audk/SecurityPkg/SecurityPkg.dec

358 lines
20 KiB
Plaintext
Raw Normal View History

## @file SecurityPkg.dec
# Provides security features that conform to TCG/UEFI industry standards
#
# The security features include secure boot, measured boot and user identification.
# It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes)
# and libraries instances, which are used for those features.
#
# Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
# This program and the accompanying materials are licensed and made available under
# the terms and conditions of the BSD License which accompanies this distribution.
# The full text of the license may be found at
# http://opensource.org/licenses/bsd-license.php
#
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#
##
[Defines]
DEC_SPECIFICATION = 0x00010005
PACKAGE_NAME = SecurityPkg
PACKAGE_UNI_FILE = SecurityPkg.uni
PACKAGE_GUID = 24369CAC-6AA6-4fb8-88DB-90BF061668AD
PACKAGE_VERSION = 0.94
[Includes]
Include
[LibraryClasses]
## @libraryclass Provides hash interfaces from different implementations.
#
HashLib|Include/Library/HashLib.h
## @libraryclass Provides a platform specific interface to detect physically present user.
#
PlatformSecureLib|Include/Library/PlatformSecureLib.h
## @libraryclass Provides interfaces to handle TPM 1.2 request.
#
TcgPhysicalPresenceLib|Include/Library/TcgPhysicalPresenceLib.h
## @libraryclass Provides interfaces for other modules to send TPM 2.0 command.
#
Tpm2CommandLib|Include/Library/Tpm2CommandLib.h
## @libraryclass Provides interfaces on how to access TPM 2.0 hardware device.
#
Tpm2DeviceLib|Include/Library/Tpm2DeviceLib.h
## @libraryclass Provides interfaces for other modules to send TPM 1.2 command.
#
Tpm12CommandLib|Include/Library/Tpm12CommandLib.h
## @libraryclass Provides interfaces on how to access TPM 1.2 hardware device.
#
Tpm12DeviceLib|Include/Library/Tpm12DeviceLib.h
## @libraryclass Provides TPM Interface Specification (TIS) interfaces for TPM command.
#
TpmCommLib|Include/Library/TpmCommLib.h
## @libraryclass Provides common interfaces about TPM measurement for other modules.
#
TpmMeasurementLib|Include/Library/TpmMeasurementLib.h
## @libraryclass Provides interfaces to handle TPM 2.0 request.
#
TrEEPhysicalPresenceLib|Include/Library/TrEEPhysicalPresenceLib.h
[Guids]
## Security package token space guid.
# Include/Guid/SecurityPkgTokenSpace.h
gEfiSecurityPkgTokenSpaceGuid = { 0xd3fb176, 0x9569, 0x4d51, { 0xa3, 0xef, 0x7d, 0x61, 0xc6, 0x4f, 0xea, 0xba }}
## Guid acted as the authenticated variable store header's signature, and to specify the variable list entries put in the EFI system table.
# Include/Guid/AuthenticatedVariableFormat.h
gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a, { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
## GUID used to "SecureBootEnable" variable for the Secure Boot feature enable/disable.
# This variable is used for allowing a physically present user to disable Secure Boot via firmware setup without the possession of PKpriv.
# Include/Guid/AuthenticatedVariableFormat.h
gEfiSecureBootEnableDisableGuid = { 0xf0a30bc7, 0xaf08, 0x4556, { 0x99, 0xc4, 0x0, 0x10, 0x9, 0xc9, 0x3a, 0x44 } }
## GUID used to "CustomMode" variable for two Secure Boot modes feature: "Custom" and "Standard".
# Standard Secure Boot mode is the default mode as UEFI Spec's description.
# Custom Secure Boot mode allows for more flexibility as specified in the following:
# Can enroll or delete PK without existing PK's private key.
# Can enroll or delete KEK without existing PK's private key.
# Can enroll or delete signature from DB/DBX without KEK's private key.
# Include/Guid/AuthenticatedVariableFormat.h
gEfiCustomModeEnableGuid = { 0xc076ec0c, 0x7028, 0x4399, { 0xa0, 0x72, 0x71, 0xee, 0x5c, 0x44, 0x8b, 0x9f } }
## GUID used to "VendorKeysNv" variable to record the out of band secure boot keys modification.
# This variable is a read-only NV variable that indicates whether someone other than the platform vendor has used a
# mechanism not defined by the UEFI Specification to transition the system to setup mode or to update secure boot keys.
# Include/Guid/AuthenticatedVariableFormat.h
gEfiVendorKeysNvGuid = { 0x9073e4e0, 0x60ec, 0x4b6e, { 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0xf, 0x3c } }
## GUID used to "certdb" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.
# Include/Guid/AuthenticatedVariableFormat.h
gEfiCertDbGuid = { 0xd9bee56e, 0x75dc, 0x49d9, { 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a } }
## Hob GUID used to pass a TCG_PCR_EVENT from a TPM PEIM to a TPM DXE Driver.
# Include/Guid/TcgEventHob.h
gTcgEventEntryHobGuid = { 0x2b9ffb52, 0x1b13, 0x416f, { 0xa8, 0x7b, 0xbc, 0x93, 0xd, 0xef, 0x92, 0xa8 }}
## HOB GUID used to pass all PEI measured FV info to DXE Driver.
# Include/Guid/MeasuredFvHob.h
gMeasuredFvHobGuid = { 0xb2360b42, 0x7173, 0x420a, { 0x86, 0x96, 0x46, 0xca, 0x6b, 0xab, 0x10, 0x60 }}
## GUID used to "PhysicalPresence" variable and "PhysicalPresenceFlags" variable for TPM request and response.
# Include/Guid/PhysicalPresenceData.h
gEfiPhysicalPresenceGuid = { 0xf6499b1, 0xe9ad, 0x493d, { 0xb9, 0xc2, 0x2f, 0x90, 0x81, 0x5c, 0x6c, 0xbc }}
## GUID used for form browser, password credential and provider identifier.
# Include/Guid/PwdCredentialProviderHii.h
gPwdCredentialProviderGuid = { 0x78b9ec8b, 0xc000, 0x46c5, { 0xac, 0x93, 0x24, 0xa0, 0xc1, 0xbb, 0x0, 0xce }}
## GUID used for form browser, USB credential and provider identifier.
# Include/Guid/UsbCredentialProviderHii.h
gUsbCredentialProviderGuid = { 0xd0849ed1, 0xa88c, 0x4ba6, { 0xb1, 0xd6, 0xab, 0x50, 0xe2, 0x80, 0xb7, 0xa9 }}
## GUID used for FormSet guid and user profile variable.
# Include/Guid/UserIdentifyManagerHii.h
gUserIdentifyManagerGuid = { 0x3ccd3dd8, 0x8d45, 0x4fed, { 0x96, 0x2d, 0x2b, 0x38, 0xcd, 0x82, 0xb3, 0xc4 }}
## GUID used for FormSet.
# Include/Guid/UserProfileManagerHii.h
gUserProfileManagerGuid = { 0xc35f272c, 0x97c2, 0x465a, { 0xa2, 0x16, 0x69, 0x6b, 0x66, 0x8a, 0x8c, 0xfe }}
## GUID used for FormSet.
# Include/Guid/TcgConfigHii.h
gTcgConfigFormSetGuid = { 0xb0f901e4, 0xc424, 0x45de, { 0x90, 0x81, 0x95, 0xe2, 0xb, 0xde, 0x6f, 0xb5 }}
## GUID used for FormSet.
# Include/Guid/SecureBootConfigHii.h
gSecureBootConfigFormSetGuid = { 0x5daf50a5, 0xea81, 0x4de2, {0x8f, 0x9b, 0xca, 0xbd, 0xa9, 0xcf, 0x5c, 0x14}}
## GUID used to "TrEEPhysicalPresence" variable and "TrEEPhysicalPresenceFlags" variable for TPM2 request and response.
# Include/Guid/TrEEPhysicalPresenceData.h
gEfiTrEEPhysicalPresenceGuid = { 0xf24643c2, 0xc622, 0x494e, { 0x8a, 0xd, 0x46, 0x32, 0x57, 0x9c, 0x2d, 0x5b }}
## GUID value used for PcdTpmInstanceGuid to indicate TPM is disabled.
# Include/Guid/TpmInstance.h
gEfiTpmDeviceInstanceNoneGuid = { 0x00000000, 0x0000, 0x0000, { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } }
## GUID value used for PcdTpmInstanceGuid to indicate TPM 1.2 device is selected to support.
# Include/Guid/TpmInstance.h
gEfiTpmDeviceInstanceTpm12Guid = { 0x8b01e5b6, 0x4f19, 0x46e8, { 0xab, 0x93, 0x1c, 0x53, 0x67, 0x1b, 0x90, 0xcc } }
## GUID value used for PcdTpmInstanceGuid to indicate discrete TPM 2.0 device is selected to support.
# Include/Guid/TpmInstance.h
gEfiTpmDeviceInstanceTpm20DtpmGuid = { 0x286bf25a, 0xc2c3, 0x408c, { 0xb3, 0xb4, 0x25, 0xe6, 0x75, 0x8b, 0x73, 0x17 } }
## GUID used to select supported TPM instance from UI.
# Include/Guid/TpmInstance.h
gEfiTpmDeviceSelectedGuid = { 0x7f4158d3, 0x74d, 0x456d, { 0x8c, 0xb2, 0x1, 0xf9, 0xc8, 0xf7, 0x9d, 0xaa } }
## GUID used for FormSet and config variable.
# Include/Guid/TrEEConfigHii.h
gTrEEConfigFormSetGuid = {0xc54b425f, 0xaa79, 0x48b4, { 0x98, 0x1f, 0x99, 0x8b, 0x3c, 0x4b, 0x64, 0x1c }}
[Ppis]
## The PPI GUID for that TPM physical presence should be locked.
# Include/Ppi/LockPhysicalPresence.h
gPeiLockPhysicalPresencePpiGuid = { 0xef9aefe5, 0x2bd3, 0x4031, { 0xaf, 0x7d, 0x5e, 0xfe, 0x5a, 0xbb, 0x9a, 0xd } }
## The PPI GUID for that TPM is initialized.
# Include/Ppi/TpmInitialized.h
gPeiTpmInitializedPpiGuid = { 0xe9db0d58, 0xd48d, 0x47f6, { 0x9c, 0x6e, 0x6f, 0x40, 0xe8, 0x6c, 0x7b, 0x41 }}
## Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h
gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid = { 0x6e056ff9, 0xc695, 0x4364, { 0x9e, 0x2c, 0x61, 0x26, 0xf5, 0xce, 0xea, 0xae } }
#
# [Error.gEfiSecurityPkgTokenSpaceGuid]
# 0x80000001 | Invalid value provided.
# 0x80000002 | Reserved bits must be set to zero.
#
[PcdsFixedAtBuild, PcdsPatchableInModule]
## Image verification policy for OptionRom. Only following values are valid:<BR><BR>
# NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
# 0x00000000 Always trust the image.<BR>
# 0x00000001 Never trust the image.<BR>
# 0x00000002 Allow execution when there is security violation.<BR>
# 0x00000003 Defer execution when there is security violation.<BR>
# 0x00000004 Deny execution when there is security violation.<BR>
# 0x00000005 Query user when there is security violation.<BR>
# @Prompt Set policy for the image from OptionRom.
# @ValidRange 0x80000001 | 0x00000000 - 0x00000005
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04|UINT32|0x00000001
## Image verification policy for removable media which includes CD-ROM, Floppy, USB and network.
# Only following values are valid:<BR><BR>
# NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
# 0x00000000 Always trust the image.<BR>
# 0x00000001 Never trust the image.<BR>
# 0x00000002 Allow execution when there is security violation.<BR>
# 0x00000003 Defer execution when there is security violation.<BR>
# 0x00000004 Deny execution when there is security violation.<BR>
# 0x00000005 Query user when there is security violation.<BR>
# @Prompt Set policy for the image from removable media.
# @ValidRange 0x80000001 | 0x00000000 - 0x00000005
gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04|UINT32|0x00000002
## Image verification policy for fixed media which includes hard disk.
# Only following values are valid:<BR><BR>
# NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
# 0x00000000 Always trust the image.<BR>
# 0x00000001 Never trust the image.<BR>
# 0x00000002 Allow execution when there is security violation.<BR>
# 0x00000003 Defer execution when there is security violation.<BR>
# 0x00000004 Deny execution when there is security violation.<BR>
# 0x00000005 Query user when there is security violation.<BR>
# @Prompt Set policy for the image from fixed media.
# @ValidRange 0x80000001 | 0x00000000 - 0x00000005
gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04|UINT32|0x00000003
## Defer Image Load policy settings. The policy is bitwise.
# If a bit is set, the image from corresponding device will be trusted when loading. Or
# the image will be deferred. The deferred image will be checked after user is identified.<BR><BR>
# BIT0 - Image from unknown device. <BR>
# BIT1 - Image from firmware volume.<BR>
# BIT2 - Image from OptionRom.<BR>
# BIT3 - Image from removable media which includes CD-ROM, Floppy, USB and network.<BR>
# BIT4 - Image from fixed media device which includes hard disk.<BR>
# @Prompt Set policy whether trust image before user identification.
# @ValidRange 0x80000002 | 0x00000000 - 0x0000001F
gEfiSecurityPkgTokenSpaceGuid.PcdDeferImageLoadPolicy|0x0000001F|UINT32|0x0000004
## Null-terminated Unicode string of the file name that is the default name to save USB credential.
# The specified file should be saved at the root directory of USB storage disk.
# @Prompt File name to save credential.
gEfiSecurityPkgTokenSpaceGuid.PcdFixedUsbCredentialProviderTokenFileName|L"Token.bin"|VOID*|0x00000005
## The size of Append variable buffer. This buffer is reserved for runtime use, OS can append data into one existing variable.
# Note: This PCD is not been used.
# @Prompt Max variable size for append operation.
gEfiSecurityPkgTokenSpaceGuid.PcdMaxAppendVariableSize|0x2000|UINT32|0x30000005
## Specifies the type of TCG platform that contains TPM chip.<BR><BR>
# If 0, TCG platform type is PC client.<BR>
# If 1, TCG platform type is PC server.<BR>
# @Prompt Select platform type.
# @ValidRange 0x80000001 | 0x00 - 0x1
gEfiSecurityPkgTokenSpaceGuid.PcdTpmPlatformClass|0|UINT8|0x00000006
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## Indicates the presence or absence of the platform operator during firmware booting.
# If platform operator is not physical presence during boot. TPM will be locked and the TPM commands
# that required operator physical presence can not run.<BR><BR>
# TRUE - The platform operator is physically present.<BR>
# FALSE - The platform operator is not physically present.<BR>
# @Prompt Physical presence of the platform operator.
gEfiSecurityPkgTokenSpaceGuid.PcdTpmPhysicalPresence|TRUE|BOOLEAN|0x00010001
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## Indicates whether TPM physical presence is locked during platform initialization.
# Once it is locked, it can not be unlocked for TPM life time.<BR><BR>
# TRUE - Lock TPM physical presence asserting method.<BR>
# FALSE - Not lock TPM physical presence asserting method.<BR>
# @Prompt Lock TPM physical presence asserting method.
gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceLifetimeLock|FALSE|BOOLEAN|0x00010003
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## Indicates whether the platform supports the software method of asserting physical presence.<BR><BR>
# TRUE - Supports the software method of asserting physical presence.<BR>
# FALSE - Does not support the software method of asserting physical presence.<BR>
# @Prompt Enable software method of asserting physical presence.
gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceCmdEnable|TRUE|BOOLEAN|0x00010004
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## Indicates whether the platform supports the hardware method of asserting physical presence.<BR><BR>
# TRUE - Supports the hardware method of asserting physical presence.<BR>
# FALSE - Does not support the hardware method of asserting physical presence.<BR>
# @Prompt Enable hardware method of asserting physical presence.
gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceHwEnable|TRUE|BOOLEAN|0x00010005
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## This PCD indicates if debugger exists. <BR><BR>
# TRUE - Firmware debugger exists.<BR>
# FALSE - Firmware debugger doesn't exist.<BR>
# @Prompt Firmware debugger status.
gEfiSecurityPkgTokenSpaceGuid.PcdFirmwareDebuggerInitialized|FALSE|BOOLEAN|0x00010009
## This PCD indicates the initialization policy for TPM 2.0.<BR><BR>
# If 0, no initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.<BR>
# If 1, initialization needed.<BR>
# @Prompt TPM 2.0 device initialization policy.<BR>
# @ValidRange 0x80000001 | 0x00 - 0x1
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2InitializationPolicy|1|UINT8|0x0001000A
## This PCD indicates the initialization policy for TPM 1.2.<BR><BR>
# If 0, no initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.<BR>
# If 1, initialization needed.<BR>
# @Prompt TPM 1.2 device initialization policy.
# @ValidRange 0x80000001 | 0x00 - 0x1
gEfiSecurityPkgTokenSpaceGuid.PcdTpmInitializationPolicy|1|UINT8|0x0001000B
## This PCD indicates the TPM 2.0 SelfTest policy.<BR><BR>
# if 0, no SelfTest needed - most likely used for fTPM, because it might already be tested.<BR>
# if 1, SelfTest needed.<BR>
# @Prompt TPM 2.0 device selftest.
# @ValidRange 0x80000001 | 0x00 - 0x1
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2SelfTestPolicy|1|UINT8|0x0001000C
## This PCD indicates Static Core Root of Trust for Measurement (SCRTM) policy using TPM 2.0.<BR><BR>
# if 0, no SCRTM measurement needed - In this case, it is already done.<BR>
# if 1, SCRTM measurement done by BIOS.<BR>
# @Prompt SCRTM policy setting for TPM 2.0 device.
# @ValidRange 0x80000001 | 0x00 - 0x1
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2ScrtmPolicy|1|UINT8|0x0001000D
## This PCD indicates Static Core Root of Trust for Measurement (SCRTM) policy using TPM 1.2.<BR><BR>
# if 0, no SCRTM measurement needed - In this case, it is already done.<BR>
# if 1, SCRTM measurement done by BIOS.<BR>
# @Prompt SCRTM policy setting for TPM 1.2 device
# @ValidRange 0x80000001 | 0x00 - 0x1
gEfiSecurityPkgTokenSpaceGuid.PcdTpmScrtmPolicy|1|UINT8|0x0001000E
## Guid name to identify TPM instance.<BR><BR>
# TPM_DEVICE_INTERFACE_NONE means disable.<BR>
# TPM_DEVICE_INTERFACE_TPM12 means TPM 1.2 DTPM.<BR>
# TPM_DEVICE_INTERFACE_DTPM2 means TPM 2.0 DTPM.<BR>
# @Prompt TPM device type identifier
gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid |{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }|VOID*|0x0001000F
## This PCD indicates Hash mask for TPM 2.0.<BR><BR>
# If this bit is set, that means this algorithm is needed to extend to PCR.<BR>
# If this bit is clear, that means this algorithm is NOT needed to extend to PCR.<BR>
# BIT0 - SHA1.<BR>
# BIT1 - SHA256.<BR>
# BIT2 - SHA384.<BR>
# BIT3 - SHA512.<BR>
# @Prompt Hash mask for TPM 2.0
# @ValidRange 0x80000001 | 0x00000000 - 0x0000000F
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000000F|UINT32|0x00010010
## This PCD indicates if BIOS auto detect TPM1.2 or dTPM2.0.<BR><BR>
# FALSE - No auto detection.<BR>
# TRUE - Auto detection.<BR>
# @Prompt TPM type detection.
gEfiSecurityPkgTokenSpaceGuid.PcdTpmAutoDetection|TRUE|BOOLEAN|0x00010011
## This PCD indicates TPM base address.<BR><BR>
# @Prompt TPM device address.
gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0xFED40000|UINT64|0x00010012
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Michael Kinney <michael.d.kinney@intel.com> Reviewed-by: Dong, Guo <guo.dong@intel.com> Add support for RSA 2048 SHA 256 signing and verification encoded in a PI FFS GUIDED Encapsulation Section. The primary use case of this feature is in support of signing and verification of encapsulated FVs for Recovery and Capsule Update, but can potentially be used for signing and verification of any content that can be stored in a PI conformant FFS file. Signing operations are performed from python scripts that wrap OpenSsl command line utilities. Verification operations are performed using the OpenSsl libraries in the CryptoPkg. The guided encapsulation sections uses the UEFI 2.4 Specification defined GUID called EFI_CERT_TYPE_RSA2048_SHA256_GUID. The data layout for the encapsulation section starts with the UEFI 2.4 Specification defined structure called EFI_CERT_BLOCK_RSA_2048_SHA256 followed immediately by the data. The signing tool included in these patches performs encode/decode operations using this data layout. HashType is set to the UEFI 2.4 Specification defined GUID called EFI_HASH_ALGORITHM_SHA256_GUID. MdePkg/Include/Guid/WinCertificate.h ================================= // // WIN_CERTIFICATE_UEFI_GUID.CertType // #define EFI_CERT_TYPE_RSA2048_SHA256_GUID \ {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } } /// /// WIN_CERTIFICATE_UEFI_GUID.CertData /// typedef struct { EFI_GUID HashType; UINT8 PublicKey[256]; UINT8 Signature[256]; } EFI_CERT_BLOCK_RSA_2048_SHA256; MdePkg/Include/Protocol/Hash.h ================================= #define EFI_HASH_ALGORITHM_SHA256_GUID \ { \ 0x51aa59de, 0xfdf2, 0x4ea3, {0xbc, 0x63, 0x87, 0x5f, 0xb7, 0x84, 0x2e, 0xe9 } \ } The verification operations require the use of public key(s). A new PCD called gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer is added to the SecurityPkg that supports one or more SHA 256 hashes of the public keys. A SHA 256 hash is performed to minimize the FLASH overhead of storing the public keys. When a verification operation is performed, a SHA 256 hash is performed on EFI_CERT_BLOCK_RSA_2048_SHA256.PublicKey and a check is made to see if that hash matches any of the hashes in the new PCD. It is recommended that this PCD always be configured in the DSC file as storage type of [PcdsDynamixExVpd], so the public keys are stored in a protected read-only region. While working on this feature, I noticed that the CRC32 signing and verification feature was incomplete. It only supported CRC32 based verification in the DXE Phase, so the attached patches also provide support for CRC32 based verification in the PEI Phase. I also noticed that the most common method for incorporating guided section extraction libraries was to directly link them to the DXE Core, which is not very flexible. The attached patches also add a generic section extraction PEIM and a generic section extraction DXE driver that can each be linked against one or more section extraction libraries. This provides a platform developer with the option of providing section extraction services with the DXE Core or providing section extraction services with these generic PEIM/DXE Drivers. Patch Summary ============== 1) BaseTools - Rsa2049Sha256Sign python script that can perform test signing or custom signing of PI FFS file GUIDed sections a. Wrapper for a set of OpenSsl command line utility operations b. OpenSsl command line tool must be installed in location that is in standard OS path or in path specified by OS environment variable called OPENSSL_PATH c. Provides standard EDK II command line arguments for a tool that encodes/decodes guided encapsulation section Rsa2048Sha256Sign - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved. usage: Rsa2048Sha256Sign -e|-d [options] <input_file> positional arguments: input_file specify the input filename optional arguments: -e encode file -d decode file -o filename, --output filename specify the output filename --private-key PRIVATEKEYFILE specify the private key filename. If not specified, a test signing key is used. -v, --verbose increase output messages -q, --quiet reduce output messages --debug [0-9] set debug level --version display the program version and exit -h, --help display this help text 2) BaseTools - Rsa2049Sha256GenerateKeys python script that can generate new private/public key and PCD value that is SHA 256 hash of public key using OpenSsl command line utilities. a. Wrapper for a set of OpenSsl command line utility operations b. OpenSsl command line tool must be installed in location that is in standard path or in path specified by OS environment variable called OPENSSL_PATH Rsa2048Sha256GenerateKeys - Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved. usage: Rsa2048Sha256GenerateKeys [options] optional arguments: -o [filename [filename ...]], --output [filename [filename ...]] specify the output private key filename in PEM format -i [filename [filename ...]], --input [filename [filename ...]] specify the input private key filename in PEM format --public-key-hash PUBLICKEYHASHFILE specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in binary format --public-key-hash-c PUBLICKEYHASHCFILE specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in C structure format -v, --verbose increase output messages -q, --quiet reduce output messages --debug [0-9] set debug level --version display the program version and exit -h, --help display this help text 3) BaseTools\Conf\tools_def.template a. Define GUID/Tool to perform RSA 2048 SHA 256 test signing and instructions on how to use alternate private/public key b. GUID is EFI_CERT_TYPE_RSA2048_SHA256_GUID c. Tool is Rsa2049Sha256Sign 4) MdeModulePkg\Library\PeiCrc32GuidedSectionExtractionLib a. Add peer for DxeCrc32GuidedSectionExtractionLib so both PEI and DXE phases can perform basic integrity checks of PEI and DXE components 5) MdeModulePkg\Universal\SectionExtractionPei a. Generic PEIM that can link against one or more NULL section extraction library instances to provided one or more GUIDED Section Extraction PPIs 6) MdeModulePkg\Universal\SectionExtractionDxe a. Generic DXE Driver that can link against one or more NULL section extraction library instances to provide one or more GUIDED Section Extraction Protocols. 7) SecurityPkg\Library\PeiRsa2048Sha256GuidedSectionExtractLib a. NULL library instances that performs PEI phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg. b. Based on algorithms from SecurityPkg Authenticated Variable services c. Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer. 8) SecurityPkg\Library\DxeRsa2048Sha256GuidedSectionExtractLib a. NULL library instances that performs DXE phase RSA 2048 SHA 256 signature verification using OpenSsl libraries from CryptoPkg. b. Based on algorithms from SecurityPkg Authenticated Variable services c. Uses public key from gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer. git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15801 6f19259b-4bc3-4df7-8a09-765794883524
2014-08-14 08:31:34 +02:00
## Provides one or more SHA 256 Hashes of the RSA 2048 public keys used to verify Recovery and Capsule Update images
#
# @Prompt One or more SHA 256 Hashes of RSA 2048 bit public keys used to verify Recovery and Capsule Update images
#
gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer|{0x91, 0x29, 0xc4, 0xbd, 0xea, 0x6d, 0xda, 0xb3, 0xaa, 0x6f, 0x50, 0x16, 0xfc, 0xdb, 0x4b, 0x7e, 0x3c, 0xd6, 0xdc, 0xa4, 0x7a, 0x0e, 0xdd, 0xe6, 0x15, 0x8c, 0x73, 0x96, 0xa2, 0xd4, 0xa6, 0x4d}|VOID*|0x00010013
[UserExtensions.TianoCore."ExtraFiles"]
SecurityPkgExtra.uni