/** @file\r
Common interfaces to call Security library.\r
\r
- Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
+ Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>\r
\r
- This program and the accompanying materials\r
- are licensed and made available under the terms and conditions of the BSD License\r
- which accompanies this distribution. The full text of the license may be found at\r
- http://opensource.org/licenses/bsd-license.php.\r
-\r
- THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
- WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+ SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
//\r
GLOBAL_REMOVE_IF_UNREFERENCED ENCRYPT_ALGORITHM mIpsecEncryptAlgorithmList[IPSEC_ENCRYPT_ALGORITHM_LIST_SIZE] = {\r
{IKE_EALG_NULL, 0, 0, 1, NULL, NULL, NULL, NULL},\r
- {IKE_EALG_NONE, 0, 0, 1, NULL, NULL, NULL, NULL}, \r
+ {IKE_EALG_NONE, 0, 0, 1, NULL, NULL, NULL, NULL},\r
{IKE_EALG_3DESCBC, 24, 8, 8, TdesGetContextSize, TdesInit, TdesCbcEncrypt, TdesCbcDecrypt},\r
{IKE_EALG_AESCBC, 16, 16, 16, AesGetContextSize, AesInit, AesCbcEncrypt, AesCbcDecrypt}\r
};\r
BOOLEAN mInitialRandomSeed = FALSE;\r
\r
/**\r
- Get the block size of specified encryption alogrithm.\r
+ Get the block size of specified encryption algorithm.\r
\r
@param[in] AlgorithmId The encryption algorithm ID.\r
\r
}\r
\r
/**\r
- Get the key length of the specified encryption alogrithm.\r
+ Get the key length of the specified encryption algorithm.\r
\r
@param[in] AlgorithmId The encryption algorithm ID.\r
\r
}\r
\r
/**\r
- Get the IV size of the specified encryption alogrithm.\r
+ Get the IV size of the specified encryption algorithm.\r
\r
@param[in] AlgorithmId The encryption algorithm ID.\r
\r
}\r
\r
/**\r
- Get the ICV size of the specified Authenticaion alogrithm.\r
+ Get the ICV size of the specified Authenticaion algorithm.\r
\r
@param[in] AlgorithmId The Authentication algorithm ID.\r
\r
if (IvSize != 0) {\r
return IpSecCryptoIoGenerateRandomBytes (IvBuffer, IvSize);\r
}\r
- \r
+\r
return EFI_SUCCESS;\r
}\r
\r
/**\r
- Get index of the specified encryption alogrithm from the mIpsecEncryptAlgorithemList.\r
+ Get index of the specified encryption algorithm from the mIpsecEncryptAlgorithmList.\r
\r
@param[in] AlgorithmId The encryption algorithm ID.\r
\r
@return the index.\r
- \r
+\r
**/\r
UINTN\r
IpSecGetIndexFromEncList (\r
)\r
{\r
UINT8 Index;\r
- \r
+\r
for (Index = 0; Index < IPSEC_ENCRYPT_ALGORITHM_LIST_SIZE; Index++) {\r
if (AlgorithmId == mIpsecEncryptAlgorithmList[Index].AlgorithmId) {\r
return Index;\r
}\r
}\r
- \r
+\r
return (UINTN) -1;\r
}\r
\r
/**\r
- Get index of the specified encryption alogrithm from the mIpsecAuthAlgorithemList.\r
+ Get index of the specified encryption algorithm from the mIpsecAuthAlgorithmList.\r
\r
@param[in] AlgorithmId The encryption algorithm ID.\r
\r
@return the index.\r
- \r
+\r
**/\r
UINTN\r
IpSecGetIndexFromAuthList (\r
)\r
{\r
UINT8 Index;\r
- \r
+\r
for (Index = 0; Index < IPSEC_AUTH_ALGORITHM_LIST_SIZE; Index++) {\r
if (AlgorithmId == mIpsecAuthAlgorithmList[Index].AlgorithmId) {\r
//\r
return Index;\r
}\r
}\r
- \r
+\r
return (UINTN) -1;\r
}\r
\r
Encrypt the buffer.\r
\r
This function calls relevant encryption interface from CryptoLib according to\r
- the input alogrithm ID. The InData should be multiple of block size. This function\r
+ the input algorithm ID. The InData should be multiple of block size. This function\r
doesn't perform the padding. If it has the Ivec data, the length of it should be\r
same with the block size. The block size is different from the different algorithm.\r
\r
- @param[in] AlgorithmId The Alogrithem identification defined in RFC.\r
+ @param[in] AlgorithmId The Algorithm identification defined in RFC.\r
@param[in] Key Pointer to the buffer containing encrypting key.\r
@param[in] KeyBits The length of the key in bits.\r
- @param[in] Ivec Point to the buffer containning the Initializeion\r
+ @param[in] Ivec Point to the buffer containing the Initialization\r
Vector (IV) data.\r
@param[in] InData Point to the buffer containing the data to be\r
encrypted.\r
IN UINTN InDataLength,\r
OUT UINT8 *OutData\r
)\r
-{ \r
+{\r
UINTN Index;\r
UINTN ContextSize;\r
UINT8 *Context;\r
EFI_STATUS Status;\r
- \r
+\r
Status = EFI_UNSUPPORTED;\r
- \r
+\r
switch (AlgorithmId) {\r
\r
case IKE_EALG_NULL:\r
if (Context != NULL) {\r
FreePool (Context);\r
}\r
- \r
+\r
return Status;\r
}\r
\r
Decrypts the buffer.\r
\r
This function calls relevant Decryption interface from CryptoLib according to\r
- the input alogrithm ID. The InData should be multiple of block size. This function\r
+ the input algorithm ID. The InData should be multiple of block size. This function\r
doesn't perform the padding. If it has the Ivec data, the length of it should be\r
same with the block size. The block size is different from the different algorithm.\r
\r
- @param[in] AlgorithmId The Alogrithem identification defined in RFC.\r
+ @param[in] AlgorithmId The Algorithm identification defined in RFC.\r
@param[in] Key Pointer to the buffer containing encrypting key.\r
@param[in] KeyBits The length of the key in bits.\r
- @param[in] Ivec Point to the buffer containning the Initializeion\r
+ @param[in] Ivec Point to the buffer containing the Initialization\r
Vector (IV) data.\r
@param[in] InData Point to the buffer containing the data to be\r
decrypted.\r
IN UINTN InDataLength,\r
OUT UINT8 *OutData\r
)\r
-{ \r
+{\r
UINTN Index;\r
UINTN ContextSize;\r
UINT8 *Context;\r
//\r
if (mIpsecEncryptAlgorithmList[Index].CipherInitiate (Context, Key, KeyBits)) {\r
if (mIpsecEncryptAlgorithmList[Index].CipherDecrypt (Context, InData, InDataLength, Ivec, OutData)) {\r
- Status = EFI_SUCCESS; \r
+ Status = EFI_SUCCESS;\r
}\r
}\r
break;\r
Digests the Payload with key and store the result into the OutData.\r
\r
This function calls relevant Hmac interface from CryptoLib according to\r
- the input alogrithm ID. It computes all datas from InDataFragment and output\r
+ the input algorithm ID. It computes all datas from InDataFragment and output\r
the result into the OutData buffer. If the OutDataSize is larger than the related\r
- HMAC alogrithm output size, return EFI_INVALID_PARAMETER.\r
- \r
+ HMAC algorithm output size, return EFI_INVALID_PARAMETER.\r
+\r
@param[in] AlgorithmId The authentication Identification.\r
@param[in] Key Pointer of the authentication key.\r
@param[in] KeyLength The length of the Key in bytes.\r
}\r
\r
goto Exit;\r
- } \r
- \r
+ }\r
+\r
default:\r
return Status;\r
}\r
Digests the Payload and store the result into the OutData.\r
\r
This function calls relevant Hash interface from CryptoLib according to\r
- the input alogrithm ID. It computes all datas from InDataFragment and output\r
+ the input algorithm ID. It computes all datas from InDataFragment and output\r
the result into the OutData buffer. If the OutDataSize is larger than the related\r
- Hash alogrithm output size, return EFI_INVALID_PARAMETER.\r
+ Hash algorithm output size, return EFI_INVALID_PARAMETER.\r
\r
@param[in] AlgorithmId The authentication Identification.\r
@param[in] InDataFragment A list contains all data to be authenticated.\r
\r
Status = EFI_UNSUPPORTED;\r
OutHashData = NULL;\r
- \r
+\r
OutHashSize = IpSecGetHmacDigestLength (AlgorithmId);\r
//\r
// If the expected hash data size is larger than the related Hash algorithm\r
- // output length, return EFI_INVALID_PARAMETER. \r
+ // output length, return EFI_INVALID_PARAMETER.\r
//\r
if (OutDataSize > OutHashSize) {\r
return EFI_INVALID_PARAMETER;\r
if (OutHashData == NULL) {\r
return EFI_OUT_OF_RESOURCES;\r
}\r
- \r
+\r
switch (AlgorithmId) {\r
\r
case IKE_AALG_NONE:\r
Status = EFI_OUT_OF_RESOURCES;\r
goto Exit;\r
}\r
- \r
+\r
//\r
// Initiate Hash context and hash the input data.\r
//\r
// In some cases, like the Icv computing, the Icv size might be less than\r
// the key length size, so copy the part of hash data to the OutData.\r
//\r
- CopyMem (OutData, OutHashData, OutDataSize); \r
+ CopyMem (OutData, OutHashData, OutDataSize);\r
Status = EFI_SUCCESS;\r
}\r
- \r
- goto Exit; \r
- } \r
- \r
+\r
+ goto Exit;\r
+ }\r
+\r
default:\r
return Status;\r
}\r
Generates the Diffie-Hellman public key.\r
\r
This function first initiate a DHContext, then call the DhSetParameter() to set\r
- the prime and primelenght, at end call the DhGenerateKey() to generates random\r
+ the prime and primelength, at end call the DhGenerateKey() to generates random\r
secret exponent, and computes the public key. The output returned via parameter\r
PublicKey and PublicKeySize. DH context is updated accordingly. If the PublicKey\r
buffer is too small to hold the public key, EFI_INVALID_PARAMETER is returned\r
and PublicKeySize is set to the required buffer size to obtain the public key.\r
\r
@param[in, out] DhContext Pointer to the DH context.\r
- @param[in] Generator Vlaue of generator.\r
+ @param[in] Generator Value of generator.\r
@param[in] PrimeLength Length in bits of prime to be generated.\r
@param[in] Prime Pointer to the buffer to receive the generated\r
prime number.\r
For out, the size of data returned in PublicKey\r
buffer in bytes.\r
\r
- @retval EFI_SUCCESS The operation perfoms successfully.\r
+ @retval EFI_SUCCESS The operation performs successfully.\r
@retval Otherwise The operation is failed.\r
\r
**/\r
IN CONST UINT8 *Prime,\r
OUT UINT8 *PublicKey,\r
IN OUT UINTN *PublicKeySize\r
- ) \r
+ )\r
{\r
EFI_STATUS Status;\r
- \r
+\r
*DhContext = DhNew ();\r
ASSERT (*DhContext != NULL);\r
if (!DhSetParameter (*DhContext, Generator, PrimeLength, Prime)) {\r
DhFree (*DhContext);\r
DhContext = NULL;\r
}\r
- \r
+\r
return Status;\r
}\r
\r
For out, the size of data returned in Key\r
buffer in bytes.\r
\r
- @retval EFI_SUCCESS The operation perfoms successfully.\r
+ @retval EFI_SUCCESS The operation performs successfully.\r
@retval Otherwise The operation is failed.\r
\r
**/\r
EFI_STATUS\r
IpSecCryptoIoDhComputeKey (\r
- IN OUT UINT8 *DhContext, \r
+ IN OUT UINT8 *DhContext,\r
IN CONST UINT8 *PeerPublicKey,\r
IN UINTN PeerPublicKeySize,\r
OUT UINT8 *Key,\r
\r
@param[in, out] DhContext Pointer to the DH context to be freed.\r
\r
- @retval EFI_SUCCESS The operation perfoms successfully.\r
+ @retval EFI_SUCCESS The operation performs successfully.\r
@retval EFI_INVALID_PARAMETER The DhContext is NULL.\r
- \r
+\r
**/\r
EFI_STATUS\r
IpSecCryptoIoFreeDh (\r
IN OUT UINT8 **DhContext\r
)\r
-{ \r
+{\r
if (*DhContext == NULL) {\r
return EFI_INVALID_PARAMETER;\r
}\r
If the Random Generator wasn't initiated, initiate it first, then call RandomBytes.\r
\r
@param[out] OutBuffer Pointer to buffer to receive random value.\r
- @param[in] Bytes Size of randome bytes to generate.\r
+ @param[in] Bytes Size of random bytes to generate.\r
\r
- @retval EFI_SUCCESS The operation perfoms successfully.\r
+ @retval EFI_SUCCESS The operation performs successfully.\r
@retval Otherwise The operation is failed.\r
\r
**/\r
@param[in] KeyPwdSize The size of Key Password in bytes.\r
@param[out] OutData The pointer to the signed data.\r
@param[in, out] OutDataSize Pointer to contain the size of out data.\r
- \r
+\r
**/\r
VOID\r
IpSecCryptoIoAuthDataWithCertificate (\r
UINT8 *RsaContext;\r
UINT8 *Signature;\r
UINTN SigSize;\r
- \r
+\r
SigSize = 0;\r
RsaContext = NULL;\r
\r
//\r
// Sign data\r
//\r
- Signature = NULL; \r
+ Signature = NULL;\r
if (!RsaPkcs1Sign (RsaContext, InData, InDataSize, Signature, &SigSize)) {\r
Signature = AllocateZeroPool (SigSize);\r
} else {\r
return;\r
- } \r
+ }\r
\r
RsaPkcs1Sign (RsaContext, InData, InDataSize, Signature, &SigSize);\r
\r
@param[in] CertLen The size of Certificate in bytes.\r
@param[in] InCa Pointer to the CA certificate\r
@param[in] CaLen The size of CA certificate in bytes.\r
- @param[in] InData Pointer to octect message hash to be checked.\r
+ @param[in] InData Pointer to octet message hash to be checked.\r
@param[in] InDataSize Size of the message hash in bytes.\r
- @param[in] Singnature The pointer to the RSA PKCS1-V1_5 signature to be verifed.\r
+ @param[in] Singnature The pointer to the RSA PKCS1-V1_5 signature to be verified.\r
@param[in] SigSize Size of signature in bytes.\r
\r
@retval TRUE Valid signature encoded in PKCS1-v1_5.\r
@retval FALSE Invalid signature or invalid RSA context.\r
- \r
+\r
**/\r
BOOLEAN\r
IpSecCryptoIoVerifySignDataByCertificate (\r
// Retrieve the RSA public Key from Certificate\r
//\r
RsaGetPublicKeyFromX509 ((CONST UINT8 *)InCert, CertLen, (VOID **)&RsaContext);\r
- \r
+\r
//\r
// Verify data\r
//\r
}\r
\r
*PublicKeyLen = 0;\r
- \r
+\r
RsaGetKey (RsaContext, RsaKeyN, NULL, PublicKeyLen);\r
- \r
+\r
*PublicKey = AllocateZeroPool (*PublicKeyLen);\r
- ASSERT (*PublicKey != NULL);\r
+ if (*PublicKey == NULL) {\r
+ Status = EFI_OUT_OF_RESOURCES;\r
+ goto EXIT;\r
+ }\r
\r
if (!RsaGetKey (RsaContext, RsaKeyN, *PublicKey, PublicKeyLen)) {\r
Status = EFI_INVALID_PARAMETER;\r
@param[in] CertSize The size of the X509 certificate in bytes.\r
@param[out] CertSubject Pointer to the retrieved certificate subject.\r
@param[out] SubjectSize The size of Certificate Subject in bytes.\r
- \r
+\r
@retval EFI_SUCCESS Retrieved the certificate subject successfully.\r
@retval EFI_INVALID_PARAMETER The certificate is malformed.\r
- \r
+\r
**/\r
EFI_STATUS\r
IpSecCryptoIoGetSubjectFromCert (\r
projects / mirror_edk2.git / blobdiff