2 PKCS7 Verify Null implementation.
4 Copyright (C) Microsoft Corporation. All Rights Reserved.
5 Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
7 SPDX-License-Identifier: BSD-2-Clause-Patent
11 #include "InternalCryptLib.h"
14 This function will return the leaf signer certificate in a chain. This is
15 required because certificate chains are not guaranteed to have the
16 certificates in the order that they were issued.
18 A typical certificate chain looks like this:
21 ----------------------------
23 ----------------------------
26 ----------------------------
27 | Policy CA | <-- Typical Trust Anchor.
28 ----------------------------
31 ----------------------------
33 ----------------------------
36 -----------------------------
37 / End-Entity (leaf) signer / <-- Bottom certificate.
38 ----------------------------- EKU: "1.3.6.1.4.1.311.76.9.21.1"
42 @param[in] CertChain Certificate chain.
44 @param[out] SignerCert Last certificate in the chain. For PKCS7 signatures,
45 this will be the end-entity (leaf) signer cert.
47 @retval EFI_SUCCESS The required EKUs were found in the signature.
48 @retval EFI_INVALID_PARAMETER A parameter was invalid.
49 @retval EFI_NOT_FOUND The number of signers found was not 1.
53 GetSignerCertificate (
54 IN CONST VOID
*CertChain
,
63 Determines if the specified EKU represented in ASN1 form is present
64 in a given certificate.
66 @param[in] Cert The certificate to check.
68 @param[in] Asn1ToFind The EKU to look for.
70 @retval EFI_SUCCESS We successfully identified the signing type.
71 @retval EFI_INVALID_PARAMETER A parameter was invalid.
72 @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
86 Determines if the specified EKUs are present in a signing certificate.
88 @param[in] SignerCert The certificate to check.
89 @param[in] RequiredEKUs The EKUs to look for.
90 @param[in] RequiredEKUsSize The number of EKUs
91 @param[in] RequireAllPresent If TRUE, then all the specified EKUs
92 must be present in the certificate.
94 @retval EFI_SUCCESS We successfully identified the signing type.
95 @retval EFI_INVALID_PARAMETER A parameter was invalid.
96 @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
100 IN CONST VOID
*SignerCert
,
101 IN CONST CHAR8
*RequiredEKUs
[],
102 IN CONST UINT32 RequiredEKUsSize
,
103 IN BOOLEAN RequireAllPresent
107 return EFI_NOT_READY
;
111 This function receives a PKCS#7 formatted signature blob,
112 looks for the EKU SEQUENCE blob, and if found then looks
113 for all the required EKUs. This function was created so that
114 the Surface team can cut down on the number of Certificate
115 Authorities (CA's) by checking EKU's on leaf signers for
116 a specific product. This prevents one product's certificate
117 from signing another product's firmware or unlock blobs.
119 Note that this function does not validate the certificate chain.
120 That needs to be done before using this function.
122 @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array
123 containing the content block with both the signature,
124 the signer's certificate, and any necessary intermediate
126 @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.
127 @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of
128 required EKUs that must be present in the signature.
129 @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.
130 @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's
131 must be present in the leaf signer. If it is
132 FALSE, then we will succeed if we find any
133 of the specified EKU's.
135 @retval EFI_SUCCESS The required EKUs were found in the signature.
136 @retval EFI_INVALID_PARAMETER A parameter was invalid.
137 @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.
142 VerifyEKUsInPkcs7Signature (
143 IN CONST UINT8
*Pkcs7Signature
,
144 IN CONST UINT32 SignatureSize
,
145 IN CONST CHAR8
*RequiredEKUs
[],
146 IN CONST UINT32 RequiredEKUsSize
,
147 IN BOOLEAN RequireAllPresent
151 return EFI_NOT_READY
;