primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
functionality enabling.\r
\r
-Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
\r
If RsaContext is NULL, then ASSERT().\r
If MessageHash is NULL, then ASSERT().\r
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256, SHA-224, SHA-512 or SHA-384 digest, then ASSERT().\r
+ If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then ASSERT().\r
If SigSize is large enough but Signature is NULL, then ASSERT().\r
\r
@param[in] RsaContext Pointer to RSA context for signature generation.\r
@param[in] HashSize Size of the message hash in bytes.\r
@param[out] Signature Pointer to buffer to receive RSA PKCS1-v1_5 signature.\r
@param[in, out] SigSize On input, the size of Signature buffer in bytes.\r
- On output, the size of data returned in Signature buffer in bytes.\r
+ On output, the size of data returned in Signature buffer in bytes.\r
\r
@retval TRUE Signature successfully generated in PKCS1-v1_5.\r
@retval FALSE Signature generation failed.\r
If RsaContext is NULL, then ASSERT().\r
If MessageHash is NULL, then ASSERT().\r
If Signature is NULL, then ASSERT().\r
- If HashSize is not equal to the size of MD5, SHA-1, SHA-256, SHA-224, SHA-512 or SHA-384 digest, then ASSERT().\r
+ If HashSize is not equal to the size of MD5, SHA-1, SHA-256 digest, then ASSERT().\r
\r
@param[in] RsaContext Pointer to RSA context for signature verification.\r
@param[in] MessageHash Pointer to octet message hash to be checked.\r
IN UINTN CACertSize\r
);\r
\r
+/**\r
+ Construct a X509 object from DER-encoded certificate data.\r
+\r
+ If Cert is NULL, then ASSERT().\r
+ If SingleX509Cert is NULL, then ASSERT().\r
+\r
+ @param[in] Cert Pointer to the DER-encoded certificate data.\r
+ @param[in] CertSize The size of certificate data in bytes.\r
+ @param[out] SingleX509Cert The generated X509 object.\r
+\r
+ @retval TRUE The X509 object generation succeeded.\r
+ @retval FALSE The operation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+X509ConstructCertificate (\r
+ IN CONST UINT8 *Cert,\r
+ IN UINTN CertSize,\r
+ OUT UINT8 **SingleX509Cert\r
+ );\r
+\r
+/**\r
+ Construct a X509 stack object from a list of DER-encoded certificate data.\r
+\r
+ If X509Stack is NULL, then ASSERT().\r
+\r
+ @param[in, out] X509Stack On input, pointer to an existing X509 stack object.\r
+ On output, pointer to the X509 stack object with new\r
+ inserted X509 certificate.\r
+ @param ... A list of DER-encoded single certificate data followed\r
+ by certificate size. A NULL terminates the list. The\r
+ pairs are the arguments to X509ConstructCertificate().\r
+ \r
+ @retval TRUE The X509 stack construction succeeded.\r
+ @retval FALSE The construction operation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+X509ConstructCertificateStack (\r
+ IN OUT UINT8 **X509Stack,\r
+ ... \r
+ );\r
+\r
+/**\r
+ Release the specified X509 object.\r
+\r
+ If X509Cert is NULL, then ASSERT().\r
+\r
+ @param[in] X509Cert Pointer to the X509 object to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+X509Free (\r
+ IN VOID *X509Cert\r
+ );\r
+\r
+/**\r
+ Release the specified X509 stack object.\r
+\r
+ If X509Stack is NULL, then ASSERT().\r
+\r
+ @param[in] X509Stack Pointer to the X509 stack object to be released.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+X509StackFree (\r
+ IN VOID *X509Stack\r
+ );\r
+\r
+/**\r
+ Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message\r
+ Syntax Standard, version 1.5". This interface is only intended to be used for\r
+ application to perform PKCS#7 functionality validation.\r
+\r
+ @param[in] PrivateKey Pointer to the PEM-formatted private key data for\r
+ data signing.\r
+ @param[in] PrivateKeySize Size of the PEM private key data in bytes.\r
+ @param[in] KeyPassword NULL-terminated passphrase used for encrypted PEM\r
+ key data.\r
+ @param[in] InData Pointer to the content to be signed.\r
+ @param[in] InDataSize Size of InData in bytes.\r
+ @param[in] SignCert Pointer to signer's DER-encoded certificate to sign with.\r
+ @param[in] OtherCerts Pointer to an optional additional set of certificates to\r
+ include in the PKCS#7 signedData (e.g. any intermediate\r
+ CAs in the chain).\r
+ @param[out] SignedData Pointer to output PKCS#7 signedData.\r
+ @param[out] SignedDataSize Size of SignedData in bytes.\r
+\r
+ @retval TRUE PKCS#7 data signing succeeded.\r
+ @retval FALSE PKCS#7 data signing failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7Sign (\r
+ IN CONST UINT8 *PrivateKey,\r
+ IN UINTN PrivateKeySize,\r
+ IN CONST UINT8 *KeyPassword,\r
+ IN UINT8 *InData,\r
+ IN UINTN InDataSize,\r
+ IN UINT8 *SignCert,\r
+ IN UINT8 *OtherCerts OPTIONAL,\r
+ OUT UINT8 **SignedData,\r
+ OUT UINTN *SignedDataSize\r
+ );\r
+\r
/**\r
Verifies the validility of a PKCS#7 signed data as described in "PKCS #7: Cryptographic\r
Message Syntax Standard".\r
IN UINTN DataSize\r
);\r
\r
+/**\r
+ Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows\r
+ Authenticode Portable Executable Signature Format".\r
+\r
+ If AuthData is NULL, then ASSERT().\r
+ If ImageHash is NULL, then ASSERT().\r
+\r
+ @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed\r
+ PE/COFF image to be verified.\r
+ @param[in] DataSize Size of the Authenticode Signature in bytes.\r
+ @param[in] TrustedCert Pointer to a trusted/root certificate encoded in DER, which\r
+ is used for certificate chain verification.\r
+ @param[in] CertSize Size of the trusted certificate in bytes.\r
+ @param[in] ImageHash Pointer to the original image file hash value. The procudure\r
+ for calculating the image hash value is described in Authenticode\r
+ specification.\r
+ @param[in] HashSize Size of Image hash value in bytes.\r
+\r
+ @retval TRUE The specified Authenticode Signature is valid.\r
+ @retval FALSE Invalid Authenticode Signature.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+AuthenticodeVerify (\r
+ IN CONST UINT8 *AuthData,\r
+ IN UINTN DataSize,\r
+ IN CONST UINT8 *TrustedCert,\r
+ IN UINTN CertSize,\r
+ IN CONST UINT8 *ImageHash,\r
+ IN UINTN HashSize\r
+ );\r
+\r
//=====================================================================================\r
// DH Key Exchange Primitive\r
//=====================================================================================\r
projects / mirror_edk2.git / blobdiff