primitives (Hash Serials, HMAC, RSA, Diffie-Hellman, etc) for UEFI security\r
functionality enabling.\r
\r
-Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
///\r
#define SHA256_DIGEST_SIZE 32\r
\r
+///\r
+/// SHA-384 digest size in bytes\r
+///\r
+#define SHA384_DIGEST_SIZE 48\r
+\r
+///\r
+/// SHA-512 digest size in bytes\r
+///\r
+#define SHA512_DIGEST_SIZE 64\r
+\r
///\r
/// TDES block size in bytes\r
///\r
OUT UINT8 *HashValue\r
);\r
\r
+/**\r
+ Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.\r
+\r
+ @return The size, in bytes, of the context buffer required for SHA-384 hash operations.\r
+\r
+**/\r
+UINTN\r
+EFIAPI\r
+Sha384GetContextSize (\r
+ VOID\r
+ );\r
+\r
+/**\r
+ Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for\r
+ subsequent use.\r
+\r
+ If Sha384Context is NULL, then return FALSE.\r
+\r
+ @param[out] Sha384Context Pointer to SHA-384 context being initialized.\r
+\r
+ @retval TRUE SHA-384 context initialization succeeded.\r
+ @retval FALSE SHA-384 context initialization failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha384Init (\r
+ OUT VOID *Sha384Context\r
+ );\r
+\r
+/**\r
+ Makes a copy of an existing SHA-384 context.\r
+\r
+ If Sha384Context is NULL, then return FALSE.\r
+ If NewSha384Context is NULL, then return FALSE.\r
+ If this interface is not supported, then return FALSE.\r
+\r
+ @param[in] Sha384Context Pointer to SHA-384 context being copied.\r
+ @param[out] NewSha384Context Pointer to new SHA-384 context.\r
+\r
+ @retval TRUE SHA-384 context copy succeeded.\r
+ @retval FALSE SHA-384 context copy failed.\r
+ @retval FALSE This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha384Duplicate (\r
+ IN CONST VOID *Sha384Context,\r
+ OUT VOID *NewSha384Context\r
+ );\r
+\r
+/**\r
+ Digests the input data and updates SHA-384 context.\r
+\r
+ This function performs SHA-384 digest on a data buffer of the specified size.\r
+ It can be called multiple times to compute the digest of long or discontinuous data streams.\r
+ SHA-384 context should be already correctly intialized by Sha384Init(), and should not be finalized\r
+ by Sha384Final(). Behavior with invalid context is undefined.\r
+\r
+ If Sha384Context is NULL, then return FALSE.\r
+\r
+ @param[in, out] Sha384Context Pointer to the SHA-384 context.\r
+ @param[in] Data Pointer to the buffer containing the data to be hashed.\r
+ @param[in] DataSize Size of Data buffer in bytes.\r
+\r
+ @retval TRUE SHA-384 data digest succeeded.\r
+ @retval FALSE SHA-384 data digest failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha384Update (\r
+ IN OUT VOID *Sha384Context,\r
+ IN CONST VOID *Data,\r
+ IN UINTN DataSize\r
+ );\r
+\r
+/**\r
+ Completes computation of the SHA-384 digest value.\r
+\r
+ This function completes SHA-384 hash computation and retrieves the digest value into\r
+ the specified memory. After this function has been called, the SHA-384 context cannot\r
+ be used again.\r
+ SHA-384 context should be already correctly intialized by Sha384Init(), and should not be\r
+ finalized by Sha384Final(). Behavior with invalid SHA-384 context is undefined.\r
+\r
+ If Sha384Context is NULL, then return FALSE.\r
+ If HashValue is NULL, then return FALSE.\r
+\r
+ @param[in, out] Sha384Context Pointer to the SHA-384 context.\r
+ @param[out] HashValue Pointer to a buffer that receives the SHA-384 digest\r
+ value (48 bytes).\r
+\r
+ @retval TRUE SHA-384 digest computation succeeded.\r
+ @retval FALSE SHA-384 digest computation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha384Final (\r
+ IN OUT VOID *Sha384Context,\r
+ OUT UINT8 *HashValue\r
+ );\r
+\r
+/**\r
+ Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.\r
+\r
+ @return The size, in bytes, of the context buffer required for SHA-512 hash operations.\r
+\r
+**/\r
+UINTN\r
+EFIAPI\r
+Sha512GetContextSize (\r
+ VOID\r
+ );\r
+\r
+/**\r
+ Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for\r
+ subsequent use.\r
+\r
+ If Sha512Context is NULL, then return FALSE.\r
+\r
+ @param[out] Sha512Context Pointer to SHA-512 context being initialized.\r
+\r
+ @retval TRUE SHA-512 context initialization succeeded.\r
+ @retval FALSE SHA-512 context initialization failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha512Init (\r
+ OUT VOID *Sha512Context\r
+ );\r
+\r
+/**\r
+ Makes a copy of an existing SHA-512 context.\r
+\r
+ If Sha512Context is NULL, then return FALSE.\r
+ If NewSha512Context is NULL, then return FALSE.\r
+ If this interface is not supported, then return FALSE.\r
+\r
+ @param[in] Sha512Context Pointer to SHA-512 context being copied.\r
+ @param[out] NewSha512Context Pointer to new SHA-512 context.\r
+\r
+ @retval TRUE SHA-512 context copy succeeded.\r
+ @retval FALSE SHA-512 context copy failed.\r
+ @retval FALSE This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha512Duplicate (\r
+ IN CONST VOID *Sha512Context,\r
+ OUT VOID *NewSha512Context\r
+ );\r
+\r
+/**\r
+ Digests the input data and updates SHA-512 context.\r
+\r
+ This function performs SHA-512 digest on a data buffer of the specified size.\r
+ It can be called multiple times to compute the digest of long or discontinuous data streams.\r
+ SHA-512 context should be already correctly intialized by Sha512Init(), and should not be finalized\r
+ by Sha512Final(). Behavior with invalid context is undefined.\r
+\r
+ If Sha512Context is NULL, then return FALSE.\r
+\r
+ @param[in, out] Sha512Context Pointer to the SHA-512 context.\r
+ @param[in] Data Pointer to the buffer containing the data to be hashed.\r
+ @param[in] DataSize Size of Data buffer in bytes.\r
+\r
+ @retval TRUE SHA-512 data digest succeeded.\r
+ @retval FALSE SHA-512 data digest failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha512Update (\r
+ IN OUT VOID *Sha512Context,\r
+ IN CONST VOID *Data,\r
+ IN UINTN DataSize\r
+ );\r
+\r
+/**\r
+ Completes computation of the SHA-512 digest value.\r
+\r
+ This function completes SHA-512 hash computation and retrieves the digest value into\r
+ the specified memory. After this function has been called, the SHA-512 context cannot\r
+ be used again.\r
+ SHA-512 context should be already correctly intialized by Sha512Init(), and should not be\r
+ finalized by Sha512Final(). Behavior with invalid SHA-512 context is undefined.\r
+\r
+ If Sha512Context is NULL, then return FALSE.\r
+ If HashValue is NULL, then return FALSE.\r
+\r
+ @param[in, out] Sha512Context Pointer to the SHA-512 context.\r
+ @param[out] HashValue Pointer to a buffer that receives the SHA-512 digest\r
+ value (64 bytes).\r
+\r
+ @retval TRUE SHA-512 digest computation succeeded.\r
+ @retval FALSE SHA-512 digest computation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Sha512Final (\r
+ IN OUT VOID *Sha512Context,\r
+ OUT UINT8 *HashValue\r
+ );\r
\r
//=====================================================================================\r
// MAC (Message Authentication Code) Primitive\r
OUT UINT8 *HmacValue\r
);\r
\r
-\r
//=====================================================================================\r
// Symmetric Cryptography Primitive\r
//=====================================================================================\r
Initializes user-supplied memory as TDES context for subsequent use.\r
\r
This function initializes user-supplied memory pointed by TdesContext as TDES context.\r
- In addtion, it sets up all TDES key materials for subsequent encryption and decryption\r
+ In addition, it sets up all TDES key materials for subsequent encryption and decryption\r
operations.\r
There are 3 key options as follows:\r
KeyLength = 64, Keying option 1: K1 == K2 == K3 (Backward compatibility with DES)\r
Initializes user-supplied memory as AES context for subsequent use.\r
\r
This function initializes user-supplied memory pointed by AesContext as AES context.\r
- In addtion, it sets up all AES key materials for subsequent encryption and decryption\r
+ In addition, it sets up all AES key materials for subsequent encryption and decryption\r
operations.\r
There are 3 options for key length, 128 bits, 192 bits, and 256 bits.\r
\r
Initializes user-supplied memory as ARC4 context for subsequent use.\r
\r
This function initializes user-supplied memory pointed by Arc4Context as ARC4 context.\r
- In addtion, it sets up all ARC4 key materials for subsequent encryption and decryption\r
+ In addition, it sets up all ARC4 key materials for subsequent encryption and decryption\r
operations.\r
\r
If Arc4Context is NULL, then return FALSE.\r
@param[in, out] RsaContext Pointer to RSA context being set.\r
@param[in] ModulusLength Length of RSA modulus N in bits.\r
@param[in] PublicExponent Pointer to RSA public exponent.\r
- @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes. \r
+ @param[in] PublicExponentSize Size of RSA public exponent buffer in bytes.\r
\r
@retval TRUE RSA key component was generated successfully.\r
@retval FALSE Invalid RSA key component tag.\r
\r
/**\r
Validates key components of RSA context.\r
+ NOTE: This function performs integrity checks on all the RSA key material, so\r
+ the RSA key structure must contain all the private key data.\r
\r
This function validates key compoents of RSA context in following aspects:\r
- Whether p is a prime\r
IN VOID *RsaContext,\r
IN CONST UINT8 *MessageHash,\r
IN UINTN HashSize,\r
- IN UINT8 *Signature,\r
+ IN CONST UINT8 *Signature,\r
IN UINTN SigSize\r
);\r
\r
@retval TRUE RSA Private Key was retrieved successfully.\r
@retval FALSE Invalid PEM key data or incorrect password.\r
@retval FALSE This interface is not supported.\r
- \r
\r
**/\r
BOOLEAN\r
If X509Stack is NULL, then return FALSE.\r
If this interface is not supported, then return FALSE.\r
\r
- @param[in, out] X509Stack On input, pointer to an existing X509 stack object.\r
+ @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.\r
On output, pointer to the X509 stack object with new\r
inserted X509 certificate.\r
@param ... A list of DER-encoded single certificate data followed\r
by certificate size. A NULL terminates the list. The\r
pairs are the arguments to X509ConstructCertificate().\r
- \r
+\r
@retval TRUE The X509 stack construction succeeded.\r
@retval FALSE The construction operation failed.\r
@retval FALSE This interface is not supported.\r
EFIAPI\r
X509ConstructCertificateStack (\r
IN OUT UINT8 **X509Stack,\r
- ... \r
+ ...\r
);\r
\r
/**\r
IN VOID *X509Stack\r
);\r
\r
+/**\r
+ Retrieve the TBSCertificate from one given X.509 certificate.\r
+\r
+ @param[in] Cert Pointer to the given DER-encoded X509 certificate.\r
+ @param[in] CertSize Size of the X509 certificate in bytes.\r
+ @param[out] TBSCert DER-Encoded To-Be-Signed certificate.\r
+ @param[out] TBSCertSize Size of the TBS certificate in bytes.\r
+\r
+ If Cert is NULL, then return FALSE.\r
+ If TBSCert is NULL, then return FALSE.\r
+ If TBSCertSize is NULL, then return FALSE.\r
+ If this interface is not supported, then return FALSE.\r
+\r
+ @retval TRUE The TBSCertificate was retrieved successfully.\r
+ @retval FALSE Invalid X.509 certificate.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+X509GetTBSCert (\r
+ IN CONST UINT8 *Cert,\r
+ IN UINTN CertSize,\r
+ OUT UINT8 **TBSCert,\r
+ OUT UINTN *TBSCertSize\r
+ );\r
+\r
/**\r
Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:\r
Cryptographic Message Syntax Standard". The input signed data could be wrapped\r
IN UINTN DataLength\r
);\r
\r
+/**\r
+ Extracts the attached content from a PKCS#7 signed data if existed. The input signed\r
+ data could be wrapped in a ContentInfo structure.\r
+\r
+ If P7Data, Content, or ContentSize is NULL, then return FALSE. If P7Length overflow,\r
+ then return FAlSE. If the P7Data is not correctly formatted, then return FALSE.\r
+\r
+ Caution: This function may receive untrusted input. So this function will do\r
+ basic check for PKCS#7 data structure.\r
+\r
+ @param[in] P7Data Pointer to the PKCS#7 signed data to process.\r
+ @param[in] P7Length Length of the PKCS#7 signed data in bytes.\r
+ @param[out] Content Pointer to the extracted content from the PKCS#7 signedData.\r
+ It's caller's responsiblity to free the buffer.\r
+ @param[out] ContentSize The size of the extracted content in bytes.\r
+\r
+ @retval TRUE The P7Data was correctly formatted for processing.\r
+ @retval FALSE The P7Data was not correctly formatted for processing.\r
+\r
+*/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs7GetAttachedContent (\r
+ IN CONST UINT8 *P7Data,\r
+ IN UINTN P7Length,\r
+ OUT VOID **Content,\r
+ OUT UINTN *ContentSize\r
+ );\r
+\r
/**\r
Verifies the validility of a PE/COFF Authenticode Signature as described in "Windows\r
Authenticode Portable Executable Signature Format".\r
IN UINTN HashSize\r
);\r
\r
+/**\r
+ Verifies the validility of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode\r
+ signature.\r
+\r
+ If AuthData is NULL, then return FALSE.\r
+ If this interface is not supported, then return FALSE.\r
+\r
+ @param[in] AuthData Pointer to the Authenticode Signature retrieved from signed\r
+ PE/COFF image to be verified.\r
+ @param[in] DataSize Size of the Authenticode Signature in bytes.\r
+ @param[in] TsaCert Pointer to a trusted/root TSA certificate encoded in DER, which\r
+ is used for TSA certificate chain verification.\r
+ @param[in] CertSize Size of the trusted certificate in bytes.\r
+ @param[out] SigningTime Return the time of timestamp generation time if the timestamp\r
+ signature is valid.\r
+\r
+ @retval TRUE The specified Authenticode includes a valid RFC3161 Timestamp CounterSignature.\r
+ @retval FALSE No valid RFC3161 Timestamp CounterSignature in the specified Authenticode data.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+ImageTimestampVerify (\r
+ IN CONST UINT8 *AuthData,\r
+ IN UINTN DataSize,\r
+ IN CONST UINT8 *TsaCert,\r
+ IN UINTN CertSize,\r
+ OUT EFI_TIME *SigningTime\r
+ );\r
+\r
//=====================================================================================\r
// DH Key Exchange Primitive\r
//=====================================================================================\r
\r
Given generator g, and length of prime number p in bits, this function generates p,\r
and sets DH context according to value of g and p.\r
- \r
+\r
Before this function can be invoked, pseudorandom number generator must be correctly\r
initialized by RandomSeed().\r
\r
/**\r
Generates DH public key.\r
\r
- This function generates random secret exponent, and computes the public key, which is \r
+ This function generates random secret exponent, and computes the public key, which is\r
returned via parameter PublicKey and PublicKeySize. DH context is updated accordingly.\r
If the PublicKey buffer is too small to hold the public key, FALSE is returned and\r
PublicKeySize is set to the required buffer size to obtain the public key.\r
Computes exchanged common key.\r
\r
Given peer's public key, this function computes the exchanged common key, based on its own\r
- context including value of prime modulus and random secret exponent. \r
+ context including value of prime modulus and random secret exponent.\r
\r
If DhContext is NULL, then return FALSE.\r
If PeerPublicKey is NULL, then return FALSE.\r
If KeySize is NULL, then return FALSE.\r
- If KeySize is large enough but Key is NULL, then return FALSE.\r
+ If Key is NULL, then return FALSE.\r
+ If KeySize is not large enough, then return FALSE.\r
If this interface is not supported, then return FALSE.\r
\r
@param[in, out] DhContext Pointer to the DH context.\r
projects / mirror_edk2.git / blobdiff