MdePkg/Include/Guid/ImageAuthentication.h

   1 /** @file
   2   Platform Key, Key Exchange Key, and Image signature database are defined
   3   for the signed image validation.
   4
   5   Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
   6   This program and the accompanying materials
   7   are licensed and made available under the terms and conditions of the BSD License
   8   which accompanies this distribution.  The full text of the license may be found at
   9   http://opensource.org/licenses/bsd-license.php
  10
  11   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14   @par Revision Reference:
  15   GUIDs defined in UEFI 2.2 spec.
  16 **/
  17
  18 #ifndef __IMAGE_AUTHTICATION_H__
  19 #define __IMAGE_AUTHTICATION_H__
  20
  21 #include <Guid/GlobalVariable.h>
  22
  23 #define EFI_IMAGE_SECURITY_DATABASE_GUID \
  24   { \
  25     0xd719b2cb, 0x3d3a, 0x4596, { 0xa3, 0xbc, 0xda, 0xd0, 0xe, 0x67, 0x65, 0x6f } \
  26   }
  27
  28 ///
  29 /// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
  30 /// for the authorized signature database.
  31 ///
  32 #define EFI_IMAGE_SECURITY_DATABASE       L"db"
  33 ///
  34 /// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID
  35 /// for the forbidden signature database.
  36 ///
  37 #define EFI_IMAGE_SECURITY_DATABASE1      L"dbx"
  38
  39 #define SETUP_MODE                        1
  40 #define USER_MODE                         0
  41 ///
  42 /// Globally "SetupMode" variable to specify whether the system is currently operating
  43 /// in setup mode (1) or not (0). All other values are reserved.
  44 ///
  45 #define EFI_SETUP_MODE_NAME               L"SetupMode"
  46 ///
  47 /// Globally "PK" variable for the Platform Key Signature Database.
  48 ///
  49 #define EFI_PLATFORM_KEY_NAME             L"PK"
  50 ///
  51 /// Globally "KEK" variable for the Key Exchange Key Signature Database.
  52 ///
  53 #define EFI_KEY_EXCHANGE_KEY_NAME         L"KEK"
  54 ///
  55 /// Globally "SignatureSupport" variable returns an array of GUIDs,
  56 /// with each GUID representing a type of signature which the platform
  57 /// firmware supports for images and other data.
  58 ///
  59 #define EFI_SIGNATURE_SUPPORT_NAME        L"SignatureSupport"
  60
  61 //***********************************************************************
  62 // Signature Database
  63 //***********************************************************************
  64 ///
  65 /// The format of a signature database.
  66 ///
  67 #pragma pack(1)
  68
  69 typedef struct {
  70   ///
  71   /// An identifier which identifies the agent which added the signature to the list.
  72   ///
  73   EFI_GUID          SignatureOwner;
  74   ///
  75   /// The format of the signature is defined by the SignatureType.
  76   ///
  77   UINT8             SignatureData[1];
  78 } EFI_SIGNATURE_DATA;
  79
  80 typedef struct {
  81   ///
  82   /// Type of the signature. GUID signature types are defined in below.
  83   ///
  84   EFI_GUID            SignatureType;
  85   ///
  86   /// Total size of the signature list, including this header.
  87   ///
  88   UINT32              SignatureListSize;
  89   ///
  90   /// Size of the signature header which precedes the array of signatures.
  91   ///
  92   UINT32              SignatureHeaderSize;
  93   ///
  94   /// Size of each signature.
  95   ///
  96   UINT32              SignatureSize;
  97   ///
  98   /// Header before the array of signatures. The format of this header is specified
  99   /// by the SignatureType.
 100   /// UINT8           SignatureHeader[SignatureHeaderSize];
 101   ///
 102   /// An array of signatures. Each signature is SignatureSize bytes in length.
 103   /// EFI_SIGNATURE_DATA Signatures[][SignatureSize];
 104   ///
 105 } EFI_SIGNATURE_LIST;
 106
 107 #pragma pack()
 108
 109 ///
 110 /// This identifies a signature containing a SHA-256 hash. The SignatureHeader size should
 111 /// always be 0.  The SignatureSize should always be 32 bytes.
 112 ///
 113 #define EFI_CERT_SHA256_GUID \
 114   { \
 115     0xc1c41626, 0x504c, 0x4092, {0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28} \
 116   }
 117
 118 ///
 119 /// This identifies a signature containing an RSA-2048 key. The SignatureHeader size should
 120 /// always be 0. The SignatureSize should always be 256 bytes.
 121 ///
 122 #define EFI_CERT_RSA2048_GUID \
 123   { \
 124     0x3c5766e8, 0x269c, 0x4e34, {0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6} \
 125   }
 126
 127 ///
 128 /// This identifies a signature containing a RSA-2048 signature of a SHA-256 hash. The
 129 /// SignatureHeader size should always be 0. The SignatureSize should always be 256 bytes.
 130 ///
 131 #define EFI_CERT_RSA2048_SHA256_GUID \
 132   { \
 133     0xe2b36190, 0x879b, 0x4a3d, {0xad, 0x8d, 0xf2, 0xe7, 0xbb, 0xa3, 0x27, 0x84} \
 134   }
 135
 136 ///
 137 /// This identifies a signature containing a SHA-1 hash.  The SignatureHeader size should always
 138 /// be 0. The SignatureSize should always be 20 bytes
 139 ///
 140 #define EFI_CERT_SHA1_GUID \
 141   { \
 142     0x826ca512, 0xcf10, 0x4ac9, {0xb1, 0x87, 0xbe, 0x1, 0x49, 0x66, 0x31, 0xbd} \
 143   }
 144
 145 ///
 146 /// This identifies a signature containing a RSA-2048 signature of a SHA-1 hash. The
 147 /// SignatureHeader size should always be 0. The SignatureSize should always be 256 bytes.
 148 ///
 149 #define EFI_CERT_RSA2048_SHA1_GUID \
 150   { \
 151     0x67f8444f, 0x8743, 0x48f1, {0xa3, 0x28, 0x1e, 0xaa, 0xb8, 0x73, 0x60, 0x80} \
 152   }
 153
 154 ///
 155 /// This identifies a signature based on an X.509 certificate. If the signature is an X.509 certificate then
 156 /// verification of the signature of an image should validate the public key certificate in the image using
 157 /// certificate path verification, up to this X.509 certificate as a trusted root.
 158 ///
 159 #define EFI_CERT_X509 \
 160   { \
 161     0xa5c059a1, 0x94e4, 0x4aa7, {0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72} \
 162   }
 163
 164 //***********************************************************************
 165 // Image Execution Information Table Definition
 166 //***********************************************************************
 167 typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;
 168
 169 #define EFI_IMAGE_EXECUTION_AUTHENTICATION      0x00000007
 170 #define EFI_IMAGE_EXECUTION_AUTH_UNTESTED       0x00000000
 171 #define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED     0x00000001
 172 #define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED     0x00000002
 173 #define EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND  0x00000003
 174 #define EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND      0x00000004
 175 #define EFI_IMAGE_EXECUTION_POLICY_FAILED       0x00000005
 176 #define EFI_IMAGE_EXECUTION_INITIALIZED         0x00000008
 177
 178 //
 179 // EFI_IMAGE_EXECUTION_INFO is added to EFI System Configuration Table
 180 // and assigned the GUID EFI_IMAGE_SECURITY_DATABASE_GUID.
 181 //
 182 typedef struct {
 183   ///
 184   /// Describes the action taken by the firmware regarding this image.
 185   ///
 186   EFI_IMAGE_EXECUTION_ACTION    Action;
 187   ///
 188   /// Size of all of the entire structure.
 189   ///
 190   UINT32                        InfoSize;
 191   ///
 192   /// If this image was a UEFI device driver (for option ROM, for example) this is the
 193   /// null-terminated, user-friendly name for the device. If the image was for an application,
 194   /// then this is the name of the application. If this cannot be determined, then a simple
 195   /// NULL character should be put in this position.
 196   /// CHAR16                    Name[];
 197   ///
 198
 199   ///
 200   /// For device drivers, this is the device path of the device for which this device driver
 201   /// was intended. In some cases, the driver itself may be stored as part of the system
 202   /// firmware, but this field should record the device's path, not the firmware path. For
 203   /// applications, this is the device path of the application. If this cannot be determined,
 204   /// a simple end-of-path device node should be put in this position.
 205   /// EFI_DEVICE_PATH_PROTOCOL  DevicePath;
 206   ///
 207
 208   ///
 209   /// Zero or more image signatures. If the image contained no signatures,
 210   /// then this field is empty.
 211   ///
 212   EFI_SIGNATURE_LIST            Signature;
 213 } EFI_IMAGE_EXECUTION_INFO;
 214
 215
 216 typedef struct {
 217   ///
 218   /// Number of EFI_IMAGE_EXECUTION_INFO structures.
 219   ///
 220   UINTN                     NumberOfImages;
 221   ///
 222   /// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures.
 223   ///
 224   // EFI_IMAGE_EXECUTION_INFO  InformationInfo[]
 225 } EFI_IMAGE_EXECUTION_INFO_TABLE;
 226
 227 extern EFI_GUID gEfiImageSecurityDatabaseGuid;
 228 extern EFI_GUID gEfiCertSha256Guid;
 229 extern EFI_GUID gEfiCertRsa2048Guid;
 230 extern EFI_GUID gEfiCertRsa2048Sha256Guid;
 231 extern EFI_GUID gEfiCertSha1Guid;
 232 extern EFI_GUID gEfiCertRsa2048Sha1Guid;
 233 extern EFI_GUID gEfiCertX509Guid;
 234
 235 #endif