Created SLH-DSA API functions to configure public and private keys for
SLH-DSA algorithm. This will allow users to sign and verify with
SLH-DSA. Unit tests were added to confirm operation of the API.
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
Created ML-DSA API functions to configure public and private keys for
ML-DSA algorithm. This will allow users to sign and verify with ML-DSA.
Unit tests were add to confirm operation of the API.
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
Implemented signature and verification functions for ED448;
Updated documentation and unit tests to cover new verification functions
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
This update includes fixes for the following security vulnerabilities:
- CVE-2026-45447
- CVE-2026-34180
- CVE-2026-34181
- CVE-2025-69419
Fixes: #12658
Signed-off-by: Thamballi Sreelalitha <sreelali@qti.qualcomm.com>
Lite version OpensslLib
base on OpensslLibFull but no-camellia, no -ecx and no-dh.
It save the size about ~192KB.
REF:
Signed-off-by: Lee LonghaoX <longhaox.lee@intel.com>
To build TPM 2.0 Reference Implementation library,
OpensslLib requires below features:
- camellia
- cmac
- elliptic curved algorithms
For thes, openssl should be configured without below two options:
- no-camellia
- no-cmac
Therefore, remove these two option for OpensslFullLib only
since TPM 2.0 Reference Library requires to use openssl built with ec
This increases OpensslFullLib size -- around 16K.
Except configure.py, other changed files are auto generated by
configure.py
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
CLANGPDB does not support the same asm syntax as GCC/CLANGDWARF.
As a result, the autogenerated ASM files in CryptoPkg need a new
flavor for CLANGPDB, which is supported by OpenSSL.
This adds support to the autogeneration script to support the new
flavor, as well as running the script and checking in the generated
asm files. To reflect the intention better than toolchain name
(as AARCH64-GCC is already out of date), the directories are renamed
to AARCH64-ELF (the former AARCH64-GCC) and AARCH64-PE (what CLANGPDB
uses).
In order to support this, a new PCD is introduced in CryptoPkg,
gEfiCryptoPkgTokenSpaceGuid.PcdOpensslLibAssemblySourceStylePe which
instructs the build system to include the PE target asm files or
the ELF target asm files. GCC and CLANGDWARF will use the ELF target
files and CLANGPDB uses the PE target files. This matches the X64
behavior to toggle between the asm files.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
CryptoPkg needed various updates to support CLANGPDB AARCH64:
- Scope a feature PCD to IA32/X64 only
- Ensure that OpenSSL and MbedTls have the Windows defines unset so
they don't try to build for Windows instead of UEFI
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Undefine WIN32 for GCC family compilers in OpensslLib INF
files to remove use of GetLastError() and SetLastError()
in OpensslLib builds.
Mingw CLANG compilers have a builtin define called WIN32.
When building OpensslLib, this define causes the Windows
APIs GetLastError() and SetLastError() to be referenced
which causes compilers warnings for undefined functions.
Mingw CLANG NOOPT builds generate link errors not finding
GetLastError() and SetLastError().
The MSFT family compilers do not define WIN32. As a result,
this issue is not observed with VS20xx tool chains. Removing
the WIN32 define aligns the GCC family with the MSFT family.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Update GCC Family to undefined _MSC_VER to match settings used
by other compilers. This addresses clang compatibility issues
for host-based unit test builds.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
CI builds have started to fail with
ERROR - Compiler #2220 from D:\a\1\s\CryptoPkg\Library\OpensslLib\openssl\crypto\bn\bn_gcd.c(659): the following warning is treated as an error
WARNING - Compiler #4319 from D:\a\1\s\CryptoPkg\Library\OpensslLib\openssl\crypto\bn\bn_gcd.c(659): '~': zero extending 'unsigned int' to 'unsigned __int64' of greater size
WARNING - Compiler #4319 from D:\a\1\s\CryptoPkg\Library\OpensslLib\openssl\crypto\bn\bn_gcd.c(671): '~': zero extending 'unsigned int' to 'unsigned __int64' of greater size
which was not flagged before. Suppress the warning in CryptoPkg so the
builds will succeed again. If this is a real issue, it should be
reported to and fixed in the upstream project.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
The OpenSSL build system enables debug information by default
unless NDEBUG is defined. This results in debug symbols being
included in GCC Release builds.
Add the NDEBUG flag to the GCC Release build flags to properly
disable debug information and align with standard Release build
practices.
Signed-off-by: Zihan Qi <zihanqi@amazon.com>
Fix wifi driver fails to configure the private key to CryptoDxe.
This enables TlsSetHostPrivateKeyEx() to handle PBES2-encrypted private
keys by providing PKCS12_pbe_crypt_ex().
Signed-off-by: Amy Chan <amy.chan@intel.com>
edk2 is dropping support for the ARM32 architecture. This
commit removes ARM32 code from CryptoPkg. This also drops
irrelevant VALID_ARCHITECTURES comments from infs that are
not arch specific.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Update the CryptoPkg to support CLANGPDB and CLANGDWARF from
both Windows and Linux host environments.
* Add PcdOpensslLibAssemblySourceStyleNasm to select the correct
optimized assembly source style for OpensslLib for IA32/X64.
NASM style is for MSFT and CLANGPDB. GAS style is for GCC.
Use this PCD in OpensslLibAccel.inf and OpensslLibFullAccel.inf
to select between .nasm and .S files.
* Add intrinsic functions required by CLANG IA32/X64 builds.
* __ashlti3
* __lshrdi3
* Disable warning -Wno-error=unused-function for CLANG build
compatibility
* Set -D OPENSSL_NO_INLINE_ASM for CLANG build compatibility
* Update TestBaseCryptLib to split out the implementation of
main() into its own C file that is only use for host-based
unit tests. This is due to CLANGPDB for host environments
injecting a __main() call that can only be resolved in host
based builds that link against host libraries.
* Update Configure.py to update IA32/X64 [Sources] sections
with feature flag expressions using the new PCD
PcdOpensslLibAssemblySourceStyleNasm.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
FIX: https://github.com/tianocore/edk2/issues/10664
CVE-2024-13176 affects ECDSA Sign of NIST P-521 implementation of
EDK2. Fix it by updating openssl to 3.4.1.
Signed-off-by: Yi Li <yi1.li@intel.com>
Some parts and versions of TLS require HMAC. This adds the missing HMAC
algorithms to the UEFI provider. One entry in the default signature
algorithms and one in the key management algorithms.
Source of these entries is the default OpenSSL provider, defltprov.c,
included in the OpenSSL library.
This change was required to connect to some TLS servers depending
on the used ciphers.
Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>
Drop the ArmSoftFloatLib dependency from the OpensslLib implementations,
so that we can retire this git submodule and associated dependencies in
other components.
The upshot of this is that OpenSSL can no longer be used on 32-bit ARM
by components that rely on the random number generation routines (which
is where the floating point usage resides). In practice, this means that
ARM platforms should use MbedTLs instead for things like signed
capsules, authenticated variables and TPM2 support. HTTPS boot is no
longer supported, as TlsDxe depends on OpensslLib directly.
Note that MbedTLS itself -surprisingly- depends on OpensslLib as well,
but only for the SM3 routines, and incorporating those does not require
softfloat support.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
REF: https://edk2.groups.io/g/devel/message/88179
Without this change, we get:
fatal error: 'Availability.h' file not found
when building on XCODE5.
The workaround uses a define present in openssl/include/crypto/rand.h
which modifies openssl behaviour on Apple only, causing the library
to default to a non-system specific source of entropy in syscall_random()
in rand_unix.c.
Co-authored-by: Savva Mitrofanov <savvamtr@gmail.com>
Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
Adding $(OPENSSL_PATH)/e_os.h to the list of source files had the effect
that $(OPENSSL_PATH)/ was added to the list of include directories.
With the file being gone in openssl-3.2.x this doesn't work any more.
Add the directory to the [Includes.Common.Private] section instead.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Create a special OpensslLib implementation that only exposes the SM3
routines that MbedTlsLib borrows from OpensslLib, to avoid having to
pull in other parts of OpenSSL that are not needed (e.g., via the
library constructor)
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
'asm' is not a keyword in C99, but GCC supports it nonetheless as a GNU
extension. So when using Clang, we must specify the gnu99 dialect
explicitly, or inline asm blocks using asm() rather than __asm__() will
be rejected by the compiler.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Generate AARCH64 related files and update .inf files,
running:
python CryptoPkg/Library/OpensslLib/configure.py
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4739
AES256-SHA256 is a Tls1.2 suite we need to support, add it to deflt_ciphers
in OpensslStub.
Signed-off-by: Shang Qingyu <qingyu.shang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Yi Li <yi1.li@intel.com>
BN and EC have not been fully tested, and will greatly increase
the size of the Crypto driver(>150KB).
Signed-off-by: Yi Li <yi1.li@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Brian J. Johnson <brian.johnson@hpe.com>
Tested-by: Kenneth Lautner <klautner@microsoft.com>
cd */edk2/CryptoPkg/Library/OpensslLib
python configure.py
Signed-off-by: Yi Li <yi1.li@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Brian J. Johnson <brian.johnson@hpe.com>
Tested-by: Kenneth Lautner <klautner@microsoft.com>
Add dummy implement of Encoder, Pkcs12 and sslserver.
OpenSSL libraries which don't need these features can include
these files to reduce the size of output.
Signed-off-by: Yi Li <yi1.li@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Brian J. Johnson <brian.johnson@hpe.com>
Tested-by: Kenneth Lautner <klautner@microsoft.com>
Disable warning as error of C4133:
v3_genn.c(101): warning C4133: 'function': incompatible types
- from 'ASN1_TYPE *' to 'const ASN1_STRING *'.
Signed-off-by: Yi Li <yi1.li@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Brian J. Johnson <brian.johnson@hpe.com>
Tested-by: Kenneth Lautner <klautner@microsoft.com>
Type of input params changed in openssl30.
Signed-off-by: Yi Li <yi1.li@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Brian J. Johnson <brian.johnson@hpe.com>
Tested-by: Kenneth Lautner <klautner@microsoft.com>
Added UEFI provider which removed unused features to
optimize the size of openssl3.
Signed-off-by: Yi Li <yi1.li@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Brian J. Johnson <brian.johnson@hpe.com>
Tested-by: Kenneth Lautner <klautner@microsoft.com>
