tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

CryptoPkg/BaseCryptLib: Retire HMAC SHA1 algorithm 

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898

HMAC SHA1 is not secure any longer.
Remove the HMAC SHA1 support from edk2.
Change the HMAC SHA1 field name in EDKII_CRYPTO_PROTOCOL to indicate the
function is unsupported any longer.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Philippe Mathieu-Daude <philmd@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
This commit is contained in:
Zhichao Gao 2020-04-23 16:20:19 +08:00 committed by mergify[bot]
parent b6174e2d09
commit c812d3209c
16 changed files with 55 additions and 967 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CryptoPkg/CryptoPkg.dsc
View File

@ -137,7 +137,6 @@
gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x06
!if $(CRYPTO_SERVICES) IN "PACKAGE ALL"
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md5.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
@ -163,7 +162,6 @@
!endif
!if $(CRYPTO_SERVICES) == MIN_PEI
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
@ -178,7 +176,6 @@
!endif
!if $(CRYPTO_SERVICES) == MIN_DXE_MIN_SMM
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs1v2Encrypt | TRUE
gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs5HashPassword | TRUE

96
CryptoPkg/Driver/Crypto.c
View File

@ -1277,154 +1277,120 @@ DeprecatedCryptoServiceHmacMd5Final (
}
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
If this interface is not supported, then return NULL.
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha1New() returns NULL.
@return NULL This interface is not supported.
**/
VOID *
EFIAPI
CryptoServiceHmacSha1New (
DeprecatedCryptoServiceHmacSha1New (
VOID
)
{
return CALL_BASECRYPTLIB (HmacSha1.Services.New, HmacSha1New, (), NULL);
return BaseCryptLibServiceDeprecated ("HmacSha1New"), NULL;
}
/**
Release the specified HMAC_CTX context.
If this interface is not supported, then do nothing.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
VOID
EFIAPI
CryptoServiceHmacSha1Free (
DeprecatedCryptoServiceHmacSha1Free (
IN VOID *HmacSha1Ctx
)
{
CALL_VOID_BASECRYPTLIB (HmacSha1.Services.Free, HmacSha1Free, (HmacSha1Ctx));
BaseCryptLibServiceDeprecated ("HmacSha1Free");
}
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
CryptoServiceHmacSha1SetKey (
DeprecatedCryptoServiceHmacSha1SetKey (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
)
{
return CALL_BASECRYPTLIB (HmacSha1.Services.SetKey, HmacSha1SetKey, (HmacSha1Context, Key, KeySize), FALSE);
return BaseCryptLibServiceDeprecated ("HmacSha1SetKey"), FALSE;
}
/**
Makes a copy of an existing HMAC-SHA1 context.
If HmacSha1Context is NULL, then return FALSE.
If NewHmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval TRUE HMAC-SHA1 context copy succeeded.
@retval FALSE HMAC-SHA1 context copy failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
CryptoServiceHmacSha1Duplicate (
DeprecatedCryptoServiceHmacSha1Duplicate (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
)
{
return CALL_BASECRYPTLIB (HmacSha1.Services.Duplicate, HmacSha1Duplicate, (HmacSha1Context, NewHmacSha1Context), FALSE);
return BaseCryptLibServiceDeprecated ("HmacSha1Duplicate"), FALSE;
}
/**
Digests the input data and updates HMAC-SHA1 context.
This function performs HMAC-SHA1 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by
HmacSha1Final(). Behavior with invalid context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE HMAC-SHA1 data digest succeeded.
@retval FALSE HMAC-SHA1 data digest failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
CryptoServiceHmacSha1Update (
DeprecatedCryptoServiceHmacSha1Update (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
return CALL_BASECRYPTLIB (HmacSha1.Services.Update, HmacSha1Update, (HmacSha1Context, Data, DataSize), FALSE);
return BaseCryptLibServiceDeprecated ("HmacSha1Update"), FALSE;
}
/**
Completes computation of the HMAC-SHA1 digest value.
This function completes HMAC-SHA1 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA1 context cannot
be used again.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized
by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval TRUE HMAC-SHA1 digest computation succeeded.
@retval FALSE HMAC-SHA1 digest computation failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
CryptoServiceHmacSha1Final (
DeprecatedCryptoServiceHmacSha1Final (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
)
{
return CALL_BASECRYPTLIB (HmacSha1.Services.Final, HmacSha1Final, (HmacSha1Context, HmacValue), FALSE);
return BaseCryptLibServiceDeprecated ("HmacSha1Final"), FALSE;
}
/**
@ -4207,13 +4173,13 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
DeprecatedCryptoServiceHmacMd5Duplicate,
DeprecatedCryptoServiceHmacMd5Update,
DeprecatedCryptoServiceHmacMd5Final,
/// HMAC SHA1
CryptoServiceHmacSha1New,
CryptoServiceHmacSha1Free,
CryptoServiceHmacSha1SetKey,
CryptoServiceHmacSha1Duplicate,
CryptoServiceHmacSha1Update,
CryptoServiceHmacSha1Final,
/// HMAC SHA1 - deprecated and unsupported
DeprecatedCryptoServiceHmacSha1New,
DeprecatedCryptoServiceHmacSha1Free,
DeprecatedCryptoServiceHmacSha1SetKey,
DeprecatedCryptoServiceHmacSha1Duplicate,
DeprecatedCryptoServiceHmacSha1Update,
DeprecatedCryptoServiceHmacSha1Final,
/// HMAC SHA256
CryptoServiceHmacSha256New,
CryptoServiceHmacSha256Free,

133
CryptoPkg/Include/Library/BaseCryptLib.h
View File

@ -880,139 +880,6 @@ Sm3HashAll (
// MAC (Message Authentication Code) Primitive
//=====================================================================================
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
If this interface is not supported, then return NULL.
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha1New() returns NULL.
@return NULL This interface is not supported.
**/
VOID *
EFIAPI
HmacSha1New (
VOID
);
/**
Release the specified HMAC_CTX context.
If this interface is not supported, then do nothing.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
VOID
EFIAPI
HmacSha1Free (
IN VOID *HmacSha1Ctx
);
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1SetKey (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
);
/**
Makes a copy of an existing HMAC-SHA1 context.
If HmacSha1Context is NULL, then return FALSE.
If NewHmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval TRUE HMAC-SHA1 context copy succeeded.
@retval FALSE HMAC-SHA1 context copy failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Duplicate (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
);
/**
Digests the input data and updates HMAC-SHA1 context.
This function performs HMAC-SHA1 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by
HmacSha1Final(). Behavior with invalid context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE HMAC-SHA1 data digest succeeded.
@retval FALSE HMAC-SHA1 data digest failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Update (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
);
/**
Completes computation of the HMAC-SHA1 digest value.
This function completes HMAC-SHA1 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA1 context cannot
be used again.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized
by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval TRUE HMAC-SHA1 digest computation succeeded.
@retval FALSE HMAC-SHA1 digest computation failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Final (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
);
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.

1
CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
View File

@ -34,7 +34,6 @@
Hash/CryptSha256.c
Hash/CryptSha512.c
Hash/CryptSm3.c
Hmac/CryptHmacSha1.c
Hmac/CryptHmacSha256.c
Kdf/CryptHkdf.c
Cipher/CryptAes.c

216
CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
View File

@ -1,216 +0,0 @@
/** @file
HMAC-SHA1 Wrapper Implementation over OpenSSL.
Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include "InternalCryptLib.h"
#include <openssl/hmac.h>
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha1New() returns NULL.
**/
VOID *
EFIAPI
HmacSha1New (
VOID
)
{
//
// Allocates & Initializes HMAC_CTX Context by OpenSSL HMAC_CTX_new()
//
return (VOID *) HMAC_CTX_new ();
}
/**
Release the specified HMAC_CTX context.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
VOID
EFIAPI
HmacSha1Free (
IN VOID *HmacSha1Ctx
)
{
//
// Free OpenSSL HMAC_CTX Context
//
HMAC_CTX_free ((HMAC_CTX *)HmacSha1Ctx);
}
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
If HmacSha1Context is NULL, then return FALSE.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
**/
BOOLEAN
EFIAPI
HmacSha1SetKey (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
)
{
//
// Check input parameters.
//
if (HmacSha1Context == NULL || KeySize > INT_MAX) {
return FALSE;
}
if (HMAC_Init_ex ((HMAC_CTX *)HmacSha1Context, Key, (UINT32) KeySize, EVP_sha1(), NULL) != 1) {
return FALSE;
}
return TRUE;
}
/**
Makes a copy of an existing HMAC-SHA1 context.
If HmacSha1Context is NULL, then return FALSE.
If NewHmacSha1Context is NULL, then return FALSE.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval TRUE HMAC-SHA1 context copy succeeded.
@retval FALSE HMAC-SHA1 context copy failed.
**/
BOOLEAN
EFIAPI
HmacSha1Duplicate (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
)
{
//
// Check input parameters.
//
if (HmacSha1Context == NULL || NewHmacSha1Context == NULL) {
return FALSE;
}
if (HMAC_CTX_copy ((HMAC_CTX *)NewHmacSha1Context, (HMAC_CTX *)HmacSha1Context) != 1) {
return FALSE;
}
return TRUE;
}
/**
Digests the input data and updates HMAC-SHA1 context.
This function performs HMAC-SHA1 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by
HmacSha1Final(). Behavior with invalid context is undefined.
If HmacSha1Context is NULL, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE HMAC-SHA1 data digest succeeded.
@retval FALSE HMAC-SHA1 data digest failed.
**/
BOOLEAN
EFIAPI
HmacSha1Update (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
//
// Check input parameters.
//
if (HmacSha1Context == NULL) {
return FALSE;
}
//
// Check invalid parameters, in case that only DataLength was checked in OpenSSL
//
if (Data == NULL && DataSize != 0) {
return FALSE;
}
//
// OpenSSL HMAC-SHA1 digest update
//
if (HMAC_Update ((HMAC_CTX *)HmacSha1Context, Data, DataSize) != 1) {
return FALSE;
}
return TRUE;
}
/**
Completes computation of the HMAC-SHA1 digest value.
This function completes HMAC-SHA1 digest computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA1 context cannot
be used again.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by
HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval TRUE HMAC-SHA1 digest computation succeeded.
@retval FALSE HMAC-SHA1 digest computation failed.
**/
BOOLEAN
EFIAPI
HmacSha1Final (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
)
{
UINT32 Length;
//
// Check input parameters.
//
if (HmacSha1Context == NULL || HmacValue == NULL) {
return FALSE;
}
//
// OpenSSL HMAC-SHA1 digest finalization
//
if (HMAC_Final ((HMAC_CTX *)HmacSha1Context, HmacValue, &Length) != 1) {
return FALSE;
}
if (HMAC_CTX_reset ((HMAC_CTX *)HmacSha1Context) != 1) {
return FALSE;
}
return TRUE;
}

139
CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c
View File

@ -1,139 +0,0 @@
/** @file
HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.
Copyright (c) 2012 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include "InternalCryptLib.h"
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
Return NULL to indicate this interface is not supported.
@return NULL This interface is not supported..
**/
VOID *
EFIAPI
HmacSha1New (
VOID
)
{
ASSERT (FALSE);
return NULL;
}
/**
Release the specified HMAC_CTX context.
This function will do nothing.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
VOID
EFIAPI
HmacSha1Free (
IN VOID *HmacSha1Ctx
)
{
ASSERT (FALSE);
return;
}
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
Return FALSE to indicate this interface is not supported.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1SetKey (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
)
{
ASSERT (FALSE);
return FALSE;
}
/**
Makes a copy of an existing HMAC-SHA1 context.
Return FALSE to indicate this interface is not supported.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Duplicate (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
)
{
ASSERT (FALSE);
return FALSE;
}
/**
Digests the input data and updates HMAC-SHA1 context.
Return FALSE to indicate this interface is not supported.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Update (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
ASSERT (FALSE);
return FALSE;
}
/**
Completes computation of the HMAC-SHA1 digest value.
Return FALSE to indicate this interface is not supported.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Final (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
)
{
ASSERT (FALSE);
return FALSE;
}

3
CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
View File

@ -7,7 +7,7 @@
# buffer overflow or integer overflow.
#
# Note:
# HMAC-SHA1/SHA256 functions, AES functions, RSA external
# HMAC-SHA256 functions, AES functions, RSA external
# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509
# certificate handler functions, authenticode signature verification functions,
# PEM handler functions, and pseudorandom number generator functions are not
@ -40,7 +40,6 @@
Hash/CryptSha256.c
Hash/CryptSm3.c
Hash/CryptSha512.c
Hmac/CryptHmacSha1Null.c
Hmac/CryptHmacSha256Null.c
Kdf/CryptHkdfNull.c
Cipher/CryptAesNull.c

4
CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
View File

@ -6,7 +6,7 @@
// This external input must be validated carefully to avoid security issues such as
// buffer overflow or integer overflow.
//
// Note: HMAC-SHA1 functions, AES
// Note: AES
// functions, RSA external functions, PKCS#7 SignedData sign functions,
// Diffie-Hellman functions, X.509 certificate handler functions, authenticode
// signature verification functions, PEM handler functions, and pseudorandom number
@ -21,5 +21,5 @@
#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for PEIM"
#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."
#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."

3
CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
View File

@ -7,7 +7,7 @@
# buffer overflow or integer overflow.
#
# Note: SHA-384 Digest functions, SHA-512 Digest functions,
# HMAC-SHA1/SHA256 functions, AES functions, RSA external
# HMAC-SHA256 functions, AES functions, RSA external
# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
# authenticode signature verification functions are not supported in this instance.
#
@ -40,7 +40,6 @@
Hash/CryptSha256.c
Hash/CryptSm3.c
Hash/CryptSha512Null.c
Hmac/CryptHmacSha1Null.c
Hmac/CryptHmacSha256Null.c
Kdf/CryptHkdfNull.c
Cipher/CryptAesNull.c

4
CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
View File

@ -6,7 +6,7 @@
// This external input must be validated carefully to avoid security issues such as
// buffer overflow or integer overflow.
//
// Note: HMAC-SHA1 functions, AES
// Note: AES
// functions, RSA external functions, PKCS#7 SignedData sign functions,
// Diffie-Hellman functions, and authenticode signature verification functions are
// not supported in this instance.
@ -20,5 +20,5 @@
#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for DXE_RUNTIME_DRIVER"
#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."

4
CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
View File

@ -7,8 +7,7 @@
# buffer overflow or integer overflow.
#
# Note: SHA-384 Digest functions, SHA-512 Digest functions,
# HMAC-SHA1 functions, RSA external
# functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
# RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and
# authenticode signature verification functions are not supported in this instance.
#
# Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>
@ -39,7 +38,6 @@
Hash/CryptSha256.c
Hash/CryptSm3.c
Hash/CryptSha512Null.c
Hmac/CryptHmacSha1Null.c
Hmac/CryptHmacSha256.c
Kdf/CryptHkdfNull.c
Cipher/CryptAes.c

4
CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
View File

@ -6,7 +6,7 @@
// This external input must be validated carefully to avoid security issues such as
// buffer overflow or integer overflow.
//
// Note: HMAC-SHA1 functions, AES
// Note: AES
// functions, RSA external functions, PKCS#7 SignedData sign functions,
// Diffie-Hellman functions, and authenticode signature verification functions are
// not supported in this instance.
@ -20,5 +20,5 @@
#string STR_MODULE_ABSTRACT #language en-US "Cryptographic Library Instance for SMM driver"
#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."
#string STR_MODULE_DESCRIPTION #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."

1
CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
View File

@ -34,7 +34,6 @@
Hash/CryptSha256Null.c
Hash/CryptSha512Null.c
Hash/CryptSm3Null.c
Hmac/CryptHmacSha1Null.c
Hmac/CryptHmacSha256Null.c
Kdf/CryptHkdfNull.c
Cipher/CryptAesNull.c

139
CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
View File

@ -1,139 +0,0 @@
/** @file
HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.
Copyright (c) 2012 - 2020, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#include "InternalCryptLib.h"
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
Return NULL to indicate this interface is not supported.
@return NULL This interface is not supported..
**/
VOID *
EFIAPI
HmacSha1New (
VOID
)
{
ASSERT (FALSE);
return NULL;
}
/**
Release the specified HMAC_CTX context.
This function will do nothing.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
VOID
EFIAPI
HmacSha1Free (
IN VOID *HmacSha1Ctx
)
{
ASSERT (FALSE);
return;
}
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
Return FALSE to indicate this interface is not supported.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1SetKey (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
)
{
ASSERT (FALSE);
return FALSE;
}
/**
Makes a copy of an existing HMAC-SHA1 context.
Return FALSE to indicate this interface is not supported.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Duplicate (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
)
{
ASSERT (FALSE);
return FALSE;
}
/**
Digests the input data and updates HMAC-SHA1 context.
Return FALSE to indicate this interface is not supported.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Update (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
ASSERT (FALSE);
return FALSE;
}
/**
Completes computation of the HMAC-SHA1 digest value.
Return FALSE to indicate this interface is not supported.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Final (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
)
{
ASSERT (FALSE);
return FALSE;
}

151
CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
View File

@ -1015,157 +1015,6 @@ Sm3HashAll (
// MAC (Message Authentication Code) Primitive
//=====================================================================================
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
If this interface is not supported, then return NULL.
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha1New() returns NULL.
@return NULL This interface is not supported.
**/
VOID *
EFIAPI
HmacSha1New (
VOID
)
{
CALL_CRYPTO_SERVICE (HmacSha1New, (), NULL);
}
/**
Release the specified HMAC_CTX context.
If this interface is not supported, then do nothing.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
VOID
EFIAPI
HmacSha1Free (
IN VOID *HmacSha1Ctx
)
{
CALL_VOID_CRYPTO_SERVICE (HmacSha1Free, (HmacSha1Ctx));
}
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1SetKey (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
)
{
CALL_CRYPTO_SERVICE (HmacSha1SetKey, (HmacSha1Context, Key, KeySize), FALSE);
}
/**
Makes a copy of an existing HMAC-SHA1 context.
If HmacSha1Context is NULL, then return FALSE.
If NewHmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval TRUE HMAC-SHA1 context copy succeeded.
@retval FALSE HMAC-SHA1 context copy failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Duplicate (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
)
{
CALL_CRYPTO_SERVICE (HmacSha1Duplicate, (HmacSha1Context, NewHmacSha1Context), FALSE);
}
/**
Digests the input data and updates HMAC-SHA1 context.
This function performs HMAC-SHA1 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by
HmacSha1Final(). Behavior with invalid context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE HMAC-SHA1 data digest succeeded.
@retval FALSE HMAC-SHA1 data digest failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Update (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
)
{
CALL_CRYPTO_SERVICE (HmacSha1Update, (HmacSha1Context, Data, DataSize), FALSE);
}
/**
Completes computation of the HMAC-SHA1 digest value.
This function completes HMAC-SHA1 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA1 context cannot
be used again.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized
by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval TRUE HMAC-SHA1 digest computation succeeded.
@retval FALSE HMAC-SHA1 digest computation failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
HmacSha1Final (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
)
{
CALL_CRYPTO_SERVICE (HmacSha1Final, (HmacSha1Context, HmacValue), FALSE);
}
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.

121
CryptoPkg/Private/Protocol/Crypto.h
View File

@ -89,140 +89,49 @@ BOOLEAN
OUT UINT8 *HmacValue
);
/**
Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
If this interface is not supported, then return NULL.
@return Pointer to the HMAC_CTX context that has been initialized.
If the allocations fails, HmacSha1New() returns NULL.
@return NULL This interface is not supported.
HMAC SHA1 is deprecated and unsupported any longer.
Keep the function field for binary compability.
**/
typedef
VOID*
(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_NEW) (
(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_NEW) (
VOID
);
/**
Release the specified HMAC_CTX context.
If this interface is not supported, then do nothing.
@param[in] HmacSha1Ctx Pointer to the HMAC_CTX context to be released.
**/
typedef
VOID
(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_FREE) (
(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FREE) (
IN VOID *HmacSha1Ctx
);
/**
Set user-supplied key for subsequent use. It must be done before any
calling to HmacSha1Update().
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[out] HmacSha1Context Pointer to HMAC-SHA1 context.
@param[in] Key Pointer to the user-supplied key.
@param[in] KeySize Key size in bytes.
@retval TRUE The Key is set successfully.
@retval FALSE The Key is set unsuccessfully.
@retval FALSE This interface is not supported.
**/
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_SET_KEY) (
(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_SET_KEY) (
OUT VOID *HmacSha1Context,
IN CONST UINT8 *Key,
IN UINTN KeySize
);
/**
Makes a copy of an existing HMAC-SHA1 context.
If HmacSha1Context is NULL, then return FALSE.
If NewHmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in] HmacSha1Context Pointer to HMAC-SHA1 context being copied.
@param[out] NewHmacSha1Context Pointer to new HMAC-SHA1 context.
@retval TRUE HMAC-SHA1 context copy succeeded.
@retval FALSE HMAC-SHA1 context copy failed.
@retval FALSE This interface is not supported.
**/
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_DUPLICATE) (
(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_DUPLICATE) (
IN CONST VOID *HmacSha1Context,
OUT VOID *NewHmacSha1Context
);
/**
Digests the input data and updates HMAC-SHA1 context.
This function performs HMAC-SHA1 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by
HmacSha1Final(). Behavior with invalid context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[in] Data Pointer to the buffer containing the data to be digested.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE HMAC-SHA1 data digest succeeded.
@retval FALSE HMAC-SHA1 data digest failed.
@retval FALSE This interface is not supported.
**/
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_UPDATE) (
(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_UPDATE) (
IN OUT VOID *HmacSha1Context,
IN CONST VOID *Data,
IN UINTN DataSize
);
/**
Completes computation of the HMAC-SHA1 digest value.
This function completes HMAC-SHA1 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the HMAC-SHA1 context cannot
be used again.
HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized
by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.
If HmacSha1Context is NULL, then return FALSE.
If HmacValue is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in, out] HmacSha1Context Pointer to the HMAC-SHA1 context.
@param[out] HmacValue Pointer to a buffer that receives the HMAC-SHA1 digest
value (20 bytes).
@retval TRUE HMAC-SHA1 digest computation succeeded.
@retval FALSE HMAC-SHA1 digest computation failed.
@retval FALSE This interface is not supported.
**/
typedef
BOOLEAN
(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_FINAL) (
(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FINAL) (
IN OUT VOID *HmacSha1Context,
OUT UINT8 *HmacValue
);
@ -3538,13 +3447,13 @@ struct _EDKII_CRYPTO_PROTOCOL {
DEPRECATED_EDKII_CRYPTO_HMAC_MD5_DUPLICATE DeprecatedHmacMd5Duplicate;
DEPRECATED_EDKII_CRYPTO_HMAC_MD5_UPDATE DeprecatedHmacMd5Update;
DEPRECATED_EDKII_CRYPTO_HMAC_MD5_FINAL DeprecatedHmacMd5Final;
/// HMAC SHA1
EDKII_CRYPTO_HMAC_SHA1_NEW HmacSha1New;
EDKII_CRYPTO_HMAC_SHA1_FREE HmacSha1Free;
EDKII_CRYPTO_HMAC_SHA1_SET_KEY HmacSha1SetKey;
EDKII_CRYPTO_HMAC_SHA1_DUPLICATE HmacSha1Duplicate;
EDKII_CRYPTO_HMAC_SHA1_UPDATE HmacSha1Update;
EDKII_CRYPTO_HMAC_SHA1_FINAL HmacSha1Final;
/// HMAC SHA1 - deprecated and unsupported
DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_NEW DeprecatedHmacSha1New;
DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FREE DeprecatedHmacSha1Free;
DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_SET_KEY DeprecatedHmacSha1SetKey;
DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_DUPLICATE DeprecatedHmacSha1Duplicate;
DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_UPDATE DeprecatedHmacSha1Update;
DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FINAL DeprecatedHmacSha1Final;
/// HMAC SHA256
EDKII_CRYPTO_HMAC_SHA256_NEW HmacSha256New;
EDKII_CRYPTO_HMAC_SHA256_FREE HmacSha256Free;