primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
functionality enabling.\r
\r
-Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>\r
SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
///\r
#define SHA512_DIGEST_SIZE 64\r
\r
+///\r
+/// SM3 digest size in bytes\r
+///\r
+#define SM3_256_DIGEST_SIZE 32\r
+\r
///\r
/// TDES block size in bytes\r
///\r
OUT UINT8 *HashValue\r
);\r
\r
+/**\r
+ Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.\r
+\r
+ @return The size, in bytes, of the context buffer required for SM3 hash operations.\r
+\r
+**/\r
+UINTN\r
+EFIAPI\r
+Sm3GetContextSize (\r
+ VOID\r
+ );\r
+\r
+/**\r
+ Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for\r
+ subsequent use.\r
+\r
+ If Sm3Context is NULL, then return FALSE.\r
+\r
+ @param[out] Sm3Context Pointer to SM3 context being initialized.\r
+\r
+ @retval TRUE SM3 context initialization succeeded.\r
+ @retval FALSE SM3 context initialization failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sm3Init (\r
+ OUT VOID *Sm3Context\r
+ );\r
+\r
+/**\r
+ Makes a copy of an existing SM3 context.\r
+\r
+ If Sm3Context is NULL, then return FALSE.\r
+ If NewSm3Context is NULL, then return FALSE.\r
+ If this interface is not supported, then return FALSE.\r
+\r
+ @param[in] Sm3Context Pointer to SM3 context being copied.\r
+ @param[out] NewSm3Context Pointer to new SM3 context.\r
+\r
+ @retval TRUE SM3 context copy succeeded.\r
+ @retval FALSE SM3 context copy failed.\r
+ @retval FALSE This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sm3Duplicate (\r
+ IN CONST VOID *Sm3Context,\r
+ OUT VOID *NewSm3Context\r
+ );\r
+\r
+/**\r
+ Digests the input data and updates SM3 context.\r
+\r
+ This function performs SM3 digest on a data buffer of the specified size.\r
+ It can be called multiple times to compute the digest of long or discontinuous data streams.\r
+ SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized\r
+ by Sm3Final(). Behavior with invalid context is undefined.\r
+\r
+ If Sm3Context is NULL, then return FALSE.\r
+\r
+ @param[in, out] Sm3Context Pointer to the SM3 context.\r
+ @param[in] Data Pointer to the buffer containing the data to be hashed.\r
+ @param[in] DataSize Size of Data buffer in bytes.\r
+\r
+ @retval TRUE SM3 data digest succeeded.\r
+ @retval FALSE SM3 data digest failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sm3Update (\r
+ IN OUT VOID *Sm3Context,\r
+ IN CONST VOID *Data,\r
+ IN UINTN DataSize\r
+ );\r
+\r
+/**\r
+ Completes computation of the SM3 digest value.\r
+\r
+ This function completes SM3 hash computation and retrieves the digest value into\r
+ the specified memory. After this function has been called, the SM3 context cannot\r
+ be used again.\r
+ SM3 context should be already correctly initialized by Sm3Init(), and should not be\r
+ finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.\r
+\r
+ If Sm3Context is NULL, then return FALSE.\r
+ If HashValue is NULL, then return FALSE.\r
+\r
+ @param[in, out] Sm3Context Pointer to the SM3 context.\r
+ @param[out] HashValue Pointer to a buffer that receives the SM3 digest\r
+ value (32 bytes).\r
+\r
+ @retval TRUE SM3 digest computation succeeded.\r
+ @retval FALSE SM3 digest computation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sm3Final (\r
+ IN OUT VOID *Sm3Context,\r
+ OUT UINT8 *HashValue\r
+ );\r
+\r
+/**\r
+ Computes the SM3 message digest of a input data buffer.\r
+\r
+ This function performs the SM3 message digest of a given data buffer, and places\r
+ the digest value into the specified memory.\r
+\r
+ If this interface is not supported, then return FALSE.\r
+\r
+ @param[in] Data Pointer to the buffer containing the data to be hashed.\r
+ @param[in] DataSize Size of Data buffer in bytes.\r
+ @param[out] HashValue Pointer to a buffer that receives the SM3 digest\r
+ value (32 bytes).\r
+\r
+ @retval TRUE SM3 digest computation succeeded.\r
+ @retval FALSE SM3 digest computation failed.\r
+ @retval FALSE This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sm3HashAll (\r
+ IN CONST VOID *Data,\r
+ IN UINTN DataSize,\r
+ OUT UINT8 *HashValue\r
+ );\r
+\r
//=====================================================================================\r
// MAC (Message Authentication Code) Primitive\r
//=====================================================================================\r
IN OUT UINTN *CommonNameSize\r
);\r
\r
+/**\r
+ Retrieve the organization name (O) string from one X.509 certificate.\r
+\r
+ @param[in] Cert Pointer to the DER-encoded X509 certificate.\r
+ @param[in] CertSize Size of the X509 certificate in bytes.\r
+ @param[out] NameBuffer Buffer to contain the retrieved certificate organization\r
+ name string. At most NameBufferSize bytes will be\r
+ written and the string will be null terminated. May be\r
+ NULL in order to determine the size buffer needed.\r
+ @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,\r
+ and the size of buffer returned Name on output.\r
+ If NameBuffer is NULL then the amount of space needed\r
+ in buffer (including the final null) is returned.\r
+\r
+ @retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.\r
+ @retval RETURN_INVALID_PARAMETER If Cert is NULL.\r
+ If NameBufferSize is NULL.\r
+ If NameBuffer is not NULL and *CommonNameSize is 0.\r
+ If Certificate is invalid.\r
+ @retval RETURN_NOT_FOUND If no Organization Name entry exists.\r
+ @retval RETURN_BUFFER_TOO_SMALL If the NameBuffer is NULL. The required buffer size\r
+ (including the final null) is returned in the\r
+ CommonNameSize parameter.\r
+ @retval RETURN_UNSUPPORTED The operation is not supported.\r
+\r
+**/\r
+RETURN_STATUS\r
+EFIAPI\r
+X509GetOrganizationName (\r
+ IN CONST UINT8 *Cert,\r
+ IN UINTN CertSize,\r
+ OUT CHAR8 *NameBuffer, OPTIONAL\r
+ IN OUT UINTN *NameBufferSize\r
+ );\r
+\r
/**\r
Verify one X509 certificate was issued by the trusted CA.\r
\r
OUT UINT8 *OutKey\r
);\r
\r
+/**\r
+ Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the\r
+ encrypted message in a newly allocated buffer.\r
+\r
+ Things that can cause a failure include:\r
+ - X509 key size does not match any known key size.\r
+ - Fail to parse X509 certificate.\r
+ - Fail to allocate an intermediate buffer.\r
+ - Null pointer provided for a non-optional parameter.\r
+ - Data size is too large for the provided key size (max size is a function of key size\r
+ and hash digest size).\r
+\r
+ @param[in] PublicKey A pointer to the DER-encoded X509 certificate that\r
+ will be used to encrypt the data.\r
+ @param[in] PublicKeySize Size of the X509 cert buffer.\r
+ @param[in] InData Data to be encrypted.\r
+ @param[in] InDataSize Size of the data buffer.\r
+ @param[in] PrngSeed [Optional] If provided, a pointer to a random seed buffer\r
+ to be used when initializing the PRNG. NULL otherwise.\r
+ @param[in] PrngSeedSize [Optional] If provided, size of the random seed buffer.\r
+ 0 otherwise.\r
+ @param[out] EncryptedData Pointer to an allocated buffer containing the encrypted\r
+ message.\r
+ @param[out] EncryptedDataSize Size of the encrypted message buffer.\r
+\r
+ @retval TRUE Encryption was successful.\r
+ @retval FALSE Encryption failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs1v2Encrypt (\r
+ IN CONST UINT8 *PublicKey,\r
+ IN UINTN PublicKeySize,\r
+ IN UINT8 *InData,\r
+ IN UINTN InDataSize,\r
+ IN CONST UINT8 *PrngSeed, OPTIONAL\r
+ IN UINTN PrngSeedSize, OPTIONAL\r
+ OUT UINT8 **EncryptedData,\r
+ OUT UINTN *EncryptedDataSize\r
+ );\r
+\r
/**\r
The 3rd parameter of Pkcs7GetSigners will return all embedded\r
X.509 certificate in one given PKCS7 signature. The format is:\r
IN UINTN DataLength\r
);\r
\r
+/**\r
+ This function receives a PKCS7 formatted signature, and then verifies that\r
+ the specified Enhanced or Extended Key Usages (EKU's) are present in the end-entity\r
+ leaf signing certificate.\r
+ Note that this function does not validate the certificate chain.\r
+\r
+ Applications for custom EKU's are quite flexible. For example, a policy EKU\r
+ may be present in an Issuing Certificate Authority (CA), and any sub-ordinate\r
+ certificate issued might also contain this EKU, thus constraining the\r
+ sub-ordinate certificate. Other applications might allow a certificate\r
+ embedded in a device to specify that other Object Identifiers (OIDs) are\r
+ present which contains binary data specifying custom capabilities that\r
+ the device is able to do.\r
+\r
+ @param[in] Pkcs7Signature The PKCS#7 signed information content block. An array\r
+ containing the content block with both the signature,\r
+ the signer's certificate, and any necessary intermediate\r
+ certificates.\r
+ @param[in] Pkcs7SignatureSize Number of bytes in Pkcs7Signature.\r
+ @param[in] RequiredEKUs Array of null-terminated strings listing OIDs of\r
+ required EKUs that must be present in the signature.\r
+ @param[in] RequiredEKUsSize Number of elements in the RequiredEKUs string array.\r
+ @param[in] RequireAllPresent If this is TRUE, then all of the specified EKU's\r
+ must be present in the leaf signer. If it is\r
+ FALSE, then we will succeed if we find any\r
+ of the specified EKU's.\r
+\r
+ @retval EFI_SUCCESS The required EKUs were found in the signature.\r
+ @retval EFI_INVALID_PARAMETER A parameter was invalid.\r
+ @retval EFI_NOT_FOUND One or more EKU's were not found in the signature.\r
+\r
+**/\r
+RETURN_STATUS\r
+EFIAPI\r
+VerifyEKUsInPkcs7Signature (\r
+ IN CONST UINT8 *Pkcs7Signature,\r
+ IN CONST UINT32 SignatureSize,\r
+ IN CONST CHAR8 *RequiredEKUs[],\r
+ IN CONST UINT32 RequiredEKUsSize,\r
+ IN BOOLEAN RequireAllPresent\r
+ );\r
+\r
/**\r
Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
data could be wrapped in a ContentInfo structure.\r
IN UINTN Size\r
);\r
\r
+//=====================================================================================\r
+// Key Derivation Function Primitive\r
+//=====================================================================================\r
+\r
+/**\r
+ Derive key data using HMAC-SHA256 based KDF.\r
+\r
+ @param[in] Key Pointer to the user-supplied key.\r
+ @param[in] KeySize Key size in bytes.\r
+ @param[in] Salt Pointer to the salt(non-secret) value.\r
+ @param[in] SaltSize Salt size in bytes.\r
+ @param[in] Info Pointer to the application specific info.\r
+ @param[in] InfoSize Info size in bytes.\r
+ @param[out] Out Pointer to buffer to receive hkdf value.\r
+ @param[in] OutSize Size of hkdf bytes to generate.\r
+\r
+ @retval TRUE Hkdf generated successfully.\r
+ @retval FALSE Hkdf generation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+HkdfSha256ExtractAndExpand (\r
+ IN CONST UINT8 *Key,\r
+ IN UINTN KeySize,\r
+ IN CONST UINT8 *Salt,\r
+ IN UINTN SaltSize,\r
+ IN CONST UINT8 *Info,\r
+ IN UINTN InfoSize,\r
+ OUT UINT8 *Out,\r
+ IN UINTN OutSize\r
+ );\r
+\r
#endif // __BASE_CRYPT_LIB_H__\r
projects / mirror_edk2.git / blobdiff