;
- goto _Exit;
- }
-
- if (SerialNumber != NULL) {
- CopyMem (SerialNumber, Asn1Integer->data, *SerialNumberSize);
- Status = TRUE;
- }
-
- *SerialNumberSize = (UINTN)Asn1Integer->length;
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Retrieve the issuer bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
- @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate issuer retrieved successfully.
- @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
- The CertIssuerSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetIssuerName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertIssuer,
- IN OUT UINTN *CertIssuerSize
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
- X509_NAME *X509Name;
- UINTN X509NameSize;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (CertIssuerSize == NULL)) {
- return FALSE;
- }
-
- X509Cert = NULL;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- Status = FALSE;
-
- //
- // Retrieve subject name from certificate object.
- //
- X509Name = X509_get_subject_name (X509Cert);
- if (X509Name == NULL) {
- goto _Exit;
- }
-
- X509NameSize = i2d_X509_NAME (X509Name, NULL);
- if (*CertIssuerSize < X509NameSize) {
- *CertIssuerSize = X509NameSize;
- goto _Exit;
- }
-
- *CertIssuerSize = X509NameSize;
- if (CertIssuer != NULL) {
- i2d_X509_NAME (X509Name, &CertIssuer);
- Status = TRUE;
- }
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Retrieve the Signature Algorithm from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Oid Signature Algorithm Object identifier buffer.
- @param[in,out] OidSize Signature Algorithm Object identifier buffer size
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If OidSize is NULL.
- If Oid is not NULL and *OidSize is 0.
- If Certificate is invalid.
- @retval FALSE If no SignatureType.
- @retval FALSE If the Oid is NULL. The required buffer size
- is returned in the OidSize.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetSignatureAlgorithm (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Oid, OPTIONAL
- IN OUT UINTN *OidSize
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
- int Nid;
- ASN1_OBJECT *Asn1Obj;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (OidSize == NULL) || (CertSize == 0)) {
- return FALSE;
- }
-
- X509Cert = NULL;
- Status = FALSE;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- Status = FALSE;
- goto _Exit;
- }
-
- //
- // Retrieve subject name from certificate object.
- //
- Nid = X509_get_signature_nid (X509Cert);
- if (Nid == NID_undef) {
- *OidSize = 0;
- Status = FALSE;
- goto _Exit;
- }
-
- Asn1Obj = OBJ_nid2obj (Nid);
- if (Asn1Obj == NULL) {
- *OidSize = 0;
- Status = FALSE;
- goto _Exit;
- }
-
- if (*OidSize < (UINTN)Asn1Obj->length) {
- *OidSize = Asn1Obj->length;
- Status = FALSE;
- goto _Exit;
- }
-
- if (Oid != NULL) {
- CopyMem (Oid, Asn1Obj->data, Asn1Obj->length);
- }
-
- *OidSize = Asn1Obj->length;
- Status = TRUE;
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Retrieve Extension data from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] Oid Object identifier buffer
- @param[in] OidSize Object identifier buffer size
- @param[out] ExtensionData Extension bytes.
- @param[in, out] ExtensionDataSize Extension bytes size.
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If ExtensionDataSize is NULL.
- If ExtensionData is not NULL and *ExtensionDataSize is 0.
- If Certificate is invalid.
- @retval FALSE If no Extension entry match Oid.
- @retval FALSE If the ExtensionData is NULL. The required buffer size
- is returned in the ExtensionDataSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtensionData (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *Oid,
- IN UINTN OidSize,
- OUT UINT8 *ExtensionData,
- IN OUT UINTN *ExtensionDataSize
- )
-{
- BOOLEAN Status;
- INTN i;
- X509 *X509Cert;
-
- CONST STACK_OF (X509_EXTENSION) *Extensions;
- ASN1_OBJECT *Asn1Obj;
- ASN1_OCTET_STRING *Asn1Oct;
- X509_EXTENSION *Ext;
- UINTN ObjLength;
- UINTN OctLength;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (CertSize == 0) || (Oid == NULL) || (OidSize == 0) || (ExtensionDataSize == NULL)) {
- return FALSE;
- }
-
- X509Cert = NULL;
- Status = FALSE;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- *ExtensionDataSize = 0;
- goto Cleanup;
- }
-
- //
- // Retrieve Extensions from certificate object.
- //
- Extensions = X509_get0_extensions (X509Cert);
- if (sk_X509_EXTENSION_num (Extensions) <= 0) {
- *ExtensionDataSize = 0;
- goto Cleanup;
- }
-
- //
- // Traverse Extensions
- //
- Status = FALSE;
- Asn1Oct = NULL;
- OctLength = 0;
- for (i = 0; i < sk_X509_EXTENSION_num (Extensions); i++) {
- Ext = sk_X509_EXTENSION_value (Extensions, (int)i);
- if (Ext == NULL) {
- continue;
- }
-
- Asn1Obj = X509_EXTENSION_get_object (Ext);
- if (Asn1Obj == NULL) {
- continue;
- }
-
- Asn1Oct = X509_EXTENSION_get_data (Ext);
- if (Asn1Oct == NULL) {
- continue;
- }
-
- ObjLength = OBJ_length (Asn1Obj);
- OctLength = ASN1_STRING_length (Asn1Oct);
- if ((OidSize == ObjLength) && (CompareMem (OBJ_get0_data (Asn1Obj), Oid, OidSize) == 0)) {
- //
- // Extension Found
- //
- Status = TRUE;
- break;
- }
-
- //
- // reset to 0 if not found
- //
- OctLength = 0;
- }
-
- if (Status) {
- if (*ExtensionDataSize < OctLength) {
- *ExtensionDataSize = OctLength;
- Status = FALSE;
- goto Cleanup;
- }
-
- if (Asn1Oct != NULL) {
- CopyMem (ExtensionData, ASN1_STRING_get0_data (Asn1Oct), OctLength);
- }
-
- *ExtensionDataSize = OctLength;
- } else {
- *ExtensionDataSize = 0;
- }
-
-Cleanup:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Retrieve the Extended Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage bytes.
- @param[in, out] UsageSize Key Usage buffer sizs in bytes.
-
- @retval TRUE The Usage bytes retrieve successfully.
- @retval FALSE If Cert is NULL.
- If CertSize is NULL.
- If Usage is not NULL and *UsageSize is 0.
- If Cert is invalid.
- @retval FALSE If the Usage is NULL. The required buffer size
- is returned in the UsageSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtendedKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Usage,
- IN OUT UINTN *UsageSize
- )
-{
- BOOLEAN Status;
-
- Status = X509GetExtensionData (Cert, CertSize, mOidExtKeyUsage, sizeof (mOidExtKeyUsage), Usage, UsageSize);
- return Status;
-}
-
-/**
- Retrieve the Validity from one X.509 certificate
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] From notBefore Pointer to DateTime object.
- @param[in,out] FromSize notBefore DateTime object size.
- @param[out] To notAfter Pointer to DateTime object.
- @param[in,out] ToSize notAfter DateTime object size.
-
- Note: X509CompareDateTime to compare DateTime oject
- x509SetDateTime to get a DateTime object from a DateTimeStr
-
- @retval TRUE The certificate Validity retrieved successfully.
- @retval FALSE Invalid certificate, or Validity retrieve failed.
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetValidity (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN UINT8 *From,
- IN OUT UINTN *FromSize,
- IN UINT8 *To,
- IN OUT UINTN *ToSize
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
- CONST ASN1_TIME *F;
- CONST ASN1_TIME *T;
- UINTN TSize;
- UINTN FSize;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (FromSize == NULL) || (ToSize == NULL) || (CertSize == 0)) {
- return FALSE;
- }
-
- X509Cert = NULL;
- Status = FALSE;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- goto _Exit;
- }
-
- //
- // Retrieve Validity from/to from certificate object.
- //
- F = X509_get0_notBefore (X509Cert);
- T = X509_get0_notAfter (X509Cert);
-
- if ((F == NULL) || (T == NULL)) {
- goto _Exit;
- }
-
- FSize = sizeof (ASN1_TIME) + F->length;
- if (*FromSize < FSize) {
- *FromSize = FSize;
- goto _Exit;
- }
-
- *FromSize = FSize;
- if (From != NULL) {
- CopyMem (From, F, sizeof (ASN1_TIME));
- ((ASN1_TIME *)From)->data = From + sizeof (ASN1_TIME);
- CopyMem (From + sizeof (ASN1_TIME), F->data, F->length);
- }
-
- TSize = sizeof (ASN1_TIME) + T->length;
- if (*ToSize < TSize) {
- *ToSize = TSize;
- goto _Exit;
- }
-
- *ToSize = TSize;
- if (To != NULL) {
- CopyMem (To, T, sizeof (ASN1_TIME));
- ((ASN1_TIME *)To)->data = To + sizeof (ASN1_TIME);
- CopyMem (To + sizeof (ASN1_TIME), T->data, T->length);
- }
-
- Status = TRUE;
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Format a DateTimeStr to DataTime object in DataTime Buffer
-
- If DateTimeStr is NULL, then return FALSE.
- If DateTimeSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
- Ref: https://www.w3.org/TR/NOTE-datetime
- Z stand for UTC time
- @param[out] DateTime Pointer to a DateTime object.
- @param[in,out] DateTimeSize DateTime object buffer size.
-
- @retval TRUE The DateTime object create successfully.
- @retval FALSE If DateTimeStr is NULL.
- If DateTimeSize is NULL.
- If DateTime is not NULL and *DateTimeSize is 0.
- If Year Month Day Hour Minute Second combination is invalid datetime.
- @retval FALSE If the DateTime is NULL. The required buffer size
- (including the final null) is returned in the
- DateTimeSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509FormatDateTime (
- IN CONST CHAR8 *DateTimeStr,
- OUT VOID *DateTime,
- IN OUT UINTN *DateTimeSize
- )
-{
- BOOLEAN Status;
- INT32 Ret;
- ASN1_TIME *Dt;
- UINTN DSize;
-
- Dt = NULL;
- Status = FALSE;
-
- Dt = ASN1_TIME_new ();
- if (Dt == NULL) {
- Status = FALSE;
- goto Cleanup;
- }
-
- Ret = ASN1_TIME_set_string_X509 (Dt, DateTimeStr);
- if (Ret != 1) {
- Status = FALSE;
- goto Cleanup;
- }
-
- DSize = sizeof (ASN1_TIME) + Dt->length;
- if (*DateTimeSize < DSize) {
- *DateTimeSize = DSize;
- Status = FALSE;
- goto Cleanup;
- }
-
- *DateTimeSize = DSize;
- if (DateTime != NULL) {
- CopyMem (DateTime, Dt, sizeof (ASN1_TIME));
- ((ASN1_TIME *)DateTime)->data = (UINT8 *)DateTime + sizeof (ASN1_TIME);
- CopyMem ((UINT8 *)DateTime + sizeof (ASN1_TIME), Dt->data, Dt->length);
- }
-
- Status = TRUE;
-
-Cleanup:
- if (Dt != NULL) {
- ASN1_TIME_free (Dt);
- }
-
- return Status;
-}
-
-/**
- Compare DateTime1 object and DateTime2 object.
-
- If DateTime1 is NULL, then return -2.
- If DateTime2 is NULL, then return -2.
- If DateTime1 == DateTime2, then return 0
- If DateTime1 > DateTime2, then return 1
- If DateTime1 < DateTime2, then return -1
-
- @param[in] DateTime1 Pointer to a DateTime Ojbect
- @param[in] DateTime2 Pointer to a DateTime Object
-
- @retval 0 If DateTime1 == DateTime2
- @retval 1 If DateTime1 > DateTime2
- @retval -1 If DateTime1 < DateTime2
-**/
-INT32
-EFIAPI
-X509CompareDateTime (
- IN CONST VOID *DateTime1,
- IN CONST VOID *DateTime2
- )
-{
- return (INT32)ASN1_TIME_compare (DateTime1, DateTime2);
-}
-
-/**
- Retrieve the Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
-
- @retval TRUE The certificate Key Usage retrieved successfully.
- @retval FALSE Invalid certificate, or Usage is NULL
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Usage
- )
-{
- BOOLEAN Status;
- X509 *X509Cert;
-
- //
- // Check input parameters.
- //
- if ((Cert == NULL) || (Usage == NULL)) {
- return FALSE;
- }
-
- X509Cert = NULL;
- Status = FALSE;
-
- //
- // Read DER-encoded X509 Certificate and Construct X509 object.
- //
- Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **)&X509Cert);
- if ((X509Cert == NULL) || (!Status)) {
- goto _Exit;
- }
-
- //
- // Retrieve subject name from certificate object.
- //
- *Usage = X509_get_key_usage (X509Cert);
- if (*Usage == NID_undef) {
- goto _Exit;
- }
-
- Status = TRUE;
-
-_Exit:
- //
- // Release Resources.
- //
- if (X509Cert != NULL) {
- X509_free (X509Cert);
- }
-
- return Status;
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
- @param[in] RootCert Trusted Root Certificate buffer
-
- @param[in] RootCertLength Trusted Root Certificate buffer length
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCertChain (
- IN CONST UINT8 *RootCert,
- IN UINTN RootCertLength,
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength
- )
-{
- CONST UINT8 *TmpPtr;
- UINTN Length;
- UINT32 Asn1Tag;
- UINT32 ObjClass;
- CONST UINT8 *CurrentCert;
- UINTN CurrentCertLen;
- CONST UINT8 *PrecedingCert;
- UINTN PrecedingCertLen;
- BOOLEAN VerifyFlag;
- INT32 Ret;
-
- PrecedingCert = RootCert;
- PrecedingCertLen = RootCertLength;
-
- CurrentCert = CertChain;
- Length = 0;
- CurrentCertLen = 0;
-
- VerifyFlag = FALSE;
- while (TRUE) {
- TmpPtr = CurrentCert;
- Ret = ASN1_get_object (
- (CONST UINT8 **)&TmpPtr,
- (long *)&Length,
- (int *)&Asn1Tag,
- (int *)&ObjClass,
- (long)(CertChainLength + CertChain - TmpPtr)
- );
- if ((Asn1Tag != V_ASN1_SEQUENCE) || (Ret == 0x80)) {
- break;
- }
-
- //
- // Calculate CurrentCert length;
- //
- CurrentCertLen = TmpPtr - CurrentCert + Length;
-
- //
- // Verify CurrentCert with preceding cert;
- //
- VerifyFlag = X509VerifyCert (CurrentCert, CurrentCertLen, PrecedingCert, PrecedingCertLen);
- if (VerifyFlag == FALSE) {
- break;
- }
-
- //
- // move Current cert to Preceding cert
- //
- PrecedingCertLen = CurrentCertLen;
- PrecedingCert = CurrentCert;
-
- //
- // Move to next
- //
- CurrentCert = CurrentCert + CurrentCertLen;
- }
-
- return VerifyFlag;
-}
-
-/**
- Get one X509 certificate from CertChain.
-
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] CertIndex Index of certificate.
-
- @param[out] Cert The certificate at the index of CertChain.
- @param[out] CertLength The length certificate at the index of CertChain.
-
- @retval TRUE Success.
- @retval FALSE Failed to get certificate from certificate chain.
-**/
-BOOLEAN
-EFIAPI
-X509GetCertFromCertChain (
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength,
- IN CONST INT32 CertIndex,
- OUT CONST UINT8 **Cert,
- OUT UINTN *CertLength
- )
-{
- UINTN Asn1Len;
- INT32 CurrentIndex;
- UINTN CurrentCertLen;
- CONST UINT8 *CurrentCert;
- CONST UINT8 *TmpPtr;
- INT32 Ret;
- UINT32 Asn1Tag;
- UINT32 ObjClass;
-
- //
- // Check input parameters.
- //
- if ((CertChain == NULL) || (Cert == NULL) ||
- (CertIndex < -1) || (CertLength == NULL))
- {
- return FALSE;
- }
-
- Asn1Len = 0;
- CurrentCertLen = 0;
- CurrentCert = CertChain;
- CurrentIndex = -1;
-
- //
- // Traverse the certificate chain
- //
- while (TRUE) {
- TmpPtr = CurrentCert;
-
- // Get asn1 object and taglen
- Ret = ASN1_get_object (
- (CONST UINT8 **)&TmpPtr,
- (long *)&Asn1Len,
- (int *)&Asn1Tag,
- (int *)&ObjClass,
- (long)(CertChainLength + CertChain - TmpPtr)
- );
- if ((Asn1Tag != V_ASN1_SEQUENCE) || (Ret == 0x80)) {
- break;
- }
-
- //
- // Calculate CurrentCert length;
- //
- CurrentCertLen = TmpPtr - CurrentCert + Asn1Len;
- CurrentIndex++;
-
- if (CurrentIndex == CertIndex) {
- *Cert = CurrentCert;
- *CertLength = CurrentCertLen;
- return TRUE;
- }
-
- //
- // Move to next
- //
- CurrentCert = CurrentCert + CurrentCertLen;
- }
-
- //
- // If CertIndex is -1, Return the last certificate
- //
- if ((CertIndex == -1) && (CurrentIndex >= 0)) {
- *Cert = CurrentCert - CurrentCertLen;
- *CertLength = CurrentCertLen;
- return TRUE;
- }
-
- return FALSE;
-}
-
-/**
- Retrieve the tag and length of the tag.
-
- @param Ptr The position in the ASN.1 data
- @param End End of data
- @param Length The variable that will receive the length
- @param Tag The expected tag
-
- @retval TRUE Get tag successful
- @retval FALSe Failed to get tag or tag not match
-**/
-BOOLEAN
-EFIAPI
-Asn1GetTag (
- IN OUT UINT8 **Ptr,
- IN CONST UINT8 *End,
- OUT UINTN *Length,
- IN UINT32 Tag
- )
-{
- UINT8 *PtrOld;
- INT32 ObjTag;
- INT32 ObjCls;
- long ObjLength;
- UINT32 Inf;
-
- //
- // Save Ptr position
- //
- PtrOld = *Ptr;
-
- // MU_CHANGE [BEGIN] - CodeQL change
- // ASN1_get_object ((CONST UINT8 **)Ptr, &ObjLength, &ObjTag, &ObjCls, (INT32)(End - (*Ptr)));
- Inf = ASN1_get_object ((CONST UINT8 **)Ptr, &ObjLength, &ObjTag, &ObjCls, (INT32)(End - (*Ptr)));
- if (Inf & 0x80) {
- return FALSE;
- }
-
- // MU_CHANGE [END] - CodeQL change
-
- if ((ObjTag == (INT32)(Tag & CRYPTO_ASN1_TAG_VALUE_MASK)) &&
- (ObjCls == (INT32)(Tag & CRYPTO_ASN1_TAG_CLASS_MASK)))
- {
- *Length = (UINTN)ObjLength;
- return TRUE;
- } else {
- //
- // if doesn't match Tag, restore Ptr to origin Ptr
- //
- *Ptr = PtrOld;
- return FALSE;
- }
-}
-
-/**
- Retrieve the basic constraints from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize size of the X509 certificate in bytes.
- @param[out] BasicConstraints basic constraints bytes.
- @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
-
- @retval TRUE The basic constraints retrieve successfully.
- @retval FALSE If cert is NULL.
- If cert_size is NULL.
- If basic_constraints is not NULL and *basic_constraints_size is 0.
- If cert is invalid.
- @retval FALSE The required buffer size is small.
- The return buffer size is basic_constraints_size parameter.
- @retval FALSE If no Extension entry match oid.
- @retval FALSE The operation is not supported.
- **/
-BOOLEAN
-EFIAPI
-X509GetExtendedBasicConstraints (
- CONST UINT8 *Cert,
- UINTN CertSize,
- UINT8 *BasicConstraints,
- UINTN *BasicConstraintsSize
- )
-{
- BOOLEAN Status;
-
- if ((Cert == NULL) || (CertSize == 0) || (BasicConstraintsSize == NULL)) {
- return FALSE;
- }
-
- Status = X509GetExtensionData (
- (UINT8 *)Cert,
- CertSize,
- mOidBasicConstraints,
- sizeof (mOidBasicConstraints),
- BasicConstraints,
- BasicConstraintsSize
- );
-
- return Status;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c
deleted file mode 100644
index 7217501948..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509Null.c
+++ /dev/null
@@ -1,751 +0,0 @@
-/** @file
- X.509 Certificate Handler Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2012 - 2020, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Construct a X509 object from DER-encoded certificate data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded certificate data.
- @param[in] CertSize The size of certificate data in bytes.
- @param[out] SingleX509Cert The generated X509 object.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificate (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **SingleX509Cert
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificateStackV (
- IN OUT UINT8 **X509Stack,
- IN VA_LIST Args
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param ... A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificateStack (
- IN OUT UINT8 **X509Stack,
- ...
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Release the specified X509 object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Cert Pointer to the X509 object to be released.
-
-**/
-VOID
-EFIAPI
-X509Free (
- IN VOID *X509Cert
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Release the specified X509 stack object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Stack Pointer to the X509 stack object to be released.
-
-**/
-VOID
-EFIAPI
-X509StackFree (
- IN VOID *X509Stack
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Retrieve the subject bytes from one X.509 certificate.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
- @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
- and the size of buffer returned CertSubject on output.
-
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetSubjectName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertSubject,
- IN OUT UINTN *SubjectSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the common name (CN) string from one X.509 certificate.
-
- Return RETURN_UNSUPPORTED to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string (UTF8). At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-X509GetCommonName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *CommonName OPTIONAL,
- IN OUT UINTN *CommonNameSize
- )
-{
- ASSERT (FALSE);
- return RETURN_UNSUPPORTED;
-}
-
-/**
- Retrieve the organization name (ON) string from one X.509 certificate.
-
- Return RETURN_UNSUPPORTED to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] NameBuffer Buffer to contain the retrieved certificate organization
- name string. At most NameBufferSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,
- and the size of buffer returned Name on output.
- If NameBuffer is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-X509GetOrganizationName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *NameBuffer OPTIONAL,
- IN OUT UINTN *NameBufferSize
- )
-{
- ASSERT (FALSE);
- return RETURN_UNSUPPORTED;
-}
-
-/**
- Retrieve the RSA Public Key from one DER-encoded X509 certificate.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA public key component. Use RsaFree() function to free the
- resource.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **RsaContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
- @param[in] CACertSize Size of the CA Certificate in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *CACert,
- IN UINTN CACertSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the TBSCertificate from one given X.509 certificate.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the given DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
- @param[out] TBSCertSize Size of the TBS certificate in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetTBSCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **TBSCert,
- OUT UINTN *TBSCertSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the EC Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC public key component. Use EcFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve EC public key from X509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **EcContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the version from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Version Pointer to the retrieved version integer.
-
- @retval TRUE The certificate version retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- @retval FALSE The operation is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetVersion (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Version
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the serialNumber from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
- @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
- and the size of buffer returned SerialNumber on output.
-
- @retval TRUE The certificate serialNumber retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- If SerialNumberSize is NULL.
- If Certificate is invalid.
- @retval FALSE If no SerialNumber exists.
- @retval FALSE If the SerialNumber is NULL. The required buffer size
- (including the final null) is returned in the
- SerialNumberSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetSerialNumber (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *SerialNumber, OPTIONAL
- IN OUT UINTN *SerialNumberSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the issuer bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
- @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate issuer retrieved successfully.
- @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
- The CertIssuerSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetIssuerName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertIssuer,
- IN OUT UINTN *CertIssuerSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the Signature Algorithm from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Oid Signature Algorithm Object identifier buffer.
- @param[in,out] OidSize Signature Algorithm Object identifier buffer size
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If OidSize is NULL.
- If Oid is not NULL and *OidSize is 0.
- If Certificate is invalid.
- @retval FALSE If no SignatureType.
- @retval FALSE If the Oid is NULL. The required buffer size
- is returned in the OidSize.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetSignatureAlgorithm (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Oid, OPTIONAL
- IN OUT UINTN *OidSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve Extension data from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] Oid Object identifier buffer
- @param[in] OidSize Object identifier buffer size
- @param[out] ExtensionData Extension bytes.
- @param[in, out] ExtensionDataSize Extension bytes size.
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If ExtensionDataSize is NULL.
- If ExtensionData is not NULL and *ExtensionDataSize is 0.
- If Certificate is invalid.
- @retval FALSE If no Extension entry match Oid.
- @retval FALSE If the ExtensionData is NULL. The required buffer size
- is returned in the ExtensionDataSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtensionData (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *Oid,
- IN UINTN OidSize,
- OUT UINT8 *ExtensionData,
- IN OUT UINTN *ExtensionDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the Extended Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage bytes.
- @param[in, out] UsageSize Key Usage buffer sizs in bytes.
-
- @retval TRUE The Usage bytes retrieve successfully.
- @retval FALSE If Cert is NULL.
- If CertSize is NULL.
- If Usage is not NULL and *UsageSize is 0.
- If Cert is invalid.
- @retval FALSE If the Usage is NULL. The required buffer size
- is returned in the UsageSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtendedKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Usage,
- IN OUT UINTN *UsageSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the Validity from one X.509 certificate
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] From notBefore Pointer to DateTime object.
- @param[in,out] FromSize notBefore DateTime object size.
- @param[in] To notAfter Pointer to DateTime object.
- @param[in,out] ToSize notAfter DateTime object size.
-
- Note: X509CompareDateTime to compare DateTime oject
- x509SetDateTime to get a DateTime object from a DateTimeStr
-
- @retval TRUE The certificate Validity retrieved successfully.
- @retval FALSE Invalid certificate, or Validity retrieve failed.
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetValidity (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN UINT8 *From,
- IN OUT UINTN *FromSize,
- IN UINT8 *To,
- IN OUT UINTN *ToSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Format a DateTimeStr to DataTime object in DataTime Buffer
-
- If DateTimeStr is NULL, then return FALSE.
- If DateTimeSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
- Ref: https://www.w3.org/TR/NOTE-datetime
- Z stand for UTC time
- @param[out] DateTime Pointer to a DateTime object.
- @param[in,out] DateTimeSize DateTime object buffer size.
-
- @retval TRUE The DateTime object create successfully.
- @retval FALSE If DateTimeStr is NULL.
- If DateTimeSize is NULL.
- If DateTime is not NULL and *DateTimeSize is 0.
- If Year Month Day Hour Minute Second combination is invalid datetime.
- @retval FALSE If the DateTime is NULL. The required buffer size
- (including the final null) is returned in the
- DateTimeSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509FormatDateTime (
- IN CONST CHAR8 *DateTimeStr,
- OUT VOID *DateTime,
- IN OUT UINTN *DateTimeSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compare DateTime1 object and DateTime2 object.
-
- If DateTime1 is NULL, then return -2.
- If DateTime2 is NULL, then return -2.
- If DateTime1 == DateTime2, then return 0
- If DateTime1 > DateTime2, then return 1
- If DateTime1 < DateTime2, then return -1
-
- @param[in] DateTime1 Pointer to a DateTime Ojbect
- @param[in] DateTime2 Pointer to a DateTime Object
-
- @retval 0 If DateTime1 == DateTime2
- @retval 1 If DateTime1 > DateTime2
- @retval -1 If DateTime1 < DateTime2
-**/
-INT32
-EFIAPI
-X509CompareDateTime (
- IN CONST VOID *DateTime1,
- IN CONST VOID *DateTime2
- )
-{
- ASSERT (FALSE);
- return -3;
-}
-
-/**
- Retrieve the Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
-
- @retval TRUE The certificate Key Usage retrieved successfully.
- @retval FALSE Invalid certificate, or Usage is NULL
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Usage
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
- @param[in] RootCert Trusted Root Certificate buffer
-
- @param[in] RootCertLength Trusted Root Certificate buffer length
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCertChain (
- IN CONST UINT8 *RootCert,
- IN UINTN RootCertLength,
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Get one X509 certificate from CertChain.
-
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] CertIndex Index of certificate.
-
- @param[out] Cert The certificate at the index of CertChain.
- @param[out] CertLength The length certificate at the index of CertChain.
-
- @retval TRUE Success.
- @retval FALSE Failed to get certificate from certificate chain.
-**/
-BOOLEAN
-EFIAPI
-X509GetCertFromCertChain (
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength,
- IN CONST INT32 CertIndex,
- OUT CONST UINT8 **Cert,
- OUT UINTN *CertLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the tag and length of the tag.
-
- @param Ptr The position in the ASN.1 data
- @param End End of data
- @param Length The variable that will receive the length
- @param Tag The expected tag
-
- @retval TRUE Get tag successful
- @retval FALSe Failed to get tag or tag not match
-**/
-BOOLEAN
-EFIAPI
-Asn1GetTag (
- IN OUT UINT8 **Ptr,
- IN CONST UINT8 *End,
- OUT UINTN *Length,
- IN UINT32 Tag
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the basic constraints from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize size of the X509 certificate in bytes.
- @param[out] BasicConstraints basic constraints bytes.
- @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
-
- @retval TRUE The basic constraints retrieve successfully.
- @retval FALSE If cert is NULL.
- If cert_size is NULL.
- If basic_constraints is not NULL and *basic_constraints_size is 0.
- If cert is invalid.
- @retval FALSE The required buffer size is small.
- The return buffer size is basic_constraints_size parameter.
- @retval FALSE If no Extension entry match oid.
- @retval FALSE The operation is not supported.
- **/
-BOOLEAN
-EFIAPI
-X509GetExtendedBasicConstraints (
- CONST UINT8 *Cert,
- UINTN CertSize,
- UINT8 *BasicConstraints,
- UINTN *BasicConstraintsSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
deleted file mode 100644
index 9e2fcefe08..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/** @file
- Pseudorandom Number Generator Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-
-//
-// Default seed for UEFI Crypto Library
-//
-CONST UINT8 DefaultSeed[] = "UEFI Crypto Library default seed";
-
-/**
- Sets up the seed value for the pseudorandom number generator.
-
- This function sets up the seed value for the pseudorandom number generator.
- If Seed is not NULL, then the seed passed in is used.
- If Seed is NULL, then default seed is used.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval TRUE Pseudorandom number generator has enough entropy for random generation.
- @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
-
-**/
-BOOLEAN
-EFIAPI
-RandomSeed (
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
- )
-{
- if (SeedSize > INT_MAX) {
- return FALSE;
- }
-
- //
- // The software PRNG implementation built in OpenSSL depends on message digest algorithm.
- // Make sure SHA-1 digest algorithm is available here.
- //
- if (EVP_add_digest (EVP_sha1 ()) == 0) {
- return FALSE;
- }
-
- //
- // Seed the pseudorandom number generator with user-supplied value.
- // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
- //
- if (Seed != NULL) {
- RAND_seed (Seed, (UINT32)SeedSize);
- } else {
- RAND_seed (DefaultSeed, sizeof (DefaultSeed));
- }
-
- if (RAND_status () == 1) {
- return TRUE;
- }
-
- return FALSE;
-}
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- If Output is NULL, then return FALSE.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval TRUE Pseudorandom byte stream generated successfully.
- @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
-
-**/
-BOOLEAN
-EFIAPI
-RandomBytes (
- OUT UINT8 *Output,
- IN UINTN Size
- )
-{
- //
- // Check input parameters.
- //
- if ((Output == NULL) || (Size > INT_MAX)) {
- return FALSE;
- }
-
- //
- // Generate random data.
- //
- if (RAND_bytes (Output, (UINT32)Size) != 1) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandNull.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandNull.c
deleted file mode 100644
index 254fa31899..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandNull.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/** @file
- Pseudorandom Number Generator Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2012, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Sets up the seed value for the pseudorandom number generator.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RandomSeed (
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RandomBytes (
- OUT UINT8 *Output,
- IN UINTN Size
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
deleted file mode 100644
index 30454bf10f..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/** @file
- Pseudorandom Number Generator Wrapper Implementation over OpenSSL.
-
-Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-#include
-
-/**
- Sets up the seed value for the pseudorandom number generator.
-
- This function sets up the seed value for the pseudorandom number generator.
- If Seed is not NULL, then the seed passed in is used.
- If Seed is NULL, then default seed is used.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval TRUE Pseudorandom number generator has enough entropy for random generation.
- @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
-
-**/
-BOOLEAN
-EFIAPI
-RandomSeed (
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
- )
-{
- CHAR8 DefaultSeed[128];
-
- if (SeedSize > INT_MAX) {
- return FALSE;
- }
-
- //
- // The software PRNG implementation built in OpenSSL depends on message digest algorithm.
- // Make sure SHA-1 digest algorithm is available here.
- //
- if (EVP_add_digest (EVP_sha1 ()) == 0) {
- return FALSE;
- }
-
- //
- // Seed the pseudorandom number generator with user-supplied value.
- // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
- //
- if (Seed != NULL) {
- RAND_seed (Seed, (UINT32)SeedSize);
- } else {
- //
- // Retrieve current time.
- //
- AsciiSPrint (
- DefaultSeed,
- sizeof (DefaultSeed),
- "UEFI Crypto Library default seed (%ld)",
- AsmReadTsc ()
- );
-
- RAND_seed (DefaultSeed, sizeof (DefaultSeed));
- }
-
- if (RAND_status () == 1) {
- return TRUE;
- }
-
- return FALSE;
-}
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- If Output is NULL, then return FALSE.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval TRUE Pseudorandom byte stream generated successfully.
- @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
-
-**/
-BOOLEAN
-EFIAPI
-RandomBytes (
- OUT UINT8 *Output,
- IN UINTN Size
- )
-{
- //
- // Check input parameters.
- //
- if ((Output == NULL) || (Size > INT_MAX)) {
- return FALSE;
- }
-
- //
- // Generate random data.
- //
- if (RAND_bytes (Output, (UINT32)Size) != 1) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
deleted file mode 100644
index 9cbbbd6f28..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+++ /dev/null
@@ -1,112 +0,0 @@
-## @file
-# Cryptographic Library Instance for DXE_RUNTIME_DRIVER.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Note: SHA-384 Digest functions, SHA-512 Digest functions,
-# HMAC-SHA256 functions, AES functions, RSA external
-# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
-# authenticode signature verification functions are not supported in this instance.
-#
-# Copyright (c) 2009 - 2022, Intel Corporation. All rights reserved.
-# Copyright (c) 2021, Hewlett Packard Enterprise Development LP. All rights reserved.
-# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = RuntimeCryptLib
- MODULE_UNI_FILE = RuntimeCryptLib.uni
- FILE_GUID = 78189cc0-727d-46a4-84ea-f7dd860de64a
- MODULE_TYPE = DXE_RUNTIME_DRIVER
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|DXE_RUNTIME_DRIVER
- CONSTRUCTOR = RuntimeCryptLibConstructor
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5Null.c ## MS_CHANGE_162948 MSChange - Remove support for deprecated crypto.
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSm3.c
- Hash/CryptSha512.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2.c ## MU_CHANGE TCBZ2997
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyCommon.c
- Pk/CryptPkcs7VerifyRuntime.c
- Pk/CryptPkcs7VerifyEkuRuntime.c
- Pk/CryptDhNull.c
- Pk/CryptX509.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Pk/CryptRsaPssNull.c
- Pk/CryptRsaPssSignNull.c
- Pk/CryptEcNull.c
- Pem/CryptPem.c
- Bn/CryptBnNull.c
-
- SysCall/CrtWrapper.c
- SysCall/TimerWrapper.c
- SysCall/RuntimeMemAllocation.c
-
-[Sources.Ia32]
- Rand/CryptRandTsc.c
-
-[Sources.X64]
- Rand/CryptRandTsc.c
-
-[Sources.ARM]
- Rand/CryptRand.c
-
-[Sources.AARCH64]
- Rand/CryptRand.c
-
-[Sources.RISCV64]
- Rand/CryptRand.c
-
-[Sources.LOONGARCH64]
- Rand/CryptRand.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- UefiRuntimeServicesTableLib
- DebugLib
- OpensslLib
- IntrinsicLib
- PrintLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
- GCC:*_CLANGDWARF_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
deleted file mode 100644
index 786738a99d..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
+++ /dev/null
@@ -1,22 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for DXE_RUNTIME_DRIVER.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Note: AES
-// functions, RSA external functions, PKCS#7 SignedData sign functions,
-// Diffie-Hellman functions, and authenticode signature verification functions are
-// not supported in this instance.
-//
-// Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for DXE_RUNTIME_DRIVER"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf
deleted file mode 100644
index e7801b24c9..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SecCryptLib.inf
+++ /dev/null
@@ -1,87 +0,0 @@
-## @file
-# Cryptographic Library Instance for SEC.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Copyright (c) 2021, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = SecCryptLib
- MODULE_UNI_FILE = SecCryptLib.uni
- FILE_GUID = 3689D343-0D32-4284-8053-BF10537990E8
- MODULE_TYPE = BASE
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|SEC
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptSha512.c
-
- Hash/CryptMd5Null.c
- Hash/CryptSha1Null.c
- Hash/CryptSha256Null.c
- Hash/CryptSm3Null.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmacNull.c
- Kdf/CryptHkdfNull.c
- Cipher/CryptAesNull.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasicNull.c
- Pk/CryptRsaExtNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptDhNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Pem/CryptPemNull.c
- Rand/CryptRandNull.c
- Pk/CryptRsaPssNull.c
- Pk/CryptRsaPssSignNull.c
- Pk/CryptEcNull.c
- Bn/CryptBnNull.c
-
- SysCall/CrtWrapper.c
- SysCall/ConstantTimeClock.c
- SysCall/BaseMemAllocation.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- DebugLib
- OpensslLib
- IntrinsicLib
- PrintLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
- GCC:*_CLANGDWARF_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLib/SecCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/SecCryptLib.uni
deleted file mode 100644
index c0dd1eb0f3..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SecCryptLib.uni
+++ /dev/null
@@ -1,17 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for SEC driver.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for SEC driver"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
deleted file mode 100644
index fb3d5bb772..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ /dev/null
@@ -1,110 +0,0 @@
-## @file
-# Cryptographic Library Instance for SMM driver.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Note: SHA-384 Digest functions, SHA-512 Digest functions,
-# RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
-# authenticode signature verification functions are not supported in this instance.
-#
-# Copyright (c) 2010 - 2022, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = SmmCryptLib
- MODULE_UNI_FILE = SmmCryptLib.uni
- FILE_GUID = 028080a3-8958-4a62-a1a8-0fa1da162007
- MODULE_TYPE = DXE_SMM_DRIVER
- VERSION_STRING = 1.0
- PI_SPECIFICATION_VERSION = 0x0001000A
- LIBRARY_CLASS = BaseCryptLib|DXE_SMM_DRIVER SMM_CORE MM_STANDALONE
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSm3.c
- Hash/CryptSha512.c
- Hash/CryptSha3.c
- Hash/CryptXkcp.c
- Hash/CryptCShake256.c
- Hash/CryptParallelHash.c
- Hash/CryptDispatchApMm.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAesNull.c ## MS_CHANGE_162948 - MSChange - Remove support for deprecated crypto.
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptPkcs1Oaep.c
- Pk/CryptPkcs5Pbkdf2.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyCommon.c
- Pk/CryptPkcs7VerifyBase.c
- Pk/CryptPkcs7VerifyEku.c
- Pk/CryptDhNull.c
- Pk/CryptX509.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSignNull.c
- Pk/CryptEcNull.c
- Pem/CryptPem.c
- Bn/CryptBnNull.c
-
- SysCall/CrtWrapper.c
- SysCall/ConstantTimeClock.c
- SysCall/BaseMemAllocation.c
-
-[Sources.Ia32]
- Rand/CryptRandTsc.c
-
-[Sources.X64]
- Rand/CryptRandTsc.c
-
-[Sources.ARM]
- Rand/CryptRand.c
-
-[Sources.AARCH64]
- Rand/CryptRand.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- OpensslLib
- IntrinsicLib
- PrintLib
- MmServicesTableLib
- SynchronizationLib
-
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
-
- XCODE:*_*_*_CC_FLAGS = -mmmx -msse -std=c99
-
- GCC:*_CLANGDWARF_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
deleted file mode 100644
index 7e0f55f792..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
+++ /dev/null
@@ -1,22 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for SMM driver.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Note: AES
-// functions, RSA external functions, PKCS#7 SignedData sign functions,
-// Diffie-Hellman functions, and authenticode signature verification functions are
-// not supported in this instance.
-//
-// Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for SMM driver"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/BaseMemAllocation.c b/CryptoPkg/Library/BaseCryptLib/SysCall/BaseMemAllocation.c
deleted file mode 100644
index b7bed15c18..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/BaseMemAllocation.c
+++ /dev/null
@@ -1,122 +0,0 @@
-/** @file
- Base Memory Allocation Routines Wrapper for Crypto library over OpenSSL
- during PEI & DXE phases.
-
-Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-//
-// Extra header to record the memory buffer size from malloc routine.
-//
-#define CRYPTMEM_HEAD_SIGNATURE SIGNATURE_32('c','m','h','d')
-typedef struct {
- UINT32 Signature;
- UINT32 Reserved;
- UINTN Size;
-} CRYPTMEM_HEAD;
-
-#define CRYPTMEM_OVERHEAD sizeof(CRYPTMEM_HEAD)
-
-//
-// -- Memory-Allocation Routines --
-//
-
-/* Allocates memory blocks */
-void *
-malloc (
- size_t size
- )
-{
- CRYPTMEM_HEAD *PoolHdr;
- UINTN NewSize;
- VOID *Data;
-
- //
- // Adjust the size by the buffer header overhead
- //
- NewSize = (UINTN)(size) + CRYPTMEM_OVERHEAD;
-
- Data = AllocatePool (NewSize);
- if (Data != NULL) {
- PoolHdr = (CRYPTMEM_HEAD *)Data;
- //
- // Record the memory brief information
- //
- PoolHdr->Signature = CRYPTMEM_HEAD_SIGNATURE;
- PoolHdr->Size = size;
-
- return (VOID *)(PoolHdr + 1);
- } else {
- //
- // The buffer allocation failed.
- //
- return NULL;
- }
-}
-
-/* Reallocate memory blocks */
-void *
-realloc (
- void *ptr,
- size_t size
- )
-{
- CRYPTMEM_HEAD *OldPoolHdr;
- CRYPTMEM_HEAD *NewPoolHdr;
- UINTN OldSize;
- UINTN NewSize;
- VOID *Data;
-
- NewSize = (UINTN)size + CRYPTMEM_OVERHEAD;
- Data = AllocatePool (NewSize);
- if (Data != NULL) {
- NewPoolHdr = (CRYPTMEM_HEAD *)Data;
- NewPoolHdr->Signature = CRYPTMEM_HEAD_SIGNATURE;
- NewPoolHdr->Size = size;
- if (ptr != NULL) {
- //
- // Retrieve the original size from the buffer header.
- //
- OldPoolHdr = (CRYPTMEM_HEAD *)ptr - 1;
- ASSERT (OldPoolHdr->Signature == CRYPTMEM_HEAD_SIGNATURE);
- OldSize = OldPoolHdr->Size;
-
- //
- // Duplicate the buffer content.
- //
- CopyMem ((VOID *)(NewPoolHdr + 1), ptr, MIN (OldSize, size));
- FreePool ((VOID *)OldPoolHdr);
- }
-
- return (VOID *)(NewPoolHdr + 1);
- } else {
- //
- // The buffer allocation failed.
- //
- return NULL;
- }
-}
-
-/* De-allocates or frees a memory block */
-void
-free (
- void *ptr
- )
-{
- CRYPTMEM_HEAD *PoolHdr;
-
- //
- // In Standard C, free() handles a null pointer argument transparently. This
- // is not true of FreePool() below, so protect it.
- //
- if (ptr != NULL) {
- PoolHdr = (CRYPTMEM_HEAD *)ptr - 1;
- ASSERT (PoolHdr->Signature == CRYPTMEM_HEAD_SIGNATURE);
- FreePool (PoolHdr);
- }
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c b/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c
deleted file mode 100644
index 2956b92d08..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c
+++ /dev/null
@@ -1,44 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Time Management Routines Wrapper Implementation
- for OpenSSL-based Cryptographic Library.
-
- This C file implements constant time value for time() and NULL for gmtime()
- thus should not be used in library instances which require functionality
- of following APIs which need system time support:
- 1) RsaGenerateKey
- 2) RsaCheckKey
- 3) RsaPkcs1Sign
- 4) Pkcs7Sign
- 5) DhGenerateParameter
- 6) DhGenerateKey
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-
-//
-// -- Time Management Routines --
-//
-
-time_t
-time (
- time_t *timer
- )
-{
- if (timer != NULL) {
- *timer = 0;
- }
-
- return 0;
-}
-
-struct tm *
-gmtime (
- const time_t *timer
- )
-{
- return NULL;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
deleted file mode 100644
index 491721e9aa..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+++ /dev/null
@@ -1,595 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Wrapper Implementation for OpenSSL-based
- Cryptographic Library.
-
-Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-
-int errno = 0;
-
-FILE *stderr = NULL;
-FILE *stdin = NULL;
-FILE *stdout = NULL;
-
-typedef
-int
-(*SORT_COMPARE)(
- IN VOID *Buffer1,
- IN VOID *Buffer2
- );
-
-//
-// Duplicated from EDKII BaseSortLib for qsort() wrapper
-//
-STATIC
-VOID
-QuickSortWorker (
- IN OUT VOID *BufferToSort,
- IN CONST UINTN Count,
- IN CONST UINTN ElementSize,
- IN SORT_COMPARE CompareFunction,
- IN VOID *Buffer
- )
-{
- VOID *Pivot;
- UINTN LoopCount;
- UINTN NextSwapLocation;
-
- ASSERT (BufferToSort != NULL);
- ASSERT (CompareFunction != NULL);
- ASSERT (Buffer != NULL);
-
- if ((Count < 2) || (ElementSize < 1)) {
- return;
- }
-
- NextSwapLocation = 0;
-
- //
- // Pick a pivot (we choose last element)
- //
- Pivot = ((UINT8 *)BufferToSort + ((Count - 1) * ElementSize));
-
- //
- // Now get the pivot such that all on "left" are below it
- // and everything "right" are above it
- //
- for (LoopCount = 0; LoopCount < Count - 1; LoopCount++) {
- //
- // If the element is less than the pivot
- //
- if (CompareFunction ((VOID *)((UINT8 *)BufferToSort + ((LoopCount) * ElementSize)), Pivot) <= 0) {
- //
- // Swap
- //
- CopyMem (Buffer, (UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), ElementSize);
- CopyMem ((UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), (UINT8 *)BufferToSort + ((LoopCount) * ElementSize), ElementSize);
- CopyMem ((UINT8 *)BufferToSort + ((LoopCount) * ElementSize), Buffer, ElementSize);
-
- //
- // Increment NextSwapLocation
- //
- NextSwapLocation++;
- }
- }
-
- //
- // Swap pivot to its final position (NextSwapLocation)
- //
- CopyMem (Buffer, Pivot, ElementSize);
- CopyMem (Pivot, (UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), ElementSize);
- CopyMem ((UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), Buffer, ElementSize);
-
- //
- // Now recurse on 2 partial lists. Neither of these will have the 'pivot' element.
- // IE list is sorted left half, pivot element, sorted right half...
- //
- QuickSortWorker (
- BufferToSort,
- NextSwapLocation,
- ElementSize,
- CompareFunction,
- Buffer
- );
-
- QuickSortWorker (
- (UINT8 *)BufferToSort + (NextSwapLocation + 1) * ElementSize,
- Count - NextSwapLocation - 1,
- ElementSize,
- CompareFunction,
- Buffer
- );
-
- return;
-}
-
-// ---------------------------------------------------------
-// Standard C Run-time Library Interface Wrapper
-// ---------------------------------------------------------
-
-//
-// -- String Manipulation Routines --
-//
-
-char *
-strchr (
- const char *str,
- int ch
- )
-{
- return ScanMem8 (str, AsciiStrSize (str), (UINT8)ch);
-}
-
-/* Scan a string for the last occurrence of a character */
-char *
-strrchr (
- const char *str,
- int c
- )
-{
- char *save;
-
- for (save = NULL; ; ++str) {
- if (*str == c) {
- save = (char *)str;
- }
-
- if (*str == 0) {
- return (save);
- }
- }
-}
-
-/* Compare first n bytes of string s1 with string s2, ignoring case */
-int
-strncasecmp (
- const char *s1,
- const char *s2,
- size_t n
- )
-{
- int Val;
-
- ASSERT (s1 != NULL);
- ASSERT (s2 != NULL);
-
- if (n != 0) {
- do {
- Val = tolower (*s1) - tolower (*s2);
- if (Val != 0) {
- return Val;
- }
-
- ++s1;
- ++s2;
- if (*s1 == '\0') {
- break;
- }
- } while (--n != 0);
- }
-
- return 0;
-}
-
-/* Read formatted data from a string */
-int
-sscanf (
- const char *buffer,
- const char *format,
- ...
- )
-{
- //
- // Null sscanf() function implementation to satisfy the linker, since
- // no direct functionality logic dependency in present UEFI cases.
- //
- return 0;
-}
-
-/* Maps errnum to an error-message string */
-char *
-strerror (
- int errnum
- )
-{
- return NULL;
-}
-
-/* Computes the length of the maximum initial segment of the string pointed to by s1
- which consists entirely of characters from the string pointed to by s2. */
-size_t
-strspn (
- const char *s1,
- const char *s2
- )
-{
- UINT8 Map[32];
- UINT32 Index;
- size_t Count;
-
- for (Index = 0; Index < 32; Index++) {
- Map[Index] = 0;
- }
-
- while (*s2) {
- Map[*s2 >> 3] |= (1 << (*s2 & 7));
- s2++;
- }
-
- if (*s1) {
- Count = 0;
- while (Map[*s1 >> 3] & (1 << (*s1 & 7))) {
- Count++;
- s1++;
- }
-
- return Count;
- }
-
- return 0;
-}
-
-/* Computes the length of the maximum initial segment of the string pointed to by s1
- which consists entirely of characters not from the string pointed to by s2. */
-size_t
-strcspn (
- const char *s1,
- const char *s2
- )
-{
- UINT8 Map[32];
- UINT32 Index;
- size_t Count;
-
- for (Index = 0; Index < 32; Index++) {
- Map[Index] = 0;
- }
-
- while (*s2) {
- Map[*s2 >> 3] |= (1 << (*s2 & 7));
- s2++;
- }
-
- Map[0] |= 1;
-
- Count = 0;
- while (!(Map[*s1 >> 3] & (1 << (*s1 & 7)))) {
- Count++;
- s1++;
- }
-
- return Count;
-}
-
-char *
-strcpy (
- char *strDest,
- const char *strSource
- )
-{
- AsciiStrCpyS (strDest, MAX_STRING_SIZE, strSource);
- return strDest;
-}
-
-int
-strcmp (
- const char *s1,
- const char *s2
- )
-{
- return (int)AsciiStrCmp (s1, s2);
-}
-
-//
-// -- Character Classification Routines --
-//
-
-/* Determines if a particular character is a decimal-digit character */
-int
-isdigit (
- int c
- )
-{
- //
- // ::= [0-9]
- //
- return (('0' <= (c)) && ((c) <= '9'));
-}
-
-/* Determine if an integer represents character that is a hex digit */
-int
-isxdigit (
- int c
- )
-{
- //
- // ::= [0-9] | [a-f] | [A-F]
- //
- return ((('0' <= (c)) && ((c) <= '9')) ||
- (('a' <= (c)) && ((c) <= 'f')) ||
- (('A' <= (c)) && ((c) <= 'F')));
-}
-
-/* Determines if a particular character represents a space character */
-int
-isspace (
- int c
- )
-{
- //
- // ::= [ ]
- //
- return ((c) == ' ');
-}
-
-/* Determine if a particular character is an alphanumeric character */
-int
-isalnum (
- int c
- )
-{
- //
- // ::= [0-9] | [a-z] | [A-Z]
- //
- return ((('0' <= (c)) && ((c) <= '9')) ||
- (('a' <= (c)) && ((c) <= 'z')) ||
- (('A' <= (c)) && ((c) <= 'Z')));
-}
-
-/* Determines if a particular character is in upper case */
-int
-isupper (
- int c
- )
-{
- //
- // := [A-Z]
- //
- return (('A' <= (c)) && ((c) <= 'Z'));
-}
-
-//
-// -- Data Conversion Routines --
-//
-
-/* Convert strings to a long-integer value */
-long
-strtol (
- const char *nptr,
- char **endptr,
- int base
- )
-{
- //
- // Null strtol() function implementation to satisfy the linker, since there is
- // no direct functionality logic dependency in present UEFI cases.
- //
- return 0;
-}
-
-/* Convert strings to an unsigned long-integer value */
-unsigned long
-strtoul (
- const char *nptr,
- char **endptr,
- int base
- )
-{
- //
- // Null strtoul() function implementation to satisfy the linker, since there is
- // no direct functionality logic dependency in present UEFI cases.
- //
- return 0;
-}
-
-/* Convert character to lowercase */
-int
-tolower (
- int c
- )
-{
- if (('A' <= (c)) && ((c) <= 'Z')) {
- return (c - ('A' - 'a'));
- }
-
- return (c);
-}
-
-//
-// -- Searching and Sorting Routines --
-//
-
-/* Performs a quick sort */
-void
-qsort (
- void *base,
- size_t num,
- size_t width,
- int ( *compare )(const void *, const void *)
- )
-{
- VOID *Buffer;
-
- ASSERT (base != NULL);
- ASSERT (compare != NULL);
-
- //
- // Use CRT-style malloc to cover BS and RT memory allocation.
- //
- Buffer = malloc (width);
- if (Buffer == NULL) {
- ASSERT (Buffer != NULL);
- return;
- }
-
- //
- // Re-use PerformQuickSort() function Implementation in EDKII BaseSortLib.
- //
- QuickSortWorker (base, (UINTN)num, (UINTN)width, (SORT_COMPARE)compare, Buffer);
-
- free (Buffer);
- return;
-}
-
-//
-// -- Process and Environment Control Routines --
-//
-
-/* Get a value from the current environment */
-char *
-getenv (
- const char *varname
- )
-{
- //
- // Null getenv() function implementation to satisfy the linker, since there is
- // no direct functionality logic dependency in present UEFI cases.
- //
- return NULL;
-}
-
-/* Get a value from the current environment */
-char *
-secure_getenv (
- const char *varname
- )
-{
- //
- // Null secure_getenv() function implementation to satisfy the linker, since
- // there is no direct functionality logic dependency in present UEFI cases.
- //
- // From the secure_getenv() manual: 'just like getenv() except that it
- // returns NULL in cases where "secure execution" is required'.
- //
- return NULL;
-}
-
-//
-// -- Stream I/O Routines --
-//
-
-/* Write data to a stream */
-size_t
-fwrite (
- const void *buffer,
- size_t size,
- size_t count,
- FILE *stream
- )
-{
- return 0;
-}
-
-#ifdef __GNUC__
-
-typedef
-VOID
-(EFIAPI *NoReturnFuncPtr)(
- VOID
- ) __attribute__ ((__noreturn__));
-
-STATIC
-VOID
-EFIAPI
-NopFunction (
- VOID
- )
-{
-}
-
-void
-abort (
- void
- )
-{
- NoReturnFuncPtr NoReturnFunc;
-
- NoReturnFunc = (NoReturnFuncPtr)NopFunction;
-
- NoReturnFunc ();
-}
-
-#else
-
-void
-abort (
- void
- )
-{
- // Do nothing
-}
-
-#endif
-
-int
-fclose (
- FILE *f
- )
-{
- return 0;
-}
-
-FILE *
-fopen (
- const char *c,
- const char *m
- )
-{
- return NULL;
-}
-
-size_t
-fread (
- void *b,
- size_t c,
- size_t i,
- FILE *f
- )
-{
- return 0;
-}
-
-uid_t
-getuid (
- void
- )
-{
- return 0;
-}
-
-uid_t
-geteuid (
- void
- )
-{
- return 0;
-}
-
-gid_t
-getgid (
- void
- )
-{
- return 0;
-}
-
-gid_t
-getegid (
- void
- )
-{
- return 0;
-}
-
-int
-printf (
- char const *fmt,
- ...
- )
-{
- return 0;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c b/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
deleted file mode 100644
index 0d2ca604ea..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
+++ /dev/null
@@ -1,462 +0,0 @@
-/** @file
- Light-weight Memory Management Routines for OpenSSL-based Crypto
- Library at Runtime Phase.
-
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-#include
-#include
-
-// ----------------------------------------------------------------
-// Initial version. Needs further optimizations.
-// ----------------------------------------------------------------
-
-//
-// Definitions for Runtime Memory Operations
-//
-#define RT_PAGE_SIZE 0x200
-#define RT_PAGE_MASK 0x1FF
-#define RT_PAGE_SHIFT 9
-
-#define RT_SIZE_TO_PAGES(a) (((a) >> RT_PAGE_SHIFT) + (((a) & RT_PAGE_MASK) ? 1 : 0))
-#define RT_PAGES_TO_SIZE(a) ((a) << RT_PAGE_SHIFT)
-
-//
-// Page Flag Definitions
-//
-#define RT_PAGE_FREE 0x00000000
-#define RT_PAGE_USED 0x00000001
-
-#define MIN_REQUIRED_BLOCKS 600
-
-//
-// Memory Page Table
-//
-typedef struct {
- UINTN StartPageOffset; // Offset of the starting page allocated.
- // Only available for USED pages.
- UINT32 PageFlag; // Page Attributes.
-} RT_MEMORY_PAGE_ENTRY;
-
-typedef struct {
- UINTN PageCount;
- UINTN LastEmptyPageOffset;
- UINT8 *DataAreaBase; // Pointer to data Area.
- RT_MEMORY_PAGE_ENTRY Pages[1]; // Page Table Entries.
-} RT_MEMORY_PAGE_TABLE;
-
-//
-// Global Page Table for Runtime Cryptographic Provider.
-//
-RT_MEMORY_PAGE_TABLE *mRTPageTable = NULL;
-
-//
-// Event for Runtime Address Conversion.
-//
-STATIC EFI_EVENT mVirtualAddressChangeEvent;
-
-/**
- Initializes pre-allocated memory pointed by ScratchBuffer for subsequent
- runtime use.
-
- @param[in, out] ScratchBuffer Pointer to user-supplied memory buffer.
- @param[in] ScratchBufferSize Size of supplied buffer in bytes.
-
- @retval EFI_SUCCESS Successful initialization.
-
-**/
-EFI_STATUS
-InitializeScratchMemory (
- IN OUT UINT8 *ScratchBuffer,
- IN UINTN ScratchBufferSize
- )
-{
- UINTN Index;
- UINTN MemorySize;
-
- //
- // Parameters Checking
- //
- if (ScratchBuffer == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- if (ScratchBufferSize < MIN_REQUIRED_BLOCKS * 1024) {
- return EFI_BUFFER_TOO_SMALL;
- }
-
- mRTPageTable = (RT_MEMORY_PAGE_TABLE *)ScratchBuffer;
-
- //
- // Initialize Internal Page Table for Memory Management
- //
- SetMem (mRTPageTable, ScratchBufferSize, 0xFF);
- MemorySize = ScratchBufferSize - sizeof (RT_MEMORY_PAGE_TABLE) + sizeof (RT_MEMORY_PAGE_ENTRY);
-
- mRTPageTable->PageCount = MemorySize / (RT_PAGE_SIZE + sizeof (RT_MEMORY_PAGE_ENTRY));
- mRTPageTable->LastEmptyPageOffset = 0x0;
-
- for (Index = 0; Index < mRTPageTable->PageCount; Index++) {
- mRTPageTable->Pages[Index].PageFlag = RT_PAGE_FREE;
- mRTPageTable->Pages[Index].StartPageOffset = 0;
- }
-
- mRTPageTable->DataAreaBase = ScratchBuffer + sizeof (RT_MEMORY_PAGE_TABLE) +
- (mRTPageTable->PageCount - 1) * sizeof (RT_MEMORY_PAGE_ENTRY);
-
- return EFI_SUCCESS;
-}
-
-/**
- Look-up Free memory Region for object allocation.
-
- @param[in] AllocationSize Bytes to be allocated.
-
- @return Return available page offset for object allocation.
-
-**/
-UINTN
-LookupFreeMemRegion (
- IN UINTN AllocationSize
- )
-{
- UINTN StartPageIndex;
- UINTN Index;
- UINTN SubIndex;
- UINTN ReqPages;
-
- StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->LastEmptyPageOffset);
- ReqPages = RT_SIZE_TO_PAGES (AllocationSize);
- if (ReqPages > mRTPageTable->PageCount) {
- //
- // No enough region for object allocation.
- //
- return (UINTN)(-1);
- }
-
- //
- // Look up the free memory region with in current memory map table.
- //
- for (Index = StartPageIndex; Index <= (mRTPageTable->PageCount - ReqPages); ) {
- //
- // Check consecutive ReqPages pages.
- //
- for (SubIndex = 0; SubIndex < ReqPages; SubIndex++) {
- if ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0) {
- break;
- }
- }
-
- if (SubIndex == ReqPages) {
- //
- // Succeed! Return the Starting Offset.
- //
- return RT_PAGES_TO_SIZE (Index);
- }
-
- //
- // Failed! Skip current free memory pages and adjacent Used pages
- //
- while ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0) {
- SubIndex++;
- }
-
- Index += SubIndex;
- }
-
- //
- // Look up the free memory region from the beginning of the memory table
- // until the StartCursorOffset
- //
- if (ReqPages > StartPageIndex) {
- //
- // No enough region for object allocation.
- //
- return (UINTN)(-1);
- }
-
- for (Index = 0; Index < (StartPageIndex - ReqPages); ) {
- //
- // Check Consecutive ReqPages Pages.
- //
- for (SubIndex = 0; SubIndex < ReqPages; SubIndex++) {
- if ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0) {
- break;
- }
- }
-
- if (SubIndex == ReqPages) {
- //
- // Succeed! Return the Starting Offset.
- //
- return RT_PAGES_TO_SIZE (Index);
- }
-
- //
- // Failed! Skip current adjacent Used pages
- //
- while ((SubIndex < (StartPageIndex - ReqPages)) &&
- ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0))
- {
- SubIndex++;
- }
-
- Index += SubIndex;
- }
-
- //
- // No available region for object allocation!
- //
- return (UINTN)(-1);
-}
-
-/**
- Allocates a buffer at runtime phase.
-
- @param[in] AllocationSize Bytes to be allocated.
-
- @return A pointer to the allocated buffer or NULL if allocation fails.
-
-**/
-VOID *
-RuntimeAllocateMem (
- IN UINTN AllocationSize
- )
-{
- UINT8 *AllocPtr;
- UINTN ReqPages;
- UINTN Index;
- UINTN StartPage;
- UINTN AllocOffset;
-
- AllocPtr = NULL;
- ReqPages = 0;
-
- //
- // Look for available consecutive memory region starting from LastEmptyPageOffset.
- // If no proper memory region found, look up from the beginning.
- // If still not found, return NULL to indicate failed allocation.
- //
- AllocOffset = LookupFreeMemRegion (AllocationSize);
- if (AllocOffset == (UINTN)(-1)) {
- return NULL;
- }
-
- //
- // Allocates consecutive memory pages with length of Size. Update the page
- // table status. Returns the starting address.
- //
- ReqPages = RT_SIZE_TO_PAGES (AllocationSize);
- AllocPtr = mRTPageTable->DataAreaBase + AllocOffset;
- StartPage = RT_SIZE_TO_PAGES (AllocOffset);
- Index = 0;
- while (Index < ReqPages) {
- mRTPageTable->Pages[StartPage + Index].PageFlag |= RT_PAGE_USED;
- mRTPageTable->Pages[StartPage + Index].StartPageOffset = AllocOffset;
-
- Index++;
- }
-
- mRTPageTable->LastEmptyPageOffset = AllocOffset + RT_PAGES_TO_SIZE (ReqPages);
-
- ZeroMem (AllocPtr, AllocationSize);
-
- //
- // Returns a void pointer to the allocated space
- //
- return AllocPtr;
-}
-
-/**
- Frees a buffer that was previously allocated at runtime phase.
-
- @param[in] Buffer Pointer to the buffer to free.
-
-**/
-VOID
-RuntimeFreeMem (
- IN VOID *Buffer
- )
-{
- UINTN StartOffset;
- UINTN StartPageIndex;
-
- StartOffset = (UINTN)Buffer - (UINTN)mRTPageTable->DataAreaBase;
- StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->Pages[RT_SIZE_TO_PAGES (StartOffset)].StartPageOffset);
-
- while (StartPageIndex < mRTPageTable->PageCount) {
- if (((mRTPageTable->Pages[StartPageIndex].PageFlag & RT_PAGE_USED) != 0) &&
- (mRTPageTable->Pages[StartPageIndex].StartPageOffset == StartOffset))
- {
- //
- // Free this page
- //
- mRTPageTable->Pages[StartPageIndex].PageFlag &= ~RT_PAGE_USED;
- mRTPageTable->Pages[StartPageIndex].PageFlag |= RT_PAGE_FREE;
- mRTPageTable->Pages[StartPageIndex].StartPageOffset = 0;
-
- StartPageIndex++;
- } else {
- break;
- }
- }
-
- return;
-}
-
-/**
- Notification function of EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE.
-
- This is a notification function registered on EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE
- event. It converts a pointer to a new virtual address.
-
- @param[in] Event The event whose notification function is being invoked.
- @param[in] Context The pointer to the notification function's context.
-
-**/
-VOID
-EFIAPI
-RuntimeCryptLibAddressChangeEvent (
- IN EFI_EVENT Event,
- IN VOID *Context
- )
-{
- //
- // Converts a pointer for runtime memory management to a new virtual address.
- //
- EfiConvertPointer (0x0, (VOID **)&mRTPageTable->DataAreaBase);
- EfiConvertPointer (0x0, (VOID **)&mRTPageTable);
-}
-
-/**
- Constructor routine for runtime crypt library instance.
-
- The constructor function pre-allocates space for runtime cryptographic operation.
-
- @param ImageHandle The firmware allocated handle for the EFI image.
- @param SystemTable A pointer to the EFI System Table.
-
- @retval EFI_SUCCESS The construction succeeded.
- @retval EFI_OUT_OF_RESOURCE Failed to allocate memory.
-
-**/
-EFI_STATUS
-EFIAPI
-RuntimeCryptLibConstructor (
- IN EFI_HANDLE ImageHandle,
- IN EFI_SYSTEM_TABLE *SystemTable
- )
-{
- EFI_STATUS Status;
- VOID *Buffer;
-
- //
- // Pre-allocates runtime space for possible cryptographic operations
- //
- Buffer = AllocateRuntimePool (MIN_REQUIRED_BLOCKS * 1024);
- Status = InitializeScratchMemory (Buffer, MIN_REQUIRED_BLOCKS * 1024);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Create address change event
- //
- Status = gBS->CreateEventEx (
- EVT_NOTIFY_SIGNAL,
- TPL_NOTIFY,
- RuntimeCryptLibAddressChangeEvent,
- NULL,
- &gEfiEventVirtualAddressChangeGuid,
- &mVirtualAddressChangeEvent
- );
- ASSERT_EFI_ERROR (Status);
-
- return Status;
-}
-
-//
-// -- Memory-Allocation Routines Wrapper for UEFI-OpenSSL Library --
-//
-
-/* Allocates memory blocks */
-void *
-malloc (
- size_t size
- )
-{
- return RuntimeAllocateMem ((UINTN)size);
-}
-
-/* Reallocate memory blocks */
-void *
-realloc (
- void *ptr,
- size_t size
- )
-{
- VOID *NewPtr;
- UINTN StartOffset;
- UINTN StartPageIndex;
- UINTN PageCount;
-
- if (ptr == NULL) {
- return malloc (size);
- }
-
- //
- // Get Original Size of ptr
- //
- StartOffset = (UINTN)ptr - (UINTN)mRTPageTable->DataAreaBase;
- StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->Pages[RT_SIZE_TO_PAGES (StartOffset)].StartPageOffset);
- PageCount = 0;
- while (StartPageIndex < mRTPageTable->PageCount) {
- if (((mRTPageTable->Pages[StartPageIndex].PageFlag & RT_PAGE_USED) != 0) &&
- (mRTPageTable->Pages[StartPageIndex].StartPageOffset == StartOffset))
- {
- StartPageIndex++;
- PageCount++;
- } else {
- break;
- }
- }
-
- if (size <= RT_PAGES_TO_SIZE (PageCount)) {
- //
- // Return the original pointer, if Caller try to reduce region size;
- //
- return ptr;
- }
-
- NewPtr = RuntimeAllocateMem ((UINTN)size);
- if (NewPtr == NULL) {
- return NULL;
- }
-
- CopyMem (NewPtr, ptr, RT_PAGES_TO_SIZE (PageCount));
-
- RuntimeFreeMem (ptr);
-
- return NewPtr;
-}
-
-/* Deallocates or frees a memory block */
-void
-free (
- void *ptr
- )
-{
- //
- // In Standard C, free() handles a null pointer argument transparently. This
- // is not true of RuntimeFreeMem() below, so protect it.
- //
- if (ptr != NULL) {
- RuntimeFreeMem (ptr);
- }
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/TimerWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/TimerWrapper.c
deleted file mode 100644
index 2dfc6fe6c5..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/TimerWrapper.c
+++ /dev/null
@@ -1,197 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Time Management Routines Wrapper Implementation
- for OpenSSL-based Cryptographic Library (used in DXE & RUNTIME).
-
-Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-
-//
-// -- Time Management Routines --
-//
-
-#define SECSPERMIN (60)
-#define SECSPERHOUR (60 * 60)
-#define SECSPERDAY (24 * SECSPERHOUR)
-
-//
-// The arrays give the cumulative number of days up to the first of the
-// month number used as the index (1 -> 12) for regular and leap years.
-// The value at index 13 is for the whole year.
-//
-UINTN CumulativeDays[2][14] = {
- {
- 0,
- 0,
- 31,
- 31 + 28,
- 31 + 28 + 31,
- 31 + 28 + 31 + 30,
- 31 + 28 + 31 + 30 + 31,
- 31 + 28 + 31 + 30 + 31 + 30,
- 31 + 28 + 31 + 30 + 31 + 30 + 31,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30 + 31
- },
- {
- 0,
- 0,
- 31,
- 31 + 29,
- 31 + 29 + 31,
- 31 + 29 + 31 + 30,
- 31 + 29 + 31 + 30 + 31,
- 31 + 29 + 31 + 30 + 31 + 30,
- 31 + 29 + 31 + 30 + 31 + 30 + 31,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30 + 31
- }
-};
-
-/* Check the year is leap or not. */
-// BOOLEAN IsLeap(
-// INTN timer
-// )
-BOOLEAN
-IsLeap (
- time_t timer
- )
-{
- INT64 Remainder1;
- INT64 Remainder2;
- INT64 Remainder3;
-
- DivS64x64Remainder (timer, 4, &Remainder1);
- DivS64x64Remainder (timer, 100, &Remainder2);
- DivS64x64Remainder (timer, 400, &Remainder3);
-
- return (Remainder1 == 0 && (Remainder2 != 0 || Remainder3 == 0));
-}
-
-/* Get the system time as seconds elapsed since midnight, January 1, 1970. */
-// INTN time(
-// INTN *timer
-// )
-time_t
-time (
- time_t *timer
- )
-{
- EFI_STATUS Status;
- EFI_TIME Time;
- time_t CalTime;
- UINTN Year;
-
- //
- // Get the current time and date information
- //
- Status = gRT->GetTime (&Time, NULL);
- if (EFI_ERROR (Status) || (Time.Year < 1970)) {
- return 0;
- }
-
- //
- // Years Handling
- // UTime should now be set to 00:00:00 on Jan 1 of the current year.
- //
- for (Year = 1970, CalTime = 0; Year != Time.Year; Year++) {
- CalTime = CalTime + (time_t)(CumulativeDays[IsLeap (Year)][13] * SECSPERDAY);
- }
-
- //
- // Add in number of seconds for current Month, Day, Hour, Minute, Seconds, and TimeZone adjustment
- //
- CalTime = CalTime +
- (time_t)((Time.TimeZone != EFI_UNSPECIFIED_TIMEZONE) ? (Time.TimeZone * 60) : 0) +
- (time_t)(CumulativeDays[IsLeap (Time.Year)][Time.Month] * SECSPERDAY) +
- (time_t)(((Time.Day > 0) ? Time.Day - 1 : 0) * SECSPERDAY) +
- (time_t)(Time.Hour * SECSPERHOUR) +
- (time_t)(Time.Minute * 60) +
- (time_t)Time.Second;
-
- if (timer != NULL) {
- *timer = CalTime;
- }
-
- return CalTime;
-}
-
-//
-// Convert a time value from type time_t to struct tm.
-//
-struct tm *
-gmtime (
- const time_t *timer
- )
-{
- struct tm *GmTime;
- UINT64 DayNo;
- UINT64 DayRemainder;
- time_t Year;
- time_t YearNo;
- UINT32 TotalDays;
- UINT32 MonthNo;
- INT64 Remainder;
-
- if (timer == NULL) {
- return NULL;
- }
-
- GmTime = malloc (sizeof (struct tm));
- if (GmTime == NULL) {
- return NULL;
- }
-
- ZeroMem ((VOID *)GmTime, (UINTN)sizeof (struct tm));
-
- DayNo = (UINT64)DivS64x64Remainder (*timer, SECSPERDAY, &Remainder);
- DayRemainder = (UINT64)Remainder;
-
- DivS64x64Remainder (DayRemainder, SECSPERMIN, &Remainder);
- GmTime->tm_sec = (int)Remainder;
- DivS64x64Remainder (DayRemainder, SECSPERHOUR, &Remainder);
- GmTime->tm_min = (int)DivS64x64Remainder (Remainder, SECSPERMIN, NULL);
- GmTime->tm_hour = (int)DivS64x64Remainder (DayRemainder, SECSPERHOUR, NULL);
- DivS64x64Remainder ((DayNo + 4), 7, &Remainder);
- GmTime->tm_wday = (int)Remainder;
-
- for (Year = 1970, YearNo = 0; DayNo > 0; Year++) {
- TotalDays = (UINT32)(IsLeap (Year) ? 366 : 365);
- if (DayNo >= TotalDays) {
- DayNo = (UINT64)(DayNo - TotalDays);
- YearNo++;
- } else {
- break;
- }
- }
-
- GmTime->tm_year = (int)(YearNo + (1970 - 1900));
- GmTime->tm_yday = (int)DayNo;
-
- for (MonthNo = 12; MonthNo > 1; MonthNo--) {
- if (DayNo >= CumulativeDays[IsLeap (Year)][MonthNo]) {
- DayNo = (UINT64)(DayNo - (UINT32)(CumulativeDays[IsLeap (Year)][MonthNo]));
- break;
- }
- }
-
- GmTime->tm_mon = (int)MonthNo - 1;
- GmTime->tm_mday = (int)DayNo + 1;
-
- GmTime->tm_isdst = 0;
- GmTime->tm_gmtoff = 0;
- GmTime->tm_zone = NULL;
-
- return GmTime;
-}
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/UnitTestHostCrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/UnitTestHostCrtWrapper.c
deleted file mode 100644
index 244e57437e..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/UnitTestHostCrtWrapper.c
+++ /dev/null
@@ -1,107 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Wrapper Implementation for OpenSSL-based
- Cryptographic Library.
-
-Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
-Copyright (c) Microsoft Corporation
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-
-#include
-#include
-
-/* Convert character to lowercase */
-int
-tolower (
- int c
- )
-{
- if (('A' <= (c)) && ((c) <= 'Z')) {
- return (c - ('A' - 'a'));
- }
-
- return (c);
-}
-
-/* Compare first n bytes of string s1 with string s2, ignoring case */
-int
-strncasecmp (
- const char *s1,
- const char *s2,
- size_t n
- )
-{
- int Val;
-
- ASSERT (s1 != NULL);
- ASSERT (s2 != NULL);
-
- if (n != 0) {
- do {
- Val = tolower (*s1) - tolower (*s2);
- if (Val != 0) {
- return Val;
- }
-
- ++s1;
- ++s2;
- if (*s1 == '\0') {
- break;
- }
- } while (--n != 0);
- }
-
- return 0;
-}
-
-/* Read formatted data from a string */
-int
-sscanf (
- const char *buffer,
- const char *format,
- ...
- )
-{
- //
- // Null sscanf() function implementation to satisfy the linker, since
- // no direct functionality logic dependency in present UEFI cases.
- //
- return 0;
-}
-
-uid_t
-getuid (
- void
- )
-{
- return 0;
-}
-
-uid_t
-geteuid (
- void
- )
-{
- return 0;
-}
-
-gid_t
-getgid (
- void
- )
-{
- return 0;
-}
-
-gid_t
-getegid (
- void
- )
-{
- return 0;
-}
-
-int errno = 0;
diff --git a/CryptoPkg/Library/BaseCryptLib/UnitTestHostBaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/UnitTestHostBaseCryptLib.inf
deleted file mode 100644
index c3d1d61e59..0000000000
--- a/CryptoPkg/Library/BaseCryptLib/UnitTestHostBaseCryptLib.inf
+++ /dev/null
@@ -1,84 +0,0 @@
-## @file
-# Cryptographic Library Instance for host based unit tests
-#
-# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.
-# Copyright (c) Microsoft Corporation.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = BaseCryptLib
- FILE_GUID = c97d34aa-caf8-42cd-8261-8705f46304b3
- MODULE_TYPE = DXE_DRIVER
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|HOST_APPLICATION
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSha512.c
- Hash/CryptSm3.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcm.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExt.c
- Pk/CryptPkcs1Oaep.c
- Pk/CryptPkcs5Pbkdf2.c
- Pk/CryptPkcs7Sign.c
- Pk/CryptPkcs7VerifyCommon.c
- Pk/CryptPkcs7VerifyBase.c
- Pk/CryptPkcs7VerifyEku.c
- Pk/CryptDh.c
- Pk/CryptX509.c
- Pk/CryptAuthenticode.c
- Pk/CryptTs.c
- Pem/CryptPem.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSign.c
- Bn/CryptBn.c
- Pk/CryptEc.c
-
- SysCall/UnitTestHostCrtWrapper.c
-
-[Sources.Ia32]
- Rand/CryptRandTsc.c
-
-[Sources.X64]
- Rand/CryptRandTsc.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- DebugLib
- OpensslLib
- PrintLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
- GCC:*_CLANGDWARF_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLibMbedTls/BaseCryptLib.inf
deleted file mode 100644
index 16def792c5..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/BaseCryptLib.inf
+++ /dev/null
@@ -1,81 +0,0 @@
-## @file
-# Cryptographic Library Instance for DXE_DRIVER.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = BaseCryptLib
- FILE_GUID = 693C5308-AF95-4CE5-ADE9-CA011C2FC642
- MODULE_TYPE = DXE_DRIVER
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|DXE_DRIVER DXE_CORE UEFI_APPLICATION UEFI_DRIVER
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Cipher/CryptAeadAesGcmNull.c
- Cipher/CryptAes.c
- Hash/CryptSha256.c
- Hash/CryptSha512.c
- Hash/CryptParallelHashNull.c
- Hash/CryptSm3Null.c
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSignNull.c
- Bn/CryptBnNull.c
- Pem/CryptPemNull.c
- Pk/CryptDhNull.c
- Pk/CryptEcNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Rand/CryptRandNull.c
- SysCall/CrtWrapper.c
- SysCall/TimerWrapper.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- UefiRuntimeServicesTableLib
- DebugLib
- MbedTlsLib
- PrintLib
- IntrinsicLib
- RngLib
- SynchronizationLib
-[Protocols]
- gEfiMpServiceProtocolGuid
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- MSFT:*_*_*_CC_FLAGS = /GL-
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Bn/CryptBnNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Bn/CryptBnNull.c
deleted file mode 100644
index 80f36dc71f..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Bn/CryptBnNull.c
+++ /dev/null
@@ -1,520 +0,0 @@
-/** @file
- Big number API implementation based on MbedTLS
-
- Copyright (c) 2023, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-/**
- Allocate new Big Number.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumInit (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Allocate new Big Number and assign the provided value to it.
-
- @param[in] Buf Big endian encoded buffer.
- @param[in] Len Buffer length.
-
- @retval New BigNum opaque structure or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumFromBin (
- IN CONST UINT8 *Buf,
- IN UINTN Len
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Convert the absolute value of Bn into big-endian form and store it at Buf.
- The Buf array should have at least BigNumBytes() in it.
-
- @param[in] Bn Big number to convert.
- @param[out] Buf Output buffer.
-
- @retval The length of the big-endian number placed at Buf or -1 on error.
-**/
-INTN
-EFIAPI
-BigNumToBin (
- IN CONST VOID *Bn,
- OUT UINT8 *Buf
- )
-{
- ASSERT (FALSE);
- return -1;
-}
-
-/**
- Free the Big Number.
-
- @param[in] Bn Big number to free.
- @param[in] Clear TRUE if the buffer should be cleared.
-**/
-VOID
-EFIAPI
-BigNumFree (
- IN VOID *Bn,
- IN BOOLEAN Clear
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Calculate the sum of two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA + BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumAdd (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Subtract two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA - BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSub (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Calculate remainder: BnRes = BnA % BnB.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA % BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compute BnA to the BnP-th power modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnP Big number (power).
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result of (BnA ^ BnP) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumExpMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnP,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compute BnA inverse modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumInverseMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Divide two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result, such that BnA / BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumDiv (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Multiply two Big Numbers modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumMulMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compare two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
-
- @retval 0 BnA == BnB.
- @retval 1 BnA > BnB.
- @retval -1 BnA < BnB.
-**/
-INTN
-EFIAPI
-BigNumCmp (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Get number of bits in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bits.
-**/
-UINTN
-EFIAPI
-BigNumBits (
- IN CONST VOID *Bn
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Get number of bytes in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bytes.
-**/
-UINTN
-EFIAPI
-BigNumBytes (
- IN CONST VOID *Bn
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Checks if Big Number equals to the given Num.
-
- @param[in] Bn Big number.
- @param[in] Num Number.
-
- @retval TRUE iff Bn == Num.
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumIsWord (
- IN CONST VOID *Bn,
- IN UINTN Num
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Checks if Big Number is odd.
-
- @param[in] Bn Big number.
-
- @retval TRUE Bn is odd (Bn % 2 == 1).
- @retval FALSE otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumIsOdd (
- IN CONST VOID *Bn
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Copy Big number.
-
- @param[out] BnDst Destination.
- @param[in] BnSrc Source.
-
- @retval BnDst on success.
- @retval NULL otherwise.
-**/
-VOID *
-EFIAPI
-BigNumCopy (
- OUT VOID *BnDst,
- IN CONST VOID *BnSrc
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Get constant Big number with value of "1".
- This may be used to save expensive allocations.
-
- @retval Big Number with value of 1.
-**/
-CONST VOID *
-EFIAPI
-BigNumValueOne (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Shift right Big Number.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] Bn Big number.
- @param[in] N Number of bits to shift.
- @param[out] BnRes The result.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumRShift (
- IN CONST VOID *Bn,
- IN UINTN N,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Mark Big Number for constant time computations.
- This function should be called before any constant time computations are
- performed on the given Big number.
-
- @param[in] Bn Big number
-**/
-VOID
-EFIAPI
-BigNumConstTime (
- IN VOID *Bn
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Calculate square modulo.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSqrMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Create new Big Number computation context. This is an opaque structure
- which should be passed to any function that requires it. The BN context is
- needed to optimize calculations and expensive allocations.
-
- @retval Big Number context struct or NULL on failure.
-**/
-VOID *
-EFIAPI
-BigNumNewContext (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Free Big Number context that was allocated with BigNumNewContext().
-
- @param[in] BnCtx Big number context to free.
-**/
-VOID
-EFIAPI
-BigNumContextFree (
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Set Big Number to a given value.
-
- @param[in] Bn Big number to set.
- @param[in] Val Value to set.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumSetUint (
- IN VOID *Bn,
- IN UINTN Val
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Add two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA + BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-BigNumAddMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAeadAesGcmNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAeadAesGcmNull.c
deleted file mode 100644
index 9a8f81c169..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAeadAesGcmNull.c
+++ /dev/null
@@ -1,100 +0,0 @@
-/** @file
- AEAD Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be encrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the encryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AeadAesGcmEncrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- OUT UINT8 *TagOut,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
- If additional authenticated data verification fails, FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be decrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[in] Tag Pointer to a buffer that contains the authentication tag.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the decryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated decryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AeadAesGcmDecrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- IN CONST UINT8 *Tag,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAes.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAes.c
deleted file mode 100644
index 274d2fa471..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAes.c
+++ /dev/null
@@ -1,225 +0,0 @@
-/** @file
- AES Wrapper Implementation over MbedTLS.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- @return The size, in bytes, of the context buffer required for AES operations.
-
-**/
-UINTN
-EFIAPI
-AesGetContextSize (
- VOID
- )
-{
- //
- // AES uses different key contexts for encryption and decryption, so here memory
- // for 2 copies of mbedtls_aes_context is allocated.
- //
- return (UINTN)(2 * sizeof (mbedtls_aes_context));
-}
-
-/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- This function initializes user-supplied memory pointed by AesContext as AES context.
- In addition, it sets up all AES key materials for subsequent encryption and decryption
- operations.
- There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
-
- If AesContext is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeyLength is not valid, then return FALSE.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval TRUE AES context initialization succeeded.
- @retval FALSE AES context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-AesInit (
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
- )
-{
- mbedtls_aes_context *AesCtx;
-
- //
- // Check input parameters.
- //
- if ((AesContext == NULL) || (Key == NULL) || ((KeyLength != 128) && (KeyLength != 192) && (KeyLength != 256))) {
- return FALSE;
- }
-
- //
- // Initialize AES encryption & decryption key schedule.
- //
- AesCtx = (mbedtls_aes_context *)AesContext;
- if (mbedtls_aes_setkey_enc (AesCtx, Key, (UINT32)KeyLength) != 0) {
- return FALSE;
- }
-
- if (mbedtls_aes_setkey_dec (AesCtx + 1, Key, (UINT32)KeyLength) != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES encryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES encryption succeeded.
- @retval FALSE AES encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- mbedtls_aes_context *AesCtx;
- UINT8 IvecBuffer[AES_BLOCK_SIZE];
-
- //
- // Check input parameters.
- //
- if ((AesContext == NULL) || (Input == NULL) || ((InputSize % AES_BLOCK_SIZE) != 0)) {
- return FALSE;
- }
-
- if ((Ivec == NULL) || (Output == NULL) || (InputSize > INT_MAX)) {
- return FALSE;
- }
-
- AesCtx = (mbedtls_aes_context *)AesContext;
- CopyMem (IvecBuffer, Ivec, AES_BLOCK_SIZE);
-
- //
- // Perform AES data encryption with CBC mode
- //
- if (mbedtls_aes_crypt_cbc (
- AesCtx,
- MBEDTLS_AES_ENCRYPT,
- (UINT32)InputSize,
- IvecBuffer,
- Input,
- Output
- ) != 0)
- {
- return FALSE;
- } else {
- return TRUE;
- }
-}
-
-/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES decryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES decryption succeeded.
- @retval FALSE AES decryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- mbedtls_aes_context *AesCtx;
- UINT8 IvecBuffer[AES_BLOCK_SIZE];
-
- //
- // Check input parameters.
- //
- if ((AesContext == NULL) || (Input == NULL) || ((InputSize % AES_BLOCK_SIZE) != 0)) {
- return FALSE;
- }
-
- if ((Ivec == NULL) || (Output == NULL) || (InputSize > INT_MAX)) {
- return FALSE;
- }
-
- AesCtx = (mbedtls_aes_context *)AesContext;
- CopyMem (IvecBuffer, Ivec, AES_BLOCK_SIZE);
-
- //
- // Perform AES data encryption with CBC mode
- //
- if (mbedtls_aes_crypt_cbc (
- AesCtx + 1,
- MBEDTLS_AES_DECRYPT,
- (UINT32)InputSize,
- IvecBuffer,
- Input,
- Output
- ) != 0)
- {
- return FALSE;
- } else {
- return TRUE;
- }
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAesNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAesNull.c
deleted file mode 100644
index ad93d56492..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAesNull.c
+++ /dev/null
@@ -1,159 +0,0 @@
-/** @file
- AES Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- Return zero to indicate this interface is not supported.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-AesGetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesInit (
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AES encryption on a data buffer of the specified size in ECB mode.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesEcbEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AES decryption on a data buffer of the specified size in ECB mode.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be decrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[out] Output Pointer to a buffer that receives the AES decryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesEcbDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- OUT UINT8 *Output
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AesCbcDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c
deleted file mode 100644
index f9590f59a0..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c
+++ /dev/null
@@ -1,225 +0,0 @@
-/** @file
- MD5 Digest Wrapper Implementation over MbedTLS.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-#ifdef ENABLE_MD5_DEPRECATED_INTERFACES
-
-/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
-
-**/
-UINTN
-EFIAPI
-Md5GetContextSize (
- VOID
- )
-{
- //
- // Retrieves the MD5 Context Size
- //
- return (UINTN)(sizeof (mbedtls_md5_context));
-}
-
-/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Init (
- OUT VOID *Md5Context
- )
-{
- INT32 Ret;
-
- if (Md5Context == NULL) {
- return FALSE;
- }
-
- mbedtls_md5_init (Md5Context);
-
- Ret = mbedtls_md5_starts (Md5Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
- )
-{
- if ((Md5Context == NULL) || (NewMd5Context == NULL)) {
- return FALSE;
- }
-
- mbedtls_md5_clone (NewMd5Context, Md5Context);
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly initialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Update (
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- INT32 Ret;
-
- if (Md5Context == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_md5_update (Md5Context, Data, DataSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly initialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if ((Md5Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- Ret = mbedtls_md5_finish (Md5Context, HashValue);
- mbedtls_md5_free (Md5Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the MD5 message digest of a input data buffer.
-
- This function performs the MD5 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Md5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_md5 (Data, DataSize, HashValue);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5Null.c
deleted file mode 100644
index 4048cc7718..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5Null.c
+++ /dev/null
@@ -1,163 +0,0 @@
-/** @file
-
-MD5 Digest Wrapper Null Implementation.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
-
-**/
-UINTN
-EFIAPI
-Md5GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Init (
- OUT VOID *Md5Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly intialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Update (
- IN OUT VOID *Md5Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
- be used again.
- MD5 context should be already correctly intialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Md5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
-Computes the MD5 message digest of a input data buffer.
-
-This function performs the MD5 message digest of a given data buffer, and places
-the digest value into the specified memory.
-
-If this interface is not supported, then return FALSE.
-
-@param[in] Data Pointer to the buffer containing the data to be hashed.
-@param[in] DataSize Size of Data buffer in bytes.
-@param[out] HashValue Pointer to a buffer that receives the MD5 digest
-value (16 bytes).
-
-@retval TRUE MD5 digest computation succeeded.
-@retval FALSE MD5 digest computation failed.
-@retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Md5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptParallelHashNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptParallelHashNull.c
deleted file mode 100644
index 334c251bda..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptParallelHashNull.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/** @file
- ParallelHash Implementation which does not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
- published December 2016.
-
- @param[in] Input Pointer to the input message (X).
- @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
- @param[in] BlockSize The size of each block (B).
- @param[out] Output Pointer to the output buffer.
- @param[in] OutputByteLen The desired number of output bytes (L).
- @param[in] Customization Pointer to the customization string (S).
- @param[in] CustomByteLen The length of the customization string in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-ParallelHash256HashAll (
- IN CONST VOID *Input,
- IN UINTN InputByteLen,
- IN UINTN BlockSize,
- OUT VOID *Output,
- IN UINTN OutputByteLen,
- IN CONST VOID *Customization,
- IN UINTN CustomByteLen
- )
-{
- // ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c
deleted file mode 100644
index 718608faec..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c
+++ /dev/null
@@ -1,225 +0,0 @@
-/** @file
- SHA-1 Digest Wrapper Implementation over MbedTLS.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha1GetContextSize (
- VOID
- )
-{
- //
- // Retrieves MbedTLS SHA Context Size
- //
- return (UINTN)(sizeof (mbedtls_sha1_context));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Init (
- OUT VOID *Sha1Context
- )
-{
- INT32 Ret;
-
- if (Sha1Context == NULL) {
- return FALSE;
- }
-
- mbedtls_sha1_init (Sha1Context);
-
- Ret = mbedtls_sha1_starts (Sha1Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
- )
-{
- if ((Sha1Context == NULL) || (NewSha1Context == NULL)) {
- return FALSE;
- }
-
- mbedtls_sha1_clone (NewSha1Context, Sha1Context);
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Update (
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- INT32 Ret;
-
- if (Sha1Context == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha1_update (Sha1Context, Data, DataSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if ((Sha1Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha1_finish (Sha1Context, HashValue);
- mbedtls_sha1_free (Sha1Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha1 (Data, DataSize, HashValue);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1Null.c
deleted file mode 100644
index a590261747..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1Null.c
+++ /dev/null
@@ -1,166 +0,0 @@
-/** @file
- SHA-1 Digest Wrapper Null Implementation.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha1GetContextSize (
- VOID
- )
-{
- //
- // Retrieves SHA Context Size
- //
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Init (
- OUT VOID *Sha1Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
- )
-{
- ASSERT (FALSE);
-
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Update (
- IN OUT VOID *Sha1Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
- be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c
deleted file mode 100644
index b0356732cf..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c
+++ /dev/null
@@ -1,218 +0,0 @@
-/** @file
- SHA-256 Digest Wrapper Implementation over MbedTLS.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha256GetContextSize (
- VOID
- )
-{
- return (UINTN)(sizeof (mbedtls_sha256_context));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Init (
- OUT VOID *Sha256Context
- )
-{
- INT32 Ret;
-
- if (Sha256Context == NULL) {
- return FALSE;
- }
-
- mbedtls_sha256_init (Sha256Context);
-
- Ret = mbedtls_sha256_starts (Sha256Context, FALSE);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Duplicate (
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
- )
-{
- if ((Sha256Context == NULL) || (NewSha256Context == NULL)) {
- return FALSE;
- }
-
- mbedtls_sha256_clone (NewSha256Context, Sha256Context);
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Update (
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- INT32 Ret;
-
- if (Sha256Context == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha256_update (Sha256Context, Data, DataSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Final (
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if ((Sha256Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha256_finish (Sha256Context, HashValue);
- mbedtls_sha256_free (Sha256Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha256 (Data, DataSize, HashValue, FALSE);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256Null.c
deleted file mode 100644
index 6d284516b5..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256Null.c
+++ /dev/null
@@ -1,162 +0,0 @@
-/** @file
- SHA-256 Digest Wrapper Null Implementation.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha256GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Init (
- OUT VOID *Sha256Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Duplicate (
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Update (
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256Final (
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c
deleted file mode 100644
index 3342a1f8fe..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c
+++ /dev/null
@@ -1,430 +0,0 @@
-/** @file
- SHA-384 and SHA-512 Digest Wrapper Implementations over MbedTLS.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha384GetContextSize (
- VOID
- )
-{
- return (UINTN)(sizeof (mbedtls_sha512_context));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval TRUE SHA-384 context initialization succeeded.
- @retval FALSE SHA-384 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Init (
- OUT VOID *Sha384Context
- )
-{
- INT32 Ret;
-
- if (Sha384Context == NULL) {
- return FALSE;
- }
-
- mbedtls_sha512_init (Sha384Context);
-
- Ret = mbedtls_sha512_starts (Sha384Context, TRUE);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Makes a copy of an existing SHA-384 context.
-
- If Sha384Context is NULL, then return FALSE.
- If NewSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval TRUE SHA-384 context copy succeeded.
- @retval FALSE SHA-384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Duplicate (
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
- )
-{
- if ((Sha384Context == NULL) || (NewSha384Context == NULL)) {
- return FALSE;
- }
-
- mbedtls_sha512_clone (NewSha384Context, Sha384Context);
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-384 context.
-
- This function performs SHA-384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
- by Sha384Final(). Behavior with invalid context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-384 data digest succeeded.
- @retval FALSE SHA-384 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Update (
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- INT32 Ret;
-
- if (Sha384Context == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha512_update (Sha384Context, Data, DataSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the SHA-384 digest value.
-
- This function completes SHA-384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-384 context cannot
- be used again.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
- finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Final (
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if ((Sha384Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha512_finish (Sha384Context, HashValue);
- mbedtls_sha512_free (Sha384Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the SHA-384 message digest of a input data buffer.
-
- This function performs the SHA-384 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha512 (Data, DataSize, HashValue, TRUE);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sha512GetContextSize (
- VOID
- )
-{
- return (UINTN)(sizeof (mbedtls_sha512_context));
-}
-
-/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval TRUE SHA-512 context initialization succeeded.
- @retval FALSE SHA-512 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Init (
- OUT VOID *Sha512Context
- )
-{
- INT32 Ret;
-
- if (Sha512Context == NULL) {
- return FALSE;
- }
-
- mbedtls_sha512_init (Sha512Context);
-
- Ret = mbedtls_sha512_starts (Sha512Context, FALSE);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Makes a copy of an existing SHA-512 context.
-
- If Sha512Context is NULL, then return FALSE.
- If NewSha512Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval TRUE SHA-512 context copy succeeded.
- @retval FALSE SHA-512 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Duplicate (
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
- )
-{
- if ((Sha512Context == NULL) || (NewSha512Context == NULL)) {
- return FALSE;
- }
-
- mbedtls_sha512_clone (NewSha512Context, Sha512Context);
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates SHA-512 context.
-
- This function performs SHA-512 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
- by Sha512Final(). Behavior with invalid context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-512 data digest succeeded.
- @retval FALSE SHA-512 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Update (
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- INT32 Ret;
-
- if (Sha512Context == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha512_update (Sha512Context, Data, DataSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the SHA-512 digest value.
-
- This function completes SHA-512 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-512 context cannot
- be used again.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
- finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Final (
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if ((Sha512Context == NULL) || (HashValue == NULL)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha512_finish (Sha512Context, HashValue);
- mbedtls_sha512_free (Sha512Context);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the SHA-512 message digest of a input data buffer.
-
- This function performs the SHA-512 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- INT32 Ret;
-
- if (HashValue == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- Ret = mbedtls_sha512 (Data, DataSize, HashValue, FALSE);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512Null.c
deleted file mode 100644
index 47e2433d11..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512Null.c
+++ /dev/null
@@ -1,275 +0,0 @@
-/** @file
- SHA-384 and SHA-512 Digest Wrapper Implementations which does not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
-
- Return zero to indicate this interface is not supported.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-Sha384GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Init (
- OUT VOID *Sha384Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-384 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Duplicate (
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-384 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Update (
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-384 digest value.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384Final (
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-384 message digest of a input data buffer.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha384HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- Return zero to indicate this interface is not supported.
-
- @retval 0 This interface is not supported.
-
-**/
-UINTN
-EFIAPI
-Sha512GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Init (
- OUT VOID *Sha512Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SHA-512 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Duplicate (
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SHA-512 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Update (
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SHA-512 digest value.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512Final (
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SHA-512 message digest of a input data buffer.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sha512HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSm3Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSm3Null.c
deleted file mode 100644
index de5be1a3ef..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSm3Null.c
+++ /dev/null
@@ -1,164 +0,0 @@
-/** @file
- SM3 Digest Wrapper Null Implementation.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
-
- @return The size, in bytes, of the context buffer required for SM3 hash operations.
-
-**/
-UINTN
-EFIAPI
-Sm3GetContextSize (
- VOID
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**
- Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
- subsequent use.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[out] Sm3Context Pointer to SM3 context being initialized.
-
- @retval TRUE SM3 context initialization succeeded.
- @retval FALSE SM3 context initialization failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Init (
- OUT VOID *Sm3Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing SM3 context.
-
- If Sm3Context is NULL, then return FALSE.
- If NewSm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sm3Context Pointer to SM3 context being copied.
- @param[out] NewSm3Context Pointer to new SM3 context.
-
- @retval TRUE SM3 context copy succeeded.
- @retval FALSE SM3 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Duplicate (
- IN CONST VOID *Sm3Context,
- OUT VOID *NewSm3Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates SM3 context.
-
- This function performs SM3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
- by Sm3Final(). Behavior with invalid context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SM3 data digest succeeded.
- @retval FALSE SM3 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Update (
- IN OUT VOID *Sm3Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the SM3 digest value.
-
- This function completes SM3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SM3 context cannot
- be used again.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be
- finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3Final (
- IN OUT VOID *Sm3Context,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the SM3 message digest of a input data buffer.
-
- This function performs the SM3 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Sm3HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmac.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmac.c
deleted file mode 100644
index c4cda57b4d..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmac.c
+++ /dev/null
@@ -1,678 +0,0 @@
-/** @file
- HMAC-SHA256 Wrapper Implementation over MbedTLS.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacShaMdNew() returns NULL.
-
-**/
-STATIC
-VOID *
-HmacMdNew (
- VOID
- )
-{
- VOID *HmacMdCtx;
-
- HmacMdCtx = AllocateZeroPool (sizeof (mbedtls_md_context_t));
- if (HmacMdCtx == NULL) {
- return NULL;
- }
-
- return HmacMdCtx;
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacMdCtx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-HmacMdFree (
- IN VOID *HmacMdCtx
- )
-{
- mbedtls_md_free (HmacMdCtx);
- if (HmacMdCtx != NULL) {
- FreePool (HmacMdCtx);
- }
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacMdUpdate().
-
- If HmacMdContext is NULL, then return FALSE.
-
- @param[in] MdType Message Digest Type.
- @param[out] HmacMdContext Pointer to HMAC-MD context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
-
-**/
-STATIC
-BOOLEAN
-HmacMdSetKey (
- IN mbedtls_md_type_t MdType,
- OUT VOID *HmacMdContext,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- const mbedtls_md_info_t *md_info;
- INT32 Ret;
-
- if ((HmacMdContext == NULL) || (KeySize > INT_MAX)) {
- return FALSE;
- }
-
- ZeroMem (HmacMdContext, sizeof (mbedtls_md_context_t));
- mbedtls_md_init (HmacMdContext);
-
- md_info = mbedtls_md_info_from_type (MdType);
- ASSERT (md_info != NULL);
-
- Ret = mbedtls_md_setup (HmacMdContext, md_info, 1);
- if (Ret != 0) {
- return FALSE;
- }
-
- Ret = mbedtls_md_hmac_starts (HmacMdContext, Key, KeySize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Return block size in md_type.
-
- @param[in] MdType message digest Type.
-
- @retval blocksize in md_type.
-
-**/
-int
-HmacMdGetBlockSize (
- mbedtls_md_type_t MdType
- )
-{
- switch (MdType) {
- case MBEDTLS_MD_SHA256:
- return 64;
- case MBEDTLS_MD_SHA384:
- return 128;
- default:
- ASSERT (FALSE);
- return 0;
- }
-}
-
-/**
- Makes a copy of an existing HMAC-MD context.
-
- If HmacMdContext is NULL, then return FALSE.
- If NewHmacMdContext is NULL, then return FALSE.
-
- @param[in] MdType message digest Type.
- @param[in] HmacMdContext Pointer to HMAC-MD context being copied.
- @param[out] NewHmacMdContext Pointer to new HMAC-MD context.
-
- @retval TRUE HMAC-MD context copy succeeded.
- @retval FALSE HMAC-MD context copy failed.
-
-**/
-STATIC
-BOOLEAN
-HmacMdDuplicate (
- IN CONST mbedtls_md_type_t MdType,
- IN CONST VOID *HmacMdContext,
- OUT VOID *NewHmacMdContext
- )
-{
- INT32 Ret;
- CONST mbedtls_md_info_t *md_info;
- mbedtls_md_context_t *MdContext;
-
- if ((HmacMdContext == NULL) || (NewHmacMdContext == NULL)) {
- return FALSE;
- }
-
- ZeroMem (NewHmacMdContext, sizeof (mbedtls_md_context_t));
- mbedtls_md_init (NewHmacMdContext);
- md_info = mbedtls_md_info_from_type (MdType);
- ASSERT (md_info != NULL);
-
- Ret = mbedtls_md_setup (NewHmacMdContext, md_info, 1);
- if (Ret != 0) {
- return FALSE;
- }
-
- MdContext = (mbedtls_md_context_t *)NewHmacMdContext;
-
- Ret = mbedtls_md_clone (NewHmacMdContext, HmacMdContext);
- if (Ret != 0) {
- if (MdContext->md_ctx != NULL) {
- mbedtls_free (MdContext->md_ctx);
- }
-
- if (MdContext->hmac_ctx != NULL) {
- mbedtls_free (MdContext->hmac_ctx);
- }
-
- return FALSE;
- }
-
- CopyMem (
- ((mbedtls_md_context_t *)NewHmacMdContext)->hmac_ctx,
- ((CONST mbedtls_md_context_t *)HmacMdContext)->hmac_ctx,
- HmacMdGetBlockSize (MdType) * 2
- );
-
- return TRUE;
-}
-
-/**
- Digests the input data and updates HMAC-MD context.
-
- This function performs HMAC-MD digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-MD context should be initialized by HmacMdNew(), and should not be finalized
- by HmacMdFinal(). Behavior with invalid context is undefined.
-
- If HmacMdContext is NULL, then return FALSE.
-
- @param[in, out] HmacMdContext Pointer to the HMAC-MD context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-MD data digest succeeded.
- @retval FALSE HMAC-MD data digest failed.
-
-**/
-STATIC
-BOOLEAN
-HmacMdUpdate (
- IN OUT VOID *HmacMdContext,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- INT32 Ret;
-
- if (HmacMdContext == NULL) {
- return FALSE;
- }
-
- if ((Data == NULL) && (DataSize != 0)) {
- return FALSE;
- }
-
- if (DataSize > INT_MAX) {
- return FALSE;
- }
-
- Ret = mbedtls_md_hmac_update (HmacMdContext, Data, DataSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Completes computation of the HMAC-MD digest value.
-
- This function completes HMAC-MD hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-MD context cannot
- be used again.
- HMAC-MD context should be initialized by HmacMdNew(), and should not be finalized
- by HmacMdFinal(). Behavior with invalid HMAC-MD context is undefined.
-
- If HmacMdContext is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
-
- @param[in, out] HmacMdContext Pointer to the HMAC-MD context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-MD digest
- value.
-
- @retval TRUE HMAC-MD digest computation succeeded.
- @retval FALSE HMAC-MD digest computation failed.
-
-**/
-STATIC
-BOOLEAN
-HmacMdFinal (
- IN OUT VOID *HmacMdContext,
- OUT UINT8 *HmacValue
- )
-{
- INT32 Ret;
-
- if ((HmacMdContext == NULL) || (HmacValue == NULL)) {
- return FALSE;
- }
-
- Ret = mbedtls_md_hmac_finish (HmacMdContext, HmacValue);
- if (Ret != 0) {
- return FALSE;
- }
-
- Ret = mbedtls_md_hmac_reset (HmacMdContext);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Computes the HMAC-MD digest of a input data buffer.
-
- This function performs the HMAC-MD digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] MdType Message Digest Type.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-MD digest
- value.
-
- @retval TRUE HMAC-MD digest computation succeeded.
- @retval FALSE HMAC-MD digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-STATIC
-BOOLEAN
-HmacMdAll (
- IN mbedtls_md_type_t MdType,
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- const mbedtls_md_info_t *md_info;
- INT32 Ret;
-
- md_info = mbedtls_md_info_from_type (MdType);
- ASSERT (md_info != NULL);
-
- Ret = mbedtls_md_hmac (md_info, Key, KeySize, Data, DataSize, HmacValue);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha256New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha256New (
- VOID
- )
-{
- return HmacMdNew ();
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha256Free (
- IN VOID *HmacSha256Ctx
- )
-{
- HmacMdFree (HmacSha256Ctx);
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha256Update().
-
- If HmacSha256Context is NULL, then return FALSE.
-
- @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256SetKey (
- OUT VOID *HmacSha256Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return HmacMdSetKey (MBEDTLS_MD_SHA256, HmacSha256Context, Key, KeySize);
-}
-
-/**
- Makes a copy of an existing HMAC-SHA256 context.
-
- If HmacSha256Context is NULL, then return FALSE.
- If NewHmacSha256Context is NULL, then return FALSE.
-
- @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
- @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
- @retval TRUE HMAC-SHA256 context copy succeeded.
- @retval FALSE HMAC-SHA256 context copy failed.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Duplicate (
- IN CONST VOID *HmacSha256Context,
- OUT VOID *NewHmacSha256Context
- )
-{
- return HmacMdDuplicate (MBEDTLS_MD_SHA256, HmacSha256Context, NewHmacSha256Context);
-}
-
-/**
- Digests the input data and updates HMAC-SHA256 context.
-
- This function performs HMAC-SHA256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA256 data digest succeeded.
- @retval FALSE HMAC-SHA256 data digest failed.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Update (
- IN OUT VOID *HmacSha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return HmacMdUpdate (HmacSha256Context, Data, DataSize);
-}
-
-/**
- Completes computation of the HMAC-SHA256 digest value.
-
- This function completes HMAC-SHA256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA256 context cannot
- be used again.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid HMAC-SHA256 context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Final (
- IN OUT VOID *HmacSha256Context,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdFinal (HmacSha256Context, HmacValue);
-}
-
-/**
- Computes the HMAC-SHA256 digest of a input data buffer.
-
- This function performs the HMAC-SHA256 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdAll (MBEDTLS_MD_SHA256, Data, DataSize, Key, KeySize, HmacValue);
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha384New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha384New (
- VOID
- )
-{
- return HmacMdNew ();
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha384Free (
- IN VOID *HmacSha384Ctx
- )
-{
- HmacMdFree (HmacSha384Ctx);
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha384Update().
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384SetKey (
- OUT VOID *HmacSha384Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- return HmacMdSetKey (MBEDTLS_MD_SHA384, HmacSha384Context, Key, KeySize);
-}
-
-/**
- Makes a copy of an existing HMAC-SHA384 context.
-
- If HmacSha384Context is NULL, then return FALSE.
- If NewHmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
- @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
- @retval TRUE HMAC-SHA384 context copy succeeded.
- @retval FALSE HMAC-SHA384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Duplicate (
- IN CONST VOID *HmacSha384Context,
- OUT VOID *NewHmacSha384Context
- )
-{
- return HmacMdDuplicate (MBEDTLS_MD_SHA384, HmacSha384Context, NewHmacSha384Context);
-}
-
-/**
- Digests the input data and updates HMAC-SHA384 context.
-
- This function performs HMAC-SHA384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA384 data digest succeeded.
- @retval FALSE HMAC-SHA384 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Update (
- IN OUT VOID *HmacSha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- return HmacMdUpdate (HmacSha384Context, Data, DataSize);
-}
-
-/**
- Completes computation of the HMAC-SHA384 digest value.
-
- This function completes HMAC-SHA384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA384 context cannot
- be used again.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Final (
- IN OUT VOID *HmacSha384Context,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdFinal (HmacSha384Context, HmacValue);
-}
-
-/**
- Computes the HMAC-SHA384 digest of a input data buffer.
-
- This function performs the HMAC-SHA384 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- return HmacMdAll (MBEDTLS_MD_SHA384, Data, DataSize, Key, KeySize, HmacValue);
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmacNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmacNull.c
deleted file mode 100644
index 37bf3ea486..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmacNull.c
+++ /dev/null
@@ -1,359 +0,0 @@
-/** @file
- HMAC-SHA256/SHA384 Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
- Return NULL to indicate this interface is not supported.
-
- @return NULL This interface is not supported..
-
-**/
-VOID *
-EFIAPI
-HmacSha256New (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- This function will do nothing.
-
- @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha256Free (
- IN VOID *HmacSha256Ctx
- )
-{
- ASSERT (FALSE);
- return;
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha256Update().
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256SetKey (
- OUT VOID *HmacSha256Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing HMAC-SHA256 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
- @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Duplicate (
- IN CONST VOID *HmacSha256Context,
- OUT VOID *NewHmacSha256Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates HMAC-SHA256 context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Update (
- IN OUT VOID *HmacSha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the HMAC-SHA256 digest value.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256Final (
- IN OUT VOID *HmacSha256Context,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the HMAC-SHA256 digest of a input data buffer.
-
- This function performs the HMAC-SHA256 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha256All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha384New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha384New (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
-
-**/
-VOID
-EFIAPI
-HmacSha384Free (
- IN VOID *HmacSha384Ctx
- )
-{
- ASSERT (FALSE);
- return;
-}
-
-/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha384Update().
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384SetKey (
- OUT VOID *HmacSha384Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Makes a copy of an existing HMAC-SHA384 context.
-
- If HmacSha384Context is NULL, then return FALSE.
- If NewHmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
- @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
- @retval TRUE HMAC-SHA384 context copy succeeded.
- @retval FALSE HMAC-SHA384 context copy failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Duplicate (
- IN CONST VOID *HmacSha384Context,
- OUT VOID *NewHmacSha384Context
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Digests the input data and updates HMAC-SHA384 context.
-
- This function performs HMAC-SHA384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA384 data digest succeeded.
- @retval FALSE HMAC-SHA384 data digest failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Update (
- IN OUT VOID *HmacSha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Completes computation of the HMAC-SHA384 digest value.
-
- This function completes HMAC-SHA384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA384 context cannot
- be used again.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384Final (
- IN OUT VOID *HmacSha384Context,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes the HMAC-SHA384 digest of a input data buffer.
-
- This function performs the HMAC-SHA384 digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-HmacSha384All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/InternalCryptLib.h b/CryptoPkg/Library/BaseCryptLibMbedTls/InternalCryptLib.h
deleted file mode 100644
index 039aa32028..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/InternalCryptLib.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/** @file
- Internal include file for BaseCryptLib.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#ifndef INTERNAL_CRYPT_LIB_H_
-#define INTERNAL_CRYPT_LIB_H_
-
-#include
-#include
-#include
-#include
-#include
-#include
-
-//
-// We should alwasy add mbedtls/config.h here
-// to ensure the config override takes effect.
-//
-#include
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdf.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdf.c
deleted file mode 100644
index 5bc632deb9..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdf.c
+++ /dev/null
@@ -1,372 +0,0 @@
-/** @file
- HMAC-SHA256 KDF Wrapper Implementation over MbedTLS.
-
- RFC 5869: HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-
-/**
- Derive HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] MdType Message Digest Type.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-STATIC
-BOOLEAN
-HkdfMdExtractAndExpand (
- IN mbedtls_md_type_t MdType,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- const mbedtls_md_info_t *md;
- INT32 Ret;
-
- if ((Key == NULL) || (Salt == NULL) || (Info == NULL) || (Out == NULL) ||
- (KeySize > INT_MAX) || (SaltSize > INT_MAX) || (InfoSize > INT_MAX) || (OutSize > INT_MAX))
- {
- return FALSE;
- }
-
- md = mbedtls_md_info_from_type (MdType);
- ASSERT (md != NULL);
-
- Ret = mbedtls_hkdf (md, Salt, (UINT32)SaltSize, Key, (UINT32)KeySize, Info, (UINT32)InfoSize, Out, (UINT32)OutSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Derive HMAC-based Extract Key Derivation Function (HKDF).
-
- @param[in] MdType Message Digest Type.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-STATIC
-BOOLEAN
-HkdfMdExtract (
- IN mbedtls_md_type_t MdType,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- IN UINTN PrkOutSize
- )
-{
- const mbedtls_md_info_t *md;
- INT32 Ret;
- UINTN MdSize;
-
- if ((Key == NULL) || (Salt == NULL) || (PrkOut == NULL) ||
- (KeySize > INT_MAX) || (SaltSize > INT_MAX) || (PrkOutSize > INT_MAX))
- {
- return FALSE;
- }
-
- MdSize = 0;
- switch (MdType) {
- case MBEDTLS_MD_SHA256:
- MdSize = SHA256_DIGEST_SIZE;
- break;
- case MBEDTLS_MD_SHA384:
- MdSize = SHA384_DIGEST_SIZE;
- break;
- case MBEDTLS_MD_SHA512:
- MdSize = SHA512_DIGEST_SIZE;
- break;
- default:
- return FALSE;
- }
-
- if (PrkOutSize != MdSize) {
- return FALSE;
- }
-
- md = mbedtls_md_info_from_type (MdType);
- ASSERT (md != NULL);
-
- Ret = mbedtls_hkdf_extract (md, Salt, (UINT32)SaltSize, Key, (UINT32)KeySize, PrkOut);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Derive HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] MdType Message Digest Type.
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-STATIC
-BOOLEAN
-HkdfMdExpand (
- IN mbedtls_md_type_t MdType,
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- const mbedtls_md_info_t *md;
- INT32 Ret;
- UINTN MdSize;
-
- if ((Prk == NULL) || (Info == NULL) || (Out == NULL) ||
- (PrkSize > INT_MAX) || (InfoSize > INT_MAX) || (OutSize > INT_MAX))
- {
- return FALSE;
- }
-
- switch (MdType) {
- case MBEDTLS_MD_SHA256:
- MdSize = SHA256_DIGEST_SIZE;
- break;
- case MBEDTLS_MD_SHA384:
- MdSize = SHA384_DIGEST_SIZE;
- break;
- case MBEDTLS_MD_SHA512:
- MdSize = SHA512_DIGEST_SIZE;
- break;
- default:
- return FALSE;
- }
-
- if (PrkSize != MdSize) {
- return FALSE;
- }
-
- md = mbedtls_md_info_from_type (MdType);
- ASSERT (md != NULL);
-
- Ret = mbedtls_hkdf_expand (md, Prk, (UINT32)PrkSize, Info, (UINT32)InfoSize, Out, (UINT32)OutSize);
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
-
-/**
- Derive SHA256 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExtractAndExpand (MBEDTLS_MD_SHA256, Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize);
-}
-
-/**
- Derive SHA256 HMAC-based Extract Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- IN UINTN PrkOutSize
- )
-{
- return HkdfMdExtract (MBEDTLS_MD_SHA256, Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize);
-}
-
-/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExpand (MBEDTLS_MD_SHA256, Prk, PrkSize, Info, InfoSize, Out, OutSize);
-}
-
-/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExtractAndExpand (MBEDTLS_MD_SHA384, Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize);
-}
-
-/**
- Derive SHA384 HMAC-based Extract Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- IN UINTN PrkOutSize
- )
-{
- return HkdfMdExtract (MBEDTLS_MD_SHA384, Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize);
-}
-
-/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- return HkdfMdExpand (MBEDTLS_MD_SHA384, Prk, PrkSize, Info, InfoSize, Out, OutSize);
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdfNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdfNull.c
deleted file mode 100644
index 8ec29b314a..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdfNull.c
+++ /dev/null
@@ -1,192 +0,0 @@
-/** @file
- HMAC-SHA256 KDF Wrapper Implementation which does not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-/**
- Derive key data using HMAC-SHA256 based KDF.
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha256Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
-**/
-BOOLEAN
-EFIAPI
-HkdfSha384Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.inf
deleted file mode 100644
index 72b22a24e8..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.inf
+++ /dev/null
@@ -1,101 +0,0 @@
-## @file
-# Cryptographic Library Instance for PEIM.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Note:
-# HMAC-SHA256 functions, AES functions, RSA external
-# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509
-# certificate handler functions, authenticode signature verification functions,
-# PEM handler functions, and pseudorandom number generator functions are not
-# supported in this instance.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = PeiCryptLib
- MODULE_UNI_FILE = PeiCryptLib.uni
- FILE_GUID = 91E0A3C3-37A7-4AEE-8689-C5B0AD2C8E63
- MODULE_TYPE = PEIM
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|PEIM PEI_CORE
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSm3Null.c
- Hash/CryptSha512.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSignNull.c
- Bn/CryptBnNull.c
- Pem/CryptPemNull.c
- Pk/CryptDhNull.c
- Pk/CryptEcNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Rand/CryptRandNull.c
- SysCall/CrtWrapper.c
- SysCall/ConstantTimeClock.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- DebugLib
- MbedTlsLib
- IntrinsicLib
- PrintLib
- PeiServicesTablePointerLib
- PeiServicesLib
- SynchronizationLib
-
-[Ppis]
- gEfiPeiMpServicesPpiGuid
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- # C4090: 'function' : different 'const' qualifiers
- # C4718: 'function call' : recursive call has no side effects, deleting
- #
- MSFT:*_*_*_CC_FLAGS = /wd4090 /wd4718
-
- GCC:*_CLANG35_*_CC_FLAGS = -std=c99
- GCC:*_CLANG38_*_CC_FLAGS = -std=c99
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.uni b/CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.uni
deleted file mode 100644
index 3a6845642d..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.uni
+++ /dev/null
@@ -1,25 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for PEIM.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Note: AES
-// functions, RSA external functions, PKCS#7 SignedData sign functions,
-// Diffie-Hellman functions, X.509 certificate handler functions, authenticode
-// signature verification functions, PEM handler functions, and pseudorandom number
-// generator functions are not supported in this instance.
-//
-// Copyright (c) 2023, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for PEIM"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."
-
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pem/CryptPemNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pem/CryptPemNull.c
deleted file mode 100644
index b3adf2f7d1..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pem/CryptPemNull.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/** @file
- PEM (Privacy Enhanced Mail) Format Handler Wrapper Implementation which does
- not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Retrieve the RSA Private Key from the password-protected PEM key data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA private key component. Use RsaFree() function to free the
- resource.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **RsaContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the EC Private Key from the password-protected PEM key data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] EcContext Pointer to new-generated EC context which contain the retrieved
- EC private key component. Use EcFree() function to free the
- resource.
-
- If PemData is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **EcContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptAuthenticodeNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptAuthenticodeNull.c
deleted file mode 100644
index 9be5b4296e..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptAuthenticodeNull.c
+++ /dev/null
@@ -1,45 +0,0 @@
-/** @file
- Authenticode Portable Executable Signature Verification which does not provide
- real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
- Authenticode Portable Executable Signature Format".
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[in] ImageHash Pointer to the original image file hash value. The procedure
- for calculating the image hash value is described in Authenticode
- specification.
- @param[in] HashSize Size of Image hash value in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AuthenticodeVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertSize,
- IN CONST UINT8 *ImageHash,
- IN UINTN HashSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptDhNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptDhNull.c
deleted file mode 100644
index daaf818250..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptDhNull.c
+++ /dev/null
@@ -1,150 +0,0 @@
-/** @file
- Diffie-Hellman Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Allocates and Initializes one Diffie-Hellman Context for subsequent use.
-
- @return Pointer to the Diffie-Hellman Context that has been initialized.
- If the interface is not supported, DhNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-DhNew (
- VOID
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified DH context.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] DhContext Pointer to the DH context to be released.
-
-**/
-VOID
-EFIAPI
-DhFree (
- IN VOID *DhContext
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Generates DH parameter.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[out] Prime Pointer to the buffer to receive the generated prime number.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhGenerateParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- OUT UINT8 *Prime
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Sets generator and prime parameters for DH.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[in] Prime Pointer to the prime number.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhSetParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- IN CONST UINT8 *Prime
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Generates DH public key.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[out] PublicKey Pointer to the buffer to receive generated public key.
- @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
- On output, the size of data returned in PublicKey buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhGenerateKey (
- IN OUT VOID *DhContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes exchanged common key.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] PeerPublicKey Pointer to the peer's public key.
- @param[in] PeerPublicKeySize Size of peer's public key in bytes.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-DhComputeKey (
- IN OUT VOID *DhContext,
- IN CONST UINT8 *PeerPublicKey,
- IN UINTN PeerPublicKeySize,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptEcNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptEcNull.c
deleted file mode 100644
index b9c08379c0..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptEcNull.c
+++ /dev/null
@@ -1,578 +0,0 @@
-/** @file
- Elliptic Curve and ECDH API implementation based on MbedTLS
-
- Copyright (c) 2023, Intel Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-/**
- Initialize new opaque EcGroup object. This object represents an EC curve and
- and is used for calculation within this group. This object should be freed
- using EcGroupFree() function.
-
- @param[in] CryptoNid Identifying number for the ECC curve (Defined in
- BaseCryptLib.h).
-
- @retval EcGroup object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-EcGroupInit (
- IN UINTN CryptoNid
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Get EC curve parameters. While elliptic curve equation is Y^2 mod P = (X^3 + AX + B) Mod P.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnPrime Group prime number.
- @param[out] BnA A coefficient.
- @param[out] BnB B coefficient..
- @param[in] BnCtx BN context.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcGroupGetCurve (
- IN CONST VOID *EcGroup,
- OUT VOID *BnPrime,
- OUT VOID *BnA,
- OUT VOID *BnB,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Get EC group order.
- This function will set the provided Big Number object to the corresponding
- value. The caller needs to make sure that the "out" BigNumber parameter
- is properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[out] BnOrder Group prime number.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcGroupGetOrder (
- IN VOID *EcGroup,
- OUT VOID *BnOrder
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Free previously allocated EC group object using EcGroupInit().
-
- @param[in] EcGroup EC group object to free.
-**/
-VOID
-EFIAPI
-EcGroupFree (
- IN VOID *EcGroup
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Initialize new opaque EC Point object. This object represents an EC point
- within the given EC group (curve).
-
- @param[in] EC Group, properly initialized using EcGroupInit().
-
- @retval EC Point object On success.
- @retval NULL On failure.
-**/
-VOID *
-EFIAPI
-EcPointInit (
- IN CONST VOID *EcGroup
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Free previously allocated EC Point object using EcPointInit().
-
- @param[in] EcPoint EC Point to free.
- @param[in] Clear TRUE iff the memory should be cleared.
-**/
-VOID
-EFIAPI
-EcPointDeInit (
- IN VOID *EcPoint,
- IN BOOLEAN Clear
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Get EC point affine (x,y) coordinates.
- This function will set the provided Big Number objects to the corresponding
- values. The caller needs to make sure all the "out" BigNumber parameters
- are properly initialized.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[out] BnX X coordinate.
- @param[out] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointGetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- OUT VOID *BnX,
- OUT VOID *BnY,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Set EC point affine (x,y) coordinates.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point object.
- @param[in] BnX X coordinate.
- @param[in] BnY Y coordinate.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointSetAffineCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN CONST VOID *BnY,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- EC Point addition. EcPointResult = EcPointA + EcPointB.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPointA EC Point.
- @param[in] EcPointB EC Point.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointAdd (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar.
-
- @param[in] EcGroup EC group object.
- @param[out] EcPointResult EC point to hold the result. The point should
- be properly initialized.
- @param[in] EcPoint EC Point.
- @param[in] BnPScalar P Scalar.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointMul (
- IN CONST VOID *EcGroup,
- OUT VOID *EcPointResult,
- IN CONST VOID *EcPoint,
- IN CONST VOID *BnPScalar,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Calculate the inverse of the supplied EC point.
-
- @param[in] EcGroup EC group object.
- @param[in,out] EcPoint EC point to invert.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointInvert (
- IN CONST VOID *EcGroup,
- IN OUT VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Check if the supplied point is on EC curve.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On curve.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointIsOnCurve (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Check if the supplied point is at infinity.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC point to check.
-
- @retval TRUE At infinity.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointIsAtInfinity (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPoint
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Check if EC points are equal.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPointA EC point A.
- @param[in] EcPointB EC point B.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE A == B.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointEqual (
- IN CONST VOID *EcGroup,
- IN CONST VOID *EcPointA,
- IN CONST VOID *EcPointB,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Set EC point compressed coordinates. Points can be described in terms of
- their compressed coordinates. For a point (x, y), for any given value for x
- such that the point is on the curve there will only ever be two possible
- values for y. Therefore, a point can be set using this function where BnX is
- the x coordinate and YBit is a value 0 or 1 to identify which of the two
- possible values for y should be used.
-
- @param[in] EcGroup EC group object.
- @param[in] EcPoint EC Point.
- @param[in] BnX X coordinate.
- @param[in] YBit 0 or 1 to identify which Y value is used.
- @param[in] BnCtx BN context, created with BigNumNewContext().
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
-**/
-BOOLEAN
-EFIAPI
-EcPointSetCompressedCoordinates (
- IN CONST VOID *EcGroup,
- IN VOID *EcPoint,
- IN CONST VOID *BnX,
- IN UINT8 YBit,
- IN VOID *BnCtx
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Allocates and Initializes one Elliptic Curve Context for subsequent use
- with the NID.
-
- @param[in] Nid cipher NID
- @return Pointer to the Elliptic Curve Context that has been initialized.
- If the allocations fails, EcNewByNid() returns NULL.
-**/
-VOID *
-EFIAPI
-EcNewByNid (
- IN UINTN Nid
- )
-{
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified EC context.
-
- @param[in] EcContext Pointer to the EC context to be released.
-**/
-VOID
-EFIAPI
-EcFree (
- IN VOID *EcContext
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Generates EC key and returns EC public key (X, Y), Please note, this function uses
- pseudo random number generator. The caller must make sure RandomSeed()
- function was properly called before.
- The Ec context should be correctly initialized by EcNewByNid.
- This function generates random secret, and computes the public key (X, Y), which is
- returned via parameter Public, PublicSize.
- X is the first half of Public with size being PublicSize / 2,
- Y is the second half of Public with size being PublicSize / 2.
- EC context is updated accordingly.
- If the Public buffer is too small to hold the public X, Y, FALSE is returned and
- PublicSize is set to the required buffer size to obtain the public X, Y.
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- If EcContext is NULL, then return FALSE.
- If PublicSize is NULL, then return FALSE.
- If PublicSize is large enough but Public is NULL, then return FALSE.
- @param[in, out] EcContext Pointer to the EC context.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC public X,Y generation succeeded.
- @retval FALSE EC public X,Y generation failed.
- @retval FALSE PublicKeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-EcGenerateKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Gets the public key component from the established EC context.
- The Ec context should be correctly initialized by EcNewByNid, and successfully
- generate key pair from EcGenerateKey().
- For P-256, the PublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to EC context being set.
- @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
- @param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
- On output, the size of data returned in Public buffer in bytes.
- @retval TRUE EC key component was retrieved successfully.
- @retval FALSE Invalid EC key component.
-**/
-BOOLEAN
-EFIAPI
-EcGetPubKey (
- IN OUT VOID *EcContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Computes exchanged common key.
- Given peer's public key (X, Y), this function computes the exchanged common key,
- based on its own context including value of curve parameter and random secret.
- X is the first half of PeerPublic with size being PeerPublicSize / 2,
- Y is the second half of PeerPublic with size being PeerPublicSize / 2.
- If EcContext is NULL, then return FALSE.
- If PeerPublic is NULL, then return FALSE.
- If PeerPublicSize is 0, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- For P-256, the PeerPublicSize is 64. First 32-byte is X, Second 32-byte is Y.
- For P-384, the PeerPublicSize is 96. First 48-byte is X, Second 48-byte is Y.
- For P-521, the PeerPublicSize is 132. First 66-byte is X, Second 66-byte is Y.
- @param[in, out] EcContext Pointer to the EC context.
- @param[in] PeerPublic Pointer to the peer's public X,Y.
- @param[in] PeerPublicSize Size of peer's public X,Y in bytes.
- @param[in] CompressFlag Flag of PeerPublic is compressed or not.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
- @retval TRUE EC exchanged key generation succeeded.
- @retval FALSE EC exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
-**/
-BOOLEAN
-EFIAPI
-EcDhComputeKey (
- IN OUT VOID *EcContext,
- IN CONST UINT8 *PeerPublic,
- IN UINTN PeerPublicSize,
- IN CONST INT32 *CompressFlag,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Carries out the EC-DSA signature.
-
- This function carries out the EC-DSA signature.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
- If SigSize is large enough but Signature is NULL, then return FALSE.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature generation.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive EC-DSA signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in EC-DSA.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
-
-**/
-BOOLEAN
-EFIAPI
-EcDsaSign (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verifies the EC-DSA signature.
-
- If EcContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
-
- For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
- For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
- For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
- @param[in] EcContext Pointer to EC context for signature verification.
- @param[in] HashNid hash NID
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to EC-DSA signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in EC-DSA.
- @retval FALSE Invalid signature or invalid EC context.
-
-**/
-BOOLEAN
-EFIAPI
-EcDsaVerify (
- IN VOID *EcContext,
- IN UINTN HashNid,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs1OaepNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs1OaepNull.c
deleted file mode 100644
index ee49f4f4bf..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs1OaepNull.c
+++ /dev/null
@@ -1,178 +0,0 @@
-/** @file
- This file contains UEFI wrapper functions for RSA PKCS1v2 OAEP encryption routines.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
- Copyright (c) 2023, Intel Corporation. All rights reserved.
- Copyright (c) Microsoft Corporation. All rights reserved.
- SPDX-License-Identifier: BSD-2-Clause-Patent
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
- will be used to encrypt the data.
- @param[in] PublicKeySize Size of the X509 cert buffer.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Encrypt (
- IN CONST UINT8 *PublicKey,
- IN UINTN PublicKeySize,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a public key using RsaSetKey().
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-RsaOaepEncrypt (
- IN VOID *RsaContext,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] PrivateKey A pointer to the DER-encoded private key.
- @param[in] PrivateKeySize Size of the private key buffer.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Decrypt (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
-
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a private key using RsaSetKey().
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-RsaOaepDecrypt (
- IN VOID *RsaContext,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs5Pbkdf2Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs5Pbkdf2Null.c
deleted file mode 100644
index 24c284b98c..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs5Pbkdf2Null.c
+++ /dev/null
@@ -1,48 +0,0 @@
-/** @file
- PBKDF2 Key Derivation Function Wrapper Implementation which does not provide real
- capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
- password based encryption key derivation function PBKDF2, as specified in RFC 2898.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PasswordLength Length of input password in bytes.
- @param[in] Password Pointer to the array for the password.
- @param[in] SaltLength Size of the Salt in bytes.
- @param[in] Salt Pointer to the Salt.
- @param[in] IterationCount Number of iterations to perform. Its value should be
- greater than or equal to 1.
- @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
- NOTE: DigestSize will be used to determine the hash algorithm.
- Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
- @param[in] KeyLength Size of the derived key buffer in bytes.
- @param[out] OutKey Pointer to the output derived key buffer.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs5HashPassword (
- IN UINTN PasswordLength,
- IN CONST CHAR8 *Password,
- IN UINTN SaltLength,
- IN CONST UINT8 *Salt,
- IN UINTN IterationCount,
- IN UINTN DigestSize,
- IN UINTN KeyLength,
- OUT UINT8 *OutKey
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7Internal.h b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7Internal.h
deleted file mode 100644
index 207f493cbb..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7Internal.h
+++ /dev/null
@@ -1,83 +0,0 @@
-/** @file
- PKCS#7 SignedData Sign Wrapper and PKCS#7 SignedData Verification Wrapper
- Implementation over mbedtls, Internal headers.
-
- RFC 2315 - PKCS #7: Cryptographic Message Syntax Version 1.5
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#ifndef CRYPT_PKCS7_INTERNAL_H_
-#define CRYPT_PKCS7_INTERNAL_H_
-
-#include "InternalCryptLib.h"
-
-#include "mbedtls/oid.h"
-#include "mbedtls/asn1.h"
-#include "mbedtls/asn1write.h"
-#include "mbedtls/x509.h"
-#include "mbedtls/x509_crt.h"
-
-///
-/// PKCS7 OID
-///
-#define MBEDTLS_OID_PKCS7 MBEDTLS_OID_PKCS "\x07"
-#define MBEDTLS_OID_PKCS7_DATA MBEDTLS_OID_PKCS7 "\x01"
-#define MBEDTLS_OID_PKCS7_SIGNED_DATA MBEDTLS_OID_PKCS7 "\x02"
-#define MBEDTLS_OID_PKCS7_ENVELOPED_DATA MBEDTLS_OID_PKCS7 "\x03"
-#define MBEDTLS_OID_PKCS7_SIGNED_AND_ENVELOPED_DATA MBEDTLS_OID_PKCS7 "\x04"
-#define MBEDTLS_OID_PKCS7_DIGESTED_DATA MBEDTLS_OID_PKCS7 "\x05"
-#define MBEDTLS_OID_PKCS7_ENCRYPTED_DATA MBEDTLS_OID_PKCS7 "\x06"
-
-typedef mbedtls_asn1_buf MBEDTLSPKCS7BUF;
-typedef mbedtls_asn1_named_data MBEDTLSPKCS7NAME;
-typedef mbedtls_asn1_sequence MBEDTLSPKCS7SEQUENCE;
-
-///
-/// PKCS7 SignerInfo type
-/// https://tools.ietf.org/html/rfc2315#section-9.2
-///
-typedef struct MbedtlsPkcs7SignerInfo {
- INT32 Version;
- mbedtls_x509_buf Serial;
- mbedtls_x509_name Issuer;
- mbedtls_x509_buf IssuerRaw;
- mbedtls_x509_buf AlgIdentifier;
- mbedtls_x509_buf SigAlgIdentifier;
- mbedtls_x509_buf AuthAttr;
- mbedtls_x509_buf Sig;
- struct MBEDTLSPKCS7SIGNERINFO *Next;
-} MBEDTLSPKCS7SIGNERINFO;
-
-///
-/// PKCS7 signed data attached data format
-///
-typedef struct MbedtlsPkcs7Data {
- mbedtls_asn1_buf Oid;
- mbedtls_asn1_buf Data;
-} MBEDTLSPKCS7DATA;
-
-///
-/// Signed Data
-/// https://tools.ietf.org/html/rfc2315#section-9.1
-///
-typedef struct MbedtlsPkcs7SignedData {
- INT32 Version;
- mbedtls_asn1_buf DigestAlgorithms;
- struct MBEDTLSPKCS7DATA ContentInfo;
- mbedtls_x509_crt Certificates;
- mbedtls_x509_crl Crls;
- struct MbedtlsPkcs7SignerInfo SignerInfos;
-} MBEDTLSPKCS7SIGNEDDATA;
-
-///
-/// PKCS7 struct, only support SignedData
-///
-typedef struct MbedtlsPkcs7 {
- mbedtls_asn1_buf ContentTypeOid;
- struct MBEDTLSPKCS7SIGNEDDATA SignedData;
-} MBEDTLSPKCS7;
-
-#endif
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7SignNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7SignNull.c
deleted file mode 100644
index 03032592a1..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7SignNull.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/** @file
- PKCS#7 SignedData Sign Wrapper Implementation which does not provide real
- capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
- Syntax Standard, version 1.5". This interface is only intended to be used for
- application to perform PKCS#7 functionality validation.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] PrivateKey Pointer to the PEM-formatted private key data for
- data signing.
- @param[in] PrivateKeySize Size of the PEM private key data in bytes.
- @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
- key data.
- @param[in] InData Pointer to the content to be signed.
- @param[in] InDataSize Size of InData in bytes.
- @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
- @param[in] OtherCerts Pointer to an optional additional set of certificates to
- include in the PKCS#7 signedData (e.g. any intermediate
- CAs in the chain).
- @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
- responsibility to free the buffer with FreePool().
- @param[out] SignedDataSize Size of SignedData in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Sign (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN CONST UINT8 *KeyPassword,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN UINT8 *SignCert,
- IN UINT8 *OtherCerts OPTIONAL,
- OUT UINT8 **SignedData,
- OUT UINTN *SignedDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuNull.c
deleted file mode 100644
index 63d7a23af3..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuNull.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/** @file
- PKCS7 Verify Null implementation.
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2023, Intel Corporation. All rights reserved.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- This function will return the leaf signer certificate in a chain. This is
- required because certificate chains are not guaranteed to have the
- certificates in the order that they were issued.
-
- A typical certificate chain looks like this:
-
-
- ----------------------------
- | Root |
- ----------------------------
- ^
- |
- ----------------------------
- | Policy CA | <-- Typical Trust Anchor.
- ----------------------------
- ^
- |
- ----------------------------
- | Issuing CA |
- ----------------------------
- ^
- |
- -----------------------------
- / End-Entity (leaf) signer / <-- Bottom certificate.
- ----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"
- (Firmware Signing)
-
-
- @param[in] CertChain Certificate chain.
-
- @param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,
- this will be the end-entity (leaf) signer cert.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND The number of signers found was not 1.
-
-**/
-EFI_STATUS
-GetSignerCertificate (
- IN CONST VOID *CertChain,
- OUT VOID **SignerCert
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
-
-/**
- Determines if the specified EKU represented in ASN1 form is present
- in a given certificate.
-
- @param[in] Cert The certificate to check.
-
- @param[in] Asn1ToFind The EKU to look for.
-
- @retval EFI_SUCCESS We successfully identified the signing type.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-EFI_STATUS
-IsEkuInCertificate (
- IN CONST VOID *Cert,
- IN VOID *Asn1ToFind
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
-
-/**
- Determines if the specified EKUs are present in a signing certificate.
-
- @param[in] SignerCert The certificate to check.
- @param[in] RequiredEKUs The EKUs to look for.
- @param[in] RequiredEKUsSize The number of EKUs
- @param[in] RequireAllPresent If TRUE, then all the specified EKUs
- must be present in the certificate.
-
- @retval EFI_SUCCESS We successfully identified the signing type.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-**/
-EFI_STATUS
-CheckEKUs (
- IN CONST VOID *SignerCert,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
-
-/**
- This function receives a PKCS#7 formatted signature blob,
- looks for the EKU SEQUENCE blob, and if found then looks
- for all the required EKUs. This function was created so that
- the Surface team can cut down on the number of Certificate
- Authorities (CA's) by checking EKU's on leaf signers for
- a specific product. This prevents one product's certificate
- from signing another product's firmware or unlock blobs.
-
- Note that this function does not validate the certificate chain.
- That needs to be done before using this function.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-EFI_STATUS
-EFIAPI
-VerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- ASSERT (FALSE);
- return EFI_NOT_READY;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuRuntime.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuRuntime.c
deleted file mode 100644
index 91273cbdb9..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuRuntime.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/** @file
- This module verifies that Enhanced Key Usages (EKU's) are present within
- a PKCS7 signature blob using MbedTLS.
-
- Copyright (C) Microsoft Corporation. All Rights Reserved.
- Copyright (c) 2023, Intel Corporation. All rights reserved.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- This function receives a PKCS#7 formatted signature blob,
- looks for the EKU SEQUENCE blob, and if found then looks
- for all the required EKUs. This function was created so that
- the Surface team can cut down on the number of Certificate
- Authorities (CA's) by checking EKU's on leaf signers for
- a specific product. This prevents one product's certificate
- from signing another product's firmware or unlock blobs.
-
- Return RETURN_UNSUPPORTED to indicate this interface is not supported.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in pPkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- All specified EKU's must be present in order to
- succeed.
- @param[in] RequiredEKUsSize Number of elements in the rgRequiredEKUs string.
- This parameter has a maximum of MAX_EKU_SEARCH.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-EFI_STATUS
-EFIAPI
-VerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- ASSERT (FALSE);
- return RETURN_UNSUPPORTED;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyNull.c
deleted file mode 100644
index 82b2b07991..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyNull.c
+++ /dev/null
@@ -1,163 +0,0 @@
-/** @file
- PKCS#7 SignedData Verification Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] StackLength Length of signer's certificates in bytes.
- @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- @param[out] CertLength Length of the trusted certificate in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetSigners (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **CertStack,
- OUT UINTN *StackLength,
- OUT UINT8 **TrustedCert,
- OUT UINTN *CertLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Wrap function to use free() to free allocated memory for certificates.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] Certs Pointer to the certificates to be freed.
-
-**/
-VOID
-EFIAPI
-Pkcs7FreeSigners (
- IN UINT8 *Certs
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
- unchained to the signer's certificates.
- The input signed data could be wrapped in a ContentInfo structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
- certificate. It's caller's responsibility to free the buffer
- with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] ChainLength Length of the chained certificates list buffer in bytes.
- @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
- responsibility to free the buffer with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetCertificatesList (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **SignerChainCerts,
- OUT UINTN *ChainLength,
- OUT UINT8 **UnchainCerts,
- OUT UINTN *UnchainLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertLength Length of the trusted certificate in bytes.
- @param[in] InData Pointer to the content to be verified.
- @param[in] DataLength Length of InData in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Verify (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertLength,
- IN CONST UINT8 *InData,
- IN UINTN DataLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyRuntime.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyRuntime.c
deleted file mode 100644
index 518a769ed3..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyRuntime.c
+++ /dev/null
@@ -1,38 +0,0 @@
-/** @file
- Runtime specific implementation of PKCS#7 SignedData Verification Wrapper.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasic.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasic.c
deleted file mode 100644
index 8b61ae02ec..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasic.c
+++ /dev/null
@@ -1,278 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over MbedTLS.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaNew
- 2) RsaFree
- 3) RsaSetKey
- 4) RsaPkcs1Verify
-
- RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-#include
-
-/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-RsaNew (
- VOID
- )
-{
- VOID *RsaContext;
-
- RsaContext = AllocateZeroPool (sizeof (mbedtls_rsa_context));
- if (RsaContext == NULL) {
- return RsaContext;
- }
-
- mbedtls_rsa_init (RsaContext);
- if (mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE) != 0) {
- return NULL;
- }
-
- return RsaContext;
-}
-
-/**
- Release the specified RSA context.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-VOID
-EFIAPI
-RsaFree (
- IN VOID *RsaContext
- )
-{
- mbedtls_rsa_free (RsaContext);
- if (RsaContext != NULL) {
- FreePool (RsaContext);
- }
-}
-
-/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-BOOLEAN
-EFIAPI
-RsaSetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
- )
-{
- mbedtls_rsa_context *RsaKey;
- INT32 Ret;
- mbedtls_mpi Value;
-
- //
- // Check input parameters.
- //
- if ((RsaContext == NULL) || (BnSize > INT_MAX)) {
- return FALSE;
- }
-
- mbedtls_mpi_init (&Value);
-
- RsaKey = (mbedtls_rsa_context *)RsaContext;
-
- // if BigNumber is Null clear
- if (BigNumber != NULL) {
- Ret = mbedtls_mpi_read_binary (&Value, BigNumber, BnSize);
- if (Ret != 0) {
- mbedtls_mpi_free (&Value);
- return FALSE;
- }
- }
-
- switch (KeyTag) {
- case RsaKeyN:
- Ret = mbedtls_rsa_import (
- RsaKey,
- &Value,
- NULL,
- NULL,
- NULL,
- NULL
- );
- break;
- case RsaKeyE:
- Ret = mbedtls_rsa_import (
- RsaKey,
- NULL,
- NULL,
- NULL,
- NULL,
- &Value
- );
- break;
- case RsaKeyD:
- Ret = mbedtls_rsa_import (
- RsaKey,
- NULL,
- NULL,
- NULL,
- &Value,
- NULL
- );
- break;
- case RsaKeyQ:
- Ret = mbedtls_rsa_import (
- RsaKey,
- NULL,
- NULL,
- &Value,
- NULL,
- NULL
- );
- break;
- case RsaKeyP:
- Ret = mbedtls_rsa_import (
- RsaKey,
- NULL,
- &Value,
- NULL,
- NULL,
- NULL
- );
- break;
- case RsaKeyDp:
- case RsaKeyDq:
- case RsaKeyQInv:
- default:
- Ret = -1;
- break;
- }
-
- mbedtls_mpi_free (&Value);
- return Ret == 0;
-}
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256, SHA-384 or SHA-512 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Verify (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- INT32 Ret;
- mbedtls_md_type_t md_alg;
- mbedtls_rsa_context *RsaKey;
-
- if ((RsaContext == NULL) || (MessageHash == NULL) || (Signature == NULL)) {
- return FALSE;
- }
-
- if ((SigSize > INT_MAX) || (SigSize == 0)) {
- return FALSE;
- }
-
- RsaKey = (mbedtls_rsa_context *)RsaContext;
- if (mbedtls_rsa_complete (RsaKey) != 0) {
- return FALSE;
- }
-
- switch (HashSize) {
- #ifdef ENABLE_MD5_DEPRECATED_INTERFACES
- case MD5_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_MD5;
- break;
- #endif
-
- #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
- case SHA1_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA1;
- break;
- #endif
-
- case SHA256_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA256;
- break;
-
- case SHA384_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA384;
- break;
-
- case SHA512_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA512;
- break;
-
- default:
- return FALSE;
- }
-
- if (mbedtls_rsa_get_len (RsaContext) != SigSize) {
- return FALSE;
- }
-
- mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V15, md_alg);
-
- Ret = mbedtls_rsa_pkcs1_verify (
- RsaContext,
- md_alg,
- (UINT32)HashSize,
- MessageHash,
- Signature
- );
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasicNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasicNull.c
deleted file mode 100644
index 3e643509fd..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasicNull.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Null Implementation.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaNew
- 2) RsaFree
- 3) RsaSetKey
- 4) RsaPkcs1Verify
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
-**/
-VOID *
-EFIAPI
-RsaNew (
- VOID
- )
-{
- //
- // Allocates & Initializes RSA Context
- //
- ASSERT (FALSE);
- return NULL;
-}
-
-/**
- Release the specified RSA context.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-VOID
-EFIAPI
-RsaFree (
- IN VOID *RsaContext
- )
-{
- //
- // Free RSA Context
- //
- ASSERT (FALSE);
-}
-
-/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
-**/
-BOOLEAN
-EFIAPI
-RsaSetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Verify (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaExtNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaExtNull.c
deleted file mode 100644
index be810fb8ca..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaExtNull.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over MbedTLS.
-
- This file does not provide real capabilities for following APIs in RSA handling:
- 1) RsaGetKey
- 2) RsaGenerateKey
- 3) RsaCheckKey
- 4) RsaPkcs1Sign
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Gets the tag-designated RSA key component from the established RSA context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[out] BigNumber Pointer to octet integer buffer.
- @param[in, out] BnSize On input, the size of big number buffer in bytes.
- On output, the size of data returned in big number buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- OUT UINT8 *BigNumber,
- IN OUT UINTN *BnSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Generates RSA key components.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] ModulusLength Length of RSA modulus N in bits.
- @param[in] PublicExponent Pointer to RSA public exponent.
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGenerateKey (
- IN OUT VOID *RsaContext,
- IN UINTN ModulusLength,
- IN CONST UINT8 *PublicExponent,
- IN UINTN PublicExponentSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Validates key components of RSA context.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] RsaContext Pointer to RSA context to check.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaCheckKey (
- IN VOID *RsaContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPkcs1Sign (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
deleted file mode 100644
index ecd1bd1a41..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
+++ /dev/null
@@ -1,122 +0,0 @@
-/** @file
- RSA Asymmetric Cipher Wrapper Implementation over MbedTLS.
-
- This file implements following APIs which provide basic capabilities for RSA:
- 1) RsaPssVerify
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-#include
-#include
-#include
-
-/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssVerify (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
- )
-{
- INT32 Ret;
- mbedtls_md_type_t MdAlg;
- UINT8 HashValue[SHA512_DIGEST_SIZE];
- mbedtls_rsa_context *RsaKey;
-
- if (RsaContext == NULL) {
- return FALSE;
- }
-
- if ((Message == NULL) || (MsgSize == 0) || (MsgSize > INT_MAX)) {
- return FALSE;
- }
-
- if (SaltLen != DigestLen) {
- return FALSE;
- }
-
- if ((Signature == NULL) || (SigSize == 0) || (SigSize > INT_MAX)) {
- return FALSE;
- }
-
- RsaKey = (mbedtls_rsa_context *)RsaContext;
- if (mbedtls_rsa_complete (RsaKey) != 0) {
- return FALSE;
- }
-
- ZeroMem (HashValue, DigestLen);
-
- switch (DigestLen) {
- case SHA256_DIGEST_SIZE:
- MdAlg = MBEDTLS_MD_SHA256;
- if (mbedtls_sha256 (Message, MsgSize, HashValue, FALSE) != 0) {
- return FALSE;
- }
-
- break;
-
- case SHA384_DIGEST_SIZE:
- MdAlg = MBEDTLS_MD_SHA384;
- if (mbedtls_sha512 (Message, MsgSize, HashValue, TRUE) != 0) {
- return FALSE;
- }
-
- break;
-
- case SHA512_DIGEST_SIZE:
- MdAlg = MBEDTLS_MD_SHA512;
- if (mbedtls_sha512 (Message, MsgSize, HashValue, FALSE) != 0) {
- return FALSE;
- }
-
- break;
-
- default:
- return FALSE;
- }
-
- if (mbedtls_rsa_get_len (RsaContext) != SigSize) {
- return FALSE;
- }
-
- mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, MdAlg);
-
- Ret = mbedtls_rsa_rsassa_pss_verify (
- RsaContext,
- MdAlg,
- (UINT32)DigestLen,
- HashValue,
- Signature
- );
- if (Ret != 0) {
- return FALSE;
- }
-
- return TRUE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssNull.c
deleted file mode 100644
index 75ad71a922..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssNull.c
+++ /dev/null
@@ -1,46 +0,0 @@
-/** @file
- RSA-PSS Asymmetric Cipher Wrapper Implementation over MbedTLS.
-
- This file does not provide real capabilities for following APIs in RSA handling:
- 1) RsaPssVerify
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssVerify (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssSignNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssSignNull.c
deleted file mode 100644
index 10687bd38e..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssSignNull.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/** @file
- RSA-PSS Asymmetric Cipher Wrapper Implementation over MbedTLS.
-
- This file does not provide real capabilities for following APIs in RSA handling:
- 1) RsaPssSign
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
- RFC 8017.
- Mask generation function is the same as the message digest algorithm.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If Message is NULL, then return FALSE.
- If MsgSize is zero or > INT_MAX, then return FALSE.
- If DigestLen is NOT 32, 48 or 64, return FALSE.
- If SaltLen is not equal to DigestLen, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] Message Pointer to octet message to be signed.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
- @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
- @param[out] Signature Pointer to buffer to receive RSA PSS signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in RSASSA-PSS.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaPssSign (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptTsNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptTsNull.c
deleted file mode 100644
index fcde333a6d..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptTsNull.c
+++ /dev/null
@@ -1,42 +0,0 @@
-/** @file
- RFC3161 Timestamp Countersignature Verification Wrapper Implementation which does
- not provide real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
- signature.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
- is used for TSA certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-ImageTimestampVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- OUT EFI_TIME *SigningTime
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptX509Null.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptX509Null.c
deleted file mode 100644
index 96356f87fd..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptX509Null.c
+++ /dev/null
@@ -1,751 +0,0 @@
-/** @file
- X.509 Certificate Handler Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Construct a X509 object from DER-encoded certificate data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded certificate data.
- @param[in] CertSize The size of certificate data in bytes.
- @param[out] SingleX509Cert The generated X509 object.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificate (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **SingleX509Cert
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- If X509Stack is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval TRUE The X509 stack construction succeeded.
- @retval FALSE The construction operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificateStackV (
- IN OUT UINT8 **X509Stack,
- IN VA_LIST Args
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Construct a X509 stack object from a list of DER-encoded certificate data.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
- On output, pointer to the X509 stack object with new
- inserted X509 certificate.
- @param ... A list of DER-encoded single certificate data followed
- by certificate size. A NULL terminates the list. The
- pairs are the arguments to X509ConstructCertificate().
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509ConstructCertificateStack (
- IN OUT UINT8 **X509Stack,
- ...
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Release the specified X509 object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Cert Pointer to the X509 object to be released.
-
-**/
-VOID
-EFIAPI
-X509Free (
- IN VOID *X509Cert
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Release the specified X509 stack object.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] X509Stack Pointer to the X509 stack object to be released.
-
-**/
-VOID
-EFIAPI
-X509StackFree (
- IN VOID *X509Stack
- )
-{
- ASSERT (FALSE);
-}
-
-/**
- Retrieve the subject bytes from one X.509 certificate.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
- @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
- and the size of buffer returned CertSubject on output.
-
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetSubjectName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertSubject,
- IN OUT UINTN *SubjectSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the common name (CN) string from one X.509 certificate.
-
- Return RETURN_UNSUPPORTED to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string (UTF8). At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-X509GetCommonName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *CommonName OPTIONAL,
- IN OUT UINTN *CommonNameSize
- )
-{
- ASSERT (FALSE);
- return RETURN_UNSUPPORTED;
-}
-
-/**
- Retrieve the organization name (ON) string from one X.509 certificate.
-
- Return RETURN_UNSUPPORTED to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] NameBuffer Buffer to contain the retrieved certificate organization
- name string. At most NameBufferSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,
- and the size of buffer returned Name on output.
- If NameBuffer is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_UNSUPPORTED The operation is not supported.
-
-**/
-RETURN_STATUS
-EFIAPI
-X509GetOrganizationName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT CHAR8 *NameBuffer OPTIONAL,
- IN OUT UINTN *NameBufferSize
- )
-{
- ASSERT (FALSE);
- return RETURN_UNSUPPORTED;
-}
-
-/**
- Retrieve the RSA Public Key from one DER-encoded X509 certificate.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA public key component. Use RsaFree() function to free the
- resource.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RsaGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **RsaContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
- @param[in] CACertSize Size of the CA Certificate in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *CACert,
- IN UINTN CACertSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the TBSCertificate from one given X.509 certificate.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Cert Pointer to the given DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
- @param[out] TBSCertSize Size of the TBS certificate in bytes.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetTBSCert (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 **TBSCert,
- OUT UINTN *TBSCertSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the EC Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC public key component. Use EcFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve EC public key from X509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **EcContext
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the version from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Version Pointer to the retrieved version integer.
-
- @retval TRUE The certificate version retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- @retval FALSE The operation is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetVersion (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Version
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the serialNumber from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertSize is 0, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
- @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
- and the size of buffer returned SerialNumber on output.
-
- @retval TRUE The certificate serialNumber retrieved successfully.
- @retval FALSE If Cert is NULL or CertSize is Zero.
- If SerialNumberSize is NULL.
- If Certificate is invalid.
- @retval FALSE If no SerialNumber exists.
- @retval FALSE If the SerialNumber is NULL. The required buffer size
- (including the final null) is returned in the
- SerialNumberSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetSerialNumber (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *SerialNumber OPTIONAL,
- IN OUT UINTN *SerialNumberSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the issuer bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
- @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate issuer retrieved successfully.
- @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
- The CertIssuerSize will be updated with the required size.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-X509GetIssuerName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertIssuer,
- IN OUT UINTN *CertIssuerSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the Signature Algorithm from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Oid Signature Algorithm Object identifier buffer.
- @param[in,out] OidSize Signature Algorithm Object identifier buffer size
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If OidSize is NULL.
- If Oid is not NULL and *OidSize is 0.
- If Certificate is invalid.
- @retval FALSE If no SignatureType.
- @retval FALSE If the Oid is NULL. The required buffer size
- is returned in the OidSize.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetSignatureAlgorithm (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Oid OPTIONAL,
- IN OUT UINTN *OidSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve Extension data from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] Oid Object identifier buffer
- @param[in] OidSize Object identifier buffer size
- @param[out] ExtensionData Extension bytes.
- @param[in, out] ExtensionDataSize Extension bytes size.
-
- @retval TRUE The certificate Extension data retrieved successfully.
- @retval FALSE If Cert is NULL.
- If ExtensionDataSize is NULL.
- If ExtensionData is not NULL and *ExtensionDataSize is 0.
- If Certificate is invalid.
- @retval FALSE If no Extension entry match Oid.
- @retval FALSE If the ExtensionData is NULL. The required buffer size
- is returned in the ExtensionDataSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtensionData (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN CONST UINT8 *Oid,
- IN UINTN OidSize,
- OUT UINT8 *ExtensionData,
- IN OUT UINTN *ExtensionDataSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the Extended Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage bytes.
- @param[in, out] UsageSize Key Usage buffer sizs in bytes.
-
- @retval TRUE The Usage bytes retrieve successfully.
- @retval FALSE If Cert is NULL.
- If CertSize is NULL.
- If Usage is not NULL and *UsageSize is 0.
- If Cert is invalid.
- @retval FALSE If the Usage is NULL. The required buffer size
- is returned in the UsageSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtendedKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Usage,
- IN OUT UINTN *UsageSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the Validity from one X.509 certificate
-
- If Cert is NULL, then return FALSE.
- If CertIssuerSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[in] From notBefore Pointer to DateTime object.
- @param[in,out] FromSize notBefore DateTime object size.
- @param[in] To notAfter Pointer to DateTime object.
- @param[in,out] ToSize notAfter DateTime object size.
-
- Note: X509CompareDateTime to compare DateTime oject
- x509SetDateTime to get a DateTime object from a DateTimeStr
-
- @retval TRUE The certificate Validity retrieved successfully.
- @retval FALSE Invalid certificate, or Validity retrieve failed.
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetValidity (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- IN UINT8 *From,
- IN OUT UINTN *FromSize,
- IN UINT8 *To,
- IN OUT UINTN *ToSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Format a DateTimeStr to DataTime object in DataTime Buffer
-
- If DateTimeStr is NULL, then return FALSE.
- If DateTimeSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
- Ref: https://www.w3.org/TR/NOTE-datetime
- Z stand for UTC time
- @param[out] DateTime Pointer to a DateTime object.
- @param[in,out] DateTimeSize DateTime object buffer size.
-
- @retval TRUE The DateTime object create successfully.
- @retval FALSE If DateTimeStr is NULL.
- If DateTimeSize is NULL.
- If DateTime is not NULL and *DateTimeSize is 0.
- If Year Month Day Hour Minute Second combination is invalid datetime.
- @retval FALSE If the DateTime is NULL. The required buffer size
- (including the final null) is returned in the
- DateTimeSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509FormatDateTime (
- IN CONST CHAR8 *DateTimeStr,
- OUT VOID *DateTime,
- IN OUT UINTN *DateTimeSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Compare DateTime1 object and DateTime2 object.
-
- If DateTime1 is NULL, then return -2.
- If DateTime2 is NULL, then return -2.
- If DateTime1 == DateTime2, then return 0
- If DateTime1 > DateTime2, then return 1
- If DateTime1 < DateTime2, then return -1
-
- @param[in] DateTime1 Pointer to a DateTime Ojbect
- @param[in] DateTime2 Pointer to a DateTime Object
-
- @retval 0 If DateTime1 == DateTime2
- @retval 1 If DateTime1 > DateTime2
- @retval -1 If DateTime1 < DateTime2
-**/
-INT32
-EFIAPI
-X509CompareDateTime (
- IN CONST VOID *DateTime1,
- IN CONST VOID *DateTime2
- )
-{
- ASSERT (FALSE);
- return -3;
-}
-
-/**
- Retrieve the Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
-
- @retval TRUE The certificate Key Usage retrieved successfully.
- @retval FALSE Invalid certificate, or Usage is NULL
- @retval FALSE This interface is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINTN *Usage
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Verify one X509 certificate was issued by the trusted CA.
- @param[in] RootCert Trusted Root Certificate buffer
-
- @param[in] RootCertLength Trusted Root Certificate buffer length
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCertChain (
- IN CONST UINT8 *RootCert,
- IN UINTN RootCertLength,
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Get one X509 certificate from CertChain.
-
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] CertIndex Index of certificate.
-
- @param[out] Cert The certificate at the index of CertChain.
- @param[out] CertLength The length certificate at the index of CertChain.
-
- @retval TRUE Success.
- @retval FALSE Failed to get certificate from certificate chain.
-**/
-BOOLEAN
-EFIAPI
-X509GetCertFromCertChain (
- IN CONST UINT8 *CertChain,
- IN UINTN CertChainLength,
- IN CONST INT32 CertIndex,
- OUT CONST UINT8 **Cert,
- OUT UINTN *CertLength
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the tag and length of the tag.
-
- @param Ptr The position in the ASN.1 data
- @param End End of data
- @param Length The variable that will receive the length
- @param Tag The expected tag
-
- @retval TRUE Get tag successful
- @retval FALSe Failed to get tag or tag not match
-**/
-BOOLEAN
-EFIAPI
-Asn1GetTag (
- IN OUT UINT8 **Ptr,
- IN CONST UINT8 *End,
- OUT UINTN *Length,
- IN UINT32 Tag
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Retrieve the basic constraints from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize size of the X509 certificate in bytes.
- @param[out] BasicConstraints basic constraints bytes.
- @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
-
- @retval TRUE The basic constraints retrieve successfully.
- @retval FALSE If cert is NULL.
- If cert_size is NULL.
- If basic_constraints is not NULL and *basic_constraints_size is 0.
- If cert is invalid.
- @retval FALSE The required buffer size is small.
- The return buffer size is basic_constraints_size parameter.
- @retval FALSE If no Extension entry match oid.
- @retval FALSE The operation is not supported.
- **/
-BOOLEAN
-EFIAPI
-X509GetExtendedBasicConstraints (
- CONST UINT8 *Cert,
- UINTN CertSize,
- UINT8 *BasicConstraints,
- UINTN *BasicConstraintsSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Rand/CryptRandNull.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Rand/CryptRandNull.c
deleted file mode 100644
index d5c66291ed..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Rand/CryptRandNull.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/** @file
- Pseudorandom Number Generator Wrapper Implementation which does not provide
- real capabilities.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include "InternalCryptLib.h"
-
-/**
- Sets up the seed value for the pseudorandom number generator.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RandomSeed (
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- Return FALSE to indicate this interface is not supported.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-RandomBytes (
- OUT UINT8 *Output,
- IN UINTN Size
- )
-{
- ASSERT (FALSE);
- return FALSE;
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.inf
deleted file mode 100644
index 9f17ef00bf..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.inf
+++ /dev/null
@@ -1,92 +0,0 @@
-## @file
-# Cryptographic Library Instance for DXE_RUNTIME_DRIVER.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Note: SHA-384 Digest functions, SHA-512 Digest functions,
-# HMAC-SHA256 functions, AES functions, RSA external
-# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
-# authenticode signature verification functions are not supported in this instance.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = RuntimeCryptLib
- MODULE_UNI_FILE = RuntimeCryptLib.uni
- FILE_GUID = D263B580-D9FC-4DC4-B445-578AAEFF530E
- MODULE_TYPE = DXE_RUNTIME_DRIVER
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|DXE_RUNTIME_DRIVER
- CONSTRUCTOR = RuntimeCryptLibConstructor
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSm3Null.c
- Hash/CryptSha512.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptRsaPssNull.c
- Pk/CryptRsaPssSignNull.c
- Bn/CryptBnNull.c
- Pem/CryptPemNull.c
- Pk/CryptDhNull.c
- Pk/CryptEcNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Rand/CryptRandNull.c
- SysCall/CrtWrapper.c
- SysCall/TimerWrapper.c
- SysCall/RuntimeMemAllocation.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- UefiRuntimeServicesTableLib
- DebugLib
- MbedTlsLib
- IntrinsicLib
- PrintLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
- GCC:*_CLANG35_*_CC_FLAGS = -std=c99
- GCC:*_CLANG38_*_CC_FLAGS = -std=c99
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.uni b/CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.uni
deleted file mode 100644
index b2a2f5ff21..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.uni
+++ /dev/null
@@ -1,22 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for DXE_RUNTIME_DRIVER.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Note: AES
-// functions, RSA external functions, PKCS#7 SignedData sign functions,
-// Diffie-Hellman functions, and authenticode signature verification functions are
-// not supported in this instance.
-//
-// Copyright (c) 2023, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for DXE_RUNTIME_DRIVER"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.inf b/CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.inf
deleted file mode 100644
index 6fc073aac6..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.inf
+++ /dev/null
@@ -1,84 +0,0 @@
-## @file
-# Cryptographic Library Instance for SEC.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = SecCryptLib
- MODULE_UNI_FILE = SecCryptLib.uni
- FILE_GUID = 894C367F-254A-4563-8624-798D46EAD796
- MODULE_TYPE = BASE
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|SEC
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptSha512.c
-
- Hash/CryptMd5Null.c
- Hash/CryptSha1Null.c
- Hash/CryptSha256Null.c
- Hash/CryptSm3Null.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmacNull.c
- Kdf/CryptHkdfNull.c
- Cipher/CryptAesNull.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasicNull.c
- Pk/CryptRsaExtNull.c
- Bn/CryptBnNull.c
- Pem/CryptPemNull.c
- Pk/CryptDhNull.c
- Pk/CryptEcNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Rand/CryptRandNull.c
- SysCall/CrtWrapper.c
- SysCall/ConstantTimeClock.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- DebugLib
- MbedTlsLib
- IntrinsicLib
- PrintLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
- GCC:*_CLANG35_*_CC_FLAGS = -std=c99
- GCC:*_CLANG38_*_CC_FLAGS = -std=c99
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
-
- XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.uni b/CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.uni
deleted file mode 100644
index be2fc4067f..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.uni
+++ /dev/null
@@ -1,17 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for SEC driver.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Copyright (c) 2023, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for SEC driver"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.inf
deleted file mode 100644
index 40c56d1b7d..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.inf
+++ /dev/null
@@ -1,92 +0,0 @@
-## @file
-# Cryptographic Library Instance for SMM driver.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Note: SHA-384 Digest functions, SHA-512 Digest functions,
-# RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
-# authenticode signature verification functions are not supported in this instance.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = SmmCryptLib
- MODULE_UNI_FILE = SmmCryptLib.uni
- FILE_GUID = CF104633-9901-4504-AD7A-91690926A253
- MODULE_TYPE = DXE_SMM_DRIVER
- VERSION_STRING = 1.0
- PI_SPECIFICATION_VERSION = 0x0001000A
- LIBRARY_CLASS = BaseCryptLib|DXE_SMM_DRIVER SMM_CORE MM_STANDALONE
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hash/CryptSha256.c
- Hash/CryptSm3Null.c
- Hash/CryptSha512.c
- Hash/CryptParallelHashNull.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Cipher/CryptAes.c
- Cipher/CryptAeadAesGcmNull.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSignNull.c
- Bn/CryptBnNull.c
- Pem/CryptPemNull.c
- Pk/CryptDhNull.c
- Pk/CryptEcNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Rand/CryptRandNull.c
- SysCall/CrtWrapper.c
- SysCall/ConstantTimeClock.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- MbedTlsLib
- IntrinsicLib
- PrintLib
- MmServicesTableLib
- SynchronizationLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- #
- # suppress the following warnings so we do not break the build with warnings-as-errors:
- #
-
- XCODE:*_*_*_CC_FLAGS = -mmmx -msse -std=c99
-
- GCC:*_CLANG35_*_CC_FLAGS = -std=c99
- GCC:*_CLANG38_*_CC_FLAGS = -std=c99
- GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.uni b/CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.uni
deleted file mode 100644
index 13948c2f3d..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.uni
+++ /dev/null
@@ -1,22 +0,0 @@
-// /** @file
-// Cryptographic Library Instance for SMM driver.
-//
-// Caution: This module requires additional review when modified.
-// This library will have external input - signature.
-// This external input must be validated carefully to avoid security issues such as
-// buffer overflow or integer overflow.
-//
-// Note: AES
-// functions, RSA external functions, PKCS#7 SignedData sign functions,
-// Diffie-Hellman functions, and authenticode signature verification functions are
-// not supported in this instance.
-//
-// Copyright (c) 2023, Intel Corporation. All rights reserved.
-//
-// SPDX-License-Identifier: BSD-2-Clause-Patent
-//
-// **/
-
-#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for SMM driver"
-
-#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/ConstantTimeClock.c b/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/ConstantTimeClock.c
deleted file mode 100644
index 2ec13ef9d0..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/ConstantTimeClock.c
+++ /dev/null
@@ -1,75 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Time Management Routines Wrapper Implementation
- for MbedTLS-based Cryptographic Library.
-
- This C file implements constant time value for time() and NULL for gmtime()
- thus should not be used in library instances which require functionality
- of following APIs which need system time support:
- 1) RsaGenerateKey
- 2) RsaCheckKey
- 3) RsaPkcs1Sign
- 4) Pkcs7Sign
- 5) DhGenerateParameter
- 6) DhGenerateKey
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-
-typedef int time_t;
-
-//
-// Structures Definitions
-//
-struct tm {
- int tm_sec; /* seconds after the minute [0-60] */
- int tm_min; /* minutes after the hour [0-59] */
- int tm_hour; /* hours since midnight [0-23] */
- int tm_mday; /* day of the month [1-31] */
- int tm_mon; /* months since January [0-11] */
- int tm_year; /* years since 1900 */
- int tm_wday; /* days since Sunday [0-6] */
- int tm_yday; /* days since January 1 [0-365] */
- int tm_isdst; /* Daylight Savings Time flag */
- long tm_gmtoff; /* offset from CUT in seconds */
- char *tm_zone; /* timezone abbreviation */
-};
-
-//
-// -- Time Management Routines --
-//
-
-/**time function. **/
-time_t
-time (
- time_t *timer
- )
-{
- if (timer != NULL) {
- *timer = 0;
- }
-
- return 0;
-}
-
-/**gmtime function. **/
-struct tm *
-gmtime (
- const time_t *timer
- )
-{
- return NULL;
-}
-
-/**_time64 function. **/
-time_t
-_time64 (
- time_t *t
- )
-{
- return time (t);
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/CrtWrapper.c
deleted file mode 100644
index f1d9b9c35c..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/CrtWrapper.c
+++ /dev/null
@@ -1,58 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Wrapper Implementation for MbedTLS-based
- Cryptographic Library.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-#include
-#include
-
-/**dummy mbedtls_printf function. **/
-int
-mbedtls_printf (
- char const *fmt,
- ...
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**dummy mbedtls_vsnprintf function. **/
-int
-mbedtls_vsnprintf (
- char *str,
- size_t size,
- const char *format,
- ...
- )
-{
- ASSERT (FALSE);
- return 0;
-}
-
-/**strchr function. **/
-char *
-strchr (
- const char *str,
- int ch
- )
-{
- return ScanMem8 (str, AsciiStrSize (str), (char)ch);
-}
-
-/**strcmp function. **/
-int
-strcmp (
- const char *s1,
- const char *s2
- )
-{
- return (int)AsciiStrCmp (s1, s2);
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/RuntimeMemAllocation.c b/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/RuntimeMemAllocation.c
deleted file mode 100644
index 51992029a8..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/RuntimeMemAllocation.c
+++ /dev/null
@@ -1,462 +0,0 @@
-/** @file
- Light-weight Memory Management Routines for MbedTLS-based Crypto
- Library at Runtime Phase.
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-#include
-#include
-
-// ----------------------------------------------------------------
-// Initial version. Needs further optimizations.
-// ----------------------------------------------------------------
-
-//
-// Definitions for Runtime Memory Operations
-//
-#define RT_PAGE_SIZE 0x200
-#define RT_PAGE_MASK 0x1FF
-#define RT_PAGE_SHIFT 9
-
-#define RT_SIZE_TO_PAGES(a) (((a) >> RT_PAGE_SHIFT) + (((a) & RT_PAGE_MASK) ? 1 : 0))
-#define RT_PAGES_TO_SIZE(a) ((a) << RT_PAGE_SHIFT)
-
-//
-// Page Flag Definitions
-//
-#define RT_PAGE_FREE 0x00000000
-#define RT_PAGE_USED 0x00000001
-
-#define MIN_REQUIRED_BLOCKS 600
-
-//
-// Memory Page Table
-//
-typedef struct {
- UINTN StartPageOffset; // Offset of the starting page allocated.
- // Only available for USED pages.
- UINT32 PageFlag; // Page Attributes.
-} RT_MEMORY_PAGE_ENTRY;
-
-typedef struct {
- UINTN PageCount;
- UINTN LastEmptyPageOffset;
- UINT8 *DataAreaBase; // Pointer to data Area.
- RT_MEMORY_PAGE_ENTRY Pages[1]; // Page Table Entries.
-} RT_MEMORY_PAGE_TABLE;
-
-//
-// Global Page Table for Runtime Cryptographic Provider.
-//
-RT_MEMORY_PAGE_TABLE *mRTPageTable = NULL;
-
-//
-// Event for Runtime Address Conversion.
-//
-STATIC EFI_EVENT mVirtualAddressChangeEvent;
-
-/**
- Initializes pre-allocated memory pointed by ScratchBuffer for subsequent
- runtime use.
-
- @param[in, out] ScratchBuffer Pointer to user-supplied memory buffer.
- @param[in] ScratchBufferSize Size of supplied buffer in bytes.
-
- @retval EFI_SUCCESS Successful initialization.
-
-**/
-EFI_STATUS
-InitializeScratchMemory (
- IN OUT UINT8 *ScratchBuffer,
- IN UINTN ScratchBufferSize
- )
-{
- UINTN Index;
- UINTN MemorySize;
-
- //
- // Parameters Checking
- //
- if (ScratchBuffer == NULL) {
- return EFI_INVALID_PARAMETER;
- }
-
- if (ScratchBufferSize < MIN_REQUIRED_BLOCKS * 1024) {
- return EFI_BUFFER_TOO_SMALL;
- }
-
- mRTPageTable = (RT_MEMORY_PAGE_TABLE *)ScratchBuffer;
-
- //
- // Initialize Internal Page Table for Memory Management
- //
- SetMem (mRTPageTable, ScratchBufferSize, 0xFF);
- MemorySize = ScratchBufferSize - sizeof (RT_MEMORY_PAGE_TABLE) + sizeof (RT_MEMORY_PAGE_ENTRY);
-
- mRTPageTable->PageCount = MemorySize / (RT_PAGE_SIZE + sizeof (RT_MEMORY_PAGE_ENTRY));
- mRTPageTable->LastEmptyPageOffset = 0x0;
-
- for (Index = 0; Index < mRTPageTable->PageCount; Index++) {
- mRTPageTable->Pages[Index].PageFlag = RT_PAGE_FREE;
- mRTPageTable->Pages[Index].StartPageOffset = 0;
- }
-
- mRTPageTable->DataAreaBase = ScratchBuffer + sizeof (RT_MEMORY_PAGE_TABLE) +
- (mRTPageTable->PageCount - 1) * sizeof (RT_MEMORY_PAGE_ENTRY);
-
- return EFI_SUCCESS;
-}
-
-/**
- Look-up Free memory Region for object allocation.
-
- @param[in] AllocationSize Bytes to be allocated.
-
- @return Return available page offset for object allocation.
-
-**/
-UINTN
-LookupFreeMemRegion (
- IN UINTN AllocationSize
- )
-{
- UINTN StartPageIndex;
- UINTN Index;
- UINTN SubIndex;
- UINTN ReqPages;
-
- StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->LastEmptyPageOffset);
- ReqPages = RT_SIZE_TO_PAGES (AllocationSize);
- if (ReqPages > mRTPageTable->PageCount) {
- //
- // No enough region for object allocation.
- //
- return (UINTN)(-1);
- }
-
- //
- // Look up the free memory region with in current memory map table.
- //
- for (Index = StartPageIndex; Index <= (mRTPageTable->PageCount - ReqPages); ) {
- //
- // Check consecutive ReqPages pages.
- //
- for (SubIndex = 0; SubIndex < ReqPages; SubIndex++) {
- if ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0) {
- break;
- }
- }
-
- if (SubIndex == ReqPages) {
- //
- // Succeed! Return the Starting Offset.
- //
- return RT_PAGES_TO_SIZE (Index);
- }
-
- //
- // Failed! Skip current free memory pages and adjacent Used pages
- //
- while ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0) {
- SubIndex++;
- }
-
- Index += SubIndex;
- }
-
- //
- // Look up the free memory region from the beginning of the memory table
- // until the StartCursorOffset
- //
- if (ReqPages > StartPageIndex) {
- //
- // No enough region for object allocation.
- //
- return (UINTN)(-1);
- }
-
- for (Index = 0; Index < (StartPageIndex - ReqPages); ) {
- //
- // Check Consecutive ReqPages Pages.
- //
- for (SubIndex = 0; SubIndex < ReqPages; SubIndex++) {
- if ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0) {
- break;
- }
- }
-
- if (SubIndex == ReqPages) {
- //
- // Succeed! Return the Starting Offset.
- //
- return RT_PAGES_TO_SIZE (Index);
- }
-
- //
- // Failed! Skip current adjacent Used pages
- //
- while ((SubIndex < (StartPageIndex - ReqPages)) &&
- ((mRTPageTable->Pages[SubIndex + Index].PageFlag & RT_PAGE_USED) != 0))
- {
- SubIndex++;
- }
-
- Index += SubIndex;
- }
-
- //
- // No available region for object allocation!
- //
- return (UINTN)(-1);
-}
-
-/**
- Allocates a buffer at runtime phase.
-
- @param[in] AllocationSize Bytes to be allocated.
-
- @return A pointer to the allocated buffer or NULL if allocation fails.
-
-**/
-VOID *
-RuntimeAllocateMem (
- IN UINTN AllocationSize
- )
-{
- UINT8 *AllocPtr;
- UINTN ReqPages;
- UINTN Index;
- UINTN StartPage;
- UINTN AllocOffset;
-
- AllocPtr = NULL;
- ReqPages = 0;
-
- //
- // Look for available consecutive memory region starting from LastEmptyPageOffset.
- // If no proper memory region found, look up from the beginning.
- // If still not found, return NULL to indicate failed allocation.
- //
- AllocOffset = LookupFreeMemRegion (AllocationSize);
- if (AllocOffset == (UINTN)(-1)) {
- return NULL;
- }
-
- //
- // Allocates consecutive memory pages with length of Size. Update the page
- // table status. Returns the starting address.
- //
- ReqPages = RT_SIZE_TO_PAGES (AllocationSize);
- AllocPtr = mRTPageTable->DataAreaBase + AllocOffset;
- StartPage = RT_SIZE_TO_PAGES (AllocOffset);
- Index = 0;
- while (Index < ReqPages) {
- mRTPageTable->Pages[StartPage + Index].PageFlag |= RT_PAGE_USED;
- mRTPageTable->Pages[StartPage + Index].StartPageOffset = AllocOffset;
-
- Index++;
- }
-
- mRTPageTable->LastEmptyPageOffset = AllocOffset + RT_PAGES_TO_SIZE (ReqPages);
-
- ZeroMem (AllocPtr, AllocationSize);
-
- //
- // Returns a VOID pointer to the allocated space
- //
- return AllocPtr;
-}
-
-/**
- Frees a buffer that was previously allocated at runtime phase.
-
- @param[in] Buffer Pointer to the buffer to free.
-
-**/
-VOID
-RuntimeFreeMem (
- IN VOID *Buffer
- )
-{
- UINTN StartOffset;
- UINTN StartPageIndex;
-
- StartOffset = (UINTN)Buffer - (UINTN)mRTPageTable->DataAreaBase;
- StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->Pages[RT_SIZE_TO_PAGES (StartOffset)].StartPageOffset);
-
- while (StartPageIndex < mRTPageTable->PageCount) {
- if (((mRTPageTable->Pages[StartPageIndex].PageFlag & RT_PAGE_USED) != 0) &&
- (mRTPageTable->Pages[StartPageIndex].StartPageOffset == StartOffset))
- {
- //
- // Free this page
- //
- mRTPageTable->Pages[StartPageIndex].PageFlag &= ~RT_PAGE_USED;
- mRTPageTable->Pages[StartPageIndex].PageFlag |= RT_PAGE_FREE;
- mRTPageTable->Pages[StartPageIndex].StartPageOffset = 0;
-
- StartPageIndex++;
- } else {
- break;
- }
- }
-
- return;
-}
-
-/**
- Notification function of EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE.
-
- This is a notification function registered on EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE
- event. It converts a pointer to a new virtual address.
-
- @param[in] Event The event whose notification function is being invoked.
- @param[in] Context The pointer to the notification function's context.
-
-**/
-VOID
-EFIAPI
-RuntimeCryptLibAddressChangeEvent (
- IN EFI_EVENT Event,
- IN VOID *Context
- )
-{
- //
- // Converts a pointer for runtime memory management to a new virtual address.
- //
- EfiConvertPointer (0x0, (VOID **)&mRTPageTable->DataAreaBase);
- EfiConvertPointer (0x0, (VOID **)&mRTPageTable);
-}
-
-/**
- Constructor routine for runtime crypt library instance.
-
- The constructor function pre-allocates space for runtime cryptographic operation.
-
- @param ImageHandle The firmware allocated handle for the EFI image.
- @param SystemTable A pointer to the EFI System Table.
-
- @retval EFI_SUCCESS The construction succeeded.
- @retval EFI_OUT_OF_RESOURCE Failed to allocate memory.
-
-**/
-EFI_STATUS
-EFIAPI
-RuntimeCryptLibConstructor (
- IN EFI_HANDLE ImageHandle,
- IN EFI_SYSTEM_TABLE *SystemTable
- )
-{
- EFI_STATUS Status;
- VOID *Buffer;
-
- //
- // Pre-allocates runtime space for possible cryptographic operations
- //
- Buffer = AllocateRuntimePool (MIN_REQUIRED_BLOCKS * 1024);
- Status = InitializeScratchMemory (Buffer, MIN_REQUIRED_BLOCKS * 1024);
- if (EFI_ERROR (Status)) {
- return Status;
- }
-
- //
- // Create address change event
- //
- Status = gBS->CreateEventEx (
- EVT_NOTIFY_SIGNAL,
- TPL_NOTIFY,
- RuntimeCryptLibAddressChangeEvent,
- NULL,
- &gEfiEventVirtualAddressChangeGuid,
- &mVirtualAddressChangeEvent
- );
- ASSERT_EFI_ERROR (Status);
-
- return Status;
-}
-
-//
-// -- Memory-Allocation Routines Wrapper for UEFI-MbedTLS Library --
-//
-
-/** Allocates memory blocks. **/
-VOID *
-malloc (
- size_t size
- )
-{
- return RuntimeAllocateMem ((UINTN)size);
-}
-
-/** Reallocate memory blocks. **/
-VOID *
-realloc (
- VOID *ptr,
- size_t size
- )
-{
- VOID *NewPtr;
- UINTN StartOffset;
- UINTN StartPageIndex;
- UINTN PageCount;
-
- if (ptr == NULL) {
- return malloc (size);
- }
-
- //
- // Get Original Size of ptr
- //
- StartOffset = (UINTN)ptr - (UINTN)mRTPageTable->DataAreaBase;
- StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->Pages[RT_SIZE_TO_PAGES (StartOffset)].StartPageOffset);
- PageCount = 0;
- while (StartPageIndex < mRTPageTable->PageCount) {
- if (((mRTPageTable->Pages[StartPageIndex].PageFlag & RT_PAGE_USED) != 0) &&
- (mRTPageTable->Pages[StartPageIndex].StartPageOffset == StartOffset))
- {
- StartPageIndex++;
- PageCount++;
- } else {
- break;
- }
- }
-
- if (size <= RT_PAGES_TO_SIZE (PageCount)) {
- //
- // Return the original pointer, if Caller try to reduce region size;
- //
- return ptr;
- }
-
- NewPtr = RuntimeAllocateMem ((UINTN)size);
- if (NewPtr == NULL) {
- return NULL;
- }
-
- CopyMem (NewPtr, ptr, RT_PAGES_TO_SIZE (PageCount));
-
- RuntimeFreeMem (ptr);
-
- return NewPtr;
-}
-
-/** Deallocates or frees a memory block. **/
-VOID
-free (
- VOID *ptr
- )
-{
- //
- // In Standard C, free() handles a null pointer argument transparently. This
- // is not true of RuntimeFreeMem() below, so protect it.
- //
- if (ptr != NULL) {
- RuntimeFreeMem (ptr);
- }
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/TimerWrapper.c b/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/TimerWrapper.c
deleted file mode 100644
index b7cd4d3181..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/TimerWrapper.c
+++ /dev/null
@@ -1,198 +0,0 @@
-/** @file
- C Run-Time Libraries (CRT) Time Management Routines Wrapper Implementation
- for MbedTLS-based Cryptographic Library (used in DXE & RUNTIME).
-
-Copyright (c) 2023, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
-#include
-#include
-#include
-
-typedef int time_t;
-
-//
-// Structures Definitions
-//
-struct tm {
- int tm_sec; /* seconds after the minute [0-60] */
- int tm_min; /* minutes after the hour [0-59] */
- int tm_hour; /* hours since midnight [0-23] */
- int tm_mday; /* day of the month [1-31] */
- int tm_mon; /* months since January [0-11] */
- int tm_year; /* years since 1900 */
- int tm_wday; /* days since Sunday [0-6] */
- int tm_yday; /* days since January 1 [0-365] */
- int tm_isdst; /* Daylight Savings Time flag */
- long tm_gmtoff; /* offset from CUT in seconds */
- char *tm_zone; /* timezone abbreviation */
-};
-
-//
-// -- Time Management Routines --
-//
-
-#define IsLeap(y) (((y) % 4) == 0 && (((y) % 100) != 0 || ((y) % 400) == 0))
-#define SECSPERMIN (60)
-#define SECSPERHOUR (60 * 60)
-#define SECSPERDAY (24 * SECSPERHOUR)
-
-//
-// The arrays give the cumulative number of days up to the first of the
-// month number used as the index (1 -> 12) for regular and leap years.
-// The value at index 13 is for the whole year.
-//
-UINTN CumulativeDays[2][14] = {
- {
- 0,
- 0,
- 31,
- 31 + 28,
- 31 + 28 + 31,
- 31 + 28 + 31 + 30,
- 31 + 28 + 31 + 30 + 31,
- 31 + 28 + 31 + 30 + 31 + 30,
- 31 + 28 + 31 + 30 + 31 + 30 + 31,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30,
- 31 + 28 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30 + 31
- },
- {
- 0,
- 0,
- 31,
- 31 + 29,
- 31 + 29 + 31,
- 31 + 29 + 31 + 30,
- 31 + 29 + 31 + 30 + 31,
- 31 + 29 + 31 + 30 + 31 + 30,
- 31 + 29 + 31 + 30 + 31 + 30 + 31,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30,
- 31 + 29 + 31 + 30 + 31 + 30 + 31 + 31 + 30 + 31 + 30 + 31
- }
-};
-
-/** Get the system time as seconds elapsed since midnight, January 1, 1970. **/
-time_t
-time (
- time_t *timer
- )
-{
- EFI_STATUS Status;
- EFI_TIME Time;
- time_t CalTime;
- UINTN Year;
-
- //
- // Get the current time and date information
- //
- Status = gRT->GetTime (&Time, NULL);
- if (EFI_ERROR (Status) || (Time.Year < 1970)) {
- return 0;
- }
-
- //
- // Years Handling
- // UTime should now be set to 00:00:00 on Jan 1 of the current year.
- //
- for (Year = 1970, CalTime = 0; Year != Time.Year; Year++) {
- CalTime = CalTime + (time_t)(CumulativeDays[IsLeap (Year)][13] * SECSPERDAY);
- }
-
- //
- // Add in number of seconds for current Month, Day, Hour, Minute, Seconds, and TimeZone adjustment
- //
- CalTime = CalTime +
- (time_t)((Time.TimeZone != EFI_UNSPECIFIED_TIMEZONE) ? (Time.TimeZone * 60) : 0) +
- (time_t)(CumulativeDays[IsLeap (Time.Year)][Time.Month] * SECSPERDAY) +
- (time_t)(((Time.Day > 0) ? Time.Day - 1 : 0) * SECSPERDAY) +
- (time_t)(Time.Hour * SECSPERHOUR) +
- (time_t)(Time.Minute * 60) +
- (time_t)Time.Second;
-
- if (timer != NULL) {
- *timer = CalTime;
- }
-
- return CalTime;
-}
-
-/** Convert a time value from type time_t to struct tm. **/
-struct tm *
-gmtime (
- const time_t *timer
- )
-{
- struct tm *GmTime;
- UINT16 DayNo;
- UINT16 DayRemainder;
- time_t Year;
- time_t YearNo;
- UINT16 TotalDays;
- UINT16 MonthNo;
-
- if (timer == NULL) {
- return NULL;
- }
-
- GmTime = AllocateZeroPool (sizeof (struct tm));
- if (GmTime == NULL) {
- return NULL;
- }
-
- ZeroMem ((VOID *)GmTime, (UINTN)sizeof (struct tm));
-
- DayNo = (UINT16)(*timer / SECSPERDAY);
- DayRemainder = (UINT16)(*timer % SECSPERDAY);
-
- GmTime->tm_sec = (int)(DayRemainder % SECSPERMIN);
- GmTime->tm_min = (int)((DayRemainder % SECSPERHOUR) / SECSPERMIN);
- GmTime->tm_hour = (int)(DayRemainder / SECSPERHOUR);
- GmTime->tm_wday = (int)((DayNo + 4) % 7);
-
- for (Year = 1970, YearNo = 0; DayNo > 0; Year++) {
- TotalDays = (UINT16)(IsLeap (Year) ? 366 : 365);
- if (DayNo >= TotalDays) {
- DayNo = (UINT16)(DayNo - TotalDays);
- YearNo++;
- } else {
- break;
- }
- }
-
- GmTime->tm_year = (int)(YearNo + (1970 - 1900));
- GmTime->tm_yday = (int)DayNo;
-
- for (MonthNo = 12; MonthNo > 1; MonthNo--) {
- if (DayNo >= CumulativeDays[IsLeap (Year)][MonthNo]) {
- DayNo = (UINT16)(DayNo - (UINT16)(CumulativeDays[IsLeap (Year)][MonthNo]));
- break;
- }
- }
-
- GmTime->tm_mon = (int)MonthNo - 1;
- GmTime->tm_mday = (int)DayNo + 1;
-
- GmTime->tm_isdst = 0;
- GmTime->tm_gmtoff = 0;
- GmTime->tm_zone = NULL;
-
- return GmTime;
-}
-
-/**_time64 function. **/
-time_t
-_time64 (
- time_t *t
- )
-{
- return time (t);
-}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/TestBaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLibMbedTls/TestBaseCryptLib.inf
deleted file mode 100644
index def990b996..0000000000
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/TestBaseCryptLib.inf
+++ /dev/null
@@ -1,76 +0,0 @@
-## @file
-# Cryptographic Library Instance for DXE_DRIVER.
-#
-# Caution: This module requires additional review when modified.
-# This library will have external input - signature.
-# This external input must be validated carefully to avoid security issues such as
-# buffer overflow or integer overflow.
-#
-# Copyright (c) 2023, Intel Corporation. All rights reserved.
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-##
-
-[Defines]
- INF_VERSION = 0x00010005
- BASE_NAME = BaseCryptLib
- FILE_GUID = 9DD60CFE-9D05-41E2-8B9E-958E2A4C1913
- MODULE_TYPE = DXE_DRIVER
- VERSION_STRING = 1.0
- LIBRARY_CLASS = BaseCryptLib|DXE_DRIVER DXE_CORE UEFI_APPLICATION UEFI_DRIVER
-
-#
-# The following information is for reference only and not required by the build tools.
-#
-# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
-#
-
-[Sources]
- InternalCryptLib.h
- Cipher/CryptAeadAesGcmNull.c
- Cipher/CryptAes.c
- Hash/CryptSha256.c
- Hash/CryptSha512.c
- Hash/CryptSm3Null.c
- Hash/CryptMd5.c
- Hash/CryptSha1.c
- Hmac/CryptHmac.c
- Kdf/CryptHkdf.c
- Pk/CryptRsaBasic.c
- Pk/CryptRsaExtNull.c
- Pk/CryptRsaPss.c
- Pk/CryptRsaPssSignNull.c
- Bn/CryptBnNull.c
- Pem/CryptPemNull.c
- Pk/CryptDhNull.c
- Pk/CryptEcNull.c
- Pk/CryptPkcs1OaepNull.c
- Pk/CryptPkcs5Pbkdf2Null.c
- Pk/CryptPkcs7SignNull.c
- Pk/CryptPkcs7VerifyNull.c
- Pk/CryptPkcs7VerifyEkuNull.c
- Pk/CryptX509Null.c
- Pk/CryptAuthenticodeNull.c
- Pk/CryptTsNull.c
- Rand/CryptRandNull.c
- SysCall/CrtWrapper.c
-
-[Packages]
- MdePkg/MdePkg.dec
- CryptoPkg/CryptoPkg.dec
-
-[LibraryClasses]
- BaseLib
- BaseMemoryLib
- MemoryAllocationLib
- UefiRuntimeServicesTableLib
- DebugLib
- MbedTlsLib
- PrintLib
- RngLib
-
-#
-# Remove these [BuildOptions] after this library is cleaned up
-#
-[BuildOptions]
- MSFT:*_*_*_CC_FLAGS = /GL-
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
index 893a2302a6..1cbbee8cc4 100644
--- a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
@@ -2,7 +2,7 @@
MD5 Digest Wrapper Null Implementation.
-Copyright (c) Microsoft Corporation. All rights reserved.
+Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
index 01d3c5a77f..9dea1205c6 100644
--- a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
@@ -3,7 +3,7 @@
SPDX-License-Identifier: BSD-2-Clause-Patent
- Copyright (C) Microsoft Corporation. All Rights Reserved.
+ Copyright (c) Microsoft Corporation.
Copyright (c) 2019, Intel Corporation. All rights reserved.
**/
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
index c1d9837c51..7261e754c4 100644
--- a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
@@ -1,7 +1,7 @@
/** @file
PKCS7 Verify Null implementation.
- Copyright (C) Microsoft Corporation. All Rights Reserved.
+ Copyright (c) Microsoft Corporation.
Copyright (c) 2019, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index c48291b972..b8b7456df4 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -2,8 +2,8 @@
Implements the BaseCryptLib and TlsLib using the services of the EDK II Crypto
Protocol/PPI.
- Copyright (C) Microsoft Corporation. All rights reserved.
- Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
+ Copyright (c) 2019 - 2020, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -95,2014 +95,2135 @@ CryptoServiceNotAvailable (
ASSERT_EFI_ERROR (EFI_UNSUPPORTED);
}
-// =====================================================================================
-// One-Way Cryptographic Hash Primitives
-// =====================================================================================
+// MU_CHANGE [BEGIN]
+// ****************************************************************************
+// AUTOGENERATED BY CryptoBinPkg\Driver\Packaging\generate_cryptodriver.py
+// AUTOGENED AS temp_CryptLib.c
+// DO NOT MODIFY
+// GENERATED ON: 2024-04-08 11:12:11.608999
-#ifdef ENABLE_MD5_DEPRECATED_INTERFACES
+// =============================================================================
+// HMACSHA256 functions
+// =============================================================================
/**
- Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for MD5 hash operations.
- @retval 0 This interface is not supported.
-
+ Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
+ @return Pointer to the HMAC_CTX context that has been initialized.
+ If the allocations fails, HmacSha256New() returns NULL.
**/
-UINTN
+// See BaseCryptLib.h:941
+VOID *
EFIAPI
-Md5GetContextSize (
+HmacSha256New (
VOID
)
{
- CALL_CRYPTO_SERVICE (Md5GetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (HmacSha256New, (), NULL);
}
/**
- Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
- subsequent use.
+ Release the specified HMAC_CTX context.
+ @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
+**/
+// See BaseCryptLib.h:953
+VOID
+EFIAPI
+HmacSha256Free (
+ IN VOID *HmacSha256Ctx
+ )
+{
+ CALL_VOID_CRYPTO_SERVICE (HmacSha256Free, (HmacSha256Ctx));
+}
- If Md5Context is NULL, then return FALSE.
+/**
+ Set user-supplied key for subsequent use. It must be done before any
+ calling to HmacSha256Update().
+ If HmacSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[out] Md5Context Pointer to MD5 context being initialized.
-
- @retval TRUE MD5 context initialization succeeded.
- @retval FALSE MD5 context initialization failed.
+ @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @retval TRUE The Key is set successfully.
+ @retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:975
BOOLEAN
EFIAPI
-Md5Init (
- OUT VOID *Md5Context
+HmacSha256SetKey (
+ OUT VOID *HmacSha256Context,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize
)
{
- CALL_CRYPTO_SERVICE (Md5Init, (Md5Context), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha256SetKey, (HmacSha256Context, Key, KeySize), FALSE);
}
/**
- Makes a copy of an existing MD5 context.
-
- If Md5Context is NULL, then return FALSE.
- If NewMd5Context is NULL, then return FALSE.
+ Makes a copy of an existing HMAC-SHA256 context.
+ If HmacSha256Context is NULL, then return FALSE.
+ If NewHmacSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Md5Context Pointer to MD5 context being copied.
- @param[out] NewMd5Context Pointer to new MD5 context.
-
- @retval TRUE MD5 context copy succeeded.
- @retval FALSE MD5 context copy failed.
+ @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
+ @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
+ @retval TRUE HMAC-SHA256 context copy succeeded.
+ @retval FALSE HMAC-SHA256 context copy failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:998
BOOLEAN
EFIAPI
-Md5Duplicate (
- IN CONST VOID *Md5Context,
- OUT VOID *NewMd5Context
+HmacSha256Duplicate (
+ IN CONST VOID *HmacSha256Context,
+ OUT VOID *NewHmacSha256Context
)
{
- CALL_CRYPTO_SERVICE (Md5Duplicate, (Md5Context, NewMd5Context), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha256Duplicate, (HmacSha256Context, NewHmacSha256Context), FALSE);
}
/**
- Digests the input data and updates MD5 context.
-
- This function performs MD5 digest on a data buffer of the specified size.
+ Digests the input data and updates HMAC-SHA256 context.
+ This function performs HMAC-SHA256 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
- MD5 context should be already correctly initialized by Md5Init(), and should not be finalized
- by Md5Final(). Behavior with invalid context is undefined.
-
- If Md5Context is NULL, then return FALSE.
+ HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
+ by HmacSha256Final(). Behavior with invalid context is undefined.
+ If HmacSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE MD5 data digest succeeded.
- @retval FALSE MD5 data digest failed.
+ @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
+ @param[in] Data Pointer to the buffer containing the data to be digested.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE HMAC-SHA256 data digest succeeded.
+ @retval FALSE HMAC-SHA256 data digest failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1025
BOOLEAN
EFIAPI
-Md5Update (
- IN OUT VOID *Md5Context,
+HmacSha256Update (
+ IN OUT VOID *HmacSha256Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (Md5Update, (Md5Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha256Update, (HmacSha256Context, Data, DataSize), FALSE);
}
/**
- Completes computation of the MD5 digest value.
-
- This function completes MD5 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the MD5 context cannot
+ Completes computation of the HMAC-SHA256 digest value.
+ This function completes HMAC-SHA256 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the HMAC-SHA256 context cannot
be used again.
- MD5 context should be already correctly initialized by Md5Init(), and should not be
- finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
-
- If Md5Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
+ HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
+ by HmacSha256Final(). Behavior with invalid HMAC-SHA256 context is undefined.
+ If HmacSha256Context is NULL, then return FALSE.
+ If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Md5Context Pointer to the MD5 context.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
+ @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
+ @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
+ value (32 bytes).
+ @retval TRUE HMAC-SHA256 digest computation succeeded.
+ @retval FALSE HMAC-SHA256 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1055
BOOLEAN
EFIAPI
-Md5Final (
- IN OUT VOID *Md5Context,
- OUT UINT8 *HashValue
+HmacSha256Final (
+ IN OUT VOID *HmacSha256Context,
+ OUT UINT8 *HmacValue
)
{
- CALL_CRYPTO_SERVICE (Md5Final, (Md5Context, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha256Final, (HmacSha256Context, HmacValue), FALSE);
}
/**
- Computes the MD5 message digest of a input data buffer.
-
- This function performs the MD5 message digest of a given data buffer, and places
+ Computes the HMAC-SHA256 digest of a input data buffer.
+ This function performs the HMAC-SHA256 digest of a given data buffer, and places
the digest value into the specified memory.
-
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the MD5 digest
- value (16 bytes).
-
- @retval TRUE MD5 digest computation succeeded.
- @retval FALSE MD5 digest computation failed.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the HMAC-SHA256 digest
+ value (32 bytes).
+ @retval TRUE HMAC-SHA256 digest computation succeeded.
+ @retval FALSE HMAC-SHA256 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1082
BOOLEAN
EFIAPI
-Md5HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+HmacSha256All (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ OUT UINT8 *HmacValue
)
{
- CALL_CRYPTO_SERVICE (Md5HashAll, (Data, DataSize, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha256All, (Data, DataSize, Key, KeySize, HmacValue), FALSE);
}
-#endif
-
-#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
+// =============================================================================
+// HMACSHA384 functions
+// =============================================================================
/**
- Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
- @retval 0 This interface is not supported.
-
+ Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
+ @return Pointer to the HMAC_CTX context that has been initialized.
+ If the allocations fails, HmacSha384New() returns NULL.
**/
-UINTN
+// See BaseCryptLib.h:1099
+VOID *
EFIAPI
-Sha1GetContextSize (
+HmacSha384New (
VOID
)
{
- CALL_CRYPTO_SERVICE (Sha1GetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (HmacSha384New, (), NULL);
}
/**
- Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
- subsequent use.
+ Release the specified HMAC_CTX context.
+ @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
+**/
+// See BaseCryptLib.h:1111
+VOID
+EFIAPI
+HmacSha384Free (
+ IN VOID *HmacSha384Ctx
+ )
+{
+ CALL_VOID_CRYPTO_SERVICE (HmacSha384Free, (HmacSha384Ctx));
+}
- If Sha1Context is NULL, then return FALSE.
+/**
+ Set user-supplied key for subsequent use. It must be done before any
+ calling to HmacSha384Update().
+ If HmacSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[out] Sha1Context Pointer to SHA-1 context being initialized.
-
- @retval TRUE SHA-1 context initialization succeeded.
- @retval FALSE SHA-1 context initialization failed.
+ @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @retval TRUE The Key is set successfully.
+ @retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1133
BOOLEAN
EFIAPI
-Sha1Init (
- OUT VOID *Sha1Context
+HmacSha384SetKey (
+ OUT VOID *HmacSha384Context,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize
)
{
- CALL_CRYPTO_SERVICE (Sha1Init, (Sha1Context), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha384SetKey, (HmacSha384Context, Key, KeySize), FALSE);
}
/**
- Makes a copy of an existing SHA-1 context.
-
- If Sha1Context is NULL, then return FALSE.
- If NewSha1Context is NULL, then return FALSE.
+ Makes a copy of an existing HMAC-SHA384 context.
+ If HmacSha384Context is NULL, then return FALSE.
+ If NewHmacSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Sha1Context Pointer to SHA-1 context being copied.
- @param[out] NewSha1Context Pointer to new SHA-1 context.
-
- @retval TRUE SHA-1 context copy succeeded.
- @retval FALSE SHA-1 context copy failed.
+ @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
+ @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
+ @retval TRUE HMAC-SHA384 context copy succeeded.
+ @retval FALSE HMAC-SHA384 context copy failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1156
BOOLEAN
EFIAPI
-Sha1Duplicate (
- IN CONST VOID *Sha1Context,
- OUT VOID *NewSha1Context
+HmacSha384Duplicate (
+ IN CONST VOID *HmacSha384Context,
+ OUT VOID *NewHmacSha384Context
)
{
- CALL_CRYPTO_SERVICE (Sha1Duplicate, (Sha1Context, NewSha1Context), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha384Duplicate, (HmacSha384Context, NewHmacSha384Context), FALSE);
}
/**
- Digests the input data and updates SHA-1 context.
-
- This function performs SHA-1 digest on a data buffer of the specified size.
+ Digests the input data and updates HMAC-SHA384 context.
+ This function performs HMAC-SHA384 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
- by Sha1Final(). Behavior with invalid context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
+ HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
+ by HmacSha384Final(). Behavior with invalid context is undefined.
+ If HmacSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-1 data digest succeeded.
- @retval FALSE SHA-1 data digest failed.
+ @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
+ @param[in] Data Pointer to the buffer containing the data to be digested.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE HMAC-SHA384 data digest succeeded.
+ @retval FALSE HMAC-SHA384 data digest failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1183
BOOLEAN
EFIAPI
-Sha1Update (
- IN OUT VOID *Sha1Context,
+HmacSha384Update (
+ IN OUT VOID *HmacSha384Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (Sha1Update, (Sha1Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha384Update, (HmacSha384Context, Data, DataSize), FALSE);
}
/**
- Completes computation of the SHA-1 digest value.
-
- This function completes SHA-1 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-1 context cannot
+ Completes computation of the HMAC-SHA384 digest value.
+ This function completes HMAC-SHA384 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the HMAC-SHA384 context cannot
be used again.
- SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
- finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
-
- If Sha1Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
+ HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
+ by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
+ If HmacSha384Context is NULL, then return FALSE.
+ If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] Sha1Context Pointer to the SHA-1 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
+ @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
+ value (48 bytes).
+ @retval TRUE HMAC-SHA384 digest computation succeeded.
+ @retval FALSE HMAC-SHA384 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:1213
BOOLEAN
EFIAPI
-Sha1Final (
- IN OUT VOID *Sha1Context,
- OUT UINT8 *HashValue
+HmacSha384Final (
+ IN OUT VOID *HmacSha384Context,
+ OUT UINT8 *HmacValue
)
{
- CALL_CRYPTO_SERVICE (Sha1Final, (Sha1Context, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha384Final, (HmacSha384Context, HmacValue), FALSE);
}
/**
- Computes the SHA-1 message digest of a input data buffer.
-
- This function performs the SHA-1 message digest of a given data buffer, and places
+ Computes the HMAC-SHA384 digest of a input data buffer.
+ This function performs the HMAC-SHA384 digest of a given data buffer, and places
the digest value into the specified memory.
-
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
- value (20 bytes).
-
- @retval TRUE SHA-1 digest computation succeeded.
- @retval FALSE SHA-1 digest computation failed.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the HMAC-SHA384 digest
+ value (48 bytes).
+ @retval TRUE HMAC-SHA384 digest computation succeeded.
+ @retval FALSE HMAC-SHA384 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1240
BOOLEAN
EFIAPI
-Sha1HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+HmacSha384All (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ OUT UINT8 *HmacValue
)
{
- CALL_CRYPTO_SERVICE (Sha1HashAll, (Data, DataSize, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (HmacSha384All, (Data, DataSize, Key, KeySize, HmacValue), FALSE);
}
-#endif
+// =============================================================================
+// PKCS functions
+// =============================================================================
/**
- Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
-
+ Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
+ password based encryption key derivation function PBKDF2, as specified in RFC 2898.
+ If Password or Salt or OutKey is NULL, then return FALSE.
+ If the hash algorithm could not be determined, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] PasswordLength Length of input password in bytes.
+ @param[in] Password Pointer to the array for the password.
+ @param[in] SaltLength Size of the Salt in bytes.
+ @param[in] Salt Pointer to the Salt.
+ @param[in] IterationCount Number of iterations to perform. Its value should be
+ greater than or equal to 1.
+ @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
+ NOTE: DigestSize will be used to determine the hash algorithm.
+ Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
+ @param[in] KeyLength Size of the derived key buffer in bytes.
+ @param[out] OutKey Pointer to the output derived key buffer.
+ @retval TRUE A key was derived successfully.
+ @retval FALSE One of the pointers was NULL or one of the sizes was too large.
+ @retval FALSE The hash algorithm could not be determined from the digest size.
+ @retval FALSE The key derivation operation failed.
+ @retval FALSE This interface is not supported.
**/
-UINTN
+// See BaseCryptLib.h:2097
+BOOLEAN
EFIAPI
-Sha256GetContextSize (
- VOID
+Pkcs5HashPassword (
+ IN UINTN PasswordLength,
+ IN CONST CHAR8 *Password,
+ IN UINTN SaltLength,
+ IN CONST UINT8 *Salt,
+ IN UINTN IterationCount,
+ IN UINTN DigestSize,
+ IN UINTN KeyLength,
+ OUT UINT8 *OutKey
)
{
- CALL_CRYPTO_SERVICE (Sha256GetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (Pkcs5HashPassword, (PasswordLength, Password, SaltLength, Salt, IterationCount, DigestSize, KeyLength, OutKey), FALSE);
}
/**
- Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
- subsequent use.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[out] Sha256Context Pointer to SHA-256 context being initialized.
-
- @retval TRUE SHA-256 context initialization succeeded.
- @retval FALSE SHA-256 context initialization failed.
-
+ Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ encrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - X509 key size does not match any known key size.
+ - Fail to parse X509 certificate.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ - Data size is too large for the provided key size (max size is a function of key size
+ and hash digest size).
+ @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
+ will be used to encrypt the data.
+ @param[in] PublicKeySize Size of the X509 cert buffer.
+ @param[in] InData Data to be encrypted.
+ @param[in] InDataSize Size of the data buffer.
+ @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
+ to be used when initializing the PRNG. NULL otherwise.
+ @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
+ 0 otherwise.
+ @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] EncryptedDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
**/
+// See BaseCryptLib.h:2139
BOOLEAN
EFIAPI
-Sha256Init (
- OUT VOID *Sha256Context
+Pkcs1v2Encrypt (
+ IN CONST UINT8 *PublicKey,
+ IN UINTN PublicKeySize,
+ IN UINT8 *InData,
+ IN UINTN InDataSize,
+ IN CONST UINT8 *PrngSeed OPTIONAL,
+ IN UINTN PrngSeedSize OPTIONAL,
+ OUT UINT8 **EncryptedData,
+ OUT UINTN *EncryptedDataSize
)
{
- CALL_CRYPTO_SERVICE (Sha256Init, (Sha256Context), FALSE);
+ CALL_CRYPTO_SERVICE (Pkcs1v2Encrypt, (PublicKey, PublicKeySize, InData, InDataSize, PrngSeed, PrngSeedSize, EncryptedData, EncryptedDataSize), FALSE);
}
/**
- Makes a copy of an existing SHA-256 context.
-
- If Sha256Context is NULL, then return FALSE.
- If NewSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha256Context Pointer to SHA-256 context being copied.
- @param[out] NewSha256Context Pointer to new SHA-256 context.
-
- @retval TRUE SHA-256 context copy succeeded.
- @retval FALSE SHA-256 context copy failed.
- @retval FALSE This interface is not supported.
-
+ Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ decrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - Fail to parse private key.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ @param[in] PrivateKey A pointer to the DER-encoded private key.
+ @param[in] PrivateKeySize Size of the private key buffer.
+ @param[in] EncryptedData Data to be decrypted.
+ @param[in] EncryptedDataSize Size of the encrypted buffer.
+ @param[out] OutData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] OutDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
**/
+// See BaseCryptLib.h:2219
BOOLEAN
EFIAPI
-Sha256Duplicate (
- IN CONST VOID *Sha256Context,
- OUT VOID *NewSha256Context
+Pkcs1v2Decrypt (
+ IN CONST UINT8 *PrivateKey,
+ IN UINTN PrivateKeySize,
+ IN UINT8 *EncryptedData,
+ IN UINTN EncryptedDataSize,
+ OUT UINT8 **OutData,
+ OUT UINTN *OutDataSize
)
{
- CALL_CRYPTO_SERVICE (Sha256Duplicate, (Sha256Context, NewSha256Context), FALSE);
+ CALL_CRYPTO_SERVICE (Pkcs1v2Decrypt, (PrivateKey, PrivateKeySize, EncryptedData, EncryptedDataSize, OutData, OutDataSize), FALSE);
}
/**
- Digests the input data and updates SHA-256 context.
-
- This function performs SHA-256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
- by Sha256Final(). Behavior with invalid context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-256 data digest succeeded.
- @retval FALSE SHA-256 data digest failed.
-
+ Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
+ Cryptographic Message Syntax Standard". The input signed data could be wrapped
+ in a ContentInfo structure.
+ If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then
+ return FALSE. If P7Length overflow, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] P7Data Pointer to the PKCS#7 message to verify.
+ @param[in] P7Length Length of the PKCS#7 message in bytes.
+ @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
+ It's caller's responsibility to free the buffer with
+ Pkcs7FreeSigners().
+ This data structure is EFI_CERT_STACK type.
+ @param[out] StackLength Length of signer's certificates in bytes.
+ @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
+ It's caller's responsibility to free the buffer with
+ Pkcs7FreeSigners().
+ @param[out] CertLength Length of the trusted certificate in bytes.
+ @retval TRUE The operation is finished successfully.
+ @retval FALSE Error occurs during the operation.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:2324
BOOLEAN
EFIAPI
-Sha256Update (
- IN OUT VOID *Sha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+Pkcs7GetSigners (
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ OUT UINT8 **CertStack,
+ OUT UINTN *StackLength,
+ OUT UINT8 **TrustedCert,
+ OUT UINTN *CertLength
)
{
- CALL_CRYPTO_SERVICE (Sha256Update, (Sha256Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (Pkcs7GetSigners, (P7Data, P7Length, CertStack, StackLength, TrustedCert, CertLength), FALSE);
}
/**
- Completes computation of the SHA-256 digest value.
-
- This function completes SHA-256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-256 context cannot
- be used again.
- SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
- finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
-
- If Sha256Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha256Context Pointer to the SHA-256 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
-
+ Wrap function to use free() to free allocated memory for certificates.
+ If this interface is not supported, then ASSERT().
+ @param[in] Certs Pointer to the certificates to be freed.
**/
-BOOLEAN
+// See BaseCryptLib.h:2343
+VOID
EFIAPI
-Sha256Final (
- IN OUT VOID *Sha256Context,
- OUT UINT8 *HashValue
+Pkcs7FreeSigners (
+ IN UINT8 *Certs
)
{
- CALL_CRYPTO_SERVICE (Sha256Final, (Sha256Context, HashValue), FALSE);
+ CALL_VOID_CRYPTO_SERVICE (Pkcs7FreeSigners, (Certs));
}
/**
- Computes the SHA-256 message digest of a input data buffer.
-
- This function performs the SHA-256 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
- value (32 bytes).
-
- @retval TRUE SHA-256 digest computation succeeded.
- @retval FALSE SHA-256 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
+ Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
+ unchained to the signer's certificates.
+ The input signed data could be wrapped in a ContentInfo structure.
+ @param[in] P7Data Pointer to the PKCS#7 message.
+ @param[in] P7Length Length of the PKCS#7 message in bytes.
+ @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
+ certificate. It's caller's responsibility to free the buffer
+ with Pkcs7FreeSigners().
+ This data structure is EFI_CERT_STACK type.
+ @param[out] ChainLength Length of the chained certificates list buffer in bytes.
+ @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
+ responsibility to free the buffer with Pkcs7FreeSigners().
+ This data structure is EFI_CERT_STACK type.
+ @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
+ @retval TRUE The operation is finished successfully.
+ @retval FALSE Error occurs during the operation.
**/
+// See BaseCryptLib.h:2371
BOOLEAN
EFIAPI
-Sha256HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+Pkcs7GetCertificatesList (
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ OUT UINT8 **SignerChainCerts,
+ OUT UINTN *ChainLength,
+ OUT UINT8 **UnchainCerts,
+ OUT UINTN *UnchainLength
)
{
- CALL_CRYPTO_SERVICE (Sha256HashAll, (Data, DataSize, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (Pkcs7GetCertificatesList, (P7Data, P7Length, SignerChainCerts, ChainLength, UnchainCerts, UnchainLength), FALSE);
}
/**
- Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
-
+ Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
+ Syntax Standard, version 1.5". This interface is only intended to be used for
+ application to perform PKCS#7 functionality validation.
+ If this interface is not supported, then return FALSE.
+ @param[in] PrivateKey Pointer to the PEM-formatted private key data for
+ data signing.
+ @param[in] PrivateKeySize Size of the PEM private key data in bytes.
+ @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
+ key data.
+ @param[in] InData Pointer to the content to be signed.
+ @param[in] InDataSize Size of InData in bytes.
+ @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
+ @param[in] SignCertSize Size of signer's DER-encoded certificate to sign with. // MU_CHANGE [TCBZ3925] - Pkcs7Sign is broken
+ @param[in] OtherCerts Pointer to an optional additional set of certificates to
+ include in the PKCS#7 signedData (e.g. any intermediate
+ CAs in the chain).
+ @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
+ responsibility to free the buffer with FreePool().
+ @param[out] SignedDataSize Size of SignedData in bytes.
+ @retval TRUE PKCS#7 data signing succeeded.
+ @retval FALSE PKCS#7 data signing failed.
+ @retval FALSE This interface is not supported.
**/
-UINTN
+// See BaseCryptLib.h:2410
+BOOLEAN
EFIAPI
-Sha384GetContextSize (
- VOID
+Pkcs7Sign (
+ IN CONST UINT8 *PrivateKey,
+ IN UINTN PrivateKeySize,
+ IN CONST UINT8 *KeyPassword,
+ IN UINT8 *InData,
+ IN UINTN InDataSize,
+ IN CONST UINT8 *SignCert,
+ IN UINTN SignCertSize,
+ IN UINT8 *OtherCerts OPTIONAL,
+ OUT UINT8 **SignedData,
+ OUT UINTN *SignedDataSize
)
{
- CALL_CRYPTO_SERVICE (Sha384GetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (Pkcs7Sign, (PrivateKey, PrivateKeySize, KeyPassword, InData, InDataSize, SignCert, SignCertSize, OtherCerts, SignedData, SignedDataSize), FALSE);
}
/**
- Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
- subsequent use.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[out] Sha384Context Pointer to SHA-384 context being initialized.
-
- @retval TRUE SHA-384 context initialization succeeded.
- @retval FALSE SHA-384 context initialization failed.
-
+ Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
+ Cryptographic Message Syntax Standard". The input signed data could be wrapped
+ in a ContentInfo structure.
+ If P7Data, TrustedCert or InData is NULL, then return FALSE.
+ If P7Length, CertLength or DataLength overflow, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] P7Data Pointer to the PKCS#7 message to verify.
+ @param[in] P7Length Length of the PKCS#7 message in bytes.
+ @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
+ is used for certificate chain verification.
+ @param[in] CertLength Length of the trusted certificate in bytes.
+ @param[in] InData Pointer to the content to be verified.
+ @param[in] DataLength Length of InData in bytes.
+ @retval TRUE The specified PKCS#7 signed data is valid.
+ @retval FALSE Invalid PKCS#7 signed data.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:2449
BOOLEAN
EFIAPI
-Sha384Init (
- OUT VOID *Sha384Context
+Pkcs7Verify (
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ IN CONST UINT8 *TrustedCert,
+ IN UINTN CertLength,
+ IN CONST UINT8 *InData,
+ IN UINTN DataLength
)
{
- CALL_CRYPTO_SERVICE (Sha384Init, (Sha384Context), FALSE);
+ CALL_CRYPTO_SERVICE (Pkcs7Verify, (P7Data, P7Length, TrustedCert, CertLength, InData, DataLength), FALSE);
}
/**
- Makes a copy of an existing SHA-384 context.
-
- If Sha384Context is NULL, then return FALSE.
- If NewSha384Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sha384Context Pointer to SHA-384 context being copied.
- @param[out] NewSha384Context Pointer to new SHA-384 context.
-
- @retval TRUE SHA-384 context copy succeeded.
- @retval FALSE SHA-384 context copy failed.
- @retval FALSE This interface is not supported.
-
+ This function receives a PKCS7 formatted signature, and then verifies that
+ the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity
+ leaf signing certificate.
+ Note that this function does not validate the certificate chain.
+ Applications for custom EKU's are quite flexible. For example, a policy EKU
+ may be present in an Issuing Certificate Authority (CA), and any sub-ordinate
+ certificate issued might also contain this EKU, thus constraining the
+ sub-ordinate certificate. Other applications might allow a certificate
+ embedded in a device to specify that other Object Identifiers (OIDs) are
+ present which contains binary data specifying custom capabilities that
+ the device is able to do.
+ @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
+ containing the content block with both the signature,
+ the signer's certificate, and any necessary intermediate
+ certificates.
+ @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
+ @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
+ required EKUs that must be present in the signature.
+ @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
+ @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
+ must be present in the leaf signer. If it is
+ FALSE, then we will succeed if we find any
+ of the specified EKU's.
+ @retval EFI_SUCCESS The required EKUs were found in the signature.
+ @retval EFI_INVALID_PARAMETER A parameter was invalid.
+ @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
**/
-BOOLEAN
+// See BaseCryptLib.h:2492
+RETURN_STATUS
EFIAPI
-Sha384Duplicate (
- IN CONST VOID *Sha384Context,
- OUT VOID *NewSha384Context
+VerifyEKUsInPkcs7Signature (
+ IN CONST UINT8 *Pkcs7Signature,
+ IN CONST UINT32 SignatureSize,
+ IN CONST CHAR8 *RequiredEKUs[],
+ IN CONST UINT32 RequiredEKUsSize,
+ IN BOOLEAN RequireAllPresent
)
{
- CALL_CRYPTO_SERVICE (Sha384Duplicate, (Sha384Context, NewSha384Context), FALSE);
+ CALL_CRYPTO_SERVICE (VerifyEKUsInPkcs7Signature, (Pkcs7Signature, SignatureSize, RequiredEKUs, RequiredEKUsSize, RequireAllPresent), 0);
}
/**
- Digests the input data and updates SHA-384 context.
-
- This function performs SHA-384 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
- by Sha384Final(). Behavior with invalid context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-384 data digest succeeded.
- @retval FALSE SHA-384 data digest failed.
-
+ Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+ data could be wrapped in a ContentInfo structure.
+ If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
+ then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
+ Caution: This function may receive untrusted input. So this function will do
+ basic check for PKCS#7 data structure.
+ @param[in] P7Data Pointer to the PKCS#7 signed data to process.
+ @param[in] P7Length Length of the PKCS#7 signed data in bytes.
+ @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
+ It's caller's responsibility to free the buffer with FreePool().
+ @param[out] ContentSize The size of the extracted content in bytes.
+ @retval TRUE The P7Data was correctly formatted for processing.
+ @retval FALSE The P7Data was not correctly formatted for processing.
**/
+// See BaseCryptLib.h:2522
BOOLEAN
EFIAPI
-Sha384Update (
- IN OUT VOID *Sha384Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+Pkcs7GetAttachedContent (
+ IN CONST UINT8 *P7Data,
+ IN UINTN P7Length,
+ OUT VOID **Content,
+ OUT UINTN *ContentSize
)
{
- CALL_CRYPTO_SERVICE (Sha384Update, (Sha384Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (Pkcs7GetAttachedContent, (P7Data, P7Length, Content, ContentSize), FALSE);
}
/**
- Completes computation of the SHA-384 digest value.
-
- This function completes SHA-384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-384 context cannot
- be used again.
- SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
- finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
-
- If Sha384Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha384Context Pointer to the SHA-384 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
-
+ Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
+ Authenticode Portable Executable Signature Format".
+ If AuthData is NULL, then return FALSE.
+ If ImageHash is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
+ PE/COFF image to be verified.
+ @param[in] DataSize Size of the Authenticode Signature in bytes.
+ @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
+ is used for certificate chain verification.
+ @param[in] CertSize Size of the trusted certificate in bytes.
+ @param[in] ImageHash Pointer to the original image file hash value. The procedure
+ for calculating the image hash value is described in Authenticode
+ specification.
+ @param[in] HashSize Size of Image hash value in bytes.
+ @retval TRUE The specified Authenticode Signature is valid.
+ @retval FALSE Invalid Authenticode Signature.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:2555
BOOLEAN
EFIAPI
-Sha384Final (
- IN OUT VOID *Sha384Context,
- OUT UINT8 *HashValue
+AuthenticodeVerify (
+ IN CONST UINT8 *AuthData,
+ IN UINTN DataSize,
+ IN CONST UINT8 *TrustedCert,
+ IN UINTN CertSize,
+ IN CONST UINT8 *ImageHash,
+ IN UINTN HashSize
)
{
- CALL_CRYPTO_SERVICE (Sha384Final, (Sha384Context, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (AuthenticodeVerify, (AuthData, DataSize, TrustedCert, CertSize, ImageHash, HashSize), FALSE);
}
/**
- Computes the SHA-384 message digest of a input data buffer.
-
- This function performs the SHA-384 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
+ Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
+ signature.
+ If AuthData is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
- value (48 bytes).
-
- @retval TRUE SHA-384 digest computation succeeded.
- @retval FALSE SHA-384 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
+ PE/COFF image to be verified.
+ @param[in] DataSize Size of the Authenticode Signature in bytes.
+ @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
+ is used for TSA certificate chain verification.
+ @param[in] CertSize Size of the trusted certificate in bytes.
+ @param[out] SigningTime Return the time of timestamp generation time if the timestamp
+ signature is valid.
+ @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
+ @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
**/
+// See BaseCryptLib.h:2586
BOOLEAN
EFIAPI
-Sha384HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+ImageTimestampVerify (
+ IN CONST UINT8 *AuthData,
+ IN UINTN DataSize,
+ IN CONST UINT8 *TsaCert,
+ IN UINTN CertSize,
+ OUT EFI_TIME *SigningTime
)
{
- CALL_CRYPTO_SERVICE (Sha384HashAll, (Data, DataSize, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (ImageTimestampVerify, (AuthData, DataSize, TsaCert, CertSize, SigningTime), FALSE);
}
-/**
- Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
-
- @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
+// =============================================================================
+// DH functions
+// =============================================================================
+/**
+ Allocates and Initializes one Diffie-Hellman Context for subsequent use.
+ @return Pointer to the Diffie-Hellman Context that has been initialized.
+ If the allocations fails, DhNew() returns NULL.
+ If the interface is not supported, DhNew() returns NULL.
**/
-UINTN
+// See BaseCryptLib.h:2982
+VOID *
EFIAPI
-Sha512GetContextSize (
+DhNew (
VOID
)
{
- CALL_CRYPTO_SERVICE (Sha512GetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (DhNew, (), NULL);
}
/**
- Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
- subsequent use.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[out] Sha512Context Pointer to SHA-512 context being initialized.
-
- @retval TRUE SHA-512 context initialization succeeded.
- @retval FALSE SHA-512 context initialization failed.
-
+ Release the specified DH context.
+ If the interface is not supported, then ASSERT().
+ @param[in] DhContext Pointer to the DH context to be released.
**/
-BOOLEAN
+// See BaseCryptLib.h:2996
+VOID
EFIAPI
-Sha512Init (
- OUT VOID *Sha512Context
+DhFree (
+ IN VOID *DhContext
)
{
- CALL_CRYPTO_SERVICE (Sha512Init, (Sha512Context), FALSE);
+ CALL_VOID_CRYPTO_SERVICE (DhFree, (DhContext));
}
/**
- Makes a copy of an existing SHA-512 context.
-
- If Sha512Context is NULL, then return FALSE.
- If NewSha512Context is NULL, then return FALSE.
+ Generates DH parameter.
+ Given generator g, and length of prime number p in bits, this function generates p,
+ and sets DH context according to value of g and p.
+ Before this function can be invoked, pseudorandom number generator must be correctly
+ initialized by RandomSeed().
+ If DhContext is NULL, then return FALSE.
+ If Prime is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Sha512Context Pointer to SHA-512 context being copied.
- @param[out] NewSha512Context Pointer to new SHA-512 context.
-
- @retval TRUE SHA-512 context copy succeeded.
- @retval FALSE SHA-512 context copy failed.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[in] Generator Value of generator.
+ @param[in] PrimeLength Length in bits of prime to be generated.
+ @param[out] Prime Pointer to the buffer to receive the generated prime number.
+ @retval TRUE DH parameter generation succeeded.
+ @retval FALSE Value of Generator is not supported.
+ @retval FALSE PRNG fails to generate random prime number with PrimeLength.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:3026
BOOLEAN
EFIAPI
-Sha512Duplicate (
- IN CONST VOID *Sha512Context,
- OUT VOID *NewSha512Context
+DhGenerateParameter (
+ IN OUT VOID *DhContext,
+ IN UINTN Generator,
+ IN UINTN PrimeLength,
+ OUT UINT8 *Prime
)
{
- CALL_CRYPTO_SERVICE (Sha512Duplicate, (Sha512Context, NewSha512Context), FALSE);
+ CALL_CRYPTO_SERVICE (DhGenerateParameter, (DhContext, Generator, PrimeLength, Prime), FALSE);
}
/**
- Digests the input data and updates SHA-512 context.
-
- This function performs SHA-512 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
- by Sha512Final(). Behavior with invalid context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SHA-512 data digest succeeded.
- @retval FALSE SHA-512 data digest failed.
-
+ Sets generator and prime parameters for DH.
+ Given generator g, and prime number p, this function and sets DH
+ context accordingly.
+ If DhContext is NULL, then return FALSE.
+ If Prime is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[in] Generator Value of generator.
+ @param[in] PrimeLength Length in bits of prime to be generated.
+ @param[in] Prime Pointer to the prime number.
+ @retval TRUE DH parameter setting succeeded.
+ @retval FALSE Value of Generator is not supported.
+ @retval FALSE Value of Generator is not suitable for the Prime.
+ @retval FALSE Value of Prime is not a prime number.
+ @retval FALSE Value of Prime is not a safe prime number.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:3058
BOOLEAN
EFIAPI
-Sha512Update (
- IN OUT VOID *Sha512Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+DhSetParameter (
+ IN OUT VOID *DhContext,
+ IN UINTN Generator,
+ IN UINTN PrimeLength,
+ IN CONST UINT8 *Prime
)
{
- CALL_CRYPTO_SERVICE (Sha512Update, (Sha512Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (DhSetParameter, (DhContext, Generator, PrimeLength, Prime), FALSE);
}
/**
- Completes computation of the SHA-512 digest value.
-
- This function completes SHA-512 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SHA-512 context cannot
- be used again.
- SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
- finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
-
- If Sha512Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sha512Context Pointer to the SHA-512 context.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
-
+ Generates DH public key.
+ This function generates random secret exponent, and computes the public key, which is
+ returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
+ If the PublicKey buffer is too small to hold the public key, FALSE is returned and
+ PublicKeySize is set to the required buffer size to obtain the public key.
+ If DhContext is NULL, then return FALSE.
+ If PublicKeySize is NULL, then return FALSE.
+ If PublicKeySize is large enough but PublicKey is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[out] PublicKey Pointer to the buffer to receive generated public key.
+ @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
+ On output, the size of data returned in PublicKey buffer in bytes.
+ @retval TRUE DH public key generation succeeded.
+ @retval FALSE DH public key generation failed.
+ @retval FALSE PublicKeySize is not large enough.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:3091
BOOLEAN
EFIAPI
-Sha512Final (
- IN OUT VOID *Sha512Context,
- OUT UINT8 *HashValue
+DhGenerateKey (
+ IN OUT VOID *DhContext,
+ OUT UINT8 *PublicKey,
+ IN OUT UINTN *PublicKeySize
)
{
- CALL_CRYPTO_SERVICE (Sha512Final, (Sha512Context, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (DhGenerateKey, (DhContext, PublicKey, PublicKeySize), FALSE);
}
/**
- Computes the SHA-512 message digest of a input data buffer.
-
- This function performs the SHA-512 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
+ Computes exchanged common key.
+ Given peer's public key, this function computes the exchanged common key, based on its own
+ context including value of prime modulus and random secret exponent.
+ If DhContext is NULL, then return FALSE.
+ If PeerPublicKey is NULL, then return FALSE.
+ If KeySize is NULL, then return FALSE.
+ If Key is NULL, then return FALSE.
+ If KeySize is not large enough, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
- value (64 bytes).
-
- @retval TRUE SHA-512 digest computation succeeded.
- @retval FALSE SHA-512 digest computation failed.
+ @param[in, out] DhContext Pointer to the DH context.
+ @param[in] PeerPublicKey Pointer to the peer's public key.
+ @param[in] PeerPublicKeySize Size of peer's public key in bytes.
+ @param[out] Key Pointer to the buffer to receive generated key.
+ @param[in, out] KeySize On input, the size of Key buffer in bytes.
+ On output, the size of data returned in Key buffer in bytes.
+ @retval TRUE DH exchanged key generation succeeded.
+ @retval FALSE DH exchanged key generation failed.
+ @retval FALSE KeySize is not large enough.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:3125
BOOLEAN
EFIAPI
-Sha512HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+DhComputeKey (
+ IN OUT VOID *DhContext,
+ IN CONST UINT8 *PeerPublicKey,
+ IN UINTN PeerPublicKeySize,
+ OUT UINT8 *Key,
+ IN OUT UINTN *KeySize
)
{
- CALL_CRYPTO_SERVICE (Sha512HashAll, (Data, DataSize, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (DhComputeKey, (DhContext, PeerPublicKey, PeerPublicKeySize, Key, KeySize), FALSE);
}
-/**
- Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
- published December 2016.
-
- @param[in] Input Pointer to the input message (X).
- @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
- @param[in] BlockSize The size of each block (B).
- @param[out] Output Pointer to the output buffer.
- @param[in] OutputByteLen The desired number of output bytes (L).
- @param[in] Customization Pointer to the customization string (S).
- @param[in] CustomByteLen The length of the customization string in bytes.
-
- @retval TRUE ParallelHash256 digest computation succeeded.
- @retval FALSE ParallelHash256 digest computation failed.
- @retval FALSE This interface is not supported.
+// =============================================================================
+// RANDOM functions
+// =============================================================================
+/**
+ Sets up the seed value for the pseudorandom number generator.
+ This function sets up the seed value for the pseudorandom number generator.
+ If Seed is not NULL, then the seed passed in is used.
+ If Seed is NULL, then default seed is used.
+ If this interface is not supported, then return FALSE.
+ @param[in] Seed Pointer to seed value.
+ If NULL, default seed is used.
+ @param[in] SeedSize Size of seed value.
+ If Seed is NULL, this parameter is ignored.
+ @retval TRUE Pseudorandom number generator has enough entropy for random generation.
+ @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:3157
BOOLEAN
EFIAPI
-ParallelHash256HashAll (
- IN CONST VOID *Input,
- IN UINTN InputByteLen,
- IN UINTN BlockSize,
- OUT VOID *Output,
- IN UINTN OutputByteLen,
- IN CONST VOID *Customization,
- IN UINTN CustomByteLen
+RandomSeed (
+ IN CONST UINT8 *Seed OPTIONAL,
+ IN UINTN SeedSize
)
{
- CALL_CRYPTO_SERVICE (ParallelHash256HashAll, (Input, InputByteLen, BlockSize, Output, OutputByteLen, Customization, CustomByteLen), FALSE);
+ CALL_CRYPTO_SERVICE (RandomSeed, (Seed, SeedSize), FALSE);
}
/**
- Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
-
- @return The size, in bytes, of the context buffer required for SM3 hash operations.
-
+ Generates a pseudorandom byte stream of the specified size.
+ If Output is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[out] Output Pointer to buffer to receive random value.
+ @param[in] Size Size of random bytes to generate.
+ @retval TRUE Pseudorandom byte stream generated successfully.
+ @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
+ @retval FALSE This interface is not supported.
**/
-UINTN
+// See BaseCryptLib.h:3178
+BOOLEAN
EFIAPI
-Sm3GetContextSize (
- VOID
+RandomBytes (
+ OUT UINT8 *Output,
+ IN UINTN Size
)
{
- CALL_CRYPTO_SERVICE (Sm3GetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (RandomBytes, (Output, Size), FALSE);
}
-/**
- Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
- subsequent use.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[out] Sm3Context Pointer to SM3 context being initialized.
-
- @retval TRUE SM3 context initialization succeeded.
- @retval FALSE SM3 context initialization failed.
+// =============================================================================
+// RSA functions
+// =============================================================================
+/**
+ Allocates and initializes one RSA context for subsequent use.
+ @return Pointer to the RSA context that has been initialized.
+ If the allocations fails, RsaNew() returns NULL.
**/
-BOOLEAN
+// See BaseCryptLib.h:1475
+VOID *
EFIAPI
-Sm3Init (
- OUT VOID *Sm3Context
+RsaNew (
+ VOID
)
{
- CALL_CRYPTO_SERVICE (Sm3Init, (Sm3Context), FALSE);
+ CALL_CRYPTO_SERVICE (RsaNew, (), NULL);
}
/**
- Makes a copy of an existing SM3 context.
-
- If Sm3Context is NULL, then return FALSE.
- If NewSm3Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Sm3Context Pointer to SM3 context being copied.
- @param[out] NewSm3Context Pointer to new SM3 context.
-
- @retval TRUE SM3 context copy succeeded.
- @retval FALSE SM3 context copy failed.
- @retval FALSE This interface is not supported.
-
+ Release the specified RSA context.
+ If RsaContext is NULL, then return FALSE.
+ @param[in] RsaContext Pointer to the RSA context to be released.
**/
-BOOLEAN
+// See BaseCryptLib.h:1489
+VOID
EFIAPI
-Sm3Duplicate (
- IN CONST VOID *Sm3Context,
- OUT VOID *NewSm3Context
+RsaFree (
+ IN VOID *RsaContext
)
{
- CALL_CRYPTO_SERVICE (Sm3Duplicate, (Sm3Context, NewSm3Context), FALSE);
+ CALL_VOID_CRYPTO_SERVICE (RsaFree, (RsaContext));
}
/**
- Digests the input data and updates SM3 context.
-
- This function performs SM3 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
- by Sm3Final(). Behavior with invalid context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE SM3 data digest succeeded.
- @retval FALSE SM3 data digest failed.
-
+ Sets the tag-designated key component into the established RSA context.
+ This function sets the tag-designated RSA key component into the established
+ RSA context from the user-specified non-negative integer (octet string format
+ represented in RSA PKCS#1).
+ If BigNumber is NULL, then the specified key component in RSA context is cleared.
+ If RsaContext is NULL, then return FALSE.
+ @param[in, out] RsaContext Pointer to RSA context being set.
+ @param[in] KeyTag Tag of RSA key component being set.
+ @param[in] BigNumber Pointer to octet integer buffer.
+ If NULL, then the specified key component in RSA
+ context is cleared.
+ @param[in] BnSize Size of big number buffer in bytes.
+ If BigNumber is NULL, then it is ignored.
+ @retval TRUE RSA key component was set successfully.
+ @retval FALSE Invalid RSA key component tag.
**/
+// See BaseCryptLib.h:1517
BOOLEAN
EFIAPI
-Sm3Update (
- IN OUT VOID *Sm3Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+RsaSetKey (
+ IN OUT VOID *RsaContext,
+ IN RSA_KEY_TAG KeyTag,
+ IN CONST UINT8 *BigNumber,
+ IN UINTN BnSize
)
{
- CALL_CRYPTO_SERVICE (Sm3Update, (Sm3Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (RsaSetKey, (RsaContext, KeyTag, BigNumber, BnSize), FALSE);
}
/**
- Completes computation of the SM3 digest value.
-
- This function completes SM3 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the SM3 context cannot
- be used again.
- SM3 context should be already correctly initialized by Sm3Init(), and should not be
- finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
-
- If Sm3Context is NULL, then return FALSE.
- If HashValue is NULL, then return FALSE.
-
- @param[in, out] Sm3Context Pointer to the SM3 context.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
-
+ Gets the tag-designated RSA key component from the established RSA context.
+ This function retrieves the tag-designated RSA key component from the
+ established RSA context as a non-negative integer (octet string format
+ represented in RSA PKCS#1).
+ If specified key component has not been set or has been cleared, then returned
+ BnSize is set to 0.
+ If the BigNumber buffer is too small to hold the contents of the key, FALSE
+ is returned and BnSize is set to the required buffer size to obtain the key.
+ If RsaContext is NULL, then return FALSE.
+ If BnSize is NULL, then return FALSE.
+ If BnSize is large enough but BigNumber is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in, out] RsaContext Pointer to RSA context being set.
+ @param[in] KeyTag Tag of RSA key component being set.
+ @param[out] BigNumber Pointer to octet integer buffer.
+ @param[in, out] BnSize On input, the size of big number buffer in bytes.
+ On output, the size of data returned in big number buffer in bytes.
+ @retval TRUE RSA key component was retrieved successfully.
+ @retval FALSE Invalid RSA key component tag.
+ @retval FALSE BnSize is too small.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:1554
BOOLEAN
EFIAPI
-Sm3Final (
- IN OUT VOID *Sm3Context,
- OUT UINT8 *HashValue
+RsaGetKey (
+ IN OUT VOID *RsaContext,
+ IN RSA_KEY_TAG KeyTag,
+ OUT UINT8 *BigNumber,
+ IN OUT UINTN *BnSize
)
{
- CALL_CRYPTO_SERVICE (Sm3Final, (Sm3Context, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (RsaGetKey, (RsaContext, KeyTag, BigNumber, BnSize), FALSE);
}
/**
- Computes the SM3 message digest of a input data buffer.
-
- This function performs the SM3 message digest of a given data buffer, and places
- the digest value into the specified memory.
-
+ Generates RSA key components.
+ This function generates RSA key components. It takes RSA public exponent E and
+ length in bits of RSA modulus N as input, and generates all key components.
+ If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
+ Before this function can be invoked, pseudorandom number generator must be correctly
+ initialized by RandomSeed().
+ If RsaContext is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be hashed.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[out] HashValue Pointer to a buffer that receives the SM3 digest
- value (32 bytes).
-
- @retval TRUE SM3 digest computation succeeded.
- @retval FALSE SM3 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in, out] RsaContext Pointer to RSA context being set.
+ @param[in] ModulusLength Length of RSA modulus N in bits.
+ @param[in] PublicExponent Pointer to RSA public exponent.
+ @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
+ @retval TRUE RSA key component was generated successfully.
+ @retval FALSE Invalid RSA key component tag.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:1586
BOOLEAN
EFIAPI
-Sm3HashAll (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- OUT UINT8 *HashValue
+RsaGenerateKey (
+ IN OUT VOID *RsaContext,
+ IN UINTN ModulusLength,
+ IN CONST UINT8 *PublicExponent,
+ IN UINTN PublicExponentSize
)
{
- CALL_CRYPTO_SERVICE (Sm3HashAll, (Data, DataSize, HashValue), FALSE);
+ CALL_CRYPTO_SERVICE (RsaGenerateKey, (RsaContext, ModulusLength, PublicExponent, PublicExponentSize), FALSE);
}
-// =====================================================================================
-// MAC (Message Authentication Code) Primitive
-// =====================================================================================
-
/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha256New() returns NULL.
-
+ Validates key components of RSA context.
+ NOTE: This function performs integrity checks on all the RSA key material, so
+ the RSA key structure must contain all the private key data.
+ This function validates key components of RSA context in following aspects:
+ - Whether p is a prime
+ - Whether q is a prime
+ - Whether n = p * q
+ - Whether d*e = 1 mod lcm(p-1,q-1)
+ If RsaContext is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] RsaContext Pointer to RSA context to check.
+ @retval TRUE RSA key components are valid.
+ @retval FALSE RSA key components are not valid.
+ @retval FALSE This interface is not supported.
**/
-VOID *
+// See BaseCryptLib.h:1616
+BOOLEAN
EFIAPI
-HmacSha256New (
- VOID
+RsaCheckKey (
+ IN VOID *RsaContext
)
{
- CALL_CRYPTO_SERVICE (HmacSha256New, (), NULL);
+ CALL_CRYPTO_SERVICE (RsaCheckKey, (RsaContext), FALSE);
}
/**
- Release the specified HMAC_CTX context.
-
- @param[in] HmacSha256Ctx Pointer to the HMAC_CTX context to be released.
-
+ Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
+ This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
+ RSA PKCS#1.
+ If the Signature buffer is too small to hold the contents of signature, FALSE
+ is returned and SigSize is set to the required buffer size to obtain the signature.
+ If RsaContext is NULL, then return FALSE.
+ If MessageHash is NULL, then return FALSE.
+ If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
+ If SigSize is large enough but Signature is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] RsaContext Pointer to RSA context for signature generation.
+ @param[in] MessageHash Pointer to octet message hash to be signed.
+ @param[in] HashSize Size of the message hash in bytes.
+ @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
+ @param[in, out] SigSize On input, the size of Signature buffer in bytes.
+ On output, the size of data returned in Signature buffer in bytes.
+ @retval TRUE Signature successfully generated in PKCS1-v1_5.
+ @retval FALSE Signature generation failed.
+ @retval FALSE SigSize is too small.
+ @retval FALSE This interface is not supported.
**/
-VOID
+// See BaseCryptLib.h:1649
+BOOLEAN
EFIAPI
-HmacSha256Free (
- IN VOID *HmacSha256Ctx
+RsaPkcs1Sign (
+ IN VOID *RsaContext,
+ IN CONST UINT8 *MessageHash,
+ IN UINTN HashSize,
+ OUT UINT8 *Signature,
+ IN OUT UINTN *SigSize
)
{
- CALL_VOID_CRYPTO_SERVICE (HmacSha256Free, (HmacSha256Ctx));
+ CALL_CRYPTO_SERVICE (RsaPkcs1Sign, (RsaContext, MessageHash, HashSize, Signature, SigSize), FALSE);
}
/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha256Update().
-
- If HmacSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha256Context Pointer to HMAC-SHA256 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
- @retval FALSE This interface is not supported.
-
+ Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
+ RSA PKCS#1.
+ If RsaContext is NULL, then return FALSE.
+ If MessageHash is NULL, then return FALSE.
+ If Signature is NULL, then return FALSE.
+ If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then return FALSE.
+ @param[in] RsaContext Pointer to RSA context for signature verification.
+ @param[in] MessageHash Pointer to octet message hash to be checked.
+ @param[in] HashSize Size of the message hash in bytes.
+ @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
+ @param[in] SigSize Size of signature in bytes.
+ @retval TRUE Valid signature encoded in PKCS1-v1_5.
+ @retval FALSE Invalid signature or invalid RSA context.
**/
+// See BaseCryptLib.h:1678
BOOLEAN
EFIAPI
-HmacSha256SetKey (
- OUT VOID *HmacSha256Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
+RsaPkcs1Verify (
+ IN VOID *RsaContext,
+ IN CONST UINT8 *MessageHash,
+ IN UINTN HashSize,
+ IN CONST UINT8 *Signature,
+ IN UINTN SigSize
)
{
- CALL_CRYPTO_SERVICE (HmacSha256SetKey, (HmacSha256Context, Key, KeySize), FALSE);
+ CALL_CRYPTO_SERVICE (RsaPkcs1Verify, (RsaContext, MessageHash, HashSize, Signature, SigSize), FALSE);
}
/**
- Makes a copy of an existing HMAC-SHA256 context.
-
- If HmacSha256Context is NULL, then return FALSE.
- If NewHmacSha256Context is NULL, then return FALSE.
+ Carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme.
+ This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
+ RFC 8017.
+ Mask generation function is the same as the message digest algorithm.
+ If the Signature buffer is too small to hold the contents of signature, FALSE
+ is returned and SigSize is set to the required buffer size to obtain the signature.
+ If RsaContext is NULL, then return FALSE.
+ If Message is NULL, then return FALSE.
+ If MsgSize is zero or > INT_MAX, then return FALSE.
+ If DigestLen is NOT 32, 48 or 64, return FALSE.
+ If SaltLen is not equal to DigestLen, then return FALSE.
+ If SigSize is large enough but Signature is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha256Context Pointer to HMAC-SHA256 context being copied.
- @param[out] NewHmacSha256Context Pointer to new HMAC-SHA256 context.
-
- @retval TRUE HMAC-SHA256 context copy succeeded.
- @retval FALSE HMAC-SHA256 context copy failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] RsaContext Pointer to RSA context for signature generation.
+ @param[in] Message Pointer to octet message to be signed.
+ @param[in] MsgSize Size of the message in bytes.
+ @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
+ @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
+ @param[out] Signature Pointer to buffer to receive RSA PSS signature.
+ @param[in, out] SigSize On input, the size of Signature buffer in bytes.
+ On output, the size of data returned in Signature buffer in bytes.
+ @retval TRUE Signature successfully generated in RSASSA-PSS.
+ @retval FALSE Signature generation failed.
+ @retval FALSE SigSize is too small.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:1720
BOOLEAN
EFIAPI
-HmacSha256Duplicate (
- IN CONST VOID *HmacSha256Context,
- OUT VOID *NewHmacSha256Context
+RsaPssSign (
+ IN VOID *RsaContext,
+ IN CONST UINT8 *Message,
+ IN UINTN MsgSize,
+ IN UINT16 DigestLen,
+ IN UINT16 SaltLen,
+ OUT UINT8 *Signature,
+ IN OUT UINTN *SigSize
)
{
- CALL_CRYPTO_SERVICE (HmacSha256Duplicate, (HmacSha256Context, NewHmacSha256Context), FALSE);
+ CALL_CRYPTO_SERVICE (RsaPssSign, (RsaContext, Message, MsgSize, DigestLen, SaltLen, Signature, SigSize), FALSE);
}
/**
- Digests the input data and updates HMAC-SHA256 context.
-
- This function performs HMAC-SHA256 digest on a data buffer of the specified size.
- It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA256 data digest succeeded.
- @retval FALSE HMAC-SHA256 data digest failed.
- @retval FALSE This interface is not supported.
-
+ Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
+ Implementation determines salt length automatically from the signature encoding.
+ Mask generation function is the same as the message digest algorithm.
+ Salt length should be equal to digest length.
+ @param[in] RsaContext Pointer to RSA context for signature verification.
+ @param[in] Message Pointer to octet message to be verified.
+ @param[in] MsgSize Size of the message in bytes.
+ @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
+ @param[in] SigSize Size of signature in bytes.
+ @param[in] DigestLen Length of digest for RSA operation.
+ @param[in] SaltLen Salt length for PSS encoding.
+ @retval TRUE Valid signature encoded in RSASSA-PSS.
+ @retval FALSE Invalid signature or invalid RSA context.
**/
+// See BaseCryptLib.h:1750
BOOLEAN
EFIAPI
-HmacSha256Update (
- IN OUT VOID *HmacSha256Context,
- IN CONST VOID *Data,
- IN UINTN DataSize
+RsaPssVerify (
+ IN VOID *RsaContext,
+ IN CONST UINT8 *Message,
+ IN UINTN MsgSize,
+ IN CONST UINT8 *Signature,
+ IN UINTN SigSize,
+ IN UINT16 DigestLen,
+ IN UINT16 SaltLen
)
{
- CALL_CRYPTO_SERVICE (HmacSha256Update, (HmacSha256Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (RsaPssVerify, (RsaContext, Message, MsgSize, Signature, SigSize, DigestLen, SaltLen), FALSE);
}
/**
- Completes computation of the HMAC-SHA256 digest value.
-
- This function completes HMAC-SHA256 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA256 context cannot
- be used again.
- HMAC-SHA256 context should be initialized by HmacSha256New(), and should not be finalized
- by HmacSha256Final(). Behavior with invalid HMAC-SHA256 context is undefined.
-
- If HmacSha256Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
+ Retrieve the RSA Private Key from the password-protected PEM key data.
+ If PemData is NULL, then return FALSE.
+ If RsaContext is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha256Context Pointer to the HMAC-SHA256 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
+ @param[in] PemSize Size of the PEM key data in bytes.
+ @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
+ @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
+ RSA private key component. Use RsaFree() function to free the
+ resource.
+ @retval TRUE RSA Private Key was retrieved successfully.
+ @retval FALSE Invalid PEM key data or incorrect password.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:1781
BOOLEAN
EFIAPI
-HmacSha256Final (
- IN OUT VOID *HmacSha256Context,
- OUT UINT8 *HmacValue
+RsaGetPrivateKeyFromPem (
+ IN CONST UINT8 *PemData,
+ IN UINTN PemSize,
+ IN CONST CHAR8 *Password,
+ OUT VOID **RsaContext
)
{
- CALL_CRYPTO_SERVICE (HmacSha256Final, (HmacSha256Context, HmacValue), FALSE);
+ CALL_CRYPTO_SERVICE (RsaGetPrivateKeyFromPem, (PemData, PemSize, Password, RsaContext), FALSE);
}
/**
- Computes the HMAC-SHA256 digest of a input data buffer.
-
- This function performs the HMAC-SHA256 digest of a given data buffer, and places
- the digest value into the specified memory.
-
+ Retrieve the RSA Public Key from one DER-encoded X509 certificate.
+ If Cert is NULL, then return FALSE.
+ If RsaContext is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA256 digest
- value (32 bytes).
-
- @retval TRUE HMAC-SHA256 digest computation succeeded.
- @retval FALSE HMAC-SHA256 digest computation failed.
- @retval FALSE This interface is not supported.
-
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
+ RSA public key component. Use RsaFree() function to free the
+ resource.
+ @retval TRUE RSA Public Key was retrieved successfully.
+ @retval FALSE Fail to retrieve RSA public key from X509 certificate.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:1808
BOOLEAN
EFIAPI
-HmacSha256All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
+RsaGetPublicKeyFromX509 (
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT VOID **RsaContext
)
{
- CALL_CRYPTO_SERVICE (HmacSha256All, (Data, DataSize, Key, KeySize, HmacValue), FALSE);
+ CALL_CRYPTO_SERVICE (RsaGetPublicKeyFromX509, (Cert, CertSize, RsaContext), FALSE);
}
/**
- Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA384 use.
-
- @return Pointer to the HMAC_CTX context that has been initialized.
- If the allocations fails, HmacSha384New() returns NULL.
-
-**/
-VOID *
-EFIAPI
-HmacSha384New (
- VOID
+ Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ encrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - X509 key size does not match any known key size.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ - Data size is too large for the provided key size (max size is a function of key size
+ and hash digest size).
+ @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
+ provisioned with a public key using RsaSetKey().
+ @param[in] InData Data to be encrypted.
+ @param[in] InDataSize Size of the data buffer.
+ @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
+ to be used when initializing the PRNG. NULL otherwise.
+ @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
+ 0 otherwise.
+ @param[in] DigestLen [Optional] If provided, size of the hash used:
+ SHA1_DIGEST_SIZE
+ SHA256_DIGEST_SIZE
+ SHA384_DIGEST_SIZE
+ SHA512_DIGEST_SIZE
+ 0 to use default (SHA1)
+ @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] EncryptedDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
+**/
+// See BaseCryptLib.h:2185
+BOOLEAN
+EFIAPI
+RsaOaepEncrypt (
+ IN VOID *RsaContext,
+ IN UINT8 *InData,
+ IN UINTN InDataSize,
+ IN CONST UINT8 *PrngSeed OPTIONAL,
+ IN UINTN PrngSeedSize OPTIONAL,
+ IN UINT16 DigestLen OPTIONAL,
+ OUT UINT8 **EncryptedData,
+ OUT UINTN *EncryptedDataSize
)
{
- CALL_CRYPTO_SERVICE (HmacSha384New, (), NULL);
+ CALL_CRYPTO_SERVICE (RsaOaepEncrypt, (RsaContext, InData, InDataSize, PrngSeed, PrngSeedSize, DigestLen, EncryptedData, EncryptedDataSize), FALSE);
}
/**
- Release the specified HMAC_CTX context.
+ Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+ decrypted message in a newly allocated buffer.
+ Things that can cause a failure include:
+ - Fail to parse private key.
+ - Fail to allocate an intermediate buffer.
+ - Null pointer provided for a non-optional parameter.
+ @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
+ provisioned with a private key using RsaSetKey().
+ @param[in] EncryptedData Data to be decrypted.
+ @param[in] EncryptedDataSize Size of the encrypted buffer.
+ @param[in] DigestLen [Optional] If provided, size of the hash used:
+ SHA1_DIGEST_SIZE
+ SHA256_DIGEST_SIZE
+ SHA384_DIGEST_SIZE
+ SHA512_DIGEST_SIZE
+ 0 to use default (SHA1)
+ @param[out] OutData Pointer to an allocated buffer containing the encrypted
+ message.
+ @param[out] OutDataSize Size of the encrypted message buffer.
+ @retval TRUE Encryption was successful.
+ @retval FALSE Encryption failed.
+**/
+// See BaseCryptLib.h:2257
+BOOLEAN
+EFIAPI
+RsaOaepDecrypt (
+ IN VOID *RsaContext,
+ IN UINT8 *EncryptedData,
+ IN UINTN EncryptedDataSize,
+ IN UINT16 DigestLen OPTIONAL,
+ OUT UINT8 **OutData,
+ OUT UINTN *OutDataSize
+ )
+{
+ CALL_CRYPTO_SERVICE (RsaOaepDecrypt, (RsaContext, EncryptedData, EncryptedDataSize, DigestLen, OutData, OutDataSize), FALSE);
+}
- @param[in] HmacSha384Ctx Pointer to the HMAC_CTX context to be released.
+// =============================================================================
+// SHA1 functions
+// =============================================================================
+/**
+ Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
+ If this interface is not supported, then return zero.
+ @return The size, in bytes, of the context buffer required for SHA-1 hash operations.
+ @retval 0 This interface is not supported.
**/
-VOID
+// See BaseCryptLib.h:244
+UINTN
EFIAPI
-HmacSha384Free (
- IN VOID *HmacSha384Ctx
+Sha1GetContextSize (
+ VOID
)
{
- CALL_VOID_CRYPTO_SERVICE (HmacSha384Free, (HmacSha384Ctx));
+ CALL_CRYPTO_SERVICE (Sha1GetContextSize, (), 0);
}
/**
- Set user-supplied key for subsequent use. It must be done before any
- calling to HmacSha384Update().
-
- If HmacSha384Context is NULL, then return FALSE.
+ Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
+ subsequent use.
+ If Sha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[out] HmacSha384Context Pointer to HMAC-SHA384 context.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
-
- @retval TRUE The Key is set successfully.
- @retval FALSE The Key is set unsuccessfully.
+ @param[out] Sha1Context Pointer to SHA-1 context being initialized.
+ @retval TRUE SHA-1 context initialization succeeded.
+ @retval FALSE SHA-1 context initialization failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:264
BOOLEAN
EFIAPI
-HmacSha384SetKey (
- OUT VOID *HmacSha384Context,
- IN CONST UINT8 *Key,
- IN UINTN KeySize
+Sha1Init (
+ OUT VOID *Sha1Context
)
{
- CALL_CRYPTO_SERVICE (HmacSha384SetKey, (HmacSha384Context, Key, KeySize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha1Init, (Sha1Context), FALSE);
}
/**
- Makes a copy of an existing HMAC-SHA384 context.
-
- If HmacSha384Context is NULL, then return FALSE.
- If NewHmacSha384Context is NULL, then return FALSE.
+ Makes a copy of an existing SHA-1 context.
+ If Sha1Context is NULL, then return FALSE.
+ If NewSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] HmacSha384Context Pointer to HMAC-SHA384 context being copied.
- @param[out] NewHmacSha384Context Pointer to new HMAC-SHA384 context.
-
- @retval TRUE HMAC-SHA384 context copy succeeded.
- @retval FALSE HMAC-SHA384 context copy failed.
+ @param[in] Sha1Context Pointer to SHA-1 context being copied.
+ @param[out] NewSha1Context Pointer to new SHA-1 context.
+ @retval TRUE SHA-1 context copy succeeded.
+ @retval FALSE SHA-1 context copy failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:285
BOOLEAN
EFIAPI
-HmacSha384Duplicate (
- IN CONST VOID *HmacSha384Context,
- OUT VOID *NewHmacSha384Context
+Sha1Duplicate (
+ IN CONST VOID *Sha1Context,
+ OUT VOID *NewSha1Context
)
{
- CALL_CRYPTO_SERVICE (HmacSha384Duplicate, (HmacSha384Context, NewHmacSha384Context), FALSE);
+ CALL_CRYPTO_SERVICE (Sha1Duplicate, (Sha1Context, NewSha1Context), FALSE);
}
/**
- Digests the input data and updates HMAC-SHA384 context.
-
- This function performs HMAC-SHA384 digest on a data buffer of the specified size.
+ Digests the input data and updates SHA-1 context.
+ This function performs SHA-1 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
+ SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
+ by Sha1Final(). Behavior with invalid context is undefined.
+ If Sha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[in] Data Pointer to the buffer containing the data to be digested.
- @param[in] DataSize Size of Data buffer in bytes.
-
- @retval TRUE HMAC-SHA384 data digest succeeded.
- @retval FALSE HMAC-SHA384 data digest failed.
+ @param[in, out] Sha1Context Pointer to the SHA-1 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-1 data digest succeeded.
+ @retval FALSE SHA-1 data digest failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:312
BOOLEAN
EFIAPI
-HmacSha384Update (
- IN OUT VOID *HmacSha384Context,
+Sha1Update (
+ IN OUT VOID *Sha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (HmacSha384Update, (HmacSha384Context, Data, DataSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha1Update, (Sha1Context, Data, DataSize), FALSE);
}
/**
- Completes computation of the HMAC-SHA384 digest value.
-
- This function completes HMAC-SHA384 hash computation and retrieves the digest value into
- the specified memory. After this function has been called, the HMAC-SHA384 context cannot
+ Completes computation of the SHA-1 digest value.
+ This function completes SHA-1 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-1 context cannot
be used again.
- HMAC-SHA384 context should be initialized by HmacSha384New(), and should not be finalized
- by HmacSha384Final(). Behavior with invalid HMAC-SHA384 context is undefined.
-
- If HmacSha384Context is NULL, then return FALSE.
- If HmacValue is NULL, then return FALSE.
+ SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
+ finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
+ If Sha1Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in, out] HmacSha384Context Pointer to the HMAC-SHA384 context.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
+ @param[in, out] Sha1Context Pointer to the SHA-1 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
+ value (20 bytes).
+ @retval TRUE SHA-1 digest computation succeeded.
+ @retval FALSE SHA-1 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:342
BOOLEAN
EFIAPI
-HmacSha384Final (
- IN OUT VOID *HmacSha384Context,
- OUT UINT8 *HmacValue
+Sha1Final (
+ IN OUT VOID *Sha1Context,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (HmacSha384Final, (HmacSha384Context, HmacValue), FALSE);
+ CALL_CRYPTO_SERVICE (Sha1Final, (Sha1Context, HashValue), FALSE);
}
/**
- Computes the HMAC-SHA384 digest of a input data buffer.
-
- This function performs the HMAC-SHA384 digest of a given data buffer, and places
+ Computes the SHA-1 message digest of a input data buffer.
+ This function performs the SHA-1 message digest of a given data buffer, and places
the digest value into the specified memory.
-
If this interface is not supported, then return FALSE.
-
- @param[in] Data Pointer to the buffer containing the data to be digested.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
@param[in] DataSize Size of Data buffer in bytes.
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA384 digest
- value (48 bytes).
-
- @retval TRUE HMAC-SHA384 digest computation succeeded.
- @retval FALSE HMAC-SHA384 digest computation failed.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-1 digest
+ value (20 bytes).
+ @retval TRUE SHA-1 digest computation succeeded.
+ @retval FALSE SHA-1 digest computation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:367
BOOLEAN
EFIAPI
-HmacSha384All (
- IN CONST VOID *Data,
- IN UINTN DataSize,
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- OUT UINT8 *HmacValue
+Sha1HashAll (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (HmacSha384All, (Data, DataSize, Key, KeySize, HmacValue), FALSE);
+ CALL_CRYPTO_SERVICE (Sha1HashAll, (Data, DataSize, HashValue), FALSE);
}
-// =====================================================================================
-// Symmetric Cryptography Primitive
-// =====================================================================================
+// =============================================================================
+// SHA256 functions
+// =============================================================================
/**
- Retrieves the size, in bytes, of the context buffer required for AES operations.
-
- If this interface is not supported, then return zero.
-
- @return The size, in bytes, of the context buffer required for AES operations.
- @retval 0 This interface is not supported.
-
+ Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
+ @return The size, in bytes, of the context buffer required for SHA-256 hash operations.
**/
+// See BaseCryptLib.h:383
UINTN
EFIAPI
-AesGetContextSize (
+Sha256GetContextSize (
VOID
)
{
- CALL_CRYPTO_SERVICE (AesGetContextSize, (), 0);
+ CALL_CRYPTO_SERVICE (Sha256GetContextSize, (), 0);
}
/**
- Initializes user-supplied memory as AES context for subsequent use.
-
- This function initializes user-supplied memory pointed by AesContext as AES context.
- In addition, it sets up all AES key materials for subsequent encryption and decryption
- operations.
- There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
-
- If AesContext is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeyLength is not valid, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] AesContext Pointer to AES context being initialized.
- @param[in] Key Pointer to the user-supplied AES key.
- @param[in] KeyLength Length of AES key in bits.
-
- @retval TRUE AES context initialization succeeded.
- @retval FALSE AES context initialization failed.
- @retval FALSE This interface is not supported.
-
+ Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
+ subsequent use.
+ If Sha256Context is NULL, then return FALSE.
+ @param[out] Sha256Context Pointer to SHA-256 context being initialized.
+ @retval TRUE SHA-256 context initialization succeeded.
+ @retval FALSE SHA-256 context initialization failed.
**/
+// See BaseCryptLib.h:401
BOOLEAN
EFIAPI
-AesInit (
- OUT VOID *AesContext,
- IN CONST UINT8 *Key,
- IN UINTN KeyLength
+Sha256Init (
+ OUT VOID *Sha256Context
)
{
- CALL_CRYPTO_SERVICE (AesInit, (AesContext, Key, KeyLength), FALSE);
+ CALL_CRYPTO_SERVICE (Sha256Init, (Sha256Context), FALSE);
}
/**
- Performs AES encryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES encryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
+ Makes a copy of an existing SHA-256 context.
+ If Sha256Context is NULL, then return FALSE.
+ If NewSha256Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES encryption succeeded.
- @retval FALSE AES encryption failed.
+ @param[in] Sha256Context Pointer to SHA-256 context being copied.
+ @param[out] NewSha256Context Pointer to new SHA-256 context.
+ @retval TRUE SHA-256 context copy succeeded.
+ @retval FALSE SHA-256 context copy failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:422
BOOLEAN
EFIAPI
-AesCbcEncrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
+Sha256Duplicate (
+ IN CONST VOID *Sha256Context,
+ OUT VOID *NewSha256Context
)
{
- CALL_CRYPTO_SERVICE (AesCbcEncrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);
+ CALL_CRYPTO_SERVICE (Sha256Duplicate, (Sha256Context, NewSha256Context), FALSE);
}
/**
- Performs AES decryption on a data buffer of the specified size in CBC mode.
-
- This function performs AES decryption on data buffer pointed by Input, of specified
- size of InputSize, in CBC mode.
- InputSize must be multiple of block size (16 bytes). This function does not perform
- padding. Caller must perform padding, if necessary, to ensure valid input data size.
- Initialization vector should be one block size (16 bytes).
- AesContext should be already correctly initialized by AesInit(). Behavior with
- invalid AES context is undefined.
-
- If AesContext is NULL, then return FALSE.
- If Input is NULL, then return FALSE.
- If InputSize is not multiple of block size (16 bytes), then return FALSE.
- If Ivec is NULL, then return FALSE.
- If Output is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AesContext Pointer to the AES context.
- @param[in] Input Pointer to the buffer containing the data to be encrypted.
- @param[in] InputSize Size of the Input buffer in bytes.
- @param[in] Ivec Pointer to initialization vector.
- @param[out] Output Pointer to a buffer that receives the AES encryption output.
-
- @retval TRUE AES decryption succeeded.
- @retval FALSE AES decryption failed.
- @retval FALSE This interface is not supported.
-
+ Digests the input data and updates SHA-256 context.
+ This function performs SHA-256 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
+ by Sha256Final(). Behavior with invalid context is undefined.
+ If Sha256Context is NULL, then return FALSE.
+ @param[in, out] Sha256Context Pointer to the SHA-256 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-256 data digest succeeded.
+ @retval FALSE SHA-256 data digest failed.
**/
+// See BaseCryptLib.h:447
BOOLEAN
EFIAPI
-AesCbcDecrypt (
- IN VOID *AesContext,
- IN CONST UINT8 *Input,
- IN UINTN InputSize,
- IN CONST UINT8 *Ivec,
- OUT UINT8 *Output
+Sha256Update (
+ IN OUT VOID *Sha256Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (AesCbcDecrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);
+ CALL_CRYPTO_SERVICE (Sha256Update, (Sha256Context, Data, DataSize), FALSE);
}
-// =====================================================================================
-// Authenticated Encryption with Associated Data (AEAD) Cryptography Primitive
-// =====================================================================================
-
/**
- Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be encrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the encryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated encryption failed.
-
+ Completes computation of the SHA-256 digest value.
+ This function completes SHA-256 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-256 context cannot
+ be used again.
+ SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
+ finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
+ If Sha256Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sha256Context Pointer to the SHA-256 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
+ value (32 bytes).
+ @retval TRUE SHA-256 digest computation succeeded.
+ @retval FALSE SHA-256 digest computation failed.
**/
+// See BaseCryptLib.h:475
BOOLEAN
EFIAPI
-AeadAesGcmEncrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- OUT UINT8 *TagOut,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
+Sha256Final (
+ IN OUT VOID *Sha256Context,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha256Final, (Sha256Context, HashValue), FALSE);
}
/**
- Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
-
- IvSize must be 12, otherwise FALSE is returned.
- KeySize must be 16, 24 or 32, otherwise FALSE is returned.
- TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
- If additional authenticated data verification fails, FALSE is returned.
-
- @param[in] Key Pointer to the encryption key.
- @param[in] KeySize Size of the encryption key in bytes.
- @param[in] Iv Pointer to the IV value.
- @param[in] IvSize Size of the IV value in bytes.
- @param[in] AData Pointer to the additional authenticated data (AAD).
- @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
- @param[in] DataIn Pointer to the input data buffer to be decrypted.
- @param[in] DataInSize Size of the input data buffer in bytes.
- @param[in] Tag Pointer to a buffer that contains the authentication tag.
- @param[in] TagSize Size of the authentication tag in bytes.
- @param[out] DataOut Pointer to a buffer that receives the decryption output.
- @param[out] DataOutSize Size of the output data buffer in bytes.
-
- @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
- @retval FALSE AEAD AES-GCM authenticated decryption failed.
-
+ Computes the SHA-256 message digest of a input data buffer.
+ This function performs the SHA-256 message digest of a given data buffer, and places
+ the digest value into the specified memory.
+ If this interface is not supported, then return FALSE.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-256 digest
+ value (32 bytes).
+ @retval TRUE SHA-256 digest computation succeeded.
+ @retval FALSE SHA-256 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:500
BOOLEAN
EFIAPI
-AeadAesGcmDecrypt (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Iv,
- IN UINTN IvSize,
- IN CONST UINT8 *AData,
- IN UINTN ADataSize,
- IN CONST UINT8 *DataIn,
- IN UINTN DataInSize,
- IN CONST UINT8 *Tag,
- IN UINTN TagSize,
- OUT UINT8 *DataOut,
- OUT UINTN *DataOutSize
+Sha256HashAll (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha256HashAll, (Data, DataSize, HashValue), FALSE);
}
-// =====================================================================================
-// Asymmetric Cryptography Primitive
-// =====================================================================================
+// =============================================================================
+// SHA384 functions
+// =============================================================================
/**
- Allocates and initializes one RSA context for subsequent use.
-
- @return Pointer to the RSA context that has been initialized.
- If the allocations fails, RsaNew() returns NULL.
-
+ Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
+ @return The size, in bytes, of the context buffer required for SHA-384 hash operations.
**/
-VOID *
+// See BaseCryptLib.h:514
+UINTN
EFIAPI
-RsaNew (
+Sha384GetContextSize (
VOID
)
{
- CALL_CRYPTO_SERVICE (RsaNew, (), NULL);
+ CALL_CRYPTO_SERVICE (Sha384GetContextSize, (), 0);
}
/**
- Release the specified RSA context.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in] RsaContext Pointer to the RSA context to be released.
-
-**/
-VOID
-EFIAPI
-RsaFree (
- IN VOID *RsaContext
+ Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
+ subsequent use.
+ If Sha384Context is NULL, then return FALSE.
+ @param[out] Sha384Context Pointer to SHA-384 context being initialized.
+ @retval TRUE SHA-384 context initialization succeeded.
+ @retval FALSE SHA-384 context initialization failed.
+**/
+// See BaseCryptLib.h:532
+BOOLEAN
+EFIAPI
+Sha384Init (
+ OUT VOID *Sha384Context
)
{
- CALL_VOID_CRYPTO_SERVICE (RsaFree, (RsaContext));
+ CALL_CRYPTO_SERVICE (Sha384Init, (Sha384Context), FALSE);
}
/**
- Sets the tag-designated key component into the established RSA context.
-
- This function sets the tag-designated RSA key component into the established
- RSA context from the user-specified non-negative integer (octet string format
- represented in RSA PKCS#1).
- If BigNumber is NULL, then the specified key component in RSA context is cleared.
-
- If RsaContext is NULL, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[in] BigNumber Pointer to octet integer buffer.
- If NULL, then the specified key component in RSA
- context is cleared.
- @param[in] BnSize Size of big number buffer in bytes.
- If BigNumber is NULL, then it is ignored.
-
- @retval TRUE RSA key component was set successfully.
- @retval FALSE Invalid RSA key component tag.
-
+ Makes a copy of an existing SHA-384 context.
+ If Sha384Context is NULL, then return FALSE.
+ If NewSha384Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Sha384Context Pointer to SHA-384 context being copied.
+ @param[out] NewSha384Context Pointer to new SHA-384 context.
+ @retval TRUE SHA-384 context copy succeeded.
+ @retval FALSE SHA-384 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:553
BOOLEAN
EFIAPI
-RsaSetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- IN CONST UINT8 *BigNumber,
- IN UINTN BnSize
+Sha384Duplicate (
+ IN CONST VOID *Sha384Context,
+ OUT VOID *NewSha384Context
)
{
- CALL_CRYPTO_SERVICE (RsaSetKey, (RsaContext, KeyTag, BigNumber, BnSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha384Duplicate, (Sha384Context, NewSha384Context), FALSE);
}
/**
- Gets the tag-designated RSA key component from the established RSA context.
-
- This function retrieves the tag-designated RSA key component from the
- established RSA context as a non-negative integer (octet string format
- represented in RSA PKCS#1).
- If specified key component has not been set or has been cleared, then returned
- BnSize is set to 0.
- If the BigNumber buffer is too small to hold the contents of the key, FALSE
- is returned and BnSize is set to the required buffer size to obtain the key.
-
- If RsaContext is NULL, then return FALSE.
- If BnSize is NULL, then return FALSE.
- If BnSize is large enough but BigNumber is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] KeyTag Tag of RSA key component being set.
- @param[out] BigNumber Pointer to octet integer buffer.
- @param[in, out] BnSize On input, the size of big number buffer in bytes.
- On output, the size of data returned in big number buffer in bytes.
-
- @retval TRUE RSA key component was retrieved successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE BnSize is too small.
- @retval FALSE This interface is not supported.
-
+ Digests the input data and updates SHA-384 context.
+ This function performs SHA-384 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-384 context should be already correctly initialized by Sha384Init(), and should not be finalized
+ by Sha384Final(). Behavior with invalid context is undefined.
+ If Sha384Context is NULL, then return FALSE.
+ @param[in, out] Sha384Context Pointer to the SHA-384 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-384 data digest succeeded.
+ @retval FALSE SHA-384 data digest failed.
**/
+// See BaseCryptLib.h:578
BOOLEAN
EFIAPI
-RsaGetKey (
- IN OUT VOID *RsaContext,
- IN RSA_KEY_TAG KeyTag,
- OUT UINT8 *BigNumber,
- IN OUT UINTN *BnSize
+Sha384Update (
+ IN OUT VOID *Sha384Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (RsaGetKey, (RsaContext, KeyTag, BigNumber, BnSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha384Update, (Sha384Context, Data, DataSize), FALSE);
}
/**
- Generates RSA key components.
-
- This function generates RSA key components. It takes RSA public exponent E and
- length in bits of RSA modulus N as input, and generates all key components.
- If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] RsaContext Pointer to RSA context being set.
- @param[in] ModulusLength Length of RSA modulus N in bits.
- @param[in] PublicExponent Pointer to RSA public exponent.
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
-
- @retval TRUE RSA key component was generated successfully.
- @retval FALSE Invalid RSA key component tag.
- @retval FALSE This interface is not supported.
-
+ Completes computation of the SHA-384 digest value.
+ This function completes SHA-384 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-384 context cannot
+ be used again.
+ SHA-384 context should be already correctly initialized by Sha384Init(), and should not be
+ finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
+ If Sha384Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sha384Context Pointer to the SHA-384 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
+ value (48 bytes).
+ @retval TRUE SHA-384 digest computation succeeded.
+ @retval FALSE SHA-384 digest computation failed.
**/
+// See BaseCryptLib.h:606
BOOLEAN
EFIAPI
-RsaGenerateKey (
- IN OUT VOID *RsaContext,
- IN UINTN ModulusLength,
- IN CONST UINT8 *PublicExponent,
- IN UINTN PublicExponentSize
+Sha384Final (
+ IN OUT VOID *Sha384Context,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (RsaGenerateKey, (RsaContext, ModulusLength, PublicExponent, PublicExponentSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha384Final, (Sha384Context, HashValue), FALSE);
}
/**
- Validates key components of RSA context.
- NOTE: This function performs integrity checks on all the RSA key material, so
- the RSA key structure must contain all the private key data.
-
- This function validates key components of RSA context in following aspects:
- - Whether p is a prime
- - Whether q is a prime
- - Whether n = p * q
- - Whether d*e = 1 mod lcm(p-1,q-1)
-
- If RsaContext is NULL, then return FALSE.
+ Computes the SHA-384 message digest of a input data buffer.
+ This function performs the SHA-384 message digest of a given data buffer, and places
+ the digest value into the specified memory.
If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context to check.
-
- @retval TRUE RSA key components are valid.
- @retval FALSE RSA key components are not valid.
- @retval FALSE This interface is not supported.
-
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
+ value (48 bytes).
+ @retval TRUE SHA-384 digest computation succeeded.
+ @retval FALSE SHA-384 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:631
BOOLEAN
EFIAPI
-RsaCheckKey (
- IN VOID *RsaContext
+Sha384HashAll (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (RsaCheckKey, (RsaContext), FALSE);
+ CALL_CRYPTO_SERVICE (Sha384HashAll, (Data, DataSize, HashValue), FALSE);
}
-/**
- Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
-
- This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] MessageHash Pointer to octet message hash to be signed.
- @param[in] HashSize Size of the message hash in bytes.
- @param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in PKCS1-v1_5.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
+// =============================================================================
+// SHA512 functions
+// =============================================================================
+/**
+ Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
+ @return The size, in bytes, of the context buffer required for SHA-512 hash operations.
**/
-BOOLEAN
+// See BaseCryptLib.h:645
+UINTN
EFIAPI
-RsaPkcs1Sign (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
+Sha512GetContextSize (
+ VOID
)
{
- CALL_CRYPTO_SERVICE (RsaPkcs1Sign, (RsaContext, MessageHash, HashSize, Signature, SigSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha512GetContextSize, (), 0);
}
/**
- Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
- RSA PKCS#1.
-
- If RsaContext is NULL, then return FALSE.
- If MessageHash is NULL, then return FALSE.
- If Signature is NULL, then return FALSE.
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] MessageHash Pointer to octet message hash to be checked.
- @param[in] HashSize Size of the message hash in bytes.
- @param[in] Signature Pointer to RSA PKCS1-v1_5 signature to be verified.
- @param[in] SigSize Size of signature in bytes.
-
- @retval TRUE Valid signature encoded in PKCS1-v1_5.
- @retval FALSE Invalid signature or invalid RSA context.
-
+ Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
+ subsequent use.
+ If Sha512Context is NULL, then return FALSE.
+ @param[out] Sha512Context Pointer to SHA-512 context being initialized.
+ @retval TRUE SHA-512 context initialization succeeded.
+ @retval FALSE SHA-512 context initialization failed.
**/
+// See BaseCryptLib.h:663
BOOLEAN
EFIAPI
-RsaPkcs1Verify (
- IN VOID *RsaContext,
- IN CONST UINT8 *MessageHash,
- IN UINTN HashSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize
+Sha512Init (
+ OUT VOID *Sha512Context
)
{
- CALL_CRYPTO_SERVICE (RsaPkcs1Verify, (RsaContext, MessageHash, HashSize, Signature, SigSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha512Init, (Sha512Context), FALSE);
}
/**
- Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
- Implementation determines salt length automatically from the signature encoding.
- Mask generation function is the same as the message digest algorithm.
- Salt length should be equal to digest length.
-
- @param[in] RsaContext Pointer to RSA context for signature verification.
- @param[in] Message Pointer to octet message to be verified.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] Signature Pointer to RSASSA-PSS signature to be verified.
- @param[in] SigSize Size of signature in bytes.
- @param[in] DigestLen Length of digest for RSA operation.
- @param[in] SaltLen Salt length for PSS encoding.
-
- @retval TRUE Valid signature encoded in RSASSA-PSS.
- @retval FALSE Invalid signature or invalid RSA context.
-
+ Makes a copy of an existing SHA-512 context.
+ If Sha512Context is NULL, then return FALSE.
+ If NewSha512Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Sha512Context Pointer to SHA-512 context being copied.
+ @param[out] NewSha512Context Pointer to new SHA-512 context.
+ @retval TRUE SHA-512 context copy succeeded.
+ @retval FALSE SHA-512 context copy failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:684
BOOLEAN
EFIAPI
-RsaPssVerify (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN CONST UINT8 *Signature,
- IN UINTN SigSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen
+Sha512Duplicate (
+ IN CONST VOID *Sha512Context,
+ OUT VOID *NewSha512Context
)
{
- CALL_CRYPTO_SERVICE (RsaPssVerify, (RsaContext, Message, MsgSize, Signature, SigSize, DigestLen, SaltLen), FALSE);
+ CALL_CRYPTO_SERVICE (Sha512Duplicate, (Sha512Context, NewSha512Context), FALSE);
}
/**
- This function carries out the RSA-SSA signature generation with EMSA-PSS encoding scheme defined in
- RFC 8017.
- Mask generation function is the same as the message digest algorithm.
- If the Signature buffer is too small to hold the contents of signature, FALSE
- is returned and SigSize is set to the required buffer size to obtain the signature.
-
- If RsaContext is NULL, then return FALSE.
- If Message is NULL, then return FALSE.
- If MsgSize is zero or > INT_MAX, then return FALSE.
- If DigestLen is NOT 32, 48 or 64, return FALSE.
- If SaltLen is not equal to DigestLen, then return FALSE.
- If SigSize is large enough but Signature is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] RsaContext Pointer to RSA context for signature generation.
- @param[in] Message Pointer to octet message to be signed.
- @param[in] MsgSize Size of the message in bytes.
- @param[in] DigestLen Length of the digest in bytes to be used for RSA signature operation.
- @param[in] SaltLen Length of the salt in bytes to be used for PSS encoding.
- @param[out] Signature Pointer to buffer to receive RSA PSS signature.
- @param[in, out] SigSize On input, the size of Signature buffer in bytes.
- On output, the size of data returned in Signature buffer in bytes.
-
- @retval TRUE Signature successfully generated in RSASSA-PSS.
- @retval FALSE Signature generation failed.
- @retval FALSE SigSize is too small.
- @retval FALSE This interface is not supported.
-
+ Digests the input data and updates SHA-512 context.
+ This function performs SHA-512 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SHA-512 context should be already correctly initialized by Sha512Init(), and should not be finalized
+ by Sha512Final(). Behavior with invalid context is undefined.
+ If Sha512Context is NULL, then return FALSE.
+ @param[in, out] Sha512Context Pointer to the SHA-512 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SHA-512 data digest succeeded.
+ @retval FALSE SHA-512 data digest failed.
**/
+// See BaseCryptLib.h:709
BOOLEAN
EFIAPI
-RsaPssSign (
- IN VOID *RsaContext,
- IN CONST UINT8 *Message,
- IN UINTN MsgSize,
- IN UINT16 DigestLen,
- IN UINT16 SaltLen,
- OUT UINT8 *Signature,
- IN OUT UINTN *SigSize
+Sha512Update (
+ IN OUT VOID *Sha512Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (RsaPssSign, (RsaContext, Message, MsgSize, DigestLen, SaltLen, Signature, SigSize), FALSE);
+ CALL_CRYPTO_SERVICE (Sha512Update, (Sha512Context, Data, DataSize), FALSE);
}
/**
- Retrieve the RSA Private Key from the password-protected PEM key data.
-
- If PemData is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
- @param[in] PemSize Size of the PEM key data in bytes.
- @param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA private key component. Use RsaFree() function to free the
- resource.
-
- @retval TRUE RSA Private Key was retrieved successfully.
- @retval FALSE Invalid PEM key data or incorrect password.
- @retval FALSE This interface is not supported.
-
+ Completes computation of the SHA-512 digest value.
+ This function completes SHA-512 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SHA-512 context cannot
+ be used again.
+ SHA-512 context should be already correctly initialized by Sha512Init(), and should not be
+ finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
+ If Sha512Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sha512Context Pointer to the SHA-512 context.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
+ value (64 bytes).
+ @retval TRUE SHA-512 digest computation succeeded.
+ @retval FALSE SHA-512 digest computation failed.
**/
+// See BaseCryptLib.h:737
BOOLEAN
EFIAPI
-RsaGetPrivateKeyFromPem (
- IN CONST UINT8 *PemData,
- IN UINTN PemSize,
- IN CONST CHAR8 *Password,
- OUT VOID **RsaContext
+Sha512Final (
+ IN OUT VOID *Sha512Context,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (RsaGetPrivateKeyFromPem, (PemData, PemSize, Password, RsaContext), FALSE);
+ CALL_CRYPTO_SERVICE (Sha512Final, (Sha512Context, HashValue), FALSE);
}
/**
- Retrieve the RSA Public Key from one DER-encoded X509 certificate.
-
- If Cert is NULL, then return FALSE.
- If RsaContext is NULL, then return FALSE.
+ Computes the SHA-512 message digest of a input data buffer.
+ This function performs the SHA-512 message digest of a given data buffer, and places
+ the digest value into the specified memory.
If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
- RSA public key component. Use RsaFree() function to free the
- resource.
-
- @retval TRUE RSA Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve RSA public key from X509 certificate.
- @retval FALSE This interface is not supported.
-
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
+ value (64 bytes).
+ @retval TRUE SHA-512 digest computation succeeded.
+ @retval FALSE SHA-512 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:762
BOOLEAN
EFIAPI
-RsaGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **RsaContext
+Sha512HashAll (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (RsaGetPublicKeyFromX509, (Cert, CertSize, RsaContext), FALSE);
+ CALL_CRYPTO_SERVICE (Sha512HashAll, (Data, DataSize, HashValue), FALSE);
}
-/**
- Retrieve the subject bytes from one X.509 certificate.
-
- If Cert is NULL, then return FALSE.
- If SubjectSize is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
- @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
- and the size of buffer returned CertSubject on output.
-
- @retval TRUE The certificate subject retrieved successfully.
- @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
- The SubjectSize will be updated with the required size.
- @retval FALSE This interface is not supported.
+// =============================================================================
+// PARALLELHASH256 functions
+// =============================================================================
+/**
+ Parallel hash function ParallelHash256, as defined in NIST's Special Publication 800-185,
+ published December 2016.
+ @param[in] Input Pointer to the input message (X).
+ @param[in] InputByteLen The number(>0) of input bytes provided for the input data.
+ @param[in] BlockSize The size of each block (B).
+ @param[out] Output Pointer to the output buffer.
+ @param[in] OutputByteLen The desired number of output bytes (L).
+ @param[in] Customization Pointer to the customization string (S).
+ @param[in] CustomByteLen The length of the customization string in bytes.
+ @retval TRUE ParallelHash256 digest computation succeeded.
+ @retval FALSE ParallelHash256 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:787
BOOLEAN
EFIAPI
-X509GetSubjectName (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *CertSubject,
- IN OUT UINTN *SubjectSize
+ParallelHash256HashAll (
+ IN CONST VOID *Input,
+ IN UINTN InputByteLen,
+ IN UINTN BlockSize,
+ OUT VOID *Output,
+ IN UINTN OutputByteLen,
+ IN CONST VOID *Customization,
+ IN UINTN CustomByteLen
)
{
- CALL_CRYPTO_SERVICE (X509GetSubjectName, (Cert, CertSize, CertSubject, SubjectSize), FALSE);
+ CALL_CRYPTO_SERVICE (ParallelHash256HashAll, (Input, InputByteLen, BlockSize, Output, OutputByteLen, Customization, CustomByteLen), FALSE);
}
-/**
- Retrieve the common name (CN) string from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] CommonName Buffer to contain the retrieved certificate common
- name string (UTF8). At most CommonNameSize bytes will be
- written and the string will be null terminated. May be
- NULL in order to determine the size buffer needed.
- @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
- and the size of buffer returned CommonName on output.
- If CommonName is NULL then the amount of space needed
- in buffer (including the final null) is returned.
-
- @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
- @retval RETURN_INVALID_PARAMETER If Cert is NULL.
- If CommonNameSize is NULL.
- If CommonName is not NULL and *CommonNameSize is 0.
- If Certificate is invalid.
- @retval RETURN_NOT_FOUND If no CommonName entry exists.
- @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
- (including the final null) is returned in the
- CommonNameSize parameter.
- @retval RETURN_UNSUPPORTED The operation is not supported.
+// =============================================================================
+// AEADAESGCM functions
+// =============================================================================
+/**
+ Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).
+ IvSize must be 12, otherwise FALSE is returned.
+ KeySize must be 16, 24 or 32, otherwise FALSE is returned.
+ TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
+ @param[in] Key Pointer to the encryption key.
+ @param[in] KeySize Size of the encryption key in bytes.
+ @param[in] Iv Pointer to the IV value.
+ @param[in] IvSize Size of the IV value in bytes.
+ @param[in] AData Pointer to the additional authenticated data (AAD).
+ @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
+ @param[in] DataIn Pointer to the input data buffer to be encrypted.
+ @param[in] DataInSize Size of the input data buffer in bytes.
+ @param[out] TagOut Pointer to a buffer that receives the authentication tag output.
+ @param[in] TagSize Size of the authentication tag in bytes.
+ @param[out] DataOut Pointer to a buffer that receives the encryption output.
+ @param[out] DataOutSize Size of the output data buffer in bytes.
+ @retval TRUE AEAD AES-GCM authenticated encryption succeeded.
+ @retval FALSE AEAD AES-GCM authenticated encryption failed.
**/
-RETURN_STATUS
+// See BaseCryptLib.h:1405
+BOOLEAN
EFIAPI
-X509GetCommonName (
+AeadAesGcmEncrypt (
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Iv,
+ IN UINTN IvSize,
+ IN CONST UINT8 *AData,
+ IN UINTN ADataSize,
+ IN CONST UINT8 *DataIn,
+ IN UINTN DataInSize,
+ OUT UINT8 *TagOut,
+ IN UINTN TagSize,
+ OUT UINT8 *DataOut,
+ OUT UINTN *DataOutSize
+ )
+{
+ CALL_CRYPTO_SERVICE (AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);
+}
+
+/**
+ Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).
+ IvSize must be 12, otherwise FALSE is returned.
+ KeySize must be 16, 24 or 32, otherwise FALSE is returned.
+ TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.
+ If additional authenticated data verification fails, FALSE is returned.
+ @param[in] Key Pointer to the encryption key.
+ @param[in] KeySize Size of the encryption key in bytes.
+ @param[in] Iv Pointer to the IV value.
+ @param[in] IvSize Size of the IV value in bytes.
+ @param[in] AData Pointer to the additional authenticated data (AAD).
+ @param[in] ADataSize Size of the additional authenticated data (AAD) in bytes.
+ @param[in] DataIn Pointer to the input data buffer to be decrypted.
+ @param[in] DataInSize Size of the input data buffer in bytes.
+ @param[in] Tag Pointer to a buffer that contains the authentication tag.
+ @param[in] TagSize Size of the authentication tag in bytes.
+ @param[out] DataOut Pointer to a buffer that receives the decryption output.
+ @param[out] DataOutSize Size of the output data buffer in bytes.
+ @retval TRUE AEAD AES-GCM authenticated decryption succeeded.
+ @retval FALSE AEAD AES-GCM authenticated decryption failed.
+**/
+// See BaseCryptLib.h:1447
+BOOLEAN
+EFIAPI
+AeadAesGcmDecrypt (
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Iv,
+ IN UINTN IvSize,
+ IN CONST UINT8 *AData,
+ IN UINTN ADataSize,
+ IN CONST UINT8 *DataIn,
+ IN UINTN DataInSize,
+ IN CONST UINT8 *Tag,
+ IN UINTN TagSize,
+ OUT UINT8 *DataOut,
+ OUT UINTN *DataOutSize
+ )
+{
+ CALL_CRYPTO_SERVICE (AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);
+}
+
+// =============================================================================
+// X509 functions
+// =============================================================================
+
+/**
+ Retrieve the subject bytes from one X.509 certificate.
+ If Cert is NULL, then return FALSE.
+ If SubjectSize is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
+ @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
+ and the size of buffer returned CertSubject on output.
+ @retval TRUE The certificate subject retrieved successfully.
+ @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
+ The SubjectSize will be updated with the required size.
+ @retval FALSE This interface is not supported.
+**/
+// See BaseCryptLib.h:1835
+BOOLEAN
+EFIAPI
+X509GetSubjectName (
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *CertSubject,
+ IN OUT UINTN *SubjectSize
+ )
+{
+ CALL_CRYPTO_SERVICE (X509GetSubjectName, (Cert, CertSize, CertSubject, SubjectSize), FALSE);
+}
+
+/**
+ Retrieve the common name (CN) string from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] CommonName Buffer to contain the retrieved certificate common
+ name string (UTF8). At most CommonNameSize bytes will be
+ written and the string will be null terminated. May be
+ NULL in order to determine the size buffer needed.
+ @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
+ and the size of buffer returned CommonName on output.
+ If CommonName is NULL then the amount of space needed
+ in buffer (including the final null) is returned.
+ @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
+ @retval RETURN_INVALID_PARAMETER If Cert is NULL.
+ If CommonNameSize is NULL.
+ If CommonName is not NULL and *CommonNameSize is 0.
+ If Certificate is invalid.
+ @retval RETURN_NOT_FOUND If no CommonName entry exists.
+ @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
+ (including the final null) is returned in the
+ CommonNameSize parameter.
+ @retval RETURN_UNSUPPORTED The operation is not supported.
+**/
+// See BaseCryptLib.h:1870
+RETURN_STATUS
+EFIAPI
+X509GetCommonName (
IN CONST UINT8 *Cert,
IN UINTN CertSize,
OUT CHAR8 *CommonName OPTIONAL,
IN OUT UINTN *CommonNameSize
)
{
- CALL_CRYPTO_SERVICE (X509GetCommonName, (Cert, CertSize, CommonName, CommonNameSize), RETURN_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (X509GetCommonName, (Cert, CertSize, CommonName, CommonNameSize), 0);
}
/**
Retrieve the organization name (O) string from one X.509 certificate.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] NameBuffer Buffer to contain the retrieved certificate organization
@@ -2113,7 +2234,6 @@ X509GetCommonName (
and the size of buffer returned Name on output.
If NameBuffer is NULL then the amount of space needed
in buffer (including the final null) is returned.
-
@retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.
@retval RETURN_INVALID_PARAMETER If Cert is NULL.
If NameBufferSize is NULL.
@@ -2124,8 +2244,8 @@ X509GetCommonName (
(including the final null) is returned in the
CommonNameSize parameter.
@retval RETURN_UNSUPPORTED The operation is not supported.
-
**/
+// See BaseCryptLib.h:1905
RETURN_STATUS
EFIAPI
X509GetOrganizationName (
@@ -2135,27 +2255,24 @@ X509GetOrganizationName (
IN OUT UINTN *NameBufferSize
)
{
- CALL_CRYPTO_SERVICE (X509GetOrganizationName, (Cert, CertSize, NameBuffer, NameBufferSize), RETURN_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (X509GetOrganizationName, (Cert, CertSize, NameBuffer, NameBufferSize), 0);
}
/**
Verify one X509 certificate was issued by the trusted CA.
-
If Cert is NULL, then return FALSE.
If CACert is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[in] CACert Pointer to the DER-encoded trusted CA certificate.
@param[in] CACertSize Size of the CA Certificate in bytes.
-
@retval TRUE The certificate was issued by the trusted CA.
@retval FALSE Invalid certificate or the certificate was not issued by the given
trusted CA.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1932
BOOLEAN
EFIAPI
X509VerifyCert (
@@ -2170,20 +2287,17 @@ X509VerifyCert (
/**
Construct a X509 object from DER-encoded certificate data.
-
If Cert is NULL, then return FALSE.
If SingleX509Cert is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] Cert Pointer to the DER-encoded certificate data.
@param[in] CertSize The size of certificate data in bytes.
@param[out] SingleX509Cert The generated X509 object.
-
@retval TRUE The X509 object generation succeeded.
@retval FALSE The operation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1957
BOOLEAN
EFIAPI
X509ConstructCertificate (
@@ -2197,76 +2311,67 @@ X509ConstructCertificate (
/**
Construct a X509 stack object from a list of DER-encoded certificate data.
-
If X509Stack is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
On output, pointer to the X509 stack object with new
inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- ... A list of DER-encoded single certificate data followed
+ @param[in] Args VA_LIST marker for the variable argument list.
+ A list of DER-encoded single certificate data followed
by certificate size. A NULL terminates the list. The
pairs are the arguments to X509ConstructCertificate().
-
@retval TRUE The X509 stack construction succeeded.
@retval FALSE The construction operation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:1984
BOOLEAN
EFIAPI
-X509ConstructCertificateStack (
- IN OUT UINT8 **X509Stack,
- ...
+X509ConstructCertificateStackV (
+ IN OUT UINT8 **X509Stack,
+ IN VA_LIST Args
)
{
- VA_LIST Args;
- BOOLEAN Result;
-
- VA_START (Args, X509Stack);
- Result = X509ConstructCertificateStackV (X509Stack, Args);
- VA_END (Args);
- return Result;
+ CALL_CRYPTO_SERVICE (X509ConstructCertificateStackV, (X509Stack, Args), FALSE);
}
/**
Construct a X509 stack object from a list of DER-encoded certificate data.
-
If X509Stack is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
On output, pointer to the X509 stack object with new
inserted X509 certificate.
- @param[in] Args VA_LIST marker for the variable argument list.
- A list of DER-encoded single certificate data followed
+ @param ... A list of DER-encoded single certificate data followed
by certificate size. A NULL terminates the list. The
pairs are the arguments to X509ConstructCertificate().
-
@retval TRUE The X509 stack construction succeeded.
@retval FALSE The construction operation failed.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:2009
BOOLEAN
EFIAPI
-X509ConstructCertificateStackV (
- IN OUT UINT8 **X509Stack,
- IN VA_LIST Args
+X509ConstructCertificateStack (
+ IN OUT UINT8 **X509Stack,
+ ...
)
{
- CALL_CRYPTO_SERVICE (X509ConstructCertificateStackV, (X509Stack, Args), FALSE);
+ VA_LIST Args;
+ BOOLEAN Result;
+
+ VA_START (Args, X509Stack);
+ Result = X509ConstructCertificateStackV (X509Stack, Args);
+ VA_END (Args);
+ return Result;
}
/**
Release the specified X509 object.
-
If the interface is not supported, then ASSERT().
-
@param[in] X509Cert Pointer to the X509 object to be released.
-
**/
+// See BaseCryptLib.h:2024
VOID
EFIAPI
X509Free (
@@ -2278,12 +2383,10 @@ X509Free (
/**
Release the specified X509 stack object.
-
If the interface is not supported, then ASSERT().
-
@param[in] X509Stack Pointer to the X509 stack object to be released.
-
**/
+// See BaseCryptLib.h:2038
VOID
EFIAPI
X509StackFree (
@@ -2295,21 +2398,18 @@ X509StackFree (
/**
Retrieve the TBSCertificate from one given X.509 certificate.
-
@param[in] Cert Pointer to the given DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] TBSCert DER-Encoded To-Be-Signed certificate.
@param[out] TBSCertSize Size of the TBS certificate in bytes.
-
If Cert is NULL, then return FALSE.
If TBSCert is NULL, then return FALSE.
If TBSCertSize is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@retval TRUE The TBSCertificate was retrieved successfully.
@retval FALSE Invalid X.509 certificate.
-
**/
+// See BaseCryptLib.h:2061
BOOLEAN
EFIAPI
X509GetTBSCert (
@@ -2324,20 +2424,17 @@ X509GetTBSCert (
/**
Retrieve the version from one X.509 certificate.
-
If Cert is NULL, then return FALSE.
If CertSize is 0, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] Version Pointer to the retrieved version integer.
-
@retval TRUE The certificate version retrieved successfully.
@retval FALSE If Cert is NULL or CertSize is Zero.
@retval FALSE The operation is not supported.
-
**/
+// See BaseCryptLib.h:2612
BOOLEAN
EFIAPI
X509GetVersion (
@@ -2351,17 +2448,14 @@ X509GetVersion (
/**
Retrieve the serialNumber from one X.509 certificate.
-
If Cert is NULL, then return FALSE.
If CertSize is 0, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
@param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
and the size of buffer returned SerialNumber on output.
-
@retval TRUE The certificate serialNumber retrieved successfully.
@retval FALSE If Cert is NULL or CertSize is Zero.
If SerialNumberSize is NULL.
@@ -2372,6 +2466,7 @@ X509GetVersion (
SerialNumberSize parameter.
@retval FALSE The operation is not supported.
**/
+// See BaseCryptLib.h:2643
BOOLEAN
EFIAPI
X509GetSerialNumber (
@@ -2386,23 +2481,20 @@ X509GetSerialNumber (
/**
Retrieve the issuer bytes from one X.509 certificate.
-
If Cert is NULL, then return FALSE.
If CertIssuerSize is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
@param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
and the size of buffer returned CertSubject on output.
-
@retval TRUE The certificate issuer retrieved successfully.
@retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
The CertIssuerSize will be updated with the required size.
@retval FALSE This interface is not supported.
-
**/
+// See BaseCryptLib.h:2671
BOOLEAN
EFIAPI
X509GetIssuerName (
@@ -2417,12 +2509,10 @@ X509GetIssuerName (
/**
Retrieve the Signature Algorithm from one X.509 certificate.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] Oid Signature Algorithm Object identifier buffer.
@param[in,out] OidSize Signature Algorithm Object identifier buffer size
-
@retval TRUE The certificate Extension data retrieved successfully.
@retval FALSE If Cert is NULL.
If OidSize is NULL.
@@ -2433,6 +2523,7 @@ X509GetIssuerName (
is returned in the OidSize.
@retval FALSE The operation is not supported.
**/
+// See BaseCryptLib.h:2698
BOOLEAN
EFIAPI
X509GetSignatureAlgorithm (
@@ -2447,14 +2538,12 @@ X509GetSignatureAlgorithm (
/**
Retrieve Extension data from one X.509 certificate.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[in] Oid Object identifier buffer
@param[in] OidSize Object identifier buffer size
@param[out] ExtensionData Extension bytes.
@param[in, out] ExtensionDataSize Extension bytes size.
-
@retval TRUE The certificate Extension data retrieved successfully.
@retval FALSE If Cert is NULL.
If ExtensionDataSize is NULL.
@@ -2465,6 +2554,7 @@ X509GetSignatureAlgorithm (
is returned in the ExtensionDataSize parameter.
@retval FALSE The operation is not supported.
**/
+// See BaseCryptLib.h:2727
BOOLEAN
EFIAPI
X509GetExtensionData (
@@ -2479,59 +2569,27 @@ X509GetExtensionData (
CALL_CRYPTO_SERVICE (X509GetExtensionData, (Cert, CertSize, Oid, OidSize, ExtensionData, ExtensionDataSize), FALSE);
}
-/**
- Retrieve the Extended Key Usage from one X.509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] Usage Key Usage bytes.
- @param[in, out] UsageSize Key Usage buffer sizs in bytes.
-
- @retval TRUE The Usage bytes retrieve successfully.
- @retval FALSE If Cert is NULL.
- If CertSize is NULL.
- If Usage is not NULL and *UsageSize is 0.
- If Cert is invalid.
- @retval FALSE If the Usage is NULL. The required buffer size
- is returned in the UsageSize parameter.
- @retval FALSE The operation is not supported.
-**/
-BOOLEAN
-EFIAPI
-X509GetExtendedKeyUsage (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT UINT8 *Usage,
- IN OUT UINTN *UsageSize
- )
-{
- CALL_CRYPTO_SERVICE (X509GetExtendedKeyUsage, (Cert, CertSize, Usage, UsageSize), FALSE);
-}
-
/**
Retrieve the Validity from one X.509 certificate
-
If Cert is NULL, then return FALSE.
If CertIssuerSize is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[in] From notBefore Pointer to DateTime object.
@param[in,out] FromSize notBefore DateTime object size.
@param[in] To notAfter Pointer to DateTime object.
@param[in,out] ToSize notAfter DateTime object size.
-
Note: X509CompareDateTime to compare DateTime oject
x509SetDateTime to get a DateTime object from a DateTimeStr
-
@retval TRUE The certificate Validity retrieved successfully.
@retval FALSE Invalid certificate, or Validity retrieve failed.
@retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:2759
BOOLEAN
EFIAPI
-X509GetValidity (
+X509GetValidity (
IN CONST UINT8 *Cert,
IN UINTN CertSize,
IN UINT8 *From,
@@ -2545,17 +2603,14 @@ X509GetValidity (
/**
Format a DateTimeStr to DataTime object in DataTime Buffer
-
If DateTimeStr is NULL, then return FALSE.
If DateTimeSize is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
-
@param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
Ref: https://www.w3.org/TR/NOTE-datetime
Z stand for UTC time
@param[out] DateTime Pointer to a DateTime object.
@param[in,out] DateTimeSize DateTime object buffer size.
-
@retval TRUE The DateTime object create successfully.
@retval FALSE If DateTimeStr is NULL.
If DateTimeSize is NULL.
@@ -2566,54 +2621,28 @@ X509GetValidity (
DateTimeSize parameter.
@retval FALSE The operation is not supported.
**/
+// See BaseCryptLib.h:2793
BOOLEAN
EFIAPI
X509FormatDateTime (
- IN CONST CHAR8 *DateTimeStr,
- OUT VOID *DateTime,
- IN OUT UINTN *DateTimeSize
+ IN CONST CHAR8 *DateTimeStr,
+ OUT VOID *DateTime,
+ IN OUT UINTN *DateTimeSize
)
{
CALL_CRYPTO_SERVICE (X509FormatDateTime, (DateTimeStr, DateTime, DateTimeSize), FALSE);
}
-/**
- Compare DateTime1 object and DateTime2 object.
-
- If DateTime1 is NULL, then return -2.
- If DateTime2 is NULL, then return -2.
- If DateTime1 == DateTime2, then return 0
- If DateTime1 > DateTime2, then return 1
- If DateTime1 < DateTime2, then return -1
-
- @param[in] DateTime1 Pointer to a DateTime Ojbect
- @param[in] DateTime2 Pointer to a DateTime Object
-
- @retval 0 If DateTime1 == DateTime2
- @retval 1 If DateTime1 > DateTime2
- @retval -1 If DateTime1 < DateTime2
-**/
-INT32
-EFIAPI
-X509CompareDateTime (
- IN CONST VOID *DateTime1,
- IN CONST VOID *DateTime2
- )
-{
- CALL_CRYPTO_SERVICE (X509CompareDateTime, (DateTime1, DateTime2), FALSE);
-}
-
/**
Retrieve the Key Usage from one X.509 certificate.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize Size of the X509 certificate in bytes.
@param[out] Usage Key Usage (CRYPTO_X509_KU_*)
-
@retval TRUE The certificate Key Usage retrieved successfully.
@retval FALSE Invalid certificate, or Usage is NULL
@retval FALSE This interface is not supported.
**/
+// See BaseCryptLib.h:2835
BOOLEAN
EFIAPI
X509GetKeyUsage (
@@ -2626,25 +2655,52 @@ X509GetKeyUsage (
}
/**
- Verify one X509 certificate was issued by the trusted CA.
- @param[in] RootCert Trusted Root Certificate buffer
-
- @param[in] RootCertLength Trusted Root Certificate buffer length
- @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
- where the first certificate is signed by the Root
- Certificate or is the Root Cerificate itself. and
- subsequent cerificate is signed by the preceding
- cerificate.
- @param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
- @retval FALSE Invalid certificate or the certificate was not issued by the given
- trusted CA.
-**/
-BOOLEAN
-EFIAPI
-X509VerifyCertChain (
- IN CONST UINT8 *RootCert,
+ Retrieve the Extended Key Usage from one X.509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] Usage Key Usage bytes.
+ @param[in, out] UsageSize Key Usage buffer sizs in bytes.
+ @retval TRUE The Usage bytes retrieve successfully.
+ @retval FALSE If Cert is NULL.
+ If CertSize is NULL.
+ If Usage is not NULL and *UsageSize is 0.
+ If Cert is invalid.
+ @retval FALSE If the Usage is NULL. The required buffer size
+ is returned in the UsageSize parameter.
+ @retval FALSE The operation is not supported.
+**/
+// See BaseCryptLib.h:2860
+BOOLEAN
+EFIAPI
+X509GetExtendedKeyUsage (
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT UINT8 *Usage,
+ IN OUT UINTN *UsageSize
+ )
+{
+ CALL_CRYPTO_SERVICE (X509GetExtendedKeyUsage, (Cert, CertSize, Usage, UsageSize), FALSE);
+}
+
+/**
+ Verify one X509 certificate was issued by the trusted CA.
+ @param[in] RootCert Trusted Root Certificate buffer
+ @param[in] RootCertLength Trusted Root Certificate buffer length
+ @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
+ where the first certificate is signed by the Root
+ Certificate or is the Root Cerificate itself. and
+ subsequent cerificate is signed by the preceding
+ cerificate.
+ @param[in] CertChainLength Total length of the certificate chain, in bytes.
+ @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
+ @retval FALSE Invalid certificate or the certificate was not issued by the given
+ trusted CA.
+**/
+// See BaseCryptLib.h:2885
+BOOLEAN
+EFIAPI
+X509VerifyCertChain (
+ IN CONST UINT8 *RootCert,
IN UINTN RootCertLength,
IN CONST UINT8 *CertChain,
IN UINTN CertChainLength
@@ -2655,22 +2711,20 @@ X509VerifyCertChain (
/**
Get one X509 certificate from CertChain.
-
@param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
where the first certificate is signed by the Root
Certificate or is the Root Cerificate itself. and
subsequent cerificate is signed by the preceding
cerificate.
@param[in] CertChainLength Total length of the certificate chain, in bytes.
-
- @param[in] CertIndex Index of certificate.
-
+ @param[in] CertIndex Index of certificate. If index is -1 indecate the
+ last certificate in CertChain.
@param[out] Cert The certificate at the index of CertChain.
@param[out] CertLength The length certificate at the index of CertChain.
-
@retval TRUE Success.
@retval FALSE Failed to get certificate from certificate chain.
**/
+// See BaseCryptLib.h:2913
BOOLEAN
EFIAPI
X509GetCertFromCertChain (
@@ -2684,37 +2738,12 @@ X509GetCertFromCertChain (
CALL_CRYPTO_SERVICE (X509GetCertFromCertChain, (CertChain, CertChainLength, CertIndex, Cert, CertLength), FALSE);
}
-/**
- Retrieve the tag and length of the tag.
-
- @param Ptr The position in the ASN.1 data
- @param End End of data
- @param Length The variable that will receive the length
- @param Tag The expected tag
-
- @retval TRUE Get tag successful
- @retval FALSe Failed to get tag or tag not match
-**/
-BOOLEAN
-EFIAPI
-Asn1GetTag (
- IN OUT UINT8 **Ptr,
- IN CONST UINT8 *End,
- OUT UINTN *Length,
- IN UINT32 Tag
- )
-{
- CALL_CRYPTO_SERVICE (Asn1GetTag, (Ptr, End, Length, Tag), FALSE);
-}
-
/**
Retrieve the basic constraints from one X.509 certificate.
-
@param[in] Cert Pointer to the DER-encoded X509 certificate.
@param[in] CertSize size of the X509 certificate in bytes.
@param[out] BasicConstraints basic constraints bytes.
@param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
-
@retval TRUE The basic constraints retrieve successfully.
@retval FALSE If cert is NULL.
If cert_size is NULL.
@@ -2725,9 +2754,10 @@ Asn1GetTag (
@retval FALSE If no Extension entry match oid.
@retval FALSE The operation is not supported.
**/
+// See BaseCryptLib.h:2961
BOOLEAN
EFIAPI
-X509GetExtendedBasicConstraints (
+X509GetExtendedBasicConstraints (
CONST UINT8 *Cert,
UINTN CertSize,
UINT8 *BasicConstraints,
@@ -2737,2505 +2767,1881 @@ X509GetExtendedBasicConstraints (
CALL_CRYPTO_SERVICE (X509GetExtendedBasicConstraints, (Cert, CertSize, BasicConstraints, BasicConstraintsSize), FALSE);
}
-/**
- Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
- password based encryption key derivation function PBKDF2, as specified in RFC 2898.
-
- If Password or Salt or OutKey is NULL, then return FALSE.
- If the hash algorithm could not be determined, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] PasswordLength Length of input password in bytes.
- @param[in] Password Pointer to the array for the password.
- @param[in] SaltLength Size of the Salt in bytes.
- @param[in] Salt Pointer to the Salt.
- @param[in] IterationCount Number of iterations to perform. Its value should be
- greater than or equal to 1.
- @param[in] DigestSize Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
- NOTE: DigestSize will be used to determine the hash algorithm.
- Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
- @param[in] KeyLength Size of the derived key buffer in bytes.
- @param[out] OutKey Pointer to the output derived key buffer.
-
- @retval TRUE A key was derived successfully.
- @retval FALSE One of the pointers was NULL or one of the sizes was too large.
- @retval FALSE The hash algorithm could not be determined from the digest size.
- @retval FALSE The key derivation operation failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs5HashPassword (
- IN UINTN PasswordLength,
- IN CONST CHAR8 *Password,
- IN UINTN SaltLength,
- IN CONST UINT8 *Salt,
- IN UINTN IterationCount,
- IN UINTN DigestSize,
- IN UINTN KeyLength,
- OUT UINT8 *OutKey
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs5HashPassword, (PasswordLength, Password, SaltLength, Salt, IterationCount, DigestSize, KeyLength, OutKey), FALSE);
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
-
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to parse X509 certificate.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
-
- @param[in] PublicKey A pointer to the DER-encoded X509 certificate that
- will be used to encrypt the data.
- @param[in] PublicKeySize Size of the X509 cert buffer.
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
-
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Encrypt (
- IN CONST UINT8 *PublicKey,
- IN UINTN PublicKeySize,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs1v2Encrypt, (PublicKey, PublicKeySize, InData, InDataSize, PrngSeed, PrngSeedSize, EncryptedData, EncryptedDataSize), FALSE);
-}
-
-/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- @param[in] PrivateKey A pointer to the DER-encoded private key.
- @param[in] PrivateKeySize Size of the private key buffer.
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-**/
-BOOLEAN
-EFIAPI
-Pkcs1v2Decrypt (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs1v2Decrypt, (PrivateKey, PrivateKeySize, EncryptedData, EncryptedDataSize, OutData, OutDataSize), FALSE);
-}
-
-/**
- Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- encrypted message in a newly allocated buffer.
- Things that can cause a failure include:
- - X509 key size does not match any known key size.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- - Data size is too large for the provided key size (max size is a function of key size
- and hash digest size).
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a public key using RsaSetKey().
- @param[in] InData Data to be encrypted.
- @param[in] InDataSize Size of the data buffer.
- @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer
- to be used when initializing the PRNG. NULL otherwise.
- @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.
- 0 otherwise.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] EncryptedDataSize Size of the encrypted message buffer.
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-**/
-BOOLEAN
-EFIAPI
-RsaOaepEncrypt (
- IN VOID *RsaContext,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN CONST UINT8 *PrngSeed OPTIONAL,
- IN UINTN PrngSeedSize OPTIONAL,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **EncryptedData,
- OUT UINTN *EncryptedDataSize
- )
-{
- CALL_CRYPTO_SERVICE (RsaOaepEncrypt, (RsaContext, InData, InDataSize, PrngSeed, PrngSeedSize, DigestLen, EncryptedData, EncryptedDataSize), FALSE);
-}
+// =============================================================================
+// ASN1 functions
+// =============================================================================
/**
- Decrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
- decrypted message in a newly allocated buffer.
- Things that can cause a failure include:
- - Fail to parse private key.
- - Fail to allocate an intermediate buffer.
- - Null pointer provided for a non-optional parameter.
- @param[in] RsaContext A pointer to an RSA context created by RsaNew() and
- provisioned with a private key using RsaSetKey().
- @param[in] EncryptedData Data to be decrypted.
- @param[in] EncryptedDataSize Size of the encrypted buffer.
- @param[in] DigestLen [Optional] If provided, size of the hash used:
- SHA1_DIGEST_SIZE
- SHA256_DIGEST_SIZE
- SHA384_DIGEST_SIZE
- SHA512_DIGEST_SIZE
- 0 to use default (SHA1)
- @param[out] OutData Pointer to an allocated buffer containing the encrypted
- message.
- @param[out] OutDataSize Size of the encrypted message buffer.
- @retval TRUE Encryption was successful.
- @retval FALSE Encryption failed.
-**/
-BOOLEAN
-EFIAPI
-RsaOaepDecrypt (
- IN VOID *RsaContext,
- IN UINT8 *EncryptedData,
- IN UINTN EncryptedDataSize,
- IN UINT16 DigestLen OPTIONAL,
- OUT UINT8 **OutData,
- OUT UINTN *OutDataSize
- )
-{
- CALL_CRYPTO_SERVICE (RsaOaepDecrypt, (RsaContext, EncryptedData, EncryptedDataSize, DigestLen, OutData, OutDataSize), FALSE);
-}
-
-/**
- Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then
- return FALSE. If P7Length overflow, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] CertStack Pointer to Signer's certificates retrieved from P7Data.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] StackLength Length of signer's certificates in bytes.
- @param[out] TrustedCert Pointer to a trusted certificate from Signer's certificates.
- It's caller's responsibility to free the buffer with
- Pkcs7FreeSigners().
- @param[out] CertLength Length of the trusted certificate in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
- @retval FALSE This interface is not supported.
-
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetSigners (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **CertStack,
- OUT UINTN *StackLength,
- OUT UINT8 **TrustedCert,
- OUT UINTN *CertLength
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs7GetSigners, (P7Data, P7Length, CertStack, StackLength, TrustedCert, CertLength), FALSE);
-}
-
-/**
- Wrap function to use free() to free allocated memory for certificates.
-
- If this interface is not supported, then ASSERT().
-
- @param[in] Certs Pointer to the certificates to be freed.
-
-**/
-VOID
-EFIAPI
-Pkcs7FreeSigners (
- IN UINT8 *Certs
- )
-{
- CALL_VOID_CRYPTO_SERVICE (Pkcs7FreeSigners, (Certs));
-}
-
-/**
- Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
- unchained to the signer's certificates.
- The input signed data could be wrapped in a ContentInfo structure.
-
- @param[in] P7Data Pointer to the PKCS#7 message.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[out] SignerChainCerts Pointer to the certificates list chained to signer's
- certificate. It's caller's responsibility to free the buffer
- with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] ChainLength Length of the chained certificates list buffer in bytes.
- @param[out] UnchainCerts Pointer to the unchained certificates lists. It's caller's
- responsibility to free the buffer with Pkcs7FreeSigners().
- This data structure is EFI_CERT_STACK type.
- @param[out] UnchainLength Length of the unchained certificates list buffer in bytes.
-
- @retval TRUE The operation is finished successfully.
- @retval FALSE Error occurs during the operation.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetCertificatesList (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT UINT8 **SignerChainCerts,
- OUT UINTN *ChainLength,
- OUT UINT8 **UnchainCerts,
- OUT UINTN *UnchainLength
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs7GetCertificatesList, (P7Data, P7Length, SignerChainCerts, ChainLength, UnchainCerts, UnchainLength), FALSE);
-}
-
-/**
- Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
- Syntax Standard, version 1.5". This interface is only intended to be used for
- application to perform PKCS#7 functionality validation.
-
- If this interface is not supported, then return FALSE.
-
- @param[in] PrivateKey Pointer to the PEM-formatted private key data for
- data signing.
- @param[in] PrivateKeySize Size of the PEM private key data in bytes.
- @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM
- key data.
- @param[in] InData Pointer to the content to be signed.
- @param[in] InDataSize Size of InData in bytes.
- @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.
- @param[in] OtherCerts Pointer to an optional additional set of certificates to
- include in the PKCS#7 signedData (e.g. any intermediate
- CAs in the chain).
- @param[out] SignedData Pointer to output PKCS#7 signedData. It's caller's
- responsibility to free the buffer with FreePool().
- @param[out] SignedDataSize Size of SignedData in bytes.
-
- @retval TRUE PKCS#7 data signing succeeded.
- @retval FALSE PKCS#7 data signing failed.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Sign (
- IN CONST UINT8 *PrivateKey,
- IN UINTN PrivateKeySize,
- IN CONST UINT8 *KeyPassword,
- IN UINT8 *InData,
- IN UINTN InDataSize,
- IN UINT8 *SignCert,
- IN UINT8 *OtherCerts OPTIONAL,
- OUT UINT8 **SignedData,
- OUT UINTN *SignedDataSize
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs7Sign, (PrivateKey, PrivateKeySize, KeyPassword, InData, InDataSize, SignCert, OtherCerts, SignedData, SignedDataSize), FALSE);
-}
-
-/**
- Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
- Cryptographic Message Syntax Standard". The input signed data could be wrapped
- in a ContentInfo structure.
-
- If P7Data, TrustedCert or InData is NULL, then return FALSE.
- If P7Length, CertLength or DataLength overflow, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] P7Data Pointer to the PKCS#7 message to verify.
- @param[in] P7Length Length of the PKCS#7 message in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertLength Length of the trusted certificate in bytes.
- @param[in] InData Pointer to the content to be verified.
- @param[in] DataLength Length of InData in bytes.
-
- @retval TRUE The specified PKCS#7 signed data is valid.
- @retval FALSE Invalid PKCS#7 signed data.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7Verify (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertLength,
- IN CONST UINT8 *InData,
- IN UINTN DataLength
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs7Verify, (P7Data, P7Length, TrustedCert, CertLength, InData, DataLength), FALSE);
-}
-
-/**
- This function receives a PKCS7 formatted signature, and then verifies that
- the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity
- leaf signing certificate.
- Note that this function does not validate the certificate chain.
-
- Applications for custom EKU's are quite flexible. For example, a policy EKU
- may be present in an Issuing Certificate Authority (CA), and any sub-ordinate
- certificate issued might also contain this EKU, thus constraining the
- sub-ordinate certificate. Other applications might allow a certificate
- embedded in a device to specify that other Object Identifiers (OIDs) are
- present which contains binary data specifying custom capabilities that
- the device is able to do.
-
- @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
- containing the content block with both the signature,
- the signer's certificate, and any necessary intermediate
- certificates.
- @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
- @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
- required EKUs that must be present in the signature.
- @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
- @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
- must be present in the leaf signer. If it is
- FALSE, then we will succeed if we find any
- of the specified EKU's.
-
- @retval EFI_SUCCESS The required EKUs were found in the signature.
- @retval EFI_INVALID_PARAMETER A parameter was invalid.
- @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
-
-**/
-RETURN_STATUS
-EFIAPI
-VerifyEKUsInPkcs7Signature (
- IN CONST UINT8 *Pkcs7Signature,
- IN CONST UINT32 SignatureSize,
- IN CONST CHAR8 *RequiredEKUs[],
- IN CONST UINT32 RequiredEKUsSize,
- IN BOOLEAN RequireAllPresent
- )
-{
- CALL_CRYPTO_SERVICE (VerifyEKUsInPkcs7Signature, (Pkcs7Signature, SignatureSize, RequiredEKUs, RequiredEKUsSize, RequireAllPresent), FALSE);
-}
-
-/**
- Extracts the attached content from a PKCS#7 signed data if existed. The input signed
- data could be wrapped in a ContentInfo structure.
-
- If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,
- then return FALSE. If the P7Data is not correctly formatted, then return FALSE.
-
- Caution: This function may receive untrusted input. So this function will do
- basic check for PKCS#7 data structure.
-
- @param[in] P7Data Pointer to the PKCS#7 signed data to process.
- @param[in] P7Length Length of the PKCS#7 signed data in bytes.
- @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.
- It's caller's responsibility to free the buffer with FreePool().
- @param[out] ContentSize The size of the extracted content in bytes.
-
- @retval TRUE The P7Data was correctly formatted for processing.
- @retval FALSE The P7Data was not correctly formatted for processing.
-
-**/
-BOOLEAN
-EFIAPI
-Pkcs7GetAttachedContent (
- IN CONST UINT8 *P7Data,
- IN UINTN P7Length,
- OUT VOID **Content,
- OUT UINTN *ContentSize
- )
-{
- CALL_CRYPTO_SERVICE (Pkcs7GetAttachedContent, (P7Data, P7Length, Content, ContentSize), FALSE);
-}
-
-/**
- Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
- Authenticode Portable Executable Signature Format".
-
- If AuthData is NULL, then return FALSE.
- If ImageHash is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which
- is used for certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[in] ImageHash Pointer to the original image file hash value. The procedure
- for calculating the image hash value is described in Authenticode
- specification.
- @param[in] HashSize Size of Image hash value in bytes.
-
- @retval TRUE The specified Authenticode Signature is valid.
- @retval FALSE Invalid Authenticode Signature.
- @retval FALSE This interface is not supported.
-
-**/
-BOOLEAN
-EFIAPI
-AuthenticodeVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TrustedCert,
- IN UINTN CertSize,
- IN CONST UINT8 *ImageHash,
- IN UINTN HashSize
- )
-{
- CALL_CRYPTO_SERVICE (AuthenticodeVerify, (AuthData, DataSize, TrustedCert, CertSize, ImageHash, HashSize), FALSE);
-}
-
-/**
- Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
- signature.
-
- If AuthData is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
- PE/COFF image to be verified.
- @param[in] DataSize Size of the Authenticode Signature in bytes.
- @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
- is used for TSA certificate chain verification.
- @param[in] CertSize Size of the trusted certificate in bytes.
- @param[out] SigningTime Return the time of timestamp generation time if the timestamp
- signature is valid.
-
- @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
- @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
-
+ Retrieve the tag and length of the tag.
+ @param Ptr The position in the ASN.1 data
+ @param End End of data
+ @param Length The variable that will receive the length
+ @param Tag The expected tag
+ @retval TRUE Get tag successful
+ @retval FALSe Failed to get tag or tag not match
**/
+// See BaseCryptLib.h:2934
BOOLEAN
EFIAPI
-ImageTimestampVerify (
- IN CONST UINT8 *AuthData,
- IN UINTN DataSize,
- IN CONST UINT8 *TsaCert,
- IN UINTN CertSize,
- OUT EFI_TIME *SigningTime
+Asn1GetTag (
+ IN OUT UINT8 **Ptr,
+ IN CONST UINT8 *End,
+ OUT UINTN *Length,
+ IN UINT32 Tag
)
{
- CALL_CRYPTO_SERVICE (ImageTimestampVerify, (AuthData, DataSize, TsaCert, CertSize, SigningTime), FALSE);
+ CALL_CRYPTO_SERVICE (Asn1GetTag, (Ptr, End, Length, Tag), FALSE);
}
-// =====================================================================================
-// DH Key Exchange Primitive
-// =====================================================================================
+// =============================================================================
+// BIGNUM functions
+// =============================================================================
/**
- Allocates and Initializes one Diffie-Hellman Context for subsequent use.
-
- @return Pointer to the Diffie-Hellman Context that has been initialized.
- If the allocations fails, DhNew() returns NULL.
- If the interface is not supported, DhNew() returns NULL.
-
+ Allocate new Big Number.
+ @retval New BigNum opaque structure or NULL on failure.
**/
+// See BaseCryptLib.h:3356
VOID *
EFIAPI
-DhNew (
+BigNumInit (
VOID
)
{
- CALL_CRYPTO_SERVICE (DhNew, (), NULL);
+ CALL_CRYPTO_SERVICE (BigNumInit, (), NULL);
}
/**
- Release the specified DH context.
-
- If the interface is not supported, then ASSERT().
-
- @param[in] DhContext Pointer to the DH context to be released.
-
+ Allocate new Big Number and assign the provided value to it.
+ @param[in] Buf Big endian encoded buffer.
+ @param[in] Len Buffer length.
+ @retval New BigNum opaque structure or NULL on failure.
**/
-VOID
+// See BaseCryptLib.h:3370
+VOID *
EFIAPI
-DhFree (
- IN VOID *DhContext
+BigNumFromBin (
+ IN CONST UINT8 *Buf,
+ IN UINTN Len
)
{
- CALL_VOID_CRYPTO_SERVICE (DhFree, (DhContext));
+ CALL_CRYPTO_SERVICE (BigNumFromBin, (Buf, Len), NULL);
}
/**
- Generates DH parameter.
-
- Given generator g, and length of prime number p in bits, this function generates p,
- and sets DH context according to value of g and p.
-
- Before this function can be invoked, pseudorandom number generator must be correctly
- initialized by RandomSeed().
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[out] Prime Pointer to the buffer to receive the generated prime number.
-
- @retval TRUE DH parameter generation succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE PRNG fails to generate random prime number with PrimeLength.
- @retval FALSE This interface is not supported.
-
+ Convert the absolute value of Bn into big-endian form and store it at Buf.
+ The Buf array should have at least BigNumBytes() in it.
+ @param[in] Bn Big number to convert.
+ @param[out] Buf Output buffer.
+ @retval The length of the big-endian number placed at Buf or -1 on error.
**/
-BOOLEAN
+// See BaseCryptLib.h:3386
+INTN
EFIAPI
-DhGenerateParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- OUT UINT8 *Prime
+BigNumToBin (
+ IN CONST VOID *Bn,
+ OUT UINT8 *Buf
)
{
- CALL_CRYPTO_SERVICE (DhGenerateParameter, (DhContext, Generator, PrimeLength, Prime), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumToBin, (Bn, Buf), 0);
}
/**
- Sets generator and prime parameters for DH.
-
- Given generator g, and prime number p, this function and sets DH
- context accordingly.
-
- If DhContext is NULL, then return FALSE.
- If Prime is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] Generator Value of generator.
- @param[in] PrimeLength Length in bits of prime to be generated.
- @param[in] Prime Pointer to the prime number.
-
- @retval TRUE DH parameter setting succeeded.
- @retval FALSE Value of Generator is not supported.
- @retval FALSE Value of Generator is not suitable for the Prime.
- @retval FALSE Value of Prime is not a prime number.
- @retval FALSE Value of Prime is not a safe prime number.
- @retval FALSE This interface is not supported.
-
+ Free the Big Number.
+ @param[in] Bn Big number to free.
+ @param[in] Clear TRUE if the buffer should be cleared.
**/
-BOOLEAN
+// See BaseCryptLib.h:3399
+VOID
EFIAPI
-DhSetParameter (
- IN OUT VOID *DhContext,
- IN UINTN Generator,
- IN UINTN PrimeLength,
- IN CONST UINT8 *Prime
+BigNumFree (
+ IN VOID *Bn,
+ IN BOOLEAN Clear
)
{
- CALL_CRYPTO_SERVICE (DhSetParameter, (DhContext, Generator, PrimeLength, Prime), FALSE);
+ CALL_VOID_CRYPTO_SERVICE (BigNumFree, (Bn, Clear));
}
/**
- Generates DH public key.
-
- This function generates random secret exponent, and computes the public key, which is
- returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
- If the PublicKey buffer is too small to hold the public key, FALSE is returned and
- PublicKeySize is set to the required buffer size to obtain the public key.
-
- If DhContext is NULL, then return FALSE.
- If PublicKeySize is NULL, then return FALSE.
- If PublicKeySize is large enough but PublicKey is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[out] PublicKey Pointer to the buffer to receive generated public key.
- @param[in, out] PublicKeySize On input, the size of PublicKey buffer in bytes.
- On output, the size of data returned in PublicKey buffer in bytes.
-
- @retval TRUE DH public key generation succeeded.
- @retval FALSE DH public key generation failed.
- @retval FALSE PublicKeySize is not large enough.
- @retval FALSE This interface is not supported.
-
+ Calculate the sum of two Big Numbers.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result of BnA + BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3418
BOOLEAN
EFIAPI
-DhGenerateKey (
- IN OUT VOID *DhContext,
- OUT UINT8 *PublicKey,
- IN OUT UINTN *PublicKeySize
+BigNumAdd (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (DhGenerateKey, (DhContext, PublicKey, PublicKeySize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumAdd, (BnA, BnB, BnRes), FALSE);
}
/**
- Computes exchanged common key.
-
- Given peer's public key, this function computes the exchanged common key, based on its own
- context including value of prime modulus and random secret exponent.
-
- If DhContext is NULL, then return FALSE.
- If PeerPublicKey is NULL, then return FALSE.
- If KeySize is NULL, then return FALSE.
- If Key is NULL, then return FALSE.
- If KeySize is not large enough, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[in, out] DhContext Pointer to the DH context.
- @param[in] PeerPublicKey Pointer to the peer's public key.
- @param[in] PeerPublicKeySize Size of peer's public key in bytes.
- @param[out] Key Pointer to the buffer to receive generated key.
- @param[in, out] KeySize On input, the size of Key buffer in bytes.
- On output, the size of data returned in Key buffer in bytes.
-
- @retval TRUE DH exchanged key generation succeeded.
- @retval FALSE DH exchanged key generation failed.
- @retval FALSE KeySize is not large enough.
- @retval FALSE This interface is not supported.
-
+ Subtract two Big Numbers.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result of BnA - BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3438
BOOLEAN
EFIAPI
-DhComputeKey (
- IN OUT VOID *DhContext,
- IN CONST UINT8 *PeerPublicKey,
- IN UINTN PeerPublicKeySize,
- OUT UINT8 *Key,
- IN OUT UINTN *KeySize
+BigNumSub (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (DhComputeKey, (DhContext, PeerPublicKey, PeerPublicKeySize, Key, KeySize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumSub, (BnA, BnB, BnRes), FALSE);
}
-// =====================================================================================
-// Pseudo-Random Generation Primitive
-// =====================================================================================
-
/**
- Sets up the seed value for the pseudorandom number generator.
-
- This function sets up the seed value for the pseudorandom number generator.
- If Seed is not NULL, then the seed passed in is used.
- If Seed is NULL, then default seed is used.
- If this interface is not supported, then return FALSE.
-
- @param[in] Seed Pointer to seed value.
- If NULL, default seed is used.
- @param[in] SeedSize Size of seed value.
- If Seed is NULL, this parameter is ignored.
-
- @retval TRUE Pseudorandom number generator has enough entropy for random generation.
- @retval FALSE Pseudorandom number generator does not have enough entropy for random generation.
- @retval FALSE This interface is not supported.
-
+ Calculate remainder: BnRes = BnA % BnB.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result of BnA % BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3458
BOOLEAN
EFIAPI
-RandomSeed (
- IN CONST UINT8 *Seed OPTIONAL,
- IN UINTN SeedSize
+BigNumMod (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (RandomSeed, (Seed, SeedSize), FALSE);
-}
-
-/**
- Generates a pseudorandom byte stream of the specified size.
-
- If Output is NULL, then return FALSE.
- If this interface is not supported, then return FALSE.
-
- @param[out] Output Pointer to buffer to receive random value.
- @param[in] Size Size of random bytes to generate.
-
- @retval TRUE Pseudorandom byte stream generated successfully.
- @retval FALSE Pseudorandom number generator fails to generate due to lack of entropy.
- @retval FALSE This interface is not supported.
+ CALL_CRYPTO_SERVICE (BigNumMod, (BnA, BnB, BnRes), FALSE);
+}
+/**
+ Compute BnA to the BnP-th power modulo BnM.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnP Big number (power).
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result of (BnA ^ BnP) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3479
BOOLEAN
EFIAPI
-RandomBytes (
- OUT UINT8 *Output,
- IN UINTN Size
+BigNumExpMod (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnP,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (RandomBytes, (Output, Size), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumExpMod, (BnA, BnP, BnM, BnRes), FALSE);
}
-// =====================================================================================
-// Key Derivation Function Primitive
-// =====================================================================================
-
/**
- Derive key data using HMAC-SHA256 based KDF.
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Compute BnA inverse modulo BnM.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3500
BOOLEAN
EFIAPI
-HkdfSha256ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+BigNumInverseMod (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (HkdfSha256ExtractAndExpand, (Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumInverseMod, (BnA, BnM, BnRes), FALSE);
}
/**
- Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
+ Divide two Big Numbers.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[out] BnRes The result, such that BnA / BnB.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3520
BOOLEAN
EFIAPI
-HkdfSha256Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
+BigNumDiv (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (HkdfSha256Extract, (Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumDiv, (BnA, BnB, BnRes), FALSE);
}
/**
- Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Multiply two Big Numbers modulo BnM.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA * BnB) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3541
BOOLEAN
EFIAPI
-HkdfSha256Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+BigNumMulMod (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (HkdfSha256Expand, (Prk, PrkSize, Info, InfoSize, Out, OutSize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumMulMod, (BnA, BnB, BnM, BnRes), FALSE);
}
/**
- Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize Key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize Salt size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Compare two Big Numbers.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @retval 0 BnA == BnB.
+ @retval 1 BnA > BnB.
+ @retval -1 BnA < BnB.
**/
-BOOLEAN
+// See BaseCryptLib.h:3560
+INTN
EFIAPI
-HkdfSha384ExtractAndExpand (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+BigNumCmp (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB
)
{
- CALL_CRYPTO_SERVICE (HkdfSha384ExtractAndExpand, (Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumCmp, (BnA, BnB), 0);
}
/**
- Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
-
- @param[in] Key Pointer to the user-supplied key.
- @param[in] KeySize key size in bytes.
- @param[in] Salt Pointer to the salt(non-secret) value.
- @param[in] SaltSize salt size in bytes.
- @param[out] PrkOut Pointer to buffer to receive hkdf value.
- @param[in] PrkOutSize size of hkdf bytes to generate.
-
- @retval true Hkdf generated successfully.
- @retval false Hkdf generation failed.
-
+ Get number of bits in Bn.
+ @param[in] Bn Big number.
+ @retval Number of bits.
**/
-BOOLEAN
+// See BaseCryptLib.h:3575
+UINTN
EFIAPI
-HkdfSha384Extract (
- IN CONST UINT8 *Key,
- IN UINTN KeySize,
- IN CONST UINT8 *Salt,
- IN UINTN SaltSize,
- OUT UINT8 *PrkOut,
- UINTN PrkOutSize
+BigNumBits (
+ IN CONST VOID *Bn
)
{
- CALL_CRYPTO_SERVICE (HkdfSha384Extract, (Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumBits, (Bn), 0);
}
/**
- Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
-
- @param[in] Prk Pointer to the user-supplied key.
- @param[in] PrkSize Key size in bytes.
- @param[in] Info Pointer to the application specific info.
- @param[in] InfoSize Info size in bytes.
- @param[out] Out Pointer to buffer to receive hkdf value.
- @param[in] OutSize Size of hkdf bytes to generate.
-
- @retval TRUE Hkdf generated successfully.
- @retval FALSE Hkdf generation failed.
-
+ Get number of bytes in Bn.
+ @param[in] Bn Big number.
+ @retval Number of bytes.
**/
-BOOLEAN
+// See BaseCryptLib.h:3588
+UINTN
EFIAPI
-HkdfSha384Expand (
- IN CONST UINT8 *Prk,
- IN UINTN PrkSize,
- IN CONST UINT8 *Info,
- IN UINTN InfoSize,
- OUT UINT8 *Out,
- IN UINTN OutSize
+BigNumBytes (
+ IN CONST VOID *Bn
)
{
- CALL_CRYPTO_SERVICE (HkdfSha384Expand, (Prk, PrkSize, Info, InfoSize, Out, OutSize), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumBytes, (Bn), 0);
}
/**
- Initializes the OpenSSL library.
-
- This function registers ciphers and digests used directly and indirectly
- by SSL/TLS, and initializes the readable error messages.
- This function must be called before any other action takes places.
-
- @retval TRUE The OpenSSL library has been initialized.
- @retval FALSE Failed to initialize the OpenSSL library.
-
+ Checks if Big Number equals to the given Num.
+ @param[in] Bn Big number.
+ @param[in] Num Number.
+ @retval TRUE iff Bn == Num.
+ @retval FALSE otherwise.
**/
+// See BaseCryptLib.h:3603
BOOLEAN
EFIAPI
-TlsInitialize (
- VOID
+BigNumIsWord (
+ IN CONST VOID *Bn,
+ IN UINTN Num
)
{
- CALL_CRYPTO_SERVICE (TlsInitialize, (), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumIsWord, (Bn, Num), FALSE);
}
/**
- Free an allocated SSL_CTX object.
-
- @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
-
+ Checks if Big Number is odd.
+ @param[in] Bn Big number.
+ @retval TRUE Bn is odd (Bn % 2 == 1).
+ @retval FALSE otherwise.
**/
-VOID
+// See BaseCryptLib.h:3618
+BOOLEAN
EFIAPI
-TlsCtxFree (
- IN VOID *TlsCtx
+BigNumIsOdd (
+ IN CONST VOID *Bn
)
{
- CALL_VOID_CRYPTO_SERVICE (TlsCtxFree, (TlsCtx));
+ CALL_CRYPTO_SERVICE (BigNumIsOdd, (Bn), FALSE);
}
/**
- Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
- connections.
-
- @param[in] MajorVer Major Version of TLS/SSL Protocol.
- @param[in] MinorVer Minor Version of TLS/SSL Protocol.
-
- @return Pointer to an allocated SSL_CTX object.
- If the creation failed, TlsCtxNew() returns NULL.
-
+ Copy Big number.
+ @param[out] BnDst Destination.
+ @param[in] BnSrc Source.
+ @retval BnDst on success.
+ @retval NULL otherwise.
**/
+// See BaseCryptLib.h:3633
VOID *
EFIAPI
-TlsCtxNew (
- IN UINT8 MajorVer,
- IN UINT8 MinorVer
+BigNumCopy (
+ OUT VOID *BnDst,
+ IN CONST VOID *BnSrc
)
{
- CALL_CRYPTO_SERVICE (TlsCtxNew, (MajorVer, MinorVer), NULL);
+ CALL_CRYPTO_SERVICE (BigNumCopy, (BnDst, BnSrc), NULL);
}
/**
- Free an allocated TLS object.
-
- This function removes the TLS object pointed to by Tls and frees up the
- allocated memory. If Tls is NULL, nothing is done.
-
- @param[in] Tls Pointer to the TLS object to be freed.
-
+ Shift right Big Number.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] Bn Big number.
+ @param[in] N Number of bits to shift.
+ @param[out] BnRes The result.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
-VOID
+// See BaseCryptLib.h:3664
+BOOLEAN
EFIAPI
-TlsFree (
- IN VOID *Tls
+BigNumRShift (
+ IN CONST VOID *Bn,
+ IN UINTN N,
+ OUT VOID *BnRes
)
{
- CALL_VOID_CRYPTO_SERVICE (TlsFree, (Tls));
+ CALL_CRYPTO_SERVICE (BigNumRShift, (Bn, N, BnRes), FALSE);
}
/**
- Create a new TLS object for a connection.
-
- This function creates a new TLS object for a connection. The new object
- inherits the setting of the underlying context TlsCtx: connection method,
- options, verification setting.
-
- @param[in] TlsCtx Pointer to the SSL_CTX object.
-
- @return Pointer to an allocated SSL object.
- If the creation failed, TlsNew() returns NULL.
-
+ Mark Big Number for constant time computations.
+ This function should be called before any constant time computations are
+ performed on the given Big number.
+ @param[in] Bn Big number.
**/
-VOID *
+// See BaseCryptLib.h:3679
+VOID
EFIAPI
-TlsNew (
- IN VOID *TlsCtx
+BigNumConstTime (
+ IN VOID *Bn
)
{
- CALL_CRYPTO_SERVICE (TlsNew, (TlsCtx), NULL);
+ CALL_VOID_CRYPTO_SERVICE (BigNumConstTime, (Bn));
}
/**
- Checks if the TLS handshake was done.
-
- This function will check if the specified TLS handshake was done.
-
- @param[in] Tls Pointer to the TLS object for handshake state checking.
-
- @retval TRUE The TLS handshake was done.
- @retval FALSE The TLS handshake was not done.
-
+ Calculate square modulo.
+ Please note, all "out" Big number arguments should be properly initialized
+ by calling to BigNumInit() or BigNumFromBin() functions.
+ @param[in] BnA Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3697
BOOLEAN
EFIAPI
-TlsInHandshake (
- IN VOID *Tls
+BigNumSqrMod (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (TlsInHandshake, (Tls), FALSE);
+ CALL_CRYPTO_SERVICE (BigNumSqrMod, (BnA, BnM, BnRes), FALSE);
}
/**
- Perform a TLS/SSL handshake.
-
- This function will perform a TLS/SSL handshake.
-
- @param[in] Tls Pointer to the TLS object for handshake operation.
- @param[in] BufferIn Pointer to the most recently received TLS Handshake packet.
- @param[in] BufferInSize Packet size in bytes for the most recently received TLS
- Handshake packet.
- @param[out] BufferOut Pointer to the buffer to hold the built packet.
- @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferIn is NULL but BufferInSize is NOT 0.
- BufferInSize is 0 but BufferIn is NOT NULL.
- BufferOutSize is NULL.
- BufferOut is NULL if *BufferOutSize is not zero.
- @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
- @retval EFI_ABORTED Something wrong during handshake.
-
+ Create new Big Number computation context. This is an opaque structure
+ which should be passed to any function that requires it. The BN context is
+ needed to optimize calculations and expensive allocations.
+ @retval Big Number context struct or NULL on failure.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3712
+VOID *
EFIAPI
-TlsDoHandshake (
- IN VOID *Tls,
- IN UINT8 *BufferIn OPTIONAL,
- IN UINTN BufferInSize OPTIONAL,
- OUT UINT8 *BufferOut OPTIONAL,
- IN OUT UINTN *BufferOutSize
+BigNumNewContext (
+ VOID
)
{
- CALL_CRYPTO_SERVICE (TlsDoHandshake, (Tls, BufferIn, BufferInSize, BufferOut, BufferOutSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (BigNumNewContext, (), NULL);
}
/**
- Handle Alert message recorded in BufferIn. If BufferIn is NULL and BufferInSize is zero,
- TLS session has errors and the response packet needs to be Alert message based on error type.
-
- @param[in] Tls Pointer to the TLS object for state checking.
- @param[in] BufferIn Pointer to the most recently received TLS Alert packet.
- @param[in] BufferInSize Packet size in bytes for the most recently received TLS
- Alert packet.
- @param[out] BufferOut Pointer to the buffer to hold the built packet.
- @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferIn is NULL but BufferInSize is NOT 0.
- BufferInSize is 0 but BufferIn is NOT NULL.
- BufferOutSize is NULL.
- BufferOut is NULL if *BufferOutSize is not zero.
- @retval EFI_ABORTED An error occurred.
- @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
-
+ Free Big Number context that was allocated with BigNumNewContext().
+ @param[in] BnCtx Big number context to free.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3723
+VOID
EFIAPI
-TlsHandleAlert (
- IN VOID *Tls,
- IN UINT8 *BufferIn OPTIONAL,
- IN UINTN BufferInSize OPTIONAL,
- OUT UINT8 *BufferOut OPTIONAL,
- IN OUT UINTN *BufferOutSize
+BigNumContextFree (
+ IN VOID *BnCtx
)
{
- CALL_CRYPTO_SERVICE (TlsHandleAlert, (Tls, BufferIn, BufferInSize, BufferOut, BufferOutSize), EFI_UNSUPPORTED);
+ CALL_VOID_CRYPTO_SERVICE (BigNumContextFree, (BnCtx));
}
/**
- Build the CloseNotify packet.
-
- @param[in] Tls Pointer to the TLS object for state checking.
- @param[in, out] Buffer Pointer to the buffer to hold the built packet.
- @param[in, out] BufferSize Pointer to the buffer size in bytes. On input, it is
- the buffer size provided by the caller. On output, it
- is the buffer size in fact needed to contain the
- packet.
-
- @retval EFI_SUCCESS The required TLS packet is built successfully.
- @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
- Tls is NULL.
- BufferSize is NULL.
- Buffer is NULL if *BufferSize is not zero.
- @retval EFI_BUFFER_TOO_SMALL BufferSize is too small to hold the response packet.
-
+ Set Big Number to a given value.
+ @param[in] Bn Big number to set.
+ @param[in] Val Value to set.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3738
+BOOLEAN
EFIAPI
-TlsCloseNotify (
- IN VOID *Tls,
- IN OUT UINT8 *Buffer,
- IN OUT UINTN *BufferSize
+BigNumSetUint (
+ IN VOID *Bn,
+ IN UINTN Val
)
{
- CALL_CRYPTO_SERVICE (TlsCloseNotify, (Tls, Buffer, BufferSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (BigNumSetUint, (Bn, Val), FALSE);
}
/**
- Attempts to read bytes from one TLS object and places the data in Buffer.
-
- This function will attempt to read BufferSize bytes from the TLS object
- and places the data in Buffer.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] Buffer Pointer to the buffer to store the data.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The amount of data successfully read from the TLS object.
- @retval <=0 No data was successfully read.
-
+ Add two Big Numbers modulo BnM.
+ @param[in] BnA Big number.
+ @param[in] BnB Big number.
+ @param[in] BnM Big number (modulo).
+ @param[out] BnRes The result, such that (BnA + BnB) % BnM.
+ @retval TRUE On success.
+ @retval FALSE Otherwise.
**/
-INTN
+// See BaseCryptLib.h:3756
+BOOLEAN
EFIAPI
-TlsCtrlTrafficOut (
- IN VOID *Tls,
- IN OUT VOID *Buffer,
- IN UINTN BufferSize
+BigNumAddMod (
+ IN CONST VOID *BnA,
+ IN CONST VOID *BnB,
+ IN CONST VOID *BnM,
+ OUT VOID *BnRes
)
{
- CALL_CRYPTO_SERVICE (TlsCtrlTrafficOut, (Tls, Buffer, BufferSize), 0);
+ CALL_CRYPTO_SERVICE (BigNumAddMod, (BnA, BnB, BnM, BnRes), FALSE);
}
-/**
- Attempts to write data from the buffer to TLS object.
-
- This function will attempt to write BufferSize bytes data from the Buffer
- to the TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
+// =============================================================================
+// TDES functions
+// =============================================================================
+// =============================================================================
+// AES functions
+// =============================================================================
- @retval >0 The amount of data successfully written to the TLS object.
- @retval <=0 No data was successfully written.
+/**
+ Retrieves the size, in bytes, of the context buffer required for AES operations.
+ If this interface is not supported, then return zero.
+ @return The size, in bytes, of the context buffer required for AES operations.
+ @retval 0 This interface is not supported.
+**/
+// See BaseCryptLib.h:1263
+UINTN
+EFIAPI
+AesGetContextSize (
+ VOID
+ )
+{
+ CALL_CRYPTO_SERVICE (AesGetContextSize, (), 0);
+}
+/**
+ Initializes user-supplied memory as AES context for subsequent use.
+ This function initializes user-supplied memory pointed by AesContext as AES context.
+ In addition, it sets up all AES key materials for subsequent encryption and decryption
+ operations.
+ There are 3 options for key length, 128 bits, 192 bits, and 256 bits.
+ If AesContext is NULL, then return FALSE.
+ If Key is NULL, then return FALSE.
+ If KeyLength is not valid, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[out] AesContext Pointer to AES context being initialized.
+ @param[in] Key Pointer to the user-supplied AES key.
+ @param[in] KeyLength Length of AES key in bits.
+ @retval TRUE AES context initialization succeeded.
+ @retval FALSE AES context initialization failed.
+ @retval FALSE This interface is not supported.
**/
-INTN
+// See BaseCryptLib.h:1291
+BOOLEAN
EFIAPI
-TlsCtrlTrafficIn (
- IN VOID *Tls,
- IN VOID *Buffer,
- IN UINTN BufferSize
+AesInit (
+ OUT VOID *AesContext,
+ IN CONST UINT8 *Key,
+ IN UINTN KeyLength
)
{
- CALL_CRYPTO_SERVICE (TlsCtrlTrafficIn, (Tls, Buffer, BufferSize), 0);
+ CALL_CRYPTO_SERVICE (AesInit, (AesContext, Key, KeyLength), FALSE);
}
/**
- Attempts to read bytes from the specified TLS connection into the buffer.
-
- This function tries to read BufferSize bytes data from the specified TLS
- connection into the Buffer.
-
- @param[in] Tls Pointer to the TLS connection for data reading.
- @param[in,out] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The read operation was successful, and return value is the
- number of bytes actually read from the TLS connection.
- @retval <=0 The read operation was not successful.
-
+ Performs AES encryption on a data buffer of the specified size in CBC mode.
+ This function performs AES encryption on data buffer pointed by Input, of specified
+ size of InputSize, in CBC mode.
+ InputSize must be multiple of block size (16 bytes). This function does not perform
+ padding. Caller must perform padding, if necessary, to ensure valid input data size.
+ Initialization vector should be one block size (16 bytes).
+ AesContext should be already correctly initialized by AesInit(). Behavior with
+ invalid AES context is undefined.
+ If AesContext is NULL, then return FALSE.
+ If Input is NULL, then return FALSE.
+ If InputSize is not multiple of block size (16 bytes), then return FALSE.
+ If Ivec is NULL, then return FALSE.
+ If Output is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] AesContext Pointer to the AES context.
+ @param[in] Input Pointer to the buffer containing the data to be encrypted.
+ @param[in] InputSize Size of the Input buffer in bytes.
+ @param[in] Ivec Pointer to initialization vector.
+ @param[out] Output Pointer to a buffer that receives the AES encryption output.
+ @retval TRUE AES encryption succeeded.
+ @retval FALSE AES encryption failed.
+ @retval FALSE This interface is not supported.
**/
-INTN
+// See BaseCryptLib.h:1328
+BOOLEAN
EFIAPI
-TlsRead (
- IN VOID *Tls,
- IN OUT VOID *Buffer,
- IN UINTN BufferSize
+AesCbcEncrypt (
+ IN VOID *AesContext,
+ IN CONST UINT8 *Input,
+ IN UINTN InputSize,
+ IN CONST UINT8 *Ivec,
+ OUT UINT8 *Output
)
{
- CALL_CRYPTO_SERVICE (TlsRead, (Tls, Buffer, BufferSize), 0);
+ CALL_CRYPTO_SERVICE (AesCbcEncrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);
}
/**
- Attempts to write data to a TLS connection.
-
- This function tries to write BufferSize bytes data from the Buffer into the
- specified TLS connection.
-
- @param[in] Tls Pointer to the TLS connection for data writing.
- @param[in] Buffer Pointer to the data buffer.
- @param[in] BufferSize The size of Buffer in bytes.
-
- @retval >0 The write operation was successful, and return value is the
- number of bytes actually written to the TLS connection.
- @retval <=0 The write operation was not successful.
-
+ Performs AES decryption on a data buffer of the specified size in CBC mode.
+ This function performs AES decryption on data buffer pointed by Input, of specified
+ size of InputSize, in CBC mode.
+ InputSize must be multiple of block size (16 bytes). This function does not perform
+ padding. Caller must perform padding, if necessary, to ensure valid input data size.
+ Initialization vector should be one block size (16 bytes).
+ AesContext should be already correctly initialized by AesInit(). Behavior with
+ invalid AES context is undefined.
+ If AesContext is NULL, then return FALSE.
+ If Input is NULL, then return FALSE.
+ If InputSize is not multiple of block size (16 bytes), then return FALSE.
+ If Ivec is NULL, then return FALSE.
+ If Output is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] AesContext Pointer to the AES context.
+ @param[in] Input Pointer to the buffer containing the data to be encrypted.
+ @param[in] InputSize Size of the Input buffer in bytes.
+ @param[in] Ivec Pointer to initialization vector.
+ @param[out] Output Pointer to a buffer that receives the AES encryption output.
+ @retval TRUE AES decryption succeeded.
+ @retval FALSE AES decryption failed.
+ @retval FALSE This interface is not supported.
**/
-INTN
+// See BaseCryptLib.h:1367
+BOOLEAN
EFIAPI
-TlsWrite (
- IN VOID *Tls,
- IN VOID *Buffer,
- IN UINTN BufferSize
+AesCbcDecrypt (
+ IN VOID *AesContext,
+ IN CONST UINT8 *Input,
+ IN UINTN InputSize,
+ IN CONST UINT8 *Ivec,
+ OUT UINT8 *Output
)
{
- CALL_CRYPTO_SERVICE (TlsWrite, (Tls, Buffer, BufferSize), 0);
+ CALL_CRYPTO_SERVICE (AesCbcDecrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);
}
-/**
- Shutdown a TLS connection.
-
- Shutdown the TLS connection without releasing the resources, meaning a new
- connection can be started without calling TlsNew() and without setting
- certificates etc.
-
- @param[in] Tls Pointer to the TLS object to shutdown.
+// =============================================================================
+// ARC4 functions
+// =============================================================================
+// =============================================================================
+// SM3 functions
+// =============================================================================
- @retval EFI_SUCCESS The TLS is shutdown successfully.
- @retval EFI_INVALID_PARAMETER Tls is NULL.
- @retval EFI_PROTOCOL_ERROR Some other error occurred.
+/**
+ Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
+ @return The size, in bytes, of the context buffer required for SM3 hash operations.
**/
-EFI_STATUS
+// See BaseCryptLib.h:805
+UINTN
EFIAPI
-TlsShutdown (
- IN VOID *Tls
+Sm3GetContextSize (
+ VOID
)
{
- CALL_CRYPTO_SERVICE (TlsShutdown, (Tls), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (Sm3GetContextSize, (), 0);
}
/**
- Set a new TLS/SSL method for a particular TLS object.
-
- This function sets a new TLS/SSL method for a particular TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] MajorVer Major Version of TLS/SSL Protocol.
- @param[in] MinorVer Minor Version of TLS/SSL Protocol.
-
- @retval EFI_SUCCESS The TLS/SSL method was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
-
+ Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
+ subsequent use.
+ If Sm3Context is NULL, then return FALSE.
+ @param[out] Sm3Context Pointer to SM3 context being initialized.
+ @retval TRUE SM3 context initialization succeeded.
+ @retval FALSE SM3 context initialization failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:823
+BOOLEAN
EFIAPI
-TlsSetVersion (
- IN VOID *Tls,
- IN UINT8 MajorVer,
- IN UINT8 MinorVer
+Sm3Init (
+ OUT VOID *Sm3Context
)
{
- CALL_CRYPTO_SERVICE (TlsSetVersion, (Tls, MajorVer, MinorVer), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (Sm3Init, (Sm3Context), FALSE);
}
/**
- Set TLS object to work in client or server mode.
-
- This function prepares a TLS object to work in client or server mode.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] IsServer Work in server mode.
-
- @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
-
+ Makes a copy of an existing SM3 context.
+ If Sm3Context is NULL, then return FALSE.
+ If NewSm3Context is NULL, then return FALSE.
+ If this interface is not supported, then return FALSE.
+ @param[in] Sm3Context Pointer to SM3 context being copied.
+ @param[out] NewSm3Context Pointer to new SM3 context.
+ @retval TRUE SM3 context copy succeeded.
+ @retval FALSE SM3 context copy failed.
+ @retval FALSE This interface is not supported.
**/
-EFI_STATUS
+// See BaseCryptLib.h:844
+BOOLEAN
EFIAPI
-TlsSetConnectionEnd (
- IN VOID *Tls,
- IN BOOLEAN IsServer
+Sm3Duplicate (
+ IN CONST VOID *Sm3Context,
+ OUT VOID *NewSm3Context
)
{
- CALL_CRYPTO_SERVICE (TlsSetConnectionEnd, (Tls, IsServer), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (Sm3Duplicate, (Sm3Context, NewSm3Context), FALSE);
}
/**
- Set the ciphers list to be used by the TLS object.
-
- This function sets the ciphers for use by a specified TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
- cipher identifier comes from the TLS Cipher Suite
- Registry of the IANA, interpreting Byte1 and Byte2
- in network (big endian) byte order.
- @param[in] CipherNum The number of cipher in the list.
-
- @retval EFI_SUCCESS The ciphers list was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
- @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
-
+ Digests the input data and updates SM3 context.
+ This function performs SM3 digest on a data buffer of the specified size.
+ It can be called multiple times to compute the digest of long or discontinuous data streams.
+ SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
+ by Sm3Final(). Behavior with invalid context is undefined.
+ If Sm3Context is NULL, then return FALSE.
+ @param[in, out] Sm3Context Pointer to the SM3 context.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @retval TRUE SM3 data digest succeeded.
+ @retval FALSE SM3 data digest failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:869
+BOOLEAN
EFIAPI
-TlsSetCipherList (
- IN VOID *Tls,
- IN UINT16 *CipherId,
- IN UINTN CipherNum
+Sm3Update (
+ IN OUT VOID *Sm3Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetCipherList, (Tls, CipherId, CipherNum), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (Sm3Update, (Sm3Context, Data, DataSize), FALSE);
}
/**
- Set the compression method for TLS/SSL operations.
-
- This function handles TLS/SSL integrated compression methods.
-
- @param[in] CompMethod The compression method ID.
-
- @retval EFI_SUCCESS The compression method for the communication was
- set successfully.
- @retval EFI_UNSUPPORTED Unsupported compression method.
-
+ Completes computation of the SM3 digest value.
+ This function completes SM3 hash computation and retrieves the digest value into
+ the specified memory. After this function has been called, the SM3 context cannot
+ be used again.
+ SM3 context should be already correctly initialized by Sm3Init(), and should not be
+ finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
+ If Sm3Context is NULL, then return FALSE.
+ If HashValue is NULL, then return FALSE.
+ @param[in, out] Sm3Context Pointer to the SM3 context.
+ @param[out] HashValue Pointer to a buffer that receives the SM3 digest
+ value (32 bytes).
+ @retval TRUE SM3 digest computation succeeded.
+ @retval FALSE SM3 digest computation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:897
+BOOLEAN
EFIAPI
-TlsSetCompressionMethod (
- IN UINT8 CompMethod
+Sm3Final (
+ IN OUT VOID *Sm3Context,
+ OUT UINT8 *HashValue
)
{
- CALL_CRYPTO_SERVICE (TlsSetCompressionMethod, (CompMethod), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (Sm3Final, (Sm3Context, HashValue), FALSE);
}
/**
- Set peer certificate verification mode for the TLS connection.
-
- This function sets the verification mode flags for the TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] VerifyMode A set of logically or'ed verification mode flags.
-
+ Computes the SM3 message digest of a input data buffer.
+ This function performs the SM3 message digest of a given data buffer, and places
+ the digest value into the specified memory.
+ If this interface is not supported, then return FALSE.
+ @param[in] Data Pointer to the buffer containing the data to be hashed.
+ @param[in] DataSize Size of Data buffer in bytes.
+ @param[out] HashValue Pointer to a buffer that receives the SM3 digest
+ value (32 bytes).
+ @retval TRUE SM3 digest computation succeeded.
+ @retval FALSE SM3 digest computation failed.
+ @retval FALSE This interface is not supported.
**/
-VOID
+// See BaseCryptLib.h:922
+BOOLEAN
EFIAPI
-TlsSetVerify (
- IN VOID *Tls,
- IN UINT32 VerifyMode
+Sm3HashAll (
+ IN CONST VOID *Data,
+ IN UINTN DataSize,
+ OUT UINT8 *HashValue
)
{
- CALL_VOID_CRYPTO_SERVICE (TlsSetVerify, (Tls, VerifyMode));
+ CALL_CRYPTO_SERVICE (Sm3HashAll, (Data, DataSize, HashValue), FALSE);
}
-/**
- Set the specified host name to be verified.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Flags The setting flags during the validation.
- @param[in] HostName The specified host name to be verified.
-
- @retval EFI_SUCCESS The HostName setting was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_ABORTED Invalid HostName setting.
+// =============================================================================
+// HKDF functions
+// =============================================================================
+/**
+ Derive key data using HMAC-SHA256 based KDF.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize Salt size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3205
+BOOLEAN
EFIAPI
-TlsSetVerifyHost (
- IN VOID *Tls,
- IN UINT32 Flags,
- IN CHAR8 *HostName
+HkdfSha256ExtractAndExpand (
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetVerifyHost, (Tls, Flags, HostName), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (HkdfSha256ExtractAndExpand, (Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize), FALSE);
}
/**
- Sets a TLS/SSL session ID to be used during TLS/SSL connect.
-
- This function sets a session ID to be used when the TLS/SSL connection is
- to be established.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] SessionId Session ID data used for session resumption.
- @param[in] SessionIdLen Length of Session ID in bytes.
-
- @retval EFI_SUCCESS Session ID was set successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED No available session for ID setting.
-
+ Derive SHA256 HMAC-based Extract key Derivation Function (HKDF).
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize salt size in bytes.
+ @param[out] PrkOut Pointer to buffer to receive hkdf value.
+ @param[in] PrkOutSize size of hkdf bytes to generate.
+ @retval true Hkdf generated successfully.
+ @retval false Hkdf generation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3232
+BOOLEAN
EFIAPI
-TlsSetSessionId (
- IN VOID *Tls,
- IN UINT8 *SessionId,
- IN UINT16 SessionIdLen
+HkdfSha256Extract (
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ OUT UINT8 *PrkOut,
+ UINTN PrkOutSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetSessionId, (Tls, SessionId, SessionIdLen), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (HkdfSha256Extract, (Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize), FALSE);
}
/**
- Adds the CA to the cert store when requesting Server or Client authentication.
-
- This function adds the CA certificate to the list of CAs when requesting
- Server or Client authentication for the chosen TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded binary
- X.509 certificate or PEM-encoded X.509 certificate.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
- @retval EFI_ABORTED Invalid X.509 certificate.
-
+ Derive SHA256 HMAC-based Expand Key Derivation Function (HKDF).
+ @param[in] Prk Pointer to the user-supplied key.
+ @param[in] PrkSize Key size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3257
+BOOLEAN
EFIAPI
-TlsSetCaCertificate (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
+HkdfSha256Expand (
+ IN CONST UINT8 *Prk,
+ IN UINTN PrkSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetCaCertificate, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (HkdfSha256Expand, (Prk, PrkSize, Info, InfoSize, Out, OutSize), FALSE);
}
/**
- Loads the local public certificate into the specified TLS object.
-
- This function loads the X.509 certificate into the specified TLS object
- for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded binary
- X.509 certificate or PEM-encoded X.509 certificate.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
- @retval EFI_ABORTED Invalid X.509 certificate.
-
+ Derive SHA384 HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize Salt size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3284
+BOOLEAN
EFIAPI
-TlsSetHostPublicCert (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
+HkdfSha384ExtractAndExpand (
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetHostPublicCert, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (HkdfSha384ExtractAndExpand, (Key, KeySize, Salt, SaltSize, Info, InfoSize, Out, OutSize), FALSE);
}
/**
- Adds the local private key to the specified TLS object.
-
- This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
- key) into the specified TLS object for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
- or PKCS#8 private key.
- @param[in] DataSize The size of data buffer in bytes.
- @param[in] Password Pointer to NULL-terminated private key password, set it to NULL
- if private key not encrypted.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid private key data.
-
+ Derive SHA384 HMAC-based Extract key Derivation Function (HKDF).
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize key size in bytes.
+ @param[in] Salt Pointer to the salt(non-secret) value.
+ @param[in] SaltSize salt size in bytes.
+ @param[out] PrkOut Pointer to buffer to receive hkdf value.
+ @param[in] PrkOutSize size of hkdf bytes to generate.
+ @retval true Hkdf generated successfully.
+ @retval false Hkdf generation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3311
+BOOLEAN
EFIAPI
-TlsSetHostPrivateKeyEx (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize,
- IN VOID *Password OPTIONAL
+HkdfSha384Extract (
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize,
+ IN CONST UINT8 *Salt,
+ IN UINTN SaltSize,
+ OUT UINT8 *PrkOut,
+ UINTN PrkOutSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetHostPrivateKeyEx, (Tls, Data, DataSize, Password), EFI_UNSUPPORTED);
-}
-
-/**
- Adds the local private key to the specified TLS object.
-
- This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
- key) into the specified TLS object for TLS negotiation.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
- or PKCS#8 private key.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid private key data.
+ CALL_CRYPTO_SERVICE (HkdfSha384Extract, (Key, KeySize, Salt, SaltSize, PrkOut, PrkOutSize), FALSE);
+}
+/**
+ Derive SHA384 HMAC-based Expand Key Derivation Function (HKDF).
+ @param[in] Prk Pointer to the user-supplied key.
+ @param[in] PrkSize Key size in bytes.
+ @param[in] Info Pointer to the application specific info.
+ @param[in] InfoSize Info size in bytes.
+ @param[out] Out Pointer to buffer to receive hkdf value.
+ @param[in] OutSize Size of hkdf bytes to generate.
+ @retval TRUE Hkdf generated successfully.
+ @retval FALSE Hkdf generation failed.
**/
-EFI_STATUS
+// See BaseCryptLib.h:3336
+BOOLEAN
EFIAPI
-TlsSetHostPrivateKey (
- IN VOID *Tls,
- IN VOID *Data,
- IN UINTN DataSize
+HkdfSha384Expand (
+ IN CONST UINT8 *Prk,
+ IN UINTN PrkSize,
+ IN CONST UINT8 *Info,
+ IN UINTN InfoSize,
+ OUT UINT8 *Out,
+ IN UINTN OutSize
)
{
- CALL_CRYPTO_SERVICE (TlsSetHostPrivateKey, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (HkdfSha384Expand, (Prk, PrkSize, Info, InfoSize, Out, OutSize), FALSE);
}
-/**
- Adds the CA-supplied certificate revocation list for certificate validation.
-
- This function adds the CA-supplied certificate revocation list data for
- certificate validity checking.
-
- @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
- @param[in] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_ABORTED Invalid CRL data.
+// =============================================================================
+// TLS functions
+// =============================================================================
+/**
+ Initializes the OpenSSL library.
+ This function registers ciphers and digests used directly and indirectly
+ by SSL/TLS, and initializes the readable error messages.
+ This function must be called before any other action takes places.
+ @retval TRUE The OpenSSL library has been initialized.
+ @retval FALSE Failed to initialize the OpenSSL library.
**/
-EFI_STATUS
+// See TlsLib.h:24
+BOOLEAN
EFIAPI
-TlsSetCertRevocationList (
- IN VOID *Data,
- IN UINTN DataSize
+TlsInitialize (
+ VOID
)
{
- CALL_CRYPTO_SERVICE (TlsSetCertRevocationList, (Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsInitialize, (), FALSE);
}
/**
- Set the signature algorithm list to used by the TLS object.
-
- This function sets the signature algorithms for use by a specified TLS object.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] Data Array of UINT8 of signature algorithms. The array consists of
- pairs of the hash algorithm and the signature algorithm as defined
- in RFC 5246
- @param[in] DataSize The length the SignatureAlgoList. Must be divisible by 2.
-
- @retval EFI_SUCCESS The signature algorithm list was set successfully.
- @retval EFI_INVALID_PARAMETER The parameters are invalid.
- @retval EFI_UNSUPPORTED No supported TLS signature algorithm was found in SignatureAlgoList
- @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
-
+ Free an allocated SSL_CTX object.
+ @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
**/
-EFI_STATUS
+// See TlsLib.h:36
+VOID
EFIAPI
-TlsSetSignatureAlgoList (
- IN VOID *Tls,
- IN UINT8 *Data,
- IN UINTN DataSize
+TlsCtxFree (
+ IN VOID *TlsCtx
)
{
- CALL_CRYPTO_SERVICE (TlsSetSignatureAlgoList, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_VOID_CRYPTO_SERVICE (TlsCtxFree, (TlsCtx));
}
/**
- Set the EC curve to be used for TLS flows
-
- This function sets the EC curve to be used for TLS flows.
-
- @param[in] Tls Pointer to a TLS object.
- @param[in] Data An EC named curve as defined in section 5.1.1 of RFC 4492.
- @param[in] DataSize Size of Data, it should be sizeof (UINT32)
-
- @retval EFI_SUCCESS The EC curve was set successfully.
- @retval EFI_INVALID_PARAMETER The parameters are invalid.
- @retval EFI_UNSUPPORTED The requested TLS EC curve is not supported
-
+ Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
+ connections.
+ @param[in] MajorVer Major Version of TLS/SSL Protocol.
+ @param[in] MinorVer Minor Version of TLS/SSL Protocol.
+ @return Pointer to an allocated SSL_CTX object.
+ If the creation failed, TlsCtxNew() returns NULL.
**/
-EFI_STATUS
+// See TlsLib.h:53
+VOID *
EFIAPI
-TlsSetEcCurve (
- IN VOID *Tls,
- IN UINT8 *Data,
- IN UINTN DataSize
+TlsCtxNew (
+ IN UINT8 MajorVer,
+ IN UINT8 MinorVer
)
{
- CALL_CRYPTO_SERVICE (TlsSetSignatureAlgoList, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsCtxNew, (MajorVer, MinorVer), NULL);
}
/**
- Gets the protocol version used by the specified TLS connection.
-
- This function returns the protocol version used by the specified TLS
- connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The protocol version of the specified TLS connection.
-
+ Free an allocated TLS object.
+ This function removes the TLS object pointed to by Tls and frees up the
+ allocated memory. If Tls is NULL, nothing is done.
+ @param[in] Tls Pointer to the TLS object to be freed.
**/
-UINT16
+// See TlsLib.h:69
+VOID
EFIAPI
-TlsGetVersion (
+TlsFree (
IN VOID *Tls
)
{
- CALL_CRYPTO_SERVICE (TlsGetVersion, (Tls), 0);
+ CALL_VOID_CRYPTO_SERVICE (TlsFree, (Tls));
}
/**
- Gets the connection end of the specified TLS connection.
-
- This function returns the connection end (as client or as server) used by
- the specified TLS connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The connection end used by the specified TLS connection.
-
+ Create a new TLS object for a connection.
+ This function creates a new TLS object for a connection. The new object
+ inherits the setting of the underlying context TlsCtx: connection method,
+ options, verification setting.
+ @param[in] TlsCtx Pointer to the SSL_CTX object.
+ @return Pointer to an allocated SSL object.
+ If the creation failed, TlsNew() returns NULL.
**/
-UINT8
+// See TlsLib.h:88
+VOID *
EFIAPI
-TlsGetConnectionEnd (
- IN VOID *Tls
+TlsNew (
+ IN VOID *TlsCtx
)
{
- CALL_CRYPTO_SERVICE (TlsGetConnectionEnd, (Tls), 0);
+ CALL_CRYPTO_SERVICE (TlsNew, (TlsCtx), NULL);
}
/**
- Gets the cipher suite used by the specified TLS connection.
-
- This function returns current cipher suite used by the specified
- TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] CipherId The cipher suite used by the TLS object.
-
- @retval EFI_SUCCESS The cipher suite was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Unsupported cipher suite.
-
+ Checks if the TLS handshake was done.
+ This function will check if the specified TLS handshake was done.
+ @param[in] Tls Pointer to the TLS object for handshake state checking.
+ @retval TRUE The TLS handshake was done.
+ @retval FALSE The TLS handshake was not done.
**/
-EFI_STATUS
+// See TlsLib.h:105
+BOOLEAN
EFIAPI
-TlsGetCurrentCipher (
- IN VOID *Tls,
- IN OUT UINT16 *CipherId
+TlsInHandshake (
+ IN VOID *Tls
)
{
- CALL_CRYPTO_SERVICE (TlsGetCurrentCipher, (Tls, CipherId), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsInHandshake, (Tls), FALSE);
}
/**
- Gets the compression methods used by the specified TLS connection.
-
- This function returns current integrated compression methods used by
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] CompressionId The current compression method used by
- the TLS object.
-
- @retval EFI_SUCCESS The compression method was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_ABORTED Invalid Compression method.
- @retval EFI_UNSUPPORTED This function is not supported.
-
+ Perform a TLS/SSL handshake.
+ This function will perform a TLS/SSL handshake.
+ @param[in] Tls Pointer to the TLS object for handshake operation.
+ @param[in] BufferIn Pointer to the most recently received TLS Handshake packet.
+ @param[in] BufferInSize Packet size in bytes for the most recently received TLS
+ Handshake packet.
+ @param[out] BufferOut Pointer to the buffer to hold the built packet.
+ @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
+ the buffer size provided by the caller. On output, it
+ is the buffer size in fact needed to contain the
+ packet.
+ @retval EFI_SUCCESS The required TLS packet is built successfully.
+ @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
+ Tls is NULL.
+ BufferIn is NULL but BufferInSize is NOT 0.
+ BufferInSize is 0 but BufferIn is NOT NULL.
+ BufferOutSize is NULL.
+ BufferOut is NULL if *BufferOutSize is not zero.
+ @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
+ @retval EFI_ABORTED Something wrong during handshake.
**/
+// See TlsLib.h:137
EFI_STATUS
EFIAPI
-TlsGetCurrentCompressionId (
+TlsDoHandshake (
IN VOID *Tls,
- IN OUT UINT8 *CompressionId
+ IN UINT8 *BufferIn OPTIONAL,
+ IN UINTN BufferInSize OPTIONAL,
+ OUT UINT8 *BufferOut OPTIONAL,
+ IN OUT UINTN *BufferOutSize
)
{
- CALL_CRYPTO_SERVICE (TlsGetCurrentCompressionId, (Tls, CompressionId), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsDoHandshake, (Tls, BufferIn, BufferInSize, BufferOut, BufferOutSize), 0);
}
/**
- Gets the verification mode currently set in the TLS connection.
-
- This function returns the peer verification mode currently set in the
- specified TLS connection.
-
- If Tls is NULL, then ASSERT().
-
- @param[in] Tls Pointer to the TLS object.
-
- @return The verification mode set in the specified TLS connection.
-
+ Handle Alert message recorded in BufferIn. If BufferIn is NULL and BufferInSize is zero,
+ TLS session has errors and the response packet needs to be Alert message based on error type.
+ @param[in] Tls Pointer to the TLS object for state checking.
+ @param[in] BufferIn Pointer to the most recently received TLS Alert packet.
+ @param[in] BufferInSize Packet size in bytes for the most recently received TLS
+ Alert packet.
+ @param[out] BufferOut Pointer to the buffer to hold the built packet.
+ @param[in, out] BufferOutSize Pointer to the buffer size in bytes. On input, it is
+ the buffer size provided by the caller. On output, it
+ is the buffer size in fact needed to contain the
+ packet.
+ @retval EFI_SUCCESS The required TLS packet is built successfully.
+ @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
+ Tls is NULL.
+ BufferIn is NULL but BufferInSize is NOT 0.
+ BufferInSize is 0 but BufferIn is NOT NULL.
+ BufferOutSize is NULL.
+ BufferOut is NULL if *BufferOutSize is not zero.
+ @retval EFI_ABORTED An error occurred.
+ @retval EFI_BUFFER_TOO_SMALL BufferOutSize is too small to hold the response packet.
**/
-UINT32
+// See TlsLib.h:172
+EFI_STATUS
EFIAPI
-TlsGetVerify (
- IN VOID *Tls
+TlsHandleAlert (
+ IN VOID *Tls,
+ IN UINT8 *BufferIn OPTIONAL,
+ IN UINTN BufferInSize OPTIONAL,
+ OUT UINT8 *BufferOut OPTIONAL,
+ IN OUT UINTN *BufferOutSize
)
{
- CALL_CRYPTO_SERVICE (TlsGetVerify, (Tls), 0);
+ CALL_CRYPTO_SERVICE (TlsHandleAlert, (Tls, BufferIn, BufferInSize, BufferOut, BufferOutSize), 0);
}
/**
- Gets the session ID used by the specified TLS connection.
-
- This function returns the TLS/SSL session ID currently used by the
- specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] SessionId Buffer to contain the returned session ID.
- @param[in,out] SessionIdLen The length of Session ID in bytes.
-
- @retval EFI_SUCCESS The Session ID was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
-
+ Build the CloseNotify packet.
+ @param[in] Tls Pointer to the TLS object for state checking.
+ @param[in, out] Buffer Pointer to the buffer to hold the built packet.
+ @param[in, out] BufferSize Pointer to the buffer size in bytes. On input, it is
+ the buffer size provided by the caller. On output, it
+ is the buffer size in fact needed to contain the
+ packet.
+ @retval EFI_SUCCESS The required TLS packet is built successfully.
+ @retval EFI_INVALID_PARAMETER One or more of the following conditions is TRUE:
+ Tls is NULL.
+ BufferSize is NULL.
+ Buffer is NULL if *BufferSize is not zero.
+ @retval EFI_BUFFER_TOO_SMALL BufferSize is too small to hold the response packet.
**/
+// See TlsLib.h:200
EFI_STATUS
EFIAPI
-TlsGetSessionId (
- IN VOID *Tls,
- IN OUT UINT8 *SessionId,
- IN OUT UINT16 *SessionIdLen
+TlsCloseNotify (
+ IN VOID *Tls,
+ IN OUT UINT8 *Buffer,
+ IN OUT UINTN *BufferSize
)
{
- CALL_CRYPTO_SERVICE (TlsGetSessionId, (Tls, SessionId, SessionIdLen), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsCloseNotify, (Tls, Buffer, BufferSize), 0);
}
/**
- Gets the client random data used in the specified TLS connection.
-
- This function returns the TLS/SSL client random data currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] ClientRandom Buffer to contain the returned client
- random data (32 bytes).
-
+ Attempts to read bytes from one TLS object and places the data in Buffer.
+ This function will attempt to read BufferSize bytes from the TLS object
+ and places the data in Buffer.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] Buffer Pointer to the buffer to store the data.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The amount of data successfully read from the TLS object.
+ @retval <=0 No data was successfully read.
**/
-VOID
+// See TlsLib.h:222
+INTN
EFIAPI
-TlsGetClientRandom (
+TlsCtrlTrafficOut (
IN VOID *Tls,
- IN OUT UINT8 *ClientRandom
+ IN OUT VOID *Buffer,
+ IN UINTN BufferSize
)
{
- CALL_VOID_CRYPTO_SERVICE (TlsGetClientRandom, (Tls, ClientRandom));
+ CALL_CRYPTO_SERVICE (TlsCtrlTrafficOut, (Tls, Buffer, BufferSize), 0);
}
/**
- Gets the server random data used in the specified TLS connection.
-
- This function returns the TLS/SSL server random data currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] ServerRandom Buffer to contain the returned server
- random data (32 bytes).
-
+ Attempts to write data from the buffer to TLS object.
+ This function will attempt to write BufferSize bytes data from the Buffer
+ to the TLS object.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Buffer Pointer to the data buffer.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The amount of data successfully written to the TLS object.
+ @retval <=0 No data was successfully written.
**/
-VOID
+// See TlsLib.h:244
+INTN
EFIAPI
-TlsGetServerRandom (
+TlsCtrlTrafficIn (
IN VOID *Tls,
- IN OUT UINT8 *ServerRandom
+ IN VOID *Buffer,
+ IN UINTN BufferSize
)
{
- CALL_VOID_CRYPTO_SERVICE (TlsGetServerRandom, (Tls, ServerRandom));
+ CALL_CRYPTO_SERVICE (TlsCtrlTrafficIn, (Tls, Buffer, BufferSize), 0);
}
/**
- Gets the master key data used in the specified TLS connection.
-
- This function returns the TLS/SSL master key material currently used in
- the specified TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[in,out] KeyMaterial Buffer to contain the returned key material.
-
- @retval EFI_SUCCESS Key material was returned successfully.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
-
+ Attempts to read bytes from the specified TLS connection into the buffer.
+ This function tries to read BufferSize bytes data from the specified TLS
+ connection into the Buffer.
+ @param[in] Tls Pointer to the TLS connection for data reading.
+ @param[in,out] Buffer Pointer to the data buffer.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The read operation was successful, and return value is the
+ number of bytes actually read from the TLS connection.
+ @retval <=0 The read operation was not successful.
**/
-EFI_STATUS
+// See TlsLib.h:267
+INTN
EFIAPI
-TlsGetKeyMaterial (
+TlsRead (
IN VOID *Tls,
- IN OUT UINT8 *KeyMaterial
+ IN OUT VOID *Buffer,
+ IN UINTN BufferSize
)
{
- CALL_CRYPTO_SERVICE (TlsGetKeyMaterial, (Tls, KeyMaterial), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsRead, (Tls, Buffer, BufferSize), 0);
}
/**
- Gets the CA Certificate from the cert store.
-
- This function returns the CA certificate for the chosen
- TLS connection.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the CA
- certificate data sent to the client.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Attempts to write data to a TLS connection.
+ This function tries to write BufferSize bytes data from the Buffer into the
+ specified TLS connection.
+ @param[in] Tls Pointer to the TLS connection for data writing.
+ @param[in] Buffer Pointer to the data buffer.
+ @param[in] BufferSize The size of Buffer in bytes.
+ @retval >0 The write operation was successful, and return value is the
+ number of bytes actually written to the TLS connection.
+ @retval <=0 The write operation was not successful.
**/
-EFI_STATUS
+// See TlsLib.h:290
+INTN
EFIAPI
-TlsGetCaCertificate (
+TlsWrite (
IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+ IN VOID *Buffer,
+ IN UINTN BufferSize
)
{
- CALL_CRYPTO_SERVICE (TlsGetCaCertificate, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsWrite, (Tls, Buffer, BufferSize), 0);
}
/**
- Gets the local public Certificate set in the specified TLS object.
-
- This function returns the local public certificate which was currently set
- in the specified TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the local
- public certificate.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The parameter is invalid.
- @retval EFI_NOT_FOUND The certificate is not found.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Shutdown a TLS connection.
+ Shutdown the TLS connection without releasing the resources, meaning a new
+ connection can be started without calling TlsNew() and without setting
+ certificates etc.
+ @param[in] Tls Pointer to the TLS object to shutdown.
+ @retval EFI_SUCCESS The TLS is shutdown successfully.
+ @retval EFI_INVALID_PARAMETER Tls is NULL.
+ @retval EFI_PROTOCOL_ERROR Some other error occurred.
**/
+// See TlsLib.h:311
EFI_STATUS
EFIAPI
-TlsGetHostPublicCert (
- IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+TlsShutdown (
+ IN VOID *Tls
)
{
- CALL_CRYPTO_SERVICE (TlsGetHostPublicCert, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsShutdown, (Tls), 0);
}
-/**
- Gets the local private key set in the specified TLS object.
-
- This function returns the local private key data which was currently set
- in the specified TLS object.
-
- @param[in] Tls Pointer to the TLS object.
- @param[out] Data Pointer to the data buffer to receive the local
- private key data.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
+// =============================================================================
+// TLSSET functions
+// =============================================================================
+/**
+ Set a new TLS/SSL method for a particular TLS object.
+ This function sets a new TLS/SSL method for a particular TLS object.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] MajorVer Major Version of TLS/SSL Protocol.
+ @param[in] MinorVer Minor Version of TLS/SSL Protocol.
+ @retval EFI_SUCCESS The TLS/SSL method was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Unsupported TLS/SSL method.
**/
+// See TlsLib.h:331
EFI_STATUS
EFIAPI
-TlsGetHostPrivateKey (
+TlsSetVersion (
IN VOID *Tls,
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+ IN UINT8 MajorVer,
+ IN UINT8 MinorVer
)
{
- CALL_CRYPTO_SERVICE (TlsGetHostPrivateKey, (Tls, Data, DataSize), EFI_UNSUPPORTED);
+ CALL_CRYPTO_SERVICE (TlsSetVersion, (Tls, MajorVer, MinorVer), 0);
}
/**
- Gets the CA-supplied certificate revocation list data set in the specified
- TLS object.
-
- This function returns the CA-supplied certificate revocation list data which
- was currently set in the specified TLS object.
-
- @param[out] Data Pointer to the data buffer to receive the CRL data.
- @param[in,out] DataSize The size of data buffer in bytes.
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_UNSUPPORTED This function is not supported.
- @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
-
+ Set TLS object to work in client or server mode.
+ This function prepares a TLS object to work in client or server mode.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] IsServer Work in server mode.
+ @retval EFI_SUCCESS The TLS/SSL work mode was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Unsupported TLS/SSL work mode.
**/
+// See TlsLib.h:352
EFI_STATUS
EFIAPI
-TlsGetCertRevocationList (
- OUT VOID *Data,
- IN OUT UINTN *DataSize
+TlsSetConnectionEnd (
+ IN VOID *Tls,
+ IN BOOLEAN IsServer
)
-{
- CALL_CRYPTO_SERVICE (TlsGetCertRevocationList, (Data, DataSize), EFI_UNSUPPORTED);
-}
-
-/**
- Derive keying material from a TLS connection.
-
- This function exports keying material using the mechanism described in RFC
- 5705.
-
- @param[in] Tls Pointer to the TLS object
- @param[in] Label Description of the key for the PRF function
- @param[in] Context Optional context
- @param[in] ContextLen The length of the context value in bytes
- @param[out] KeyBuffer Buffer to hold the output of the TLS-PRF
- @param[in] KeyBufferLen The length of the KeyBuffer
-
- @retval EFI_SUCCESS The operation succeeded.
- @retval EFI_INVALID_PARAMETER The TLS object is invalid.
- @retval EFI_PROTOCOL_ERROR Some other error occurred.
+{
+ CALL_CRYPTO_SERVICE (TlsSetConnectionEnd, (Tls, IsServer), 0);
+}
+/**
+ Set the ciphers list to be used by the TLS object.
+ This function sets the ciphers for use by a specified TLS object.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] CipherId Array of UINT16 cipher identifiers. Each UINT16
+ cipher identifier comes from the TLS Cipher Suite
+ Registry of the IANA, interpreting Byte1 and Byte2
+ in network (big endian) byte order.
+ @param[in] CipherNum The number of cipher in the list.
+ @retval EFI_SUCCESS The ciphers list was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED No supported TLS cipher was found in CipherId.
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
**/
+// See TlsLib.h:377
EFI_STATUS
EFIAPI
-TlsGetExportKey (
- IN VOID *Tls,
- IN CONST VOID *Label,
- IN CONST VOID *Context,
- IN UINTN ContextLen,
- OUT VOID *KeyBuffer,
- IN UINTN KeyBufferLen
+TlsSetCipherList (
+ IN VOID *Tls,
+ IN UINT16 *CipherId,
+ IN UINTN CipherNum
)
{
- CALL_CRYPTO_SERVICE (
- TlsGetExportKey,
- (Tls, Label, Context, ContextLen,
- KeyBuffer, KeyBufferLen),
- EFI_UNSUPPORTED
- );
+ CALL_CRYPTO_SERVICE (TlsSetCipherList, (Tls, CipherId, CipherNum), 0);
}
-// =====================================================================================
-// Big number primitive
-// =====================================================================================
-
/**
- Allocate new Big Number.
-
- @retval New BigNum opaque structure or NULL on failure.
+ Set the compression method for TLS/SSL operations.
+ This function handles TLS/SSL integrated compression methods.
+ @param[in] CompMethod The compression method ID.
+ @retval EFI_SUCCESS The compression method for the communication was
+ set successfully.
+ @retval EFI_UNSUPPORTED Unsupported compression method.
**/
-VOID *
+// See TlsLib.h:397
+EFI_STATUS
EFIAPI
-BigNumInit (
- VOID
+TlsSetCompressionMethod (
+ IN UINT8 CompMethod
)
{
- CALL_CRYPTO_SERVICE (BigNumInit, (), NULL);
+ CALL_CRYPTO_SERVICE (TlsSetCompressionMethod, (CompMethod), 0);
}
/**
- Allocate new Big Number and assign the provided value to it.
-
- @param[in] Buf Big endian encoded buffer.
- @param[in] Len Buffer length.
-
- @retval New BigNum opaque structure or NULL on failure.
+ Set peer certificate verification mode for the TLS connection.
+ This function sets the verification mode flags for the TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] VerifyMode A set of logically or'ed verification mode flags.
**/
-VOID *
+// See TlsLib.h:412
+VOID
EFIAPI
-BigNumFromBin (
- IN CONST UINT8 *Buf,
- IN UINTN Len
+TlsSetVerify (
+ IN VOID *Tls,
+ IN UINT32 VerifyMode
)
{
- CALL_CRYPTO_SERVICE (BigNumFromBin, (Buf, Len), NULL);
+ CALL_VOID_CRYPTO_SERVICE (TlsSetVerify, (Tls, VerifyMode));
}
/**
- Convert the absolute value of Bn into big-endian form and store it at Buf.
- The Buf array should have at least BigNumBytes() in it.
-
- @param[in] Bn Big number to convert.
- @param[out] Buf Output buffer.
-
- @retval The length of the big-endian number placed at Buf or -1 on error.
+ Set the specified host name to be verified.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Flags The setting flags during the validation.
+ @param[in] HostName The specified host name to be verified.
+ @retval EFI_SUCCESS The HostName setting was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_ABORTED Invalid HostName setting.
**/
-INTN
+// See TlsLib.h:431
+EFI_STATUS
EFIAPI
-BigNumToBin (
- IN CONST VOID *Bn,
- OUT UINT8 *Buf
+TlsSetVerifyHost (
+ IN VOID *Tls,
+ IN UINT32 Flags,
+ IN CHAR8 *HostName
)
{
- CALL_CRYPTO_SERVICE (BigNumToBin, (Bn, Buf), -1);
+ CALL_CRYPTO_SERVICE (TlsSetVerifyHost, (Tls, Flags, HostName), 0);
}
/**
- Free the Big Number.
-
- @param[in] Bn Big number to free.
- @param[in] Clear TRUE if the buffer should be cleared.
+ Sets a TLS/SSL session ID to be used during TLS/SSL connect.
+ This function sets a session ID to be used when the TLS/SSL connection is
+ to be established.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] SessionId Session ID data used for session resumption.
+ @param[in] SessionIdLen Length of Session ID in bytes.
+ @retval EFI_SUCCESS Session ID was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED No available session for ID setting.
**/
-VOID
+// See TlsLib.h:454
+EFI_STATUS
EFIAPI
-BigNumFree (
- IN VOID *Bn,
- IN BOOLEAN Clear
+TlsSetSessionId (
+ IN VOID *Tls,
+ IN UINT8 *SessionId,
+ IN UINT16 SessionIdLen
)
{
- CALL_VOID_CRYPTO_SERVICE (BigNumFree, (Bn, Clear));
+ CALL_CRYPTO_SERVICE (TlsSetSessionId, (Tls, SessionId, SessionIdLen), 0);
}
/**
- Calculate the sum of two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA + BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Adds the CA to the cert store when requesting Server or Client authentication.
+ This function adds the CA certificate to the list of CAs when requesting
+ Server or Client authentication for the chosen TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded binary
+ X.509 certificate or PEM-encoded X.509 certificate.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
+ @retval EFI_ABORTED Invalid X.509 certificate.
**/
-BOOLEAN
+// See TlsLib.h:479
+EFI_STATUS
EFIAPI
-BigNumAdd (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+TlsSetCaCertificate (
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumAdd, (BnA, BnB, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetCaCertificate, (Tls, Data, DataSize), 0);
}
/**
- Subtract two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA - BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Loads the local public certificate into the specified TLS object.
+ This function loads the X.509 certificate into the specified TLS object
+ for TLS negotiation.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded binary
+ X.509 certificate or PEM-encoded X.509 certificate.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_OUT_OF_RESOURCES Required resources could not be allocated.
+ @retval EFI_ABORTED Invalid X.509 certificate.
**/
-BOOLEAN
+// See TlsLib.h:504
+EFI_STATUS
EFIAPI
-BigNumSub (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+TlsSetHostPublicCert (
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumSub, (BnA, BnB, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetHostPublicCert, (Tls, Data, DataSize), 0);
}
/**
- Calculate remainder: BnRes = BnA % BnB
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result of BnA % BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Adds the local private key to the specified TLS object.
+ This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
+ key) into the specified TLS object for TLS negotiation.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
+ or PKCS#8 private key.
+ @param[in] DataSize The size of data buffer in bytes.
+ @param[in] Password Pointer to NULL-terminated private key password, set it to NULL
+ if private key not encrypted.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_ABORTED Invalid private key data.
**/
-BOOLEAN
+// See TlsLib.h:530
+EFI_STATUS
EFIAPI
-BigNumMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+TlsSetHostPrivateKeyEx (
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize,
+ IN VOID *Password OPTIONAL
)
{
- CALL_CRYPTO_SERVICE (BigNumMod, (BnA, BnB, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetHostPrivateKeyEx, (Tls, Data, DataSize, Password), 0);
}
/**
- Compute BnA to the BnP-th power modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnP Big number (power).
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result of (BnA ^ BnP) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Adds the local private key to the specified TLS object.
+ This function adds the local private key (DER-encoded or PEM-encoded or PKCS#8 private
+ key) into the specified TLS object for TLS negotiation.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in] Data Pointer to the data buffer of a DER-encoded or PEM-encoded
+ or PKCS#8 private key.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_ABORTED Invalid private key data.
**/
-BOOLEAN
+// See TlsLib.h:555
+EFI_STATUS
EFIAPI
-BigNumExpMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnP,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+TlsSetHostPrivateKey (
+ IN VOID *Tls,
+ IN VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumExpMod, (BnA, BnP, BnM, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetHostPrivateKey, (Tls, Data, DataSize), 0);
}
/**
- Compute BnA inverse modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnRes) % BnM == 1.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Adds the CA-supplied certificate revocation list for certificate validation.
+ This function adds the CA-supplied certificate revocation list data for
+ certificate validity checking.
+ @param[in] Data Pointer to the data buffer of a DER-encoded CRL data.
+ @param[in] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_ABORTED Invalid CRL data.
**/
-BOOLEAN
+// See TlsLib.h:577
+EFI_STATUS
EFIAPI
-BigNumInverseMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+TlsSetCertRevocationList (
+ IN VOID *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumInverseMod, (BnA, BnM, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetCertRevocationList, (Data, DataSize), 0);
}
/**
- Divide two Big Numbers.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[out] BnRes The result, such that BnA / BnB.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Set the signature algorithm list to used by the TLS object.
+ This function sets the signature algorithms for use by a specified TLS object.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] Data Array of UINT8 of signature algorithms. The array consists of
+ pairs of the hash algorithm and the signature algorithm as defined
+ in RFC 5246
+ @param[in] DataSize The length the SignatureAlgoList. Must be divisible by 2.
+ @retval EFI_SUCCESS The signature algorithm list was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameters are invalid.
+ @retval EFI_UNSUPPORTED No supported TLS signature algorithm was found in SignatureAlgoList
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
**/
-BOOLEAN
+// See TlsLib.h:601
+EFI_STATUS
EFIAPI
-BigNumDiv (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- OUT VOID *BnRes
+TlsSetSignatureAlgoList (
+ IN VOID *Tls,
+ IN UINT8 *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumDiv, (BnA, BnB, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetSignatureAlgoList, (Tls, Data, DataSize), 0);
}
/**
- Multiply two Big Numbers modulo BnM.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA * BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Set the EC curve to be used for TLS flows
+ This function sets the EC curve to be used for TLS flows.
+ @param[in] Tls Pointer to a TLS object.
+ @param[in] Data An EC named curve as defined in section 5.1.1 of RFC 4492.
+ @param[in] DataSize Size of Data, it should be sizeof (UINT32)
+ @retval EFI_SUCCESS The EC curve was set successfully.
+ @retval EFI_INVALID_PARAMETER The parameters are invalid.
+ @retval EFI_UNSUPPORTED The requested TLS EC curve is not supported
**/
-BOOLEAN
+// See TlsLib.h:623
+EFI_STATUS
EFIAPI
-BigNumMulMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+TlsSetEcCurve (
+ IN VOID *Tls,
+ IN UINT8 *Data,
+ IN UINTN DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumMulMod, (BnA, BnB, BnM, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsSetEcCurve, (Tls, Data, DataSize), 0);
}
-/**
- Compare two Big Numbers.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
+// =============================================================================
+// TLSGET functions
+// =============================================================================
- @retval 0 BnA == BnB.
- @retval 1 BnA > BnB.
- @retval -1 BnA < BnB.
+/**
+ Gets the protocol version used by the specified TLS connection.
+ This function returns the protocol version used by the specified TLS
+ connection.
+ If Tls is NULL, then ASSERT().
+ @param[in] Tls Pointer to the TLS object.
+ @return The protocol version of the specified TLS connection.
**/
-INTN
+// See TlsLib.h:644
+UINT16
EFIAPI
-BigNumCmp (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB
+TlsGetVersion (
+ IN VOID *Tls
)
{
- CALL_CRYPTO_SERVICE (BigNumCmp, (BnA, BnB), 0);
+ CALL_CRYPTO_SERVICE (TlsGetVersion, (Tls), 0);
}
/**
- Get number of bits in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bits.
+ Gets the connection end of the specified TLS connection.
+ This function returns the connection end (as client or as server) used by
+ the specified TLS connection.
+ If Tls is NULL, then ASSERT().
+ @param[in] Tls Pointer to the TLS object.
+ @return The connection end used by the specified TLS connection.
**/
-UINTN
+// See TlsLib.h:663
+UINT8
EFIAPI
-BigNumBits (
- IN CONST VOID *Bn
+TlsGetConnectionEnd (
+ IN VOID *Tls
)
{
- CALL_CRYPTO_SERVICE (BigNumBits, (Bn), 0);
+ CALL_CRYPTO_SERVICE (TlsGetConnectionEnd, (Tls), 0);
}
/**
- Get number of bytes in Bn.
-
- @param[in] Bn Big number.
-
- @retval Number of bytes.
+ Gets the cipher suite used by the specified TLS connection.
+ This function returns current cipher suite used by the specified
+ TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] CipherId The cipher suite used by the TLS object.
+ @retval EFI_SUCCESS The cipher suite was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Unsupported cipher suite.
**/
-UINTN
+// See TlsLib.h:683
+EFI_STATUS
EFIAPI
-BigNumBytes (
- IN CONST VOID *Bn
+TlsGetCurrentCipher (
+ IN VOID *Tls,
+ IN OUT UINT16 *CipherId
)
{
- CALL_CRYPTO_SERVICE (BigNumBytes, (Bn), 0);
+ CALL_CRYPTO_SERVICE (TlsGetCurrentCipher, (Tls, CipherId), 0);
}
/**
- Checks if Big Number equals to the given Num.
-
- @param[in] Bn Big number.
- @param[in] Num Number.
-
- @retval TRUE iff Bn == Num.
- @retval FALSE otherwise.
+ Gets the compression methods used by the specified TLS connection.
+ This function returns current integrated compression methods used by
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] CompressionId The current compression method used by
+ the TLS object.
+ @retval EFI_SUCCESS The compression method was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_ABORTED Invalid Compression method.
+ @retval EFI_UNSUPPORTED This function is not supported.
**/
-BOOLEAN
+// See TlsLib.h:706
+EFI_STATUS
EFIAPI
-BigNumIsWord (
- IN CONST VOID *Bn,
- IN UINTN Num
+TlsGetCurrentCompressionId (
+ IN VOID *Tls,
+ IN OUT UINT8 *CompressionId
)
{
- CALL_CRYPTO_SERVICE (BigNumIsWord, (Bn, Num), FALSE);
+ CALL_CRYPTO_SERVICE (TlsGetCurrentCompressionId, (Tls, CompressionId), 0);
}
/**
- Checks if Big Number is odd.
-
- @param[in] Bn Big number.
-
- @retval TRUE Bn is odd (Bn % 2 == 1).
- @retval FALSE otherwise.
+ Gets the verification mode currently set in the TLS connection.
+ This function returns the peer verification mode currently set in the
+ specified TLS connection.
+ If Tls is NULL, then ASSERT().
+ @param[in] Tls Pointer to the TLS object.
+ @return The verification mode set in the specified TLS connection.
**/
-BOOLEAN
+// See TlsLib.h:726
+UINT32
EFIAPI
-BigNumIsOdd (
- IN CONST VOID *Bn
+TlsGetVerify (
+ IN VOID *Tls
)
{
- CALL_CRYPTO_SERVICE (BigNumIsOdd, (Bn), FALSE);
+ CALL_CRYPTO_SERVICE (TlsGetVerify, (Tls), 0);
}
/**
- Copy Big number.
-
- @param[out] BnDst Destination.
- @param[in] BnSrc Source.
-
- @retval BnDst on success.
- @retval NULL otherwise.
+ Gets the session ID used by the specified TLS connection.
+ This function returns the TLS/SSL session ID currently used by the
+ specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] SessionId Buffer to contain the returned session ID.
+ @param[in,out] SessionIdLen The length of Session ID in bytes.
+ @retval EFI_SUCCESS The Session ID was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
**/
-VOID *
+// See TlsLib.h:747
+EFI_STATUS
EFIAPI
-BigNumCopy (
- OUT VOID *BnDst,
- IN CONST VOID *BnSrc
+TlsGetSessionId (
+ IN VOID *Tls,
+ IN OUT UINT8 *SessionId,
+ IN OUT UINT16 *SessionIdLen
)
{
- CALL_CRYPTO_SERVICE (BigNumCopy, (BnDst, BnSrc), NULL);
+ CALL_CRYPTO_SERVICE (TlsGetSessionId, (Tls, SessionId, SessionIdLen), 0);
}
/**
- Get constant Big number with value of "1".
- This may be used to save expensive allocations.
-
- @retval Big Number with value of 1.
+ Gets the client random data used in the specified TLS connection.
+ This function returns the TLS/SSL client random data currently used in
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] ClientRandom Buffer to contain the returned client
+ random data (32 bytes).
**/
-CONST VOID *
+// See TlsLib.h:766
+VOID
EFIAPI
-BigNumValueOne (
- VOID
+TlsGetClientRandom (
+ IN VOID *Tls,
+ IN OUT UINT8 *ClientRandom
)
{
- CALL_CRYPTO_SERVICE (BigNumValueOne, (), NULL);
+ CALL_VOID_CRYPTO_SERVICE (TlsGetClientRandom, (Tls, ClientRandom));
}
/**
- Shift right Big Number.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] Bn Big number.
- @param[in] N Number of bits to shift.
- @param[out] BnRes The result.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Gets the server random data used in the specified TLS connection.
+ This function returns the TLS/SSL server random data currently used in
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] ServerRandom Buffer to contain the returned server
+ random data (32 bytes).
**/
-BOOLEAN
+// See TlsLib.h:784
+VOID
EFIAPI
-BigNumRShift (
- IN CONST VOID *Bn,
- IN UINTN N,
- OUT VOID *BnRes
+TlsGetServerRandom (
+ IN VOID *Tls,
+ IN OUT UINT8 *ServerRandom
)
{
- CALL_CRYPTO_SERVICE (BigNumRShift, (Bn, N, BnRes), FALSE);
-}
-
-/**
- Mark Big Number for constant time computations.
- This function should be called before any constant time computations are
- performed on the given Big number.
+ CALL_VOID_CRYPTO_SERVICE (TlsGetServerRandom, (Tls, ServerRandom));
+}
- @param[in] Bn Big number.
+/**
+ Gets the master key data used in the specified TLS connection.
+ This function returns the TLS/SSL master key material currently used in
+ the specified TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[in,out] KeyMaterial Buffer to contain the returned key material.
+ @retval EFI_SUCCESS Key material was returned successfully.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_UNSUPPORTED Invalid TLS/SSL session.
**/
-VOID
+// See TlsLib.h:805
+EFI_STATUS
EFIAPI
-BigNumConstTime (
- IN VOID *Bn
+TlsGetKeyMaterial (
+ IN VOID *Tls,
+ IN OUT UINT8 *KeyMaterial
)
{
- CALL_VOID_CRYPTO_SERVICE (BigNumConstTime, (Bn));
+ CALL_CRYPTO_SERVICE (TlsGetKeyMaterial, (Tls, KeyMaterial), 0);
}
/**
- Calculate square modulo.
- Please note, all "out" Big number arguments should be properly initialized
- by calling to BigNumInit() or BigNumFromBin() functions.
-
- @param[in] BnA Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA ^ 2) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Gets the CA Certificate from the cert store.
+ This function returns the CA certificate for the chosen
+ TLS connection.
+ @param[in] Tls Pointer to the TLS object.
+ @param[out] Data Pointer to the data buffer to receive the CA
+ certificate data sent to the client.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
-BOOLEAN
+// See TlsLib.h:828
+EFI_STATUS
EFIAPI
-BigNumSqrMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+TlsGetCaCertificate (
+ IN VOID *Tls,
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumSqrMod, (BnA, BnM, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsGetCaCertificate, (Tls, Data, DataSize), 0);
}
/**
- Create new Big Number computation context. This is an opaque structure
- which should be passed to any function that requires it. The BN context is
- needed to optimize calculations and expensive allocations.
-
- @retval Big Number context struct or NULL on failure.
+ Gets the local public Certificate set in the specified TLS object.
+ This function returns the local public certificate which was currently set
+ in the specified TLS object.
+ @param[in] Tls Pointer to the TLS object.
+ @param[out] Data Pointer to the data buffer to receive the local
+ public certificate.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The parameter is invalid.
+ @retval EFI_NOT_FOUND The certificate is not found.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
-VOID *
+// See TlsLib.h:853
+EFI_STATUS
EFIAPI
-BigNumNewContext (
- VOID
+TlsGetHostPublicCert (
+ IN VOID *Tls,
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumNewContext, (), NULL);
+ CALL_CRYPTO_SERVICE (TlsGetHostPublicCert, (Tls, Data, DataSize), 0);
}
/**
- Free Big Number context that was allocated with BigNumNewContext().
-
- @param[in] BnCtx Big number context to free.
+ Gets the local private key set in the specified TLS object.
+ This function returns the local private key data which was currently set
+ in the specified TLS object.
+ @param[in] Tls Pointer to the TLS object.
+ @param[out] Data Pointer to the data buffer to receive the local
+ private key data.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
-VOID
+// See TlsLib.h:877
+EFI_STATUS
EFIAPI
-BigNumContextFree (
- IN VOID *BnCtx
+TlsGetHostPrivateKey (
+ IN VOID *Tls,
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
)
{
- CALL_VOID_CRYPTO_SERVICE (BigNumContextFree, (BnCtx));
+ CALL_CRYPTO_SERVICE (TlsGetHostPrivateKey, (Tls, Data, DataSize), 0);
}
/**
- Set Big Number to a given value.
-
- @param[in] Bn Big number to set.
- @param[in] Val Value to set.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Gets the CA-supplied certificate revocation list data set in the specified
+ TLS object.
+ This function returns the CA-supplied certificate revocation list data which
+ was currently set in the specified TLS object.
+ @param[out] Data Pointer to the data buffer to receive the CRL data.
+ @param[in,out] DataSize The size of data buffer in bytes.
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_UNSUPPORTED This function is not supported.
+ @retval EFI_BUFFER_TOO_SMALL The Data is too small to hold the data.
**/
-BOOLEAN
+// See TlsLib.h:900
+EFI_STATUS
EFIAPI
-BigNumSetUint (
- IN VOID *Bn,
- IN UINTN Val
+TlsGetCertRevocationList (
+ OUT VOID *Data,
+ IN OUT UINTN *DataSize
)
{
- CALL_CRYPTO_SERVICE (BigNumSetUint, (Bn, Val), FALSE);
+ CALL_CRYPTO_SERVICE (TlsGetCertRevocationList, (Data, DataSize), 0);
}
/**
- Add two Big Numbers modulo BnM.
-
- @param[in] BnA Big number.
- @param[in] BnB Big number.
- @param[in] BnM Big number (modulo).
- @param[out] BnRes The result, such that (BnA + BnB) % BnM.
-
- @retval TRUE On success.
- @retval FALSE Otherwise.
+ Derive keying material from a TLS connection.
+ This function exports keying material using the mechanism described in RFC
+ 5705.
+ @param[in] Tls Pointer to the TLS object
+ @param[in] Label Description of the key for the PRF function
+ @param[in] Context Optional context
+ @param[in] ContextLen The length of the context value in bytes
+ @param[out] KeyBuffer Buffer to hold the output of the TLS-PRF
+ @param[in] KeyBufferLen The length of the KeyBuffer
+ @retval EFI_SUCCESS The operation succeeded.
+ @retval EFI_INVALID_PARAMETER The TLS object is invalid.
+ @retval EFI_PROTOCOL_ERROR Some other error occurred.
**/
-BOOLEAN
+// See TlsLib.h:925
+EFI_STATUS
EFIAPI
-BigNumAddMod (
- IN CONST VOID *BnA,
- IN CONST VOID *BnB,
- IN CONST VOID *BnM,
- OUT VOID *BnRes
+TlsGetExportKey (
+ IN VOID *Tls,
+ IN CONST VOID *Label,
+ IN CONST VOID *Context,
+ IN UINTN ContextLen,
+ OUT VOID *KeyBuffer,
+ IN UINTN KeyBufferLen
)
{
- CALL_CRYPTO_SERVICE (BigNumAddMod, (BnA, BnB, BnM, BnRes), FALSE);
+ CALL_CRYPTO_SERVICE (TlsGetExportKey, (Tls, Label, Context, ContextLen, KeyBuffer, KeyBufferLen), 0);
}
+// =============================================================================
+// EC functions
+// =============================================================================
+
/**
Initialize new opaque EcGroup object. This object represents an EC curve and
and is used for calculation within this group. This object should be freed
using EcGroupFree() function.
-
@param[in] CryptoNid Identifying number for the ECC curve (Defined in
BaseCryptLib.h).
-
@retval EcGroup object On success.
@retval NULL On failure.
**/
+// See BaseCryptLib.h:3780
VOID *
EFIAPI
EcGroupInit (
@@ -5250,16 +4656,15 @@ EcGroupInit (
This function will set the provided Big Number objects to the corresponding
values. The caller needs to make sure all the "out" BigNumber parameters
are properly initialized.
-
@param[in] EcGroup EC group object.
@param[out] BnPrime Group prime number.
@param[out] BnA A coefficient.
@param[out] BnB B coefficient.
@param[in] BnCtx BN context.
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3801
BOOLEAN
EFIAPI
EcGroupGetCurve (
@@ -5278,13 +4683,12 @@ EcGroupGetCurve (
This function will set the provided Big Number object to the corresponding
value. The caller needs to make sure that the "out" BigNumber parameter
is properly initialized.
-
@param[in] EcGroup EC group object.
@param[out] BnOrder Group prime number.
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3823
BOOLEAN
EFIAPI
EcGroupGetOrder (
@@ -5297,9 +4701,9 @@ EcGroupGetOrder (
/**
Free previously allocated EC group object using EcGroupInit().
-
@param[in] EcGroup EC group object to free.
**/
+// See BaseCryptLib.h:3835
VOID
EFIAPI
EcGroupFree (
@@ -5312,12 +4716,11 @@ EcGroupFree (
/**
Initialize new opaque EC Point object. This object represents an EC point
within the given EC group (curve).
-
@param[in] EC Group, properly initialized using EcGroupInit().
-
@retval EC Point object On success.
@retval NULL On failure.
**/
+// See BaseCryptLib.h:3850
VOID *
EFIAPI
EcPointInit (
@@ -5329,10 +4732,10 @@ EcPointInit (
/**
Free previously allocated EC Point object using EcPointInit().
-
@param[in] EcPoint EC Point to free.
@param[in] Clear TRUE iff the memory should be cleared.
**/
+// See BaseCryptLib.h:3862
VOID
EFIAPI
EcPointDeInit (
@@ -5348,16 +4751,15 @@ EcPointDeInit (
This function will set the provided Big Number objects to the corresponding
values. The caller needs to make sure all the "out" BigNumber parameters
are properly initialized.
-
@param[in] EcGroup EC group object.
@param[in] EcPoint EC point object.
@param[out] BnX X coordinate.
@param[out] BnY Y coordinate.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3884
BOOLEAN
EFIAPI
EcPointGetAffineCoordinates (
@@ -5373,16 +4775,15 @@ EcPointGetAffineCoordinates (
/**
Set EC point affine (x,y) coordinates.
-
@param[in] EcGroup EC group object.
@param[in] EcPoint EC point object.
@param[in] BnX X coordinate.
@param[in] BnY Y coordinate.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3906
BOOLEAN
EFIAPI
EcPointSetAffineCoordinates (
@@ -5398,17 +4799,16 @@ EcPointSetAffineCoordinates (
/**
EC Point addition. EcPointResult = EcPointA + EcPointB.
-
@param[in] EcGroup EC group object.
@param[out] EcPointResult EC point to hold the result. The point should
be properly initialized.
@param[in] EcPointA EC Point.
@param[in] EcPointB EC Point.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3929
BOOLEAN
EFIAPI
EcPointAdd (
@@ -5424,17 +4824,16 @@ EcPointAdd (
/**
Variable EC point multiplication. EcPointResult = EcPoint * BnPScalar.
-
@param[in] EcGroup EC group object.
@param[out] EcPointResult EC point to hold the result. The point should
be properly initialized.
@param[in] EcPoint EC Point.
@param[in] BnPScalar P Scalar.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3952
BOOLEAN
EFIAPI
EcPointMul (
@@ -5450,14 +4849,13 @@ EcPointMul (
/**
Calculate the inverse of the supplied EC point.
-
@param[in] EcGroup EC group object.
@param[in,out] EcPoint EC point to invert.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3972
BOOLEAN
EFIAPI
EcPointInvert (
@@ -5471,14 +4869,13 @@ EcPointInvert (
/**
Check if the supplied point is on EC curve.
-
@param[in] EcGroup EC group object.
@param[in] EcPoint EC point to check.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On curve.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:3990
BOOLEAN
EFIAPI
EcPointIsOnCurve (
@@ -5492,13 +4889,12 @@ EcPointIsOnCurve (
/**
Check if the supplied point is at infinity.
-
@param[in] EcGroup EC group object.
@param[in] EcPoint EC point to check.
-
@retval TRUE At infinity.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:4007
BOOLEAN
EFIAPI
EcPointIsAtInfinity (
@@ -5511,15 +4907,14 @@ EcPointIsAtInfinity (
/**
Check if EC points are equal.
-
@param[in] EcGroup EC group object.
@param[in] EcPointA EC point A.
@param[in] EcPointB EC point B.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE A == B.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:4025
BOOLEAN
EFIAPI
EcPointEqual (
@@ -5539,16 +4934,15 @@ EcPointEqual (
values for y. Therefore, a point can be set using this function where BnX is
the x coordinate and YBit is a value 0 or 1 to identify which of the two
possible values for y should be used.
-
@param[in] EcGroup EC group object.
@param[in] EcPoint EC Point.
@param[in] BnX X coordinate.
@param[in] YBit 0 or 1 to identify which Y value is used.
@param[in] BnCtx BN context, created with BigNumNewContext().
-
@retval TRUE On success.
@retval FALSE Otherwise.
**/
+// See BaseCryptLib.h:4051
BOOLEAN
EFIAPI
EcPointSetCompressedCoordinates (
@@ -5565,11 +4959,11 @@ EcPointSetCompressedCoordinates (
/**
Allocates and Initializes one Elliptic Curve Context for subsequent use
with the NID.
-
@param[in] Nid cipher NID
@return Pointer to the Elliptic Curve Context that has been initialized.
If the allocations fails, EcNewByNid() returns NULL.
**/
+// See BaseCryptLib.h:4073
VOID *
EFIAPI
EcNewByNid (
@@ -5581,9 +4975,9 @@ EcNewByNid (
/**
Release the specified EC context.
-
@param[in] EcContext Pointer to the EC context to be released.
**/
+// See BaseCryptLib.h:4084
VOID
EFIAPI
EcFree (
@@ -5612,13 +5006,14 @@ EcFree (
If PublicSize is NULL, then return FALSE.
If PublicSize is large enough but Public is NULL, then return FALSE.
@param[in, out] EcContext Pointer to the EC context.
- @param[out] PublicKey Pointer to the buffer to receive generated public X,Y.
+ @param[out] PublicKey Pointer to t buffer to receive generated public X,Y.
@param[in, out] PublicKeySize On input, the size of Public buffer in bytes.
On output, the size of data returned in Public buffer in bytes.
@retval TRUE EC public X,Y generation succeeded.
@retval FALSE EC public X,Y generation failed.
@retval FALSE PublicKeySize is not large enough.
**/
+// See BaseCryptLib.h:4116
BOOLEAN
EFIAPI
EcGenerateKey (
@@ -5644,6 +5039,7 @@ EcGenerateKey (
@retval TRUE EC key component was retrieved successfully.
@retval FALSE Invalid EC key component.
**/
+// See BaseCryptLib.h:4138
BOOLEAN
EFIAPI
EcGetPubKey (
@@ -5680,6 +5076,7 @@ EcGetPubKey (
@retval FALSE EC exchanged key generation failed.
@retval FALSE KeySize is not large enough.
**/
+// See BaseCryptLib.h:4171
BOOLEAN
EFIAPI
EcDhComputeKey (
@@ -5694,50 +5091,20 @@ EcDhComputeKey (
CALL_CRYPTO_SERVICE (EcDhComputeKey, (EcContext, PeerPublic, PeerPublicSize, CompressFlag, Key, KeySize), FALSE);
}
-/**
- Retrieve the EC Public Key from one DER-encoded X509 certificate.
-
- @param[in] Cert Pointer to the DER-encoded X509 certificate.
- @param[in] CertSize Size of the X509 certificate in bytes.
- @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
- EC public key component. Use EcFree() function to free the
- resource.
-
- If Cert is NULL, then return FALSE.
- If EcContext is NULL, then return FALSE.
-
- @retval TRUE EC Public Key was retrieved successfully.
- @retval FALSE Fail to retrieve EC public key from X509 certificate.
-
-**/
-BOOLEAN
-EFIAPI
-EcGetPublicKeyFromX509 (
- IN CONST UINT8 *Cert,
- IN UINTN CertSize,
- OUT VOID **EcContext
- )
-{
- CALL_CRYPTO_SERVICE (EcGetPublicKeyFromX509, (Cert, CertSize, EcContext), FALSE);
-}
-
/**
Retrieve the EC Private Key from the password-protected PEM key data.
-
@param[in] PemData Pointer to the PEM-encoded key data to be retrieved.
@param[in] PemSize Size of the PEM key data in bytes.
@param[in] Password NULL-terminated passphrase used for encrypted PEM key data.
@param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
EC private key component. Use EcFree() function to free the
resource.
-
If PemData is NULL, then return FALSE.
If EcContext is NULL, then return FALSE.
-
@retval TRUE EC Private Key was retrieved successfully.
@retval FALSE Invalid PEM key data or incorrect password.
-
**/
+// See BaseCryptLib.h:4199
BOOLEAN
EFIAPI
EcGetPrivateKeyFromPem (
@@ -5751,21 +5118,41 @@ EcGetPrivateKeyFromPem (
}
/**
- Carries out the EC-DSA signature.
+ Retrieve the EC Public Key from one DER-encoded X509 certificate.
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.
+ @param[in] CertSize Size of the X509 certificate in bytes.
+ @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
+ EC public key component. Use EcFree() function to free the
+ resource.
+ If Cert is NULL, then return FALSE.
+ If EcContext is NULL, then return FALSE.
+ @retval TRUE EC Public Key was retrieved successfully.
+ @retval FALSE Fail to retrieve EC public key from X509 certificate.
+**/
+// See BaseCryptLib.h:4224
+BOOLEAN
+EFIAPI
+EcGetPublicKeyFromX509 (
+ IN CONST UINT8 *Cert,
+ IN UINTN CertSize,
+ OUT VOID **EcContext
+ )
+{
+ CALL_CRYPTO_SERVICE (EcGetPublicKeyFromX509, (Cert, CertSize, EcContext), FALSE);
+}
+/**
+ Carries out the EC-DSA signature.
This function carries out the EC-DSA signature.
If the Signature buffer is too small to hold the contents of signature, FALSE
is returned and SigSize is set to the required buffer size to obtain the signature.
-
If EcContext is NULL, then return FALSE.
If MessageHash is NULL, then return FALSE.
If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
If SigSize is large enough but Signature is NULL, then return FALSE.
-
For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
@param[in] EcContext Pointer to EC context for signature generation.
@param[in] HashNid hash NID
@param[in] MessageHash Pointer to octet message hash to be signed.
@@ -5773,12 +5160,11 @@ EcGetPrivateKeyFromPem (
@param[out] Signature Pointer to buffer to receive EC-DSA signature.
@param[in, out] SigSize On input, the size of Signature buffer in bytes.
On output, the size of data returned in Signature buffer in bytes.
-
@retval TRUE Signature successfully generated in EC-DSA.
@retval FALSE Signature generation failed.
@retval FALSE SigSize is too small.
-
**/
+// See BaseCryptLib.h:4261
BOOLEAN
EFIAPI
EcDsaSign (
@@ -5795,27 +5181,23 @@ EcDsaSign (
/**
Verifies the EC-DSA signature.
-
If EcContext is NULL, then return FALSE.
If MessageHash is NULL, then return FALSE.
If Signature is NULL, then return FALSE.
If HashSize need match the HashNid. HashNid could be SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512.
-
For P-256, the SigSize is 64. First 32-byte is R, Second 32-byte is S.
For P-384, the SigSize is 96. First 48-byte is R, Second 48-byte is S.
For P-521, the SigSize is 132. First 66-byte is R, Second 66-byte is S.
-
@param[in] EcContext Pointer to EC context for signature verification.
@param[in] HashNid hash NID
@param[in] MessageHash Pointer to octet message hash to be checked.
@param[in] HashSize Size of the message hash in bytes.
@param[in] Signature Pointer to EC-DSA signature to be verified.
@param[in] SigSize Size of signature in bytes.
-
@retval TRUE Valid signature encoded in EC-DSA.
@retval FALSE Invalid signature or invalid EC context.
-
**/
+// See BaseCryptLib.h:4295
BOOLEAN
EFIAPI
EcDsaVerify (
@@ -5829,3 +5211,7 @@ EcDsaVerify (
{
CALL_CRYPTO_SERVICE (EcDsaVerify, (EcContext, HashNid, MessageHash, HashSize, Signature, SigSize), FALSE);
}
+
+// AUTOGEN ENDS
+// ****************************************************************************
+// MU_CHANGE [END]
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.c
index dc7527bb01..b10e589d22 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.c
@@ -2,7 +2,7 @@
Implements the GetCryptoServices() API that retuns a pointer to the EDK II
Crypto Protocol.
- Copyright (C) Microsoft Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.inf b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.inf
index 972291574c..1803fe2d79 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/DxeCryptLib.inf
@@ -2,7 +2,7 @@
# Implements the BaseCryptLib and TlsLib using the services of the EDK II Crypto
# Protocol.
#
-# Copyright (C) Microsoft Corporation. All rights reserved.
+# Copyright (c) Microsoft Corporation.
# Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
# SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -42,5 +42,218 @@
[Protocols]
gEdkiiCryptoProtocolGuid ## CONSUMES
+# MU_CHANGE START
+# ****************************************************************************
+# AUTOGENERATED BY CryptoPkg\Driver\Packaging\generate_cryptodriver.py
+# AUTOGENED AS temp_crypto_pcd.inc.inf
+# DO NOT MODIFY
+# GENERATED ON: 2023-05-18 16:49:35.909212
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceParallelHash256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesGetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaSetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaCheckKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSubjectName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCommonName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetOrganizationName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStackV # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStack # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509StackFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetTBSCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs5HashPassword # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Encrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7FreeSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetCertificatesList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceVerifyEKUsInPkcs7Signature # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetAttachedContent # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAuthenticodeVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceImageTimestampVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSerialNumber # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetIssuerName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSignatureAlgorithm # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtensionData # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetValidity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509FormatDateTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCertFromCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAsn1GetTag # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedBasicConstraints # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhSetParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomSeed # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFromBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumToBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSub # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumExpMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInverseMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumDiv # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMulMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCmp # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBits # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsWord # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsOdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCopy # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumRShift # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumConstTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSqrMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumNewContext # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumContextFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSetUint # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAddMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetOrder # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointDeInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointGetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointMul # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInvert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsOnCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsAtInfinity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointEqual # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetCompressedCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcNewByNid # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPubKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInitialize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsDoHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsHandleAlert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCloseNotify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficOut # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficIn # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsRead # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsWrite # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsShutdown # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCipherList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCompressionMethod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerifyHost # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKeyEx # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSignatureAlgoList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetEcCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCipher # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCompressionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetClientRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetServerRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetKeyMaterial # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetExportKey # CONSUMES
+# AUTOGEN ENDS
+# ****************************************************************************
+# MU_CHANGE END
+
[Depex]
gEdkiiCryptoProtocolGuid
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.c
index 51f858302f..36c21cbe50 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.c
@@ -2,7 +2,7 @@
Implements the GetCryptoServices() API that retuns a pointer to the EDK II
Crypto PPI.
- Copyright (C) Microsoft Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.inf
index e7d153db0b..9b420d5aa2 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/PeiCryptLib.inf
@@ -2,7 +2,7 @@
# Implements the BaseCryptLib and TlsLib using the services of the EDK II Crypto
# PPI.
#
-# Copyright (C) Microsoft Corporation. All rights reserved.
+# Copyright (c) Microsoft Corporation.
# Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
# SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -41,5 +41,218 @@
[Ppis]
gEdkiiCryptoPpiGuid ## CONSUMES
+# MU_CHANGE START
+# ****************************************************************************
+# AUTOGENERATED BY CryptoPkg\Driver\Packaging\generate_cryptodriver.py
+# AUTOGENED AS temp_crypto_pcd.inc.inf
+# DO NOT MODIFY
+# GENERATED ON: 2023-05-18 16:49:35.909212
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceParallelHash256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesGetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaSetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaCheckKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSubjectName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCommonName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetOrganizationName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStackV # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStack # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509StackFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetTBSCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs5HashPassword # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Encrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7FreeSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetCertificatesList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceVerifyEKUsInPkcs7Signature # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetAttachedContent # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAuthenticodeVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceImageTimestampVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSerialNumber # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetIssuerName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSignatureAlgorithm # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtensionData # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetValidity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509FormatDateTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCertFromCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAsn1GetTag # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedBasicConstraints # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhSetParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomSeed # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFromBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumToBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSub # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumExpMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInverseMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumDiv # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMulMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCmp # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBits # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsWord # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsOdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCopy # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumRShift # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumConstTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSqrMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumNewContext # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumContextFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSetUint # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAddMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetOrder # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointDeInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointGetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointMul # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInvert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsOnCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsAtInfinity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointEqual # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetCompressedCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcNewByNid # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPubKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInitialize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsDoHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsHandleAlert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCloseNotify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficOut # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficIn # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsRead # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsWrite # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsShutdown # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCipherList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCompressionMethod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerifyHost # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKeyEx # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSignatureAlgoList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetEcCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCipher # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCompressionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetClientRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetServerRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetKeyMaterial # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetExportKey # CONSUMES
+# AUTOGEN ENDS
+# ****************************************************************************
+# MU_CHANGE END
+
[Depex]
gEdkiiCryptoPpiGuid
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.c
new file mode 100644
index 0000000000..641d1213df
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.c
@@ -0,0 +1,121 @@
+/** @file
+ Implements the GetCryptoServices() API that makes services from the EDK II
+ Crypto Protocol available to Runtime DXE drivers.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+STATIC EDKII_CRYPTO_PROTOCOL *mCryptoProtocol = NULL;
+STATIC EFI_EVENT mVirtualAddressChangeEvent = NULL;
+
+/**
+ Internal worker function that returns the pointer to an EDK II Crypto
+ Protocol/PPI. The layout of the PPI, DXE Protocol, and SMM Protocol are
+ identical which allows the implementation of the BaseCryptLib functions that
+ call through a Protocol/PPI to be shared for the PEI, DXE, and SMM
+ implementations.
+
+ This DXE implementation returns the pointer to the EDK II Crypto Protocol
+ that was found in the library constructor DxeCryptLibConstructor().
+
+ @return A pointer to the EDK II Crypto Protocol found in the constructor.
+**/
+VOID *
+GetCryptoServices (
+ VOID
+ )
+{
+ return (VOID *)mCryptoProtocol;
+}
+
+/**
+ Library instance EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE notification function.
+
+ Converts global pointers to their new virtual address.
+
+ @param[in] Event Event whose notification function is being invoked.
+ @param[in] Context Pointer to the notification function's context.
+**/
+VOID
+EFIAPI
+DxeCryptLibAddressChangeEvent (
+ IN EFI_EVENT Event,
+ IN VOID *Context
+ )
+{
+ if (mCryptoProtocol != NULL) {
+ EfiConvertPointer (0x0, (VOID **)&mCryptoProtocol);
+ }
+}
+
+/**
+ Locate the EDK II Crypto Protocol.
+
+ @param[in] ImageHandle The firmware allocated handle for the EFI image.
+ @param[in] SystemTable A pointer to the EFI System Table.
+
+ @retval EFI_SUCCESS The constructor executed correctly.
+ @retval EFI_NOT_FOUND An instance of the EDK II Crypto protocol was not found.
+ @retval EFI_ABORTED Failed to register for the address change event.
+ @retval EFI_UNSUPPORTED The EDK II Crypto protocol version is less than the expected version.
+**/
+EFI_STATUS
+EFIAPI
+RuntimeDxeCryptLibConstructor (
+ IN EFI_HANDLE ImageHandle,
+ IN EFI_SYSTEM_TABLE *SystemTable
+ )
+{
+ EFI_STATUS Status;
+ UINTN Version;
+
+ Status = gBS->LocateProtocol (
+ &gEdkiiCryptoProtocolGuid,
+ NULL,
+ (VOID **)&mCryptoProtocol
+ );
+
+ if (EFI_ERROR (Status) || (mCryptoProtocol == NULL)) {
+ DEBUG ((DEBUG_ERROR, "[%a] Failed to locate Crypto Protocol. Status = %r.\n", __func__, Status));
+ ASSERT_EFI_ERROR (Status);
+ ASSERT (mCryptoProtocol != NULL);
+ mCryptoProtocol = NULL;
+ return EFI_NOT_FOUND;
+ }
+
+ Status = gBS->CreateEventEx (
+ EVT_NOTIFY_SIGNAL,
+ TPL_NOTIFY,
+ DxeCryptLibAddressChangeEvent,
+ NULL,
+ &gEfiEventVirtualAddressChangeGuid,
+ &mVirtualAddressChangeEvent
+ );
+ if (EFI_ERROR (Status)) {
+ // If virtual address change registration fails, the pointer will be invalid at runtime.
+ // Consider the pointer invalid in that case by setting it to null.
+ DEBUG ((DEBUG_ERROR, "[%a] Failed to register for address change notification.\n", __func__));
+ ASSERT_EFI_ERROR (Status);
+ mCryptoProtocol = NULL;
+ return EFI_ABORTED;
+ }
+
+ Version = mCryptoProtocol->GetVersion ();
+ if (Version < EDKII_CRYPTO_VERSION) {
+ DEBUG ((DEBUG_ERROR, "[%a] Crypto Protocol unsupported version %u.\n", __func__, Version));
+ ASSERT (Version >= EDKII_CRYPTO_VERSION);
+ mCryptoProtocol = NULL;
+ return EFI_NOT_FOUND;
+ }
+
+ return EFI_SUCCESS;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.inf b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.inf
new file mode 100644
index 0000000000..911cefb24f
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/RuntimeDxeCryptLib.inf
@@ -0,0 +1,263 @@
+## @file
+# Implements the BaseCryptLib and TlsLib for Runtime DXE using the services of the EDK II Crypto
+# Protocol.
+#
+# Copyright (c) Microsoft Corporation.
+# Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
+# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x0001001B
+ BASE_NAME = RuntimeDxeCryptLib
+ MODULE_UNI_FILE = CryptLib.uni
+ FILE_GUID = C7B611C1-2E9A-4F71-BC41-B14E461B6F9C
+ VERSION_STRING = 1.0
+ MODULE_TYPE = DXE_RUNTIME_DRIVER
+ LIBRARY_CLASS = BaseCryptLib | DXE_RUNTIME_DRIVER
+ LIBRARY_CLASS = TlsLib | DXE_RUNTIME_DRIVER
+ CONSTRUCTOR = RuntimeDxeCryptLibConstructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 RISCV64 LOONGARCH64
+#
+
+[Packages]
+ MdePkg/MdePkg.dec
+ CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ DebugLib
+ UefiBootServicesTableLib
+ UefiRuntimeLib
+
+[Guids]
+ gEfiEventVirtualAddressChangeGuid
+
+[Sources]
+ RuntimeDxeCryptLib.c
+ CryptLib.c
+
+[Protocols]
+ gEdkiiCryptoProtocolGuid ## CONSUMES
+
+# MU_CHANGE START
+# ****************************************************************************
+# AUTOGENERATED BY CryptoPkg\Driver\Packaging\generate_cryptodriver.py
+# AUTOGENED AS temp_crypto_pcd.inc.inf
+# DO NOT MODIFY
+# GENERATED ON: 2023-05-18 16:49:35.909212
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceParallelHash256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesGetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaSetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaCheckKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSubjectName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCommonName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetOrganizationName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStackV # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStack # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509StackFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetTBSCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs5HashPassword # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Encrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7FreeSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetCertificatesList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceVerifyEKUsInPkcs7Signature # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetAttachedContent # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAuthenticodeVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceImageTimestampVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSerialNumber # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetIssuerName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSignatureAlgorithm # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtensionData # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetValidity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509FormatDateTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCertFromCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAsn1GetTag # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedBasicConstraints # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhSetParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomSeed # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFromBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumToBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSub # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumExpMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInverseMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumDiv # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMulMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCmp # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBits # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsWord # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsOdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCopy # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumRShift # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumConstTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSqrMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumNewContext # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumContextFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSetUint # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAddMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetOrder # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointDeInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointGetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointMul # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInvert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsOnCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsAtInfinity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointEqual # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetCompressedCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcNewByNid # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPubKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInitialize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsDoHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsHandleAlert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCloseNotify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficOut # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficIn # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsRead # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsWrite # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsShutdown # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCipherList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCompressionMethod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerifyHost # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKeyEx # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSignatureAlgoList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetEcCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCipher # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCompressionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetClientRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetServerRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetKeyMaterial # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetExportKey # CONSUMES
+# AUTOGEN ENDS
+# ****************************************************************************
+# MU_CHANGE END
+
+[Depex]
+ gEdkiiCryptoProtocolGuid
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.c
index be0f44e63b..9fd1b4869d 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.c
@@ -2,7 +2,7 @@
Implements the GetCryptoServices() API that retuns a pointer to the EDK II
SMM Crypto Protocol.
- Copyright (C) Microsoft Corporation. All rights reserved.
+ Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.inf
index b1285b4447..a1dbfb00d2 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/SmmCryptLib.inf
@@ -2,7 +2,7 @@
# Implements the BaseCryptLib and TlsLib using the services of the EDK II Crypto
# SMM Protocol.
#
-# Copyright (C) Microsoft Corporation. All rights reserved.
+# Copyright (c) Microsoft Corporation.
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -42,3 +42,216 @@
[Depex]
gEdkiiSmmCryptoProtocolGuid
+
+# MU_CHANGE START
+# ****************************************************************************
+# AUTOGENERATED BY CryptoPkg\Driver\Packaging\generate_cryptodriver.py
+# AUTOGENED AS temp_crypto_pcd.inc.inf
+# DO NOT MODIFY
+# GENERATED ON: 2023-05-18 16:49:35.909212
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceParallelHash256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesGetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaSetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaCheckKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSubjectName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCommonName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetOrganizationName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStackV # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStack # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509StackFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetTBSCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs5HashPassword # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Encrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7FreeSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetCertificatesList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceVerifyEKUsInPkcs7Signature # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetAttachedContent # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAuthenticodeVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceImageTimestampVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSerialNumber # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetIssuerName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSignatureAlgorithm # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtensionData # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetValidity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509FormatDateTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCertFromCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAsn1GetTag # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedBasicConstraints # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhSetParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomSeed # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFromBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumToBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSub # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumExpMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInverseMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumDiv # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMulMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCmp # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBits # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsWord # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsOdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCopy # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumRShift # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumConstTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSqrMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumNewContext # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumContextFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSetUint # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAddMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetOrder # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointDeInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointGetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointMul # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInvert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsOnCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsAtInfinity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointEqual # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetCompressedCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcNewByNid # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPubKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInitialize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsDoHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsHandleAlert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCloseNotify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficOut # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficIn # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsRead # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsWrite # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsShutdown # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCipherList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCompressionMethod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerifyHost # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKeyEx # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSignatureAlgoList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetEcCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCipher # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCompressionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetClientRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetServerRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetKeyMaterial # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetExportKey # CONSUMES
+# AUTOGEN ENDS
+# ****************************************************************************
+# MU_CHANGE END
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.c
new file mode 100644
index 0000000000..eda635a357
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.c
@@ -0,0 +1,79 @@
+/** @file
+ Implements the GetCryptoServices() API that retuns a pointer to the EDK II
+ SMM Crypto Protocol.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include
+#include
+#include
+#include
+#include
+
+EDKII_SMM_CRYPTO_PROTOCOL *mSmmCryptoProtocol = NULL;
+
+/**
+ Internal worker function that returns the pointer to an EDK II Crypto
+ Protocol/PPI. The layout of the PPI, DXE Protocol, and SMM Protocol are
+ identical which allows the implementation of the BaseCryptLib functions that
+ call through a Protocol/PPI to be shared for the PEI, DXE, and SMM
+ implementations.
+
+ This SMM implementation returns the pointer to the EDK II SMM Crypto Protocol
+ that was found in the library constructor SmmCryptLibConstructor().
+**/
+VOID *
+GetCryptoServices (
+ VOID
+ )
+{
+ return (VOID *)mSmmCryptoProtocol;
+}
+
+/**
+ Constructor looks up the EDK II SMM Crypto Protocol and verifies that it is
+ not NULL and has a high enough version value to support all the BaseCryptLib
+ functions.
+
+ @param ImageHandle The firmware allocated handle for the EFI image.
+ @param MmSystemTable A pointer to the MM System Table.
+
+ @retval EFI_SUCCESS The EDK II SMM Crypto Protocol was found.
+ @retval EFI_NOT_FOUND The EDK II SMM Crypto Protocol was not found.
+**/
+EFI_STATUS
+EFIAPI
+StandaloneMmCryptLibConstructor (
+ IN EFI_HANDLE ImageHandle,
+ IN EFI_MM_SYSTEM_TABLE *MmSystemTable
+ )
+{
+ EFI_STATUS Status;
+ UINTN Version;
+
+ Status = gMmst->MmLocateProtocol (
+ &gEdkiiSmmCryptoProtocolGuid,
+ NULL,
+ (VOID **)&mSmmCryptoProtocol
+ );
+ if (EFI_ERROR (Status) || (mSmmCryptoProtocol == NULL)) {
+ DEBUG ((DEBUG_ERROR, "[StandaloneMmCryptLib] Failed to locate Crypto SMM Protocol. Status = %r\n", Status));
+ ASSERT_EFI_ERROR (Status);
+ ASSERT (mSmmCryptoProtocol != NULL);
+ mSmmCryptoProtocol = NULL;
+ return EFI_NOT_FOUND;
+ }
+
+ Version = mSmmCryptoProtocol->GetVersion ();
+ if (Version < EDKII_CRYPTO_VERSION) {
+ DEBUG ((DEBUG_ERROR, "[StandaloneMmCryptLib] Crypto SMM Protocol unsupported version %d\n", Version));
+ ASSERT (Version >= EDKII_CRYPTO_VERSION);
+ mSmmCryptoProtocol = NULL;
+ return EFI_NOT_FOUND;
+ }
+
+ return EFI_SUCCESS;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.inf b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.inf
new file mode 100644
index 0000000000..83e8b696c1
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/StandaloneMmCryptLib.inf
@@ -0,0 +1,258 @@
+## @file
+# Implements the BaseCryptLib and TlsLib using the services of the EDK II Crypto
+# SMM Protocol for Stdandalone MM.
+#
+# Copyright (c) Microsoft Corporation.
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x0001001B
+ BASE_NAME = StandaloneMmCryptLib
+ MODULE_UNI_FILE = CryptLib.uni
+ FILE_GUID = FA7EB4FD-7B3B-4FE4-BA95-1CE47CD0BE3E
+ VERSION_STRING = 1.0
+ PI_SPECIFICATION_VERSION = 0x00010032
+ MODULE_TYPE = MM_STANDALONE
+ LIBRARY_CLASS = BaseCryptLib | MM_STANDALONE
+ LIBRARY_CLASS = TlsLib | MM_STANDALONE
+ CONSTRUCTOR = StandaloneMmCryptLibConstructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64
+#
+
+[Packages]
+ MdePkg/MdePkg.dec
+ CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ DebugLib
+ MmServicesTableLib
+
+[Sources]
+ StandaloneMmCryptLib.c
+ CryptLib.c
+
+[Protocols]
+ gEdkiiSmmCryptoProtocolGuid ## CONSUMES
+
+[Depex]
+ gEdkiiSmmCryptoProtocolGuid
+
+# MU_CHANGE START
+# ****************************************************************************
+# AUTOGENERATED BY CryptoPkg\Driver\Packaging\generate_cryptodriver.py
+# AUTOGENED AS temp_crypto_pcd.inc.inf
+# DO NOT MODIFY
+# GENERATED ON: 2023-05-18 16:49:35.909212
+
+[Pcd]
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha1HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha384HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSha512HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceParallelHash256HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3GetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Init # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceSm3HashAll # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha256All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384New # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384SetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Duplicate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Update # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384Final # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHmacSha384All # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesGetContextSize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAesCbcDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmEncrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAeadAesGcmDecrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaSetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaCheckKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPkcs1Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaPssVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRsaGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSubjectName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCommonName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetOrganizationName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStackV # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509ConstructCertificateStack # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509Free # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509StackFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetTBSCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs5HashPassword # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs1v2Encrypt # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7FreeSigners # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetCertificatesList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Sign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7Verify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceVerifyEKUsInPkcs7Signature # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServicePkcs7GetAttachedContent # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAuthenticodeVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceImageTimestampVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSerialNumber # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetIssuerName # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetSignatureAlgorithm # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtensionData # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetValidity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509FormatDateTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedKeyUsage # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509VerifyCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetCertFromCertChain # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceAsn1GetTag # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceX509GetExtendedBasicConstraints # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhSetParameter # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomSeed # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceRandomBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha256Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384ExtractAndExpand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Extract # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceHkdfSha384Expand # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFromBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumToBin # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSub # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumExpMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumInverseMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumDiv # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumMulMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCmp # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBits # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumBytes # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsWord # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumIsOdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumCopy # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumRShift # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumConstTime # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSqrMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumNewContext # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumContextFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumSetUint # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceBigNumAddMod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupGetOrder # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGroupFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointDeInit # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointGetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetAffineCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointAdd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointMul # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointInvert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsOnCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointIsAtInfinity # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointEqual # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcPointSetCompressedCoordinates # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcNewByNid # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGenerateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPubKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDhComputeKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPrivateKeyFromPem # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcGetPublicKeyFromX509 # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaSign # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceEcDsaVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInitialize # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtxNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsFree # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsNew # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsInHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsDoHandshake # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsHandleAlert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCloseNotify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficOut # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsCtrlTrafficIn # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsRead # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsWrite # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsShutdown # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCipherList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCompressionMethod # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetVerifyHost # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKeyEx # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetSignatureAlgoList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsSetEcCurve # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVersion # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetConnectionEnd # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCipher # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCurrentCompressionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetVerify # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetSessionId # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetClientRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetServerRandom # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetKeyMaterial # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCaCertificate # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPublicCert # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetHostPrivateKey # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetCertRevocationList # CONSUMES
+ gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceTlsGetExportKey # CONSUMES
+# AUTOGEN ENDS
+# ****************************************************************************
+# MU_CHANGE END
diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/readme.md b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/readme.md
new file mode 100644
index 0000000000..456605eb67
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/readme.md
@@ -0,0 +1,7 @@
+# BaseCryptLibOnProtocolPpi
+
+This is an implementation of BaseCryptLib that uses a protocol.
+
+This makes binaries smaller, makes servicing easier, and allows crypto to be pre-compiled.
+
+See CryptoPkg/Driver/readme.md for more information.
diff --git a/CryptoPkg/Library/HmacSha1Lib/CryptHmacSha1Null.c b/CryptoPkg/Library/HmacSha1Lib/CryptHmacSha1Null.c
new file mode 100644
index 0000000000..d55547683a
--- /dev/null
+++ b/CryptoPkg/Library/HmacSha1Lib/CryptHmacSha1Null.c
@@ -0,0 +1,161 @@
+/** @file
+ HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include
+#include
+#include
+
+/**
+ Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.
+ (NOTE: This API is deprecated.
+ Use HmacSha1New() / HmacSha1Free() for HMAC-SHA1 Context operations.)
+
+ Return zero to indicate this interface is not supported.
+
+ @retval 0 This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+HmacSha1GetContextSize (
+ VOID
+ )
+{
+ ASSERT (FALSE);
+ return 0;
+}
+
+/**
+ Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
+
+ Return NULL to indicate this interface is not supported.
+
+ @return NULL This interface is not supported..
+
+**/
+VOID *
+EFIAPI
+HmacSha1New (
+ VOID
+ )
+{
+ ASSERT (FALSE);
+ return NULL;
+}
+
+/**
+ Release the specified HMAC_CTX context.
+
+ This function will do nothing.
+
+ @param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
+
+**/
+VOID
+EFIAPI
+HmacSha1Free (
+ IN VOID *HmacSha1Ctx
+ )
+{
+ ASSERT (FALSE);
+ return;
+}
+
+/**
+ Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for
+ subsequent use.
+
+ Return FALSE to indicate this interface is not supported.
+
+ @param[out] HmacSha1Context Pointer to HMAC-SHA1 context being initialized.
+ @param[in] Key Pointer to the user-supplied key.
+ @param[in] KeySize Key size in bytes.
+
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Init (
+ OUT VOID *HmacSha1Context,
+ IN CONST UINT8 *Key,
+ IN UINTN KeySize
+ )
+{
+ ASSERT (FALSE);
+ return FALSE;
+}
+
+/**
+ Makes a copy of an existing HMAC-SHA1 context.
+
+ Return FALSE to indicate this interface is not supported.
+
+ @param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
+ @param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
+
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Duplicate (
+ IN CONST VOID *HmacSha1Context,
+ OUT VOID *NewHmacSha1Context
+ )
+{
+ ASSERT (FALSE);
+ return FALSE;
+}
+
+/**
+ Digests the input data and updates HMAC-SHA1 context.
+
+ Return FALSE to indicate this interface is not supported.
+
+ @param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
+ @param[in] Data Pointer to the buffer containing the data to be digested.
+ @param[in] DataSize Size of Data buffer in bytes.
+
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Update (
+ IN OUT VOID *HmacSha1Context,
+ IN CONST VOID *Data,
+ IN UINTN DataSize
+ )
+{
+ ASSERT (FALSE);
+ return FALSE;
+}
+
+/**
+ Completes computation of the HMAC-SHA1 digest value.
+
+ Return FALSE to indicate this interface is not supported.
+
+ @param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
+ @param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
+ value (20 bytes).
+
+ @retval FALSE This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Final (
+ IN OUT VOID *HmacSha1Context,
+ OUT UINT8 *HmacValue
+ )
+{
+ ASSERT (FALSE);
+ return FALSE;
+}
diff --git a/CryptoPkg/Library/HmacSha1Lib/HmacSha1LibNull.inf b/CryptoPkg/Library/HmacSha1Lib/HmacSha1LibNull.inf
new file mode 100644
index 0000000000..5dd123b9fe
--- /dev/null
+++ b/CryptoPkg/Library/HmacSha1Lib/HmacSha1LibNull.inf
@@ -0,0 +1,62 @@
+## @file
+# Cryptographic Library Instance for DXE_DRIVER.
+#
+# Caution: This module requires additional review when modified.
+# This library will have external input - signature.
+# This external input must be validated carefully to avoid security issues such as
+# buffer overflow or integer overflow.
+#
+# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.
+# Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = HmacSha1Lib
+ MODULE_UNI_FILE = HmacSha1Lib.uni
+ FILE_GUID = d11b624a-928e-4962-9799-8b5a223bafaf
+ MODULE_TYPE = DXE_DRIVER
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = HmacSha1Lib|DXE_DRIVER DXE_CORE UEFI_APPLICATION UEFI_DRIVER
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 RISCV64
+#
+
+[Sources]
+ CryptHmacSha1Null.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
+
+#
+# Remove these [BuildOptions] after this library is cleaned up
+#
+[BuildOptions]
+ #
+ # suppress the following warnings so we do not break the build with warnings-as-errors:
+ # C4090: 'function' : different 'const' qualifiers
+ #
+ MSFT:*_*_*_CC_FLAGS = /wd4090
+ MSFT:*_*_AARCH64_CC_FLAGS = /U_M_ARM64 /D_M_MS_ARM64 # MU_CHANGE - TCBZ2029
+ MSFT:*_*_ARM_CC_FLAGS = /U_M_ARM /D_M_MS_ARM # MU_CHANGE - TCBZ2029
+
+ # -JCryptoPkg/Include : To disable the use of the system includes provided by RVCT
+ # --diag_remark=1 : Reduce severity of "#1-D: last line of file ends without a newline"
+ RVCT:*_*_ARM_CC_FLAGS = -JCryptoPkg/Include --diag_remark=1
+
+ GCC:*_CLANG35_*_CC_FLAGS = -std=c99
+ GCC:*_CLANG38_*_CC_FLAGS = -std=c99
+ GCC:*_CLANGPDB_*_CC_FLAGS = -std=c99 -Wno-error=incompatible-pointer-types
+
+ XCODE:*_*_*_CC_FLAGS = -std=c99
diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
deleted file mode 100644
index f36fe08f0c..0000000000
--- a/CryptoPkg/Library/Include/CrtLibSupport.h
+++ /dev/null
@@ -1,427 +0,0 @@
-/** @file
- Root include file of C runtime library to support building the third-party
- cryptographic library.
-
-Copyright (c) 2010 - 2022, Intel Corporation. All rights reserved.
-Copyright (c) 2020, Hewlett Packard Enterprise Development LP. All rights reserved.
-Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#ifndef __CRT_LIB_SUPPORT_H__
-#define __CRT_LIB_SUPPORT_H__
-
-#include
-#include
-#include
-#include
-
-#define OPENSSLDIR ""
-#define ENGINESDIR ""
-#define MODULESDIR ""
-
-#define MAX_STRING_SIZE 0x1000
-
-//
-// We already have "no-ui" in out Configure invocation.
-// but the code still fails to compile.
-// Ref: https://github.com/openssl/openssl/issues/8904
-//
-// This is defined in CRT library(stdio.h).
-//
-#ifndef BUFSIZ
-#define BUFSIZ 8192
-#endif
-
-//
-// OpenSSL relies on explicit configuration for word size in crypto/bn,
-// but we want it to be automatically inferred from the target. So we
-// bypass what's in for OPENSSL_SYS_UEFI, and
-// define our own here.
-//
-#ifdef CONFIG_HEADER_BN_H
- #error CONFIG_HEADER_BN_H already defined
-#endif
-
-#define CONFIG_HEADER_BN_H
-
-#if !defined (SIXTY_FOUR_BIT) && !defined (THIRTY_TWO_BIT)
- #if defined (MDE_CPU_X64) || defined (MDE_CPU_AARCH64) || defined (MDE_CPU_IA64) || defined (MDE_CPU_RISCV64) || defined (MDE_CPU_LOONGARCH64)
-//
-// With GCC we would normally use SIXTY_FOUR_BIT_LONG, but MSVC needs
-// SIXTY_FOUR_BIT, because 'long' is 32-bit and only 'long long' is
-// 64-bit. Since using 'long long' works fine on GCC too, just do that.
-//
-#define SIXTY_FOUR_BIT
- #elif defined (MDE_CPU_IA32) || defined (MDE_CPU_ARM) || defined (MDE_CPU_EBC)
-#define THIRTY_TWO_BIT
- #else
- #error Unknown target architecture
- #endif
-#endif
-
-//
-// Map all va_xxxx elements to VA_xxx defined in MdePkg/Include/Base.h
-//
-#if !defined (__CC_ARM) // if va_list is not already defined
-#define va_list VA_LIST
-#define va_arg VA_ARG
-#define va_start VA_START
-#define va_end VA_END
-#else // __CC_ARM
-#define va_start(Marker, Parameter) __va_start(Marker, Parameter)
-#define va_arg(Marker, TYPE) __va_arg(Marker, TYPE)
-#define va_end(Marker) ((void)0)
-#endif
-
-//
-// Definitions for global constants used by CRT library routines
-//
-#define EINVAL 22 /* Invalid argument */
-#define EAFNOSUPPORT 47 /* Address family not supported by protocol family */
-#define INT_MAX 0x7FFFFFFF /* Maximum (signed) int value */
-#define INT_MIN (-INT_MAX-1) /* Minimum (signed) int value */
-#define LONG_MAX 0X7FFFFFFFL /* max value for a long */
-#define LONG_MIN (-LONG_MAX-1) /* min value for a long */
-#define UINT_MAX 0xFFFFFFFF /* Maximum unsigned int value */
-#define ULONG_MAX 0xFFFFFFFF /* Maximum unsigned long value */
-#define CHAR_BIT 8 /* Number of bits in a char */
-#define SIZE_MAX 0xFFFFFFFF /* Maximum unsigned size_t */
-
-//
-// Address families.
-//
-#define AF_INET 2 /* internetwork: UDP, TCP, etc. */
-#define AF_INET6 24 /* IP version 6 */
-
-//
-// Define constants based on RFC0883, RFC1034, RFC 1035
-//
-#define NS_INT16SZ 2 /*%< #/bytes of data in a u_int16_t */
-#define NS_INADDRSZ 4 /*%< IPv4 T_A */
-#define NS_IN6ADDRSZ 16 /*%< IPv6 T_AAAA */
-
-//
-// Basic types mapping
-//
-typedef UINTN size_t;
-typedef UINTN off_t;
-typedef UINTN u_int;
-typedef INTN ptrdiff_t;
-typedef INTN ssize_t;
-typedef INT64 time_t;
-typedef UINT8 __uint8_t;
-typedef UINT8 sa_family_t;
-typedef UINT8 u_char;
-typedef UINT32 uid_t;
-typedef UINT32 gid_t;
-typedef CHAR16 wchar_t;
-
-//
-// File operations are not required for EFI building,
-// so FILE is mapped to VOID * to pass build
-//
-typedef VOID *FILE;
-
-//
-// Structures Definitions
-//
-struct tm {
- int tm_sec; /* seconds after the minute [0-60] */
- int tm_min; /* minutes after the hour [0-59] */
- int tm_hour; /* hours since midnight [0-23] */
- int tm_mday; /* day of the month [1-31] */
- int tm_mon; /* months since January [0-11] */
- int tm_year; /* years since 1900 */
- int tm_wday; /* days since Sunday [0-6] */
- int tm_yday; /* days since January 1 [0-365] */
- int tm_isdst; /* Daylight Savings Time flag */
- long tm_gmtoff; /* offset from CUT in seconds */
- char *tm_zone; /* timezone abbreviation */
-};
-
-struct timeval {
- long tv_sec; /* time value, in seconds */
- long tv_usec; /* time value, in microseconds */
-};
-
-struct sockaddr {
- __uint8_t sa_len; /* total length */
- sa_family_t sa_family; /* address family */
- char sa_data[14]; /* actually longer; address value */
-};
-
-//
-// Global variables
-//
-extern int errno;
-extern FILE *stderr;
-
-//
-// Function prototypes of CRT Library routines
-//
-void *
-malloc (
- size_t
- );
-
-void *
-realloc (
- void *,
- size_t
- );
-
-void
-free (
- void *
- );
-
-void *
-memset (
- void *,
- int,
- size_t
- );
-
-int
-memcmp (
- const void *,
- const void *,
- size_t
- );
-
-int
-isdigit (
- int
- );
-
-int
-isspace (
- int
- );
-
-int
-isxdigit (
- int
- );
-
-int
-isalnum (
- int
- );
-
-int
-isupper (
- int
- );
-
-int
-tolower (
- int
- );
-
-int
-strcmp (
- const char *,
- const char *
- );
-
-int
-strncasecmp (
- const char *,
- const char *,
- size_t
- );
-
-char *
-strchr (
- const char *,
- int
- );
-
-char *
-strrchr (
- const char *,
- int
- );
-
-unsigned long
-strtoul (
- const char *,
- char **,
- int
- );
-
-long
-strtol (
- const char *,
- char **,
- int
- );
-
-char *
-strerror (
- int
- );
-
-size_t
-strspn (
- const char *,
- const char *
- );
-
-size_t
-strcspn (
- const char *,
- const char *
- );
-
-int
-printf (
- const char *,
- ...
- );
-
-int
-sscanf (
- const char *,
- const char *,
- ...
- );
-
-FILE *
-fopen (
- const char *,
- const char *
- );
-
-size_t
-fread (
- void *,
- size_t,
- size_t,
- FILE *
- );
-
-size_t
-fwrite (
- const void *,
- size_t,
- size_t,
- FILE *
- );
-
-int
-fclose (
- FILE *
- );
-
-int
-fprintf (
- FILE *,
- const char *,
- ...
- );
-
-time_t
-time (
- time_t *
- );
-
-struct tm *
-gmtime (
- const time_t *
- );
-
-uid_t
-getuid (
- void
- );
-
-uid_t
-geteuid (
- void
- );
-
-gid_t
-getgid (
- void
- );
-
-gid_t
-getegid (
- void
- );
-
-int
-issetugid (
- void
- );
-
-void
-qsort (
- void *,
- size_t,
- size_t,
- int (*)(const void *, const void *)
- );
-
-char *
-getenv (
- const char *
- );
-
-char *
-secure_getenv (
- const char *
- );
-
-#if defined (__GNUC__) && (__GNUC__ >= 2)
-void
-abort (
- void
- ) __attribute__ ((__noreturn__));
-
-#else
-void
-abort (
- void
- );
-
-#endif
-int
-inet_pton (
- int,
- const char *,
- void *
- );
-
-char *
-strcpy (
- char *strDest,
- const char *strSource
- );
-
-//
-// Macros that directly map functions to BaseLib, BaseMemoryLib, and DebugLib functions
-//
-#define memcpy(dest, source, count) CopyMem(dest,source,(UINTN)(count))
-#define memset(dest, ch, count) SetMem(dest,(UINTN)(count),(UINT8)(ch))
-#define memchr(buf, ch, count) ScanMem8(buf,(UINTN)(count),(UINT8)ch)
-#define memcmp(buf1, buf2, count) (int)(CompareMem(buf1,buf2,(UINTN)(count)))
-#define memmove(dest, source, count) CopyMem(dest,source,(UINTN)(count))
-#define strlen(str) (size_t)(AsciiStrnLenS(str,MAX_STRING_SIZE))
-#define strncpy(strDest, strSource, count) AsciiStrnCpyS(strDest,MAX_STRING_SIZE,strSource,(UINTN)count)
-#define strcat(strDest, strSource) AsciiStrCatS(strDest,MAX_STRING_SIZE,strSource)
-#define strncmp(string1, string2, count) (int)(AsciiStrnCmp(string1,string2,(UINTN)(count)))
-#define strcasecmp(str1, str2) (int)AsciiStriCmp(str1,str2)
-#define strstr(s1, s2) AsciiStrStr(s1,s2)
-#define sprintf(buf, ...) AsciiSPrint(buf,MAX_STRING_SIZE,__VA_ARGS__)
-#define localtime(timer) NULL
-#define assert(expression)
-#define offsetof(type, member) OFFSET_OF(type,member)
-#define atoi(nptr) AsciiStrDecimalToUintn(nptr)
-#define gettimeofday(tvp, tz) do { (tvp)->tv_sec = time(NULL); (tvp)->tv_usec = 0; } while (0)
-
-#endif
diff --git a/CryptoPkg/Library/Include/arpa/inet.h b/CryptoPkg/Library/Include/arpa/inet.h
deleted file mode 100644
index 988e4e0a73..0000000000
--- a/CryptoPkg/Library/Include/arpa/inet.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building third-party standard C / BSD sockets code.
-
- Copyright (C) 2019, Red Hat, Inc.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/arpa/nameser.h b/CryptoPkg/Library/Include/arpa/nameser.h
deleted file mode 100644
index 988e4e0a73..0000000000
--- a/CryptoPkg/Library/Include/arpa/nameser.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building third-party standard C / BSD sockets code.
-
- Copyright (C) 2019, Red Hat, Inc.
-
- SPDX-License-Identifier: BSD-2-Clause-Patent
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/assert.h b/CryptoPkg/Library/Include/assert.h
deleted file mode 100644
index 040ecfa519..0000000000
--- a/CryptoPkg/Library/Include/assert.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/ctype.h b/CryptoPkg/Library/Include/ctype.h
deleted file mode 100644
index 040ecfa519..0000000000
--- a/CryptoPkg/Library/Include/ctype.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/errno.h b/CryptoPkg/Library/Include/errno.h
deleted file mode 100644
index 040ecfa519..0000000000
--- a/CryptoPkg/Library/Include/errno.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/fcntl.h b/CryptoPkg/Library/Include/fcntl.h
deleted file mode 100644
index 040ecfa519..0000000000
--- a/CryptoPkg/Library/Include/fcntl.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/intrin.h b/CryptoPkg/Library/Include/intrin.h
deleted file mode 100644
index 47fd4f2c35..0000000000
--- a/CryptoPkg/Library/Include/intrin.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// @file - intrin.h
-// This file is created to get around a bug in OpenSSL
-
-// MU_CHANGE - TCBZ2029 [Entire file.]
-
-#ifndef INTRIN_H
-#define INTRIN_H
-
-#if defined (_M_ARM64)
-typedef enum _tag_ARM64INTR_BARRIER_TYPE {
- _ARM64_BARRIER_SY = 0xF,
- _ARM64_BARRIER_ST = 0xE,
- _ARM64_BARRIER_LD = 0xD,
- _ARM64_BARRIER_ISH = 0xB,
- _ARM64_BARRIER_ISHST = 0xA,
- _ARM64_BARRIER_ISHLD = 0x9,
- _ARM64_BARRIER_NSH = 0x7,
- _ARM64_BARRIER_NSHST = 0x6,
- _ARM64_BARRIER_NSHLD = 0x5,
- _ARM64_BARRIER_OSH = 0x3,
- _ARM64_BARRIER_OSHST = 0x2,
- _ARM64_BARRIER_OSHLD = 0x1
-} _ARM64INTR_BARRIER_TYPE;
-
-#endif
-#endif
diff --git a/CryptoPkg/Library/Include/inttypes.h b/CryptoPkg/Library/Include/inttypes.h
deleted file mode 100644
index 3d44d8201d..0000000000
--- a/CryptoPkg/Library/Include/inttypes.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2024, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/limits.h b/CryptoPkg/Library/Include/limits.h
deleted file mode 100644
index 040ecfa519..0000000000
--- a/CryptoPkg/Library/Include/limits.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
-
-**/
-
-#include
diff --git a/CryptoPkg/Library/Include/memory.h b/CryptoPkg/Library/Include/memory.h
deleted file mode 100644
index 040ecfa519..0000000000
--- a/CryptoPkg/Library/Include/memory.h
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @file
- Include file to support building the third-party cryptographic library.
-
-Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.