sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CryptoPkg Updates to support RFC3161 timestamp signature verification.

Browse Source 
The main changes includes:
1. Enabling SHA384 and SHA512 digest algorithm; (Sha512.c)
2. RFC 3161 timestamp signature verification support; (CryptTs.c)
3. Fixed one ASN.1 length encoding issue in Authenticode verification routine. (CryptAuthenticode.c)
4. Add the corresponding test cases in Cryptest utility (SHA384 & SHA512 & Timestamp verification)

Contributed-under: TianoCore Contribution Agreement 1.0

Signed-off-by: Qin Long <qin.long@intel.com> 
Reviewed-by: Guo Dong <guo.dong@intel.com>
Reviewed-by: Ting Ye <ting.ye@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16339 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Qin Long
2014-11-12 08:51:45 +00:00
committed by qlong
parent bcbdc75535
commit 2ac68e8b54
29 changed files with 2369 additions and 687 deletions
Download Patch File Download Diff File Expand all files Collapse all files

264
CryptoPkg/Include/Library/BaseCryptLib.h
View File

@@ -4,7 +4,7 @@
primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security
functionality enabling.
Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -38,6 +38,16 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
///
#define SHA256_DIGEST_SIZE 32
///
/// SHA-384 digest size in bytes
///
#define SHA384_DIGEST_SIZE 48
///
/// SHA-512 digest size in bytes
///
#define SHA512_DIGEST_SIZE 64
///
/// TDES block size in bytes
///
@@ -513,6 +523,215 @@ Sha256Final (
OUT UINT8 *HashValue
);
/**
Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
@return The size, in bytes, of the context buffer required for SHA-384 hash operations.
**/
UINTN
EFIAPI
Sha384GetContextSize (
VOID
);
/**
Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
subsequent use.
If Sha384Context is NULL, then return FALSE.
@param[out] Sha384Context Pointer to SHA-384 context being initialized.
@retval TRUE SHA-384 context initialization succeeded.
@retval FALSE SHA-384 context initialization failed.
**/
BOOLEAN
EFIAPI
Sha384Init (
OUT VOID *Sha384Context
);
/**
Makes a copy of an existing SHA-384 context.
If Sha384Context is NULL, then return FALSE.
If NewSha384Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in] Sha384Context Pointer to SHA-384 context being copied.
@param[out] NewSha384Context Pointer to new SHA-384 context.
@retval TRUE SHA-384 context copy succeeded.
@retval FALSE SHA-384 context copy failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
Sha384Duplicate (
IN CONST VOID *Sha384Context,
OUT VOID *NewSha384Context
);
/**
Digests the input data and updates SHA-384 context.
This function performs SHA-384 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
SHA-384 context should be already correctly intialized by Sha384Init(), and should not be finalized
by Sha384Final(). Behavior with invalid context is undefined.
If Sha384Context is NULL, then return FALSE.
@param[in, out] Sha384Context Pointer to the SHA-384 context.
@param[in] Data Pointer to the buffer containing the data to be hashed.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE SHA-384 data digest succeeded.
@retval FALSE SHA-384 data digest failed.
**/
BOOLEAN
EFIAPI
Sha384Update (
IN OUT VOID *Sha384Context,
IN CONST VOID *Data,
IN UINTN DataSize
);
/**
Completes computation of the SHA-384 digest value.
This function completes SHA-384 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the SHA-384 context cannot
be used again.
SHA-384 context should be already correctly intialized by Sha384Init(), and should not be
finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.
If Sha384Context is NULL, then return FALSE.
If HashValue is NULL, then return FALSE.
@param[in, out] Sha384Context Pointer to the SHA-384 context.
@param[out] HashValue Pointer to a buffer that receives the SHA-384 digest
value (48 bytes).
@retval TRUE SHA-384 digest computation succeeded.
@retval FALSE SHA-384 digest computation failed.
**/
BOOLEAN
EFIAPI
Sha384Final (
IN OUT VOID *Sha384Context,
OUT UINT8 *HashValue
);
/**
Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
@return The size, in bytes, of the context buffer required for SHA-512 hash operations.
**/
UINTN
EFIAPI
Sha512GetContextSize (
VOID
);
/**
Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
subsequent use.
If Sha512Context is NULL, then return FALSE.
@param[out] Sha512Context Pointer to SHA-512 context being initialized.
@retval TRUE SHA-512 context initialization succeeded.
@retval FALSE SHA-512 context initialization failed.
**/
BOOLEAN
EFIAPI
Sha512Init (
OUT VOID *Sha512Context
);
/**
Makes a copy of an existing SHA-512 context.
If Sha512Context is NULL, then return FALSE.
If NewSha512Context is NULL, then return FALSE.
If this interface is not supported, then return FALSE.
@param[in] Sha512Context Pointer to SHA-512 context being copied.
@param[out] NewSha512Context Pointer to new SHA-512 context.
@retval TRUE SHA-512 context copy succeeded.
@retval FALSE SHA-512 context copy failed.
@retval FALSE This interface is not supported.
**/
BOOLEAN
EFIAPI
Sha512Duplicate (
IN CONST VOID *Sha512Context,
OUT VOID *NewSha512Context
);
/**
Digests the input data and updates SHA-512 context.
This function performs SHA-512 digest on a data buffer of the specified size.
It can be called multiple times to compute the digest of long or discontinuous data streams.
SHA-512 context should be already correctly intialized by Sha512Init(), and should not be finalized
by Sha512Final(). Behavior with invalid context is undefined.
If Sha512Context is NULL, then return FALSE.
@param[in, out] Sha512Context Pointer to the SHA-512 context.
@param[in] Data Pointer to the buffer containing the data to be hashed.
@param[in] DataSize Size of Data buffer in bytes.
@retval TRUE SHA-512 data digest succeeded.
@retval FALSE SHA-512 data digest failed.
**/
BOOLEAN
EFIAPI
Sha512Update (
IN OUT VOID *Sha512Context,
IN CONST VOID *Data,
IN UINTN DataSize
);
/**
Completes computation of the SHA-512 digest value.
This function completes SHA-512 hash computation and retrieves the digest value into
the specified memory. After this function has been called, the SHA-512 context cannot
be used again.
SHA-512 context should be already correctly intialized by Sha512Init(), and should not be
finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.
If Sha512Context is NULL, then return FALSE.
If HashValue is NULL, then return FALSE.
@param[in, out] Sha512Context Pointer to the SHA-512 context.
@param[out] HashValue Pointer to a buffer that receives the SHA-512 digest
value (64 bytes).
@retval TRUE SHA-512 digest computation succeeded.
@retval FALSE SHA-512 digest computation failed.
**/
BOOLEAN
EFIAPI
Sha512Final (
IN OUT VOID *Sha512Context,
OUT UINT8 *HashValue
);
//=====================================================================================
// MAC (Message Authentication Code) Primitive
@@ -754,7 +973,6 @@ HmacSha1Final (
OUT UINT8 *HmacValue
);
//=====================================================================================
// Symmetric Cryptography Primitive
//=====================================================================================
@@ -1395,7 +1613,7 @@ RsaGetKey (
@param[in, out] RsaContext Pointer to RSA context being set.
@param[in] ModulusLength Length of RSA modulus N in bits.
@param[in] PublicExponent Pointer to RSA public exponent.
@param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
@param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.
@retval TRUE RSA key component was generated successfully.
@retval FALSE Invalid RSA key component tag.
@@ -1519,7 +1737,6 @@ RsaPkcs1Verify (
@retval TRUE RSA Private Key was retrieved successfully.
@retval FALSE Invalid PEM key data or incorrect password.
@retval FALSE This interface is not supported.
**/
BOOLEAN
@@ -1648,7 +1865,7 @@ X509ConstructCertificate (
@param ... A list of DER-encoded single certificate data followed
by certificate size. A NULL terminates the list. The
pairs are the arguments to X509ConstructCertificate().
@retval TRUE The X509 stack construction succeeded.
@retval FALSE The construction operation failed.
@retval FALSE This interface is not supported.
@@ -1658,7 +1875,7 @@ BOOLEAN
EFIAPI
X509ConstructCertificateStack (
IN OUT UINT8 **X509Stack,
...
...
);
/**
@@ -1845,6 +2062,35 @@ AuthenticodeVerify (
IN UINTN HashSize
);
/**
Verifies the validility of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
signature.
If AuthData is NULL, then return FALSE.
@param[in] AuthData Pointer to the Authenticode Signature retrieved from signed
PE/COFF image to be verified.
@param[in] DataSize Size of the Authenticode Signature in bytes.
@param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which
is used for TSA certificate chain verification.
@param[in] CertSize Size of the trusted certificate in bytes.
@param[out] SigningTime Return the time of timestamp generation time if the timestamp
signature is valid.
@retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.
@retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.
**/
BOOLEAN
EFIAPI
ImageTimestampVerify (
IN CONST UINT8 *AuthData,
IN UINTN DataSize,
IN CONST UINT8 *TsaCert,
IN UINTN CertSize,
OUT EFI_TIME *SigningTime
);
//=====================================================================================
// DH Key Exchange Primitive
//=====================================================================================
@@ -1882,7 +2128,7 @@ DhFree (
Given generator g, and length of prime number p in bits, this function generates p,
and sets DH context according to value of g and p.
Before this function can be invoked, pseudorandom number generator must be correctly
initialized by RandomSeed().
@@ -1945,7 +2191,7 @@ DhSetParameter (
/**
Generates DH public key.
This function generates random secret exponent, and computes the public key, which is
This function generates random secret exponent, and computes the public key, which is
returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.
If the PublicKey buffer is too small to hold the public key, FALSE is returned and
PublicKeySize is set to the required buffer size to obtain the public key.
@@ -2060,4 +2306,4 @@ RandomBytes (
IN UINTN Size
);
#endif // __BASE_CRYPT_LIB_H__
#endif // __BASE_CRYPT_LIB_H__