Created SLH-DSA API functions to configure public and private keys for
SLH-DSA algorithm. This will allow users to sign and verify with
SLH-DSA. Unit tests were added to confirm operation of the API.
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
Include validation checks for Context and ContextSize in
sign and verify functions.
Returned FALSE for EdDsaGeneratePubKey.
Updated ReadMe to show EdDsa support
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
Created ML-DSA API functions to configure public and private keys for
ML-DSA algorithm. This will allow users to sign and verify with ML-DSA.
Unit tests were add to confirm operation of the API.
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
Implemented signature and verification functions for ED448;
Updated documentation and unit tests to cover new verification functions
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
Add RsaPssSignDigest() and RsaPssVerifyDigest() to BaseCryptLib for
signing/verifying precomputed digests. Provide OpenSSL/MbedTLS/Null
implementations, expose via EDKII_CRYPTO_PROTOCOL (v24), and add PCD
controls for independent service enabling. Include unit tests.
Signed-off-by: Anbazhagan Baraneedharan <anbazhagan@hp.com>
Replace traditional `#ifndef`/`#define`/`#endif` include guards with
`#pragma` once.
`#pragma once` is a widely supported preprocessor directive that
prevents header files from being included multiple times. It is
supported by all toolchains used to build edk2: GCC, Clang/LLVM, and
MSVC.
Does not include updates to OpenSSL generated header files checked
into the repo. Those in `CryptoPkg\Library\OpensslLib\OpensslGen\`.
Compared to macro-based include guards, `#pragma once`:
- Eliminates the risk of macro name collisions or copy/paste errors
where two headers inadvertently use the same guard macro.
- Eliminate inconsistency in the way include guard macros are named
(e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.).
- Reduces boilerplate (three lines replaced by one).
- Avoids polluting the macro namespace with guard symbols.
- Can improve build times as the preprocessor can skip re-opening the
file entirely, rather than re-reading it to find the matching
`#endif` ("multiple-include optimization").
- Note that some compilers may already optimize traditional include
guards, by recognzining the idiomatic pattern.
This change is made acknowledging that overall portability of the
code will technically be reduced, as `#pragma once` is not part of the
C/C++ standards.
However, this is considered acceptable given:
1. edk2 already defines a subset of supported compilers in
BaseTools/Conf/tools_def.template, all of which have supported
`#pragma once` for over two decades.
2. There have been concerns raised to the project about inconsistent
include guard naming and potential macro collisions.
Approximate compiler support dates:
- MSVC: Supported since Visual C++ 4.2 (1996)
- GCC: Supported since 3.4 (2004)
(http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html)
- Clang (LLVM based): Since initial release in 2007
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
MbebTls no support signature with content data.
test would be fail in below test case:
TestPkcs7Attached
TestPkcs7Detached
TestVerifyPkcs7ContentData
REF: https://github.com/tianocore/edk2/issues/11605
Signed-off-by: Longhaox Lee <longhaox.lee@intel.com>
Currently BaseCryptLibMbedTls does not support all Crypto services,
so the following case will fail:
TestVerifyEKUsWith3CertsInSignature()
TestVerifyEKUsWith2CertsInSignature()
TestNoEKUsInSignature()
TestVerifyRsaCertPkcs1SignVerify
TestVerifyPkcs7SignVerifyNonSelfIssued()
TestVerifyDhGenerateKey()
Pkcs1v2Decrypt
Pkcs1v2EncryptDecrypt
RsaOaepEncrypt (Interface)
RsaOaepEncrypt (NoSeed)
RsaOaepEncrypt (Seeded)
RsaOaepDecrypt
RsaOaepEncryptDecrypt
RsaOaepEncryptPkcs1v2Decrypt
Pkcs1v2EncryptRsaOaepDecrypt
RsaOaepEncrypt (MdDefaultMgf1Default)
RsaOaepDecrypt (MdDefaultMgf1Default)
RsaOaepEncryptDecrypt (MdDefaultMgf1Default)
RsaOaepEncrypt (MdSha1Bgf1Sha1
RsaOaepDecrypt (MdSha1Bgf1Sha1)
RsaOaepEncryptDecrypt (MdSha1Bgf1Sha1)
RsaOaepEncrypt (MdSha256Bgf1Sha256)
RsaOaepDecrypt (MdSha256Bgf1Sha256)
RsaOaepEncryptDecrypt (MdSha256Bgf1Sha256)
TestVerifyBn()
TestVerifyEcKey()
Signed-off-by: Yi Li <yi1.li@intel.com>
This case uses a non-self-issued certificate as the signing
certificate and CA.
BaseCryptLib can pass this case (X509_V_FLAG_PARTIAL_CHAIN enabled).
BaseCryptLibMbedTls cannot, because Mbedtls certificate chain
validation lacks support for partial certificate chains currently.
Signed-off-by: Yi Li <yi1.li@intel.com>
This patch updates several CodeQL errors for potential null pointer
access and unguarded header conclusion across production and test
code that have been flagged in the build/security tab in GitHub.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Update the CryptoPkg to support CLANGPDB and CLANGDWARF from
both Windows and Linux host environments.
* Add PcdOpensslLibAssemblySourceStyleNasm to select the correct
optimized assembly source style for OpensslLib for IA32/X64.
NASM style is for MSFT and CLANGPDB. GAS style is for GCC.
Use this PCD in OpensslLibAccel.inf and OpensslLibFullAccel.inf
to select between .nasm and .S files.
* Add intrinsic functions required by CLANG IA32/X64 builds.
* __ashlti3
* __lshrdi3
* Disable warning -Wno-error=unused-function for CLANG build
compatibility
* Set -D OPENSSL_NO_INLINE_ASM for CLANG build compatibility
* Update TestBaseCryptLib to split out the implementation of
main() into its own C file that is only use for host-based
unit tests. This is due to CLANGPDB for host environments
injecting a __main() call that can only be resolved in host
based builds that link against host libraries.
* Update Configure.py to update IA32/X64 [Sources] sections
with feature flag expressions using the new PCD
PcdOpensslLibAssemblySourceStyleNasm.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
SM3 needs to be tested so we can verify that alternative implementations
(such as the one I will be contributing to BaseCryptLibMbedTls) as well
as the reference implementation produce the expected value.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Add unit test functions:
TestVerifyPkcs1v2EncryptInterface()
TestVerifyRsaOaepEncryptInterface()
TestVerifyEncrypt()
TestVerifyDecrypt()
TestVerifyEncryptDecrypt()
Signed-off-by: Chris Ruffin <v-chruffin@microsoft.com>
Cc: Chris Ruffin <cruffin@millcore.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Cc: Wenxing Hou <wenxing.hou@intel.com>
Reviewed-by: Yi Li <yi1.li@intel.com>
Add MD5/SHA1/SHA256/SHA384/SHA512 APIs.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
Reviewed-by: Yi Li <yi1.li@intel.com>
Add RSA APIs.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4177
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
Reviewed-by: Yi Li <yi1.li@intel.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4130
Remove TestBaseCryptLibHostAccel.inf and instead use FILE_GUID
override in DSC file to run the same unit test INF against
OpensslLibFull.inf and OpensslLibFullAccel.inf
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Build host-based tests using OpensslLib instance with all services
enabled.
* Build host-based tests using performance optimized OpensslLib instance
with all services enabled.
* Remove unused PCD gEfiCryptoPkgTokenSpaceGuid.PcdOpensslEcEnabled
* Remove redundant and unnecessary [BuildOptions]
* Limit host-based unit tests to only IA32/X64
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Christopher Zurcher <christopher.zurcher@microsoft.com>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Update ImageTimeStampTest to return UNIT_TEST_PASSED instead of
Status. On success Status is TRUE(1), which was returning a unit
test status of UNIT_TEST_ERROR_PREREQUISITE_NOT_MET.
* Update HmacTests to use the *Free() service from the HMAC family
instead of FreePool(). Using FreePool() generates ASSERT() because
the context being freed was not allocated using AllocatePool().
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Christopher Zurcher <christopher.zurcher@microsoft.com>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Add unit test for CryptoEc.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Yi Li <yi1.li@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Add unit test for CryptoBn.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Yi Li <yi1.li@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
openssl 3.0 wants at least 512 bytes, otherwise it throws an error:
error:0280007E:Diffie-Hellman routines::modulus too small
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3596
Parallel hash function ParallelHash256HashAll, as defined in NIST's
Special Publication 800-185, published December 2016. It utilizes
multi-process to calculate the digest.
Passed CI test.
Onprotocol version code passed test.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Signed-off-by: Zhihao Li <zhihao.li@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737
Apply uncrustify changes to .c/.h files in the CryptoPkg package
Cc: Andrew Fish <afish@apple.com>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Only include MD5 unit tests if ENABLE_MD5_DEPRECATED_INTERFACES
is defined and define ENABLE_MD5_DEPRECATED_INTERFACES for host
based unit tests so MD5 services are always tested.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
This adds a new INF for BaseCryptLib suitable for
host based environments. It adds a host based unit test for
BaseCryptLib that can also be built as a shell based Unit Test.
In addition, this also adds a UnitTestHostCrtWrapper.c file, which provides
some of the functionality not provided by the default host based unit test
system that OpenSSL expects. This is used by UnitTestHostBaseCryptLib, a
version of the BaseCryptLib meant specifically for host based unit testing.
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Signed-off-by: Matthew Carlson <matthewfcarlson@gmail.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
