primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
functionality enabling.\r
\r
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>\r
SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
OUT UINT8 *OutKey\r
);\r
\r
+/**\r
+ Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the\r
+ encrypted message in a newly allocated buffer.\r
+\r
+ Things that can cause a failure include:\r
+ - X509 key size does not match any known key size.\r
+ - Fail to parse X509 certificate.\r
+ - Fail to allocate an intermediate buffer.\r
+ - Null pointer provided for a non-optional parameter.\r
+ - Data size is too large for the provided key size (max size is a function of key size\r
+ and hash digest size).\r
+\r
+ @param[in] PublicKey A pointer to the DER-encoded X509 certificate that\r
+ will be used to encrypt the data.\r
+ @param[in] PublicKeySize Size of the X509 cert buffer.\r
+ @param[in] InData Data to be encrypted.\r
+ @param[in] InDataSize Size of the data buffer.\r
+ @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer\r
+ to be used when initializing the PRNG. NULL otherwise.\r
+ @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.\r
+ 0 otherwise.\r
+ @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted\r
+ message.\r
+ @param[out] EncryptedDataSize Size of the encrypted message buffer.\r
+\r
+ @retval TRUE Encryption was successful.\r
+ @retval FALSE Encryption failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs1v2Encrypt (\r
+ IN CONST UINT8 *PublicKey,\r
+ IN UINTN PublicKeySize,\r
+ IN UINT8 *InData,\r
+ IN UINTN InDataSize,\r
+ IN CONST UINT8 *PrngSeed, OPTIONAL\r
+ IN UINTN PrngSeedSize, OPTIONAL\r
+ OUT UINT8 **EncryptedData,\r
+ OUT UINTN *EncryptedDataSize\r
+ );\r
+\r
/**\r
The 3rd parameter of Pkcs7GetSigners will return all embedded\r
X.509 certificate in one given PKCS7 signature. The format is:\r
IN UINTN DataLength\r
);\r
\r
+/**\r
+ This function receives a PKCS7 formatted signature, and then verifies that\r
+ the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity\r
+ leaf signing certificate.\r
+ Note that this function does not validate the certificate chain.\r
+\r
+ Applications for custom EKU's are quite flexible. For example, a policy EKU\r
+ may be present in an Issuing Certificate Authority (CA), and any sub-ordinate\r
+ certificate issued might also contain this EKU, thus constraining the\r
+ sub-ordinate certificate. Other applications might allow a certificate\r
+ embedded in a device to specify that other Object Identifiers (OIDs) are\r
+ present which contains binary data specifying custom capabilities that\r
+ the device is able to do.\r
+\r
+ @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array\r
+ containing the content block with both the signature,\r
+ the signer's certificate, and any necessary intermediate\r
+ certificates.\r
+ @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.\r
+ @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of\r
+ required EKUs that must be present in the signature.\r
+ @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.\r
+ @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's\r
+ must be present in the leaf signer. If it is\r
+ FALSE, then we will succeed if we find any\r
+ of the specified EKU's.\r
+\r
+ @retval EFI_SUCCESS The required EKUs were found in the signature.\r
+ @retval EFI_INVALID_PARAMETER A parameter was invalid.\r
+ @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
+\r
+**/\r
+RETURN_STATUS\r
+EFIAPI\r
+VerifyEKUsInPkcs7Signature (\r
+ IN CONST UINT8 *Pkcs7Signature,\r
+ IN CONST UINT32 SignatureSize,\r
+ IN CONST CHAR8 *RequiredEKUs[],\r
+ IN CONST UINT32 RequiredEKUsSize,\r
+ IN BOOLEAN RequireAllPresent\r
+ );\r
+\r
/**\r
Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
data could be wrapped in a ContentInfo structure.\r