sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correct the Hash Calculation for Revoked X.509 Certificate to align with RFC3280 and UEFI 2.4 Spec.

Browse Source 
This patch added one new X509GetTBSCert() interface in BaseCryptLib to retrieve the TBSCertificate, 
and also corrected the hash calculation for revoked certificate to aligned the RFC3280 and UEFI 2.4 spec.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Long, Qin" <qin.long@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@initel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16559 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Long, Qin
2014-12-25 08:37:08 +00:00
committed by qlong
parent 270fc03f3e
commit 12d95665cb
6 changed files with 182 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
View File

@ -852,6 +852,8 @@ IsCertHashFoundInDatabase (
UINT8 CertDigest[MAX_DIGEST_SIZE];
UINT8 *DbxCertHash;
UINTN SiglistHeaderSize;
UINT8 *TBSCert;
UINTN TBSCertSize;
IsFound = FALSE;
DbxList = SignatureList;
@ -859,8 +861,16 @@ IsCertHashFoundInDatabase (
HashCtx = NULL;
HashAlg = HASHALG_MAX;
ASSERT (RevocationTime != NULL);
ASSERT (DbxList != NULL);
if ((RevocationTime == NULL) || (DbxList == NULL)) {
return FALSE;
}
//
// Retrieve the TBSCertificate from the X.509 Certificate.
//
if (!X509GetTBSCert (Certificate, CertSize, &TBSCert, &TBSCertSize)) {
return FALSE;
}
while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {
//
@ -879,7 +889,7 @@ IsCertHashFoundInDatabase (
}
//
// Calculate the hash value of current db certificate for comparision.
// Calculate the hash value of current TBSCertificate for comparision.
//
if (mHash[HashAlg].GetContextSize == NULL) {
goto Done;
@ -893,7 +903,7 @@ IsCertHashFoundInDatabase (
if (!Status) {
goto Done;
}
Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);
Status = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);
if (!Status) {
goto Done;
}