CryptoPkg: add AeadAesGcm to Crypto Service.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4036

Signed-off-by: Qi Zhang <qi1.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index 417804f64f069f81dd9c055d709502b219ad5567..79c6a4eeae394e3f995ab0d362ca61affb817d6f 100644 (file)
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -215,6 +215,8 @@
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init                        | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt                  | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt                  | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Services.Encrypt              | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Services.Decrypt              | TRUE\r
 !endif\r
 \r
 ###################################################################################################\r

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index b54e59fd07bc106354808a972c0c2d1952df5bbe..9562dfeec58c3cbb5ae99c1e9d76c8550fd7cf96 100644 (file)
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -4938,6 +4938,95 @@ CryptoServiceParallelHash256HashAll (
   return CALL_BASECRYPTLIB (ParallelHash.Services.HashAll, ParallelHash256HashAll, (Input, InputByteLen, BlockSize, Output, OutputByteLen, Customization, CustomByteLen), FALSE);\r
 }\r
 \r
+/**\r
+  Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).\r
+\r
+  IvSize must be 12, otherwise FALSE is returned.\r
+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.\r
+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.\r
+\r
+  @param[in]   Key         Pointer to the encryption key.\r
+  @param[in]   KeySize     Size of the encryption key in bytes.\r
+  @param[in]   Iv          Pointer to the IV value.\r
+  @param[in]   IvSize      Size of the IV value in bytes.\r
+  @param[in]   AData       Pointer to the additional authenticated data (AAD).\r
+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.\r
+  @param[in]   DataIn      Pointer to the input data buffer to be encrypted.\r
+  @param[in]   DataInSize  Size of the input data buffer in bytes.\r
+  @param[out]  TagOut      Pointer to a buffer that receives the authentication tag output.\r
+  @param[in]   TagSize     Size of the authentication tag in bytes.\r
+  @param[out]  DataOut     Pointer to a buffer that receives the encryption output.\r
+  @param[out]  DataOutSize Size of the output data buffer in bytes.\r
+\r
+  @retval TRUE   AEAD AES-GCM authenticated encryption succeeded.\r
+  @retval FALSE  AEAD AES-GCM authenticated encryption failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+CryptoServiceAeadAesGcmEncrypt (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Iv,\r
+  IN   UINTN        IvSize,\r
+  IN   CONST UINT8  *AData,\r
+  IN   UINTN        ADataSize,\r
+  IN   CONST UINT8  *DataIn,\r
+  IN   UINTN        DataInSize,\r
+  OUT  UINT8        *TagOut,\r
+  IN   UINTN        TagSize,\r
+  OUT  UINT8        *DataOut,\r
+  OUT  UINTN        *DataOutSize\r
+  )\r
+{\r
+  return CALL_BASECRYPTLIB (AeadAesGcm.Services.Encrypt, AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);\r
+}\r
+\r
+/**\r
+  Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).\r
+\r
+  IvSize must be 12, otherwise FALSE is returned.\r
+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.\r
+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.\r
+  If additional authenticated data verification fails, FALSE is returned.\r
+\r
+  @param[in]   Key         Pointer to the encryption key.\r
+  @param[in]   KeySize     Size of the encryption key in bytes.\r
+  @param[in]   Iv          Pointer to the IV value.\r
+  @param[in]   IvSize      Size of the IV value in bytes.\r
+  @param[in]   AData       Pointer to the additional authenticated data (AAD).\r
+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.\r
+  @param[in]   DataIn      Pointer to the input data buffer to be decrypted.\r
+  @param[in]   DataInSize  Size of the input data buffer in bytes.\r
+  @param[in]   Tag         Pointer to a buffer that contains the authentication tag.\r
+  @param[in]   TagSize     Size of the authentication tag in bytes.\r
+  @param[out]  DataOut     Pointer to a buffer that receives the decryption output.\r
+  @param[out]  DataOutSize Size of the output data buffer in bytes.\r
+\r
+  @retval TRUE   AEAD AES-GCM authenticated decryption succeeded.\r
+  @retval FALSE  AEAD AES-GCM authenticated decryption failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+CryptoServiceAeadAesGcmDecrypt (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Iv,\r
+  IN   UINTN        IvSize,\r
+  IN   CONST UINT8  *AData,\r
+  IN   UINTN        ADataSize,\r
+  IN   CONST UINT8  *DataIn,\r
+  IN   UINTN        DataInSize,\r
+  IN   CONST UINT8  *Tag,\r
+  IN   UINTN        TagSize,\r
+  OUT  UINT8        *DataOut,\r
+  OUT  UINTN        *DataOutSize\r
+  )\r
+{\r
+  return CALL_BASECRYPTLIB (AeadAesGcm.Services.Decrypt, AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);\r
+}\r
+\r
 const EDKII_CRYPTO_PROTOCOL  mEdkiiCrypto = {\r
   /// Version\r
   CryptoServiceGetCryptoVersion,\r
@@ -5159,5 +5248,8 @@ const EDKII_CRYPTO_PROTOCOL  mEdkiiCrypto = {
   CryptoServiceHkdfSha256Expand,\r
   CryptoServiceHkdfSha384ExtractAndExpand,\r
   CryptoServiceHkdfSha384Extract,\r
-  CryptoServiceHkdfSha384Expand\r
+  CryptoServiceHkdfSha384Expand,\r
+  /// Aead Aes GCM\r
+  CryptoServiceAeadAesGcmEncrypt,\r
+  CryptoServiceAeadAesGcmDecrypt\r
 };\r

diff --git a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
index 5caf597421af48265e5ec5ed5f4c0435301d6d1b..8a8d7c179d84ce2e5e3030aa98c680aa4308573b 100644 (file)
--- a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
+++ b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
@@ -319,6 +319,13 @@ typedef struct {
     } Services;\r
     UINT32    Family;\r
   } ParallelHash;\r
+  union {\r
+    struct {\r
+      UINT8    Encrypt : 1;\r
+      UINT8    Decrypt : 1;\r
+    } Services;\r
+    UINT32    Family;\r
+  } AeadAesGcm;\r
 } PCD_CRYPTO_SERVICE_FAMILY_ENABLE;\r
 \r
 #endif\r

diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index 6a57daea6afb33a848c06c5c3dfb6f9d3e92cfd2..eaf9ad05503c1d8795bd0270c659a544c505a3e4 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -1552,6 +1552,99 @@ AesCbcDecrypt (
   CALL_CRYPTO_SERVICE (AesCbcDecrypt, (AesContext, Input, InputSize, Ivec, Output), FALSE);\r
 }\r
 \r
+// =====================================================================================\r
+//    Authenticated Encryption with Associated Data (AEAD) Cryptography Primitive\r
+// =====================================================================================\r
+\r
+/**\r
+  Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).\r
+\r
+  IvSize must be 12, otherwise FALSE is returned.\r
+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.\r
+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.\r
+\r
+  @param[in]   Key         Pointer to the encryption key.\r
+  @param[in]   KeySize     Size of the encryption key in bytes.\r
+  @param[in]   Iv          Pointer to the IV value.\r
+  @param[in]   IvSize      Size of the IV value in bytes.\r
+  @param[in]   AData       Pointer to the additional authenticated data (AAD).\r
+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.\r
+  @param[in]   DataIn      Pointer to the input data buffer to be encrypted.\r
+  @param[in]   DataInSize  Size of the input data buffer in bytes.\r
+  @param[out]  TagOut      Pointer to a buffer that receives the authentication tag output.\r
+  @param[in]   TagSize     Size of the authentication tag in bytes.\r
+  @param[out]  DataOut     Pointer to a buffer that receives the encryption output.\r
+  @param[out]  DataOutSize Size of the output data buffer in bytes.\r
+\r
+  @retval TRUE   AEAD AES-GCM authenticated encryption succeeded.\r
+  @retval FALSE  AEAD AES-GCM authenticated encryption failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+AeadAesGcmEncrypt (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Iv,\r
+  IN   UINTN        IvSize,\r
+  IN   CONST UINT8  *AData,\r
+  IN   UINTN        ADataSize,\r
+  IN   CONST UINT8  *DataIn,\r
+  IN   UINTN        DataInSize,\r
+  OUT  UINT8        *TagOut,\r
+  IN   UINTN        TagSize,\r
+  OUT  UINT8        *DataOut,\r
+  OUT  UINTN        *DataOutSize\r
+  )\r
+{\r
+  CALL_CRYPTO_SERVICE (AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);\r
+}\r
+\r
+/**\r
+  Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).\r
+\r
+  IvSize must be 12, otherwise FALSE is returned.\r
+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.\r
+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.\r
+  If additional authenticated data verification fails, FALSE is returned.\r
+\r
+  @param[in]   Key         Pointer to the encryption key.\r
+  @param[in]   KeySize     Size of the encryption key in bytes.\r
+  @param[in]   Iv          Pointer to the IV value.\r
+  @param[in]   IvSize      Size of the IV value in bytes.\r
+  @param[in]   AData       Pointer to the additional authenticated data (AAD).\r
+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.\r
+  @param[in]   DataIn      Pointer to the input data buffer to be decrypted.\r
+  @param[in]   DataInSize  Size of the input data buffer in bytes.\r
+  @param[in]   Tag         Pointer to a buffer that contains the authentication tag.\r
+  @param[in]   TagSize     Size of the authentication tag in bytes.\r
+  @param[out]  DataOut     Pointer to a buffer that receives the decryption output.\r
+  @param[out]  DataOutSize Size of the output data buffer in bytes.\r
+\r
+  @retval TRUE   AEAD AES-GCM authenticated decryption succeeded.\r
+  @retval FALSE  AEAD AES-GCM authenticated decryption failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+AeadAesGcmDecrypt (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Iv,\r
+  IN   UINTN        IvSize,\r
+  IN   CONST UINT8  *AData,\r
+  IN   UINTN        ADataSize,\r
+  IN   CONST UINT8  *DataIn,\r
+  IN   UINTN        DataInSize,\r
+  IN   CONST UINT8  *Tag,\r
+  IN   UINTN        TagSize,\r
+  OUT  UINT8        *DataOut,\r
+  OUT  UINTN        *DataOutSize\r
+  )\r
+{\r
+  CALL_CRYPTO_SERVICE (AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);\r
+}\r
+\r
 // =====================================================================================\r
 //    Asymmetric Cryptography Primitive\r
 // =====================================================================================\r

diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Private/Protocol/Crypto.h
index da726e8381224333d7ac5a46847f3e7650ebe982..a66be2c388d382c9c0b996e14e207a625dd61bb5 100644 (file)
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Private/Protocol/Crypto.h
@@ -21,7 +21,7 @@
 /// the EDK II Crypto Protocol is extended, this version define must be\r
 /// increased.\r
 ///\r
-#define EDKII_CRYPTO_VERSION  10\r
+#define EDKII_CRYPTO_VERSION  11\r
 \r
 ///\r
 /// EDK II Crypto Protocol forward declaration\r
@@ -3805,6 +3805,89 @@ BOOLEAN
   IN       UINTN  CustomByteLen\r
   );\r
 \r
+/**\r
+  Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).\r
+\r
+  IvSize must be 12, otherwise FALSE is returned.\r
+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.\r
+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.\r
+\r
+  @param[in]   Key         Pointer to the encryption key.\r
+  @param[in]   KeySize     Size of the encryption key in bytes.\r
+  @param[in]   Iv          Pointer to the IV value.\r
+  @param[in]   IvSize      Size of the IV value in bytes.\r
+  @param[in]   AData       Pointer to the additional authenticated data (AAD).\r
+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.\r
+  @param[in]   DataIn      Pointer to the input data buffer to be encrypted.\r
+  @param[in]   DataInSize  Size of the input data buffer in bytes.\r
+  @param[out]  TagOut      Pointer to a buffer that receives the authentication tag output.\r
+  @param[in]   TagSize     Size of the authentication tag in bytes.\r
+  @param[out]  DataOut     Pointer to a buffer that receives the encryption output.\r
+  @param[out]  DataOutSize Size of the output data buffer in bytes.\r
+\r
+  @retval TRUE   AEAD AES-GCM authenticated encryption succeeded.\r
+  @retval FALSE  AEAD AES-GCM authenticated encryption failed.\r
+\r
+**/\r
+typedef\r
+BOOLEAN\r
+(EFIAPI *EDKII_AEAD_AES_GCM_ENCRYPT)(\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Iv,\r
+  IN   UINTN        IvSize,\r
+  IN   CONST UINT8  *AData,\r
+  IN   UINTN        ADataSize,\r
+  IN   CONST UINT8  *DataIn,\r
+  IN   UINTN        DataInSize,\r
+  OUT  UINT8        *TagOut,\r
+  IN   UINTN        TagSize,\r
+  OUT  UINT8        *DataOut,\r
+  OUT  UINTN        *DataOutSize\r
+  );\r
+\r
+/**\r
+  Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).\r
+\r
+  IvSize must be 12, otherwise FALSE is returned.\r
+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.\r
+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.\r
+  If additional authenticated data verification fails, FALSE is returned.\r
+\r
+  @param[in]   Key         Pointer to the encryption key.\r
+  @param[in]   KeySize     Size of the encryption key in bytes.\r
+  @param[in]   Iv          Pointer to the IV value.\r
+  @param[in]   IvSize      Size of the IV value in bytes.\r
+  @param[in]   AData       Pointer to the additional authenticated data (AAD).\r
+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.\r
+  @param[in]   DataIn      Pointer to the input data buffer to be decrypted.\r
+  @param[in]   DataInSize  Size of the input data buffer in bytes.\r
+  @param[in]   Tag         Pointer to a buffer that contains the authentication tag.\r
+  @param[in]   TagSize     Size of the authentication tag in bytes.\r
+  @param[out]  DataOut     Pointer to a buffer that receives the decryption output.\r
+  @param[out]  DataOutSize Size of the output data buffer in bytes.\r
+\r
+  @retval TRUE   AEAD AES-GCM authenticated decryption succeeded.\r
+  @retval FALSE  AEAD AES-GCM authenticated decryption failed.\r
+\r
+**/\r
+typedef\r
+BOOLEAN\r
+(EFIAPI *EDKII_AEAD_AES_GCM_DECRYPT)(\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Iv,\r
+  IN   UINTN        IvSize,\r
+  IN   CONST UINT8  *AData,\r
+  IN   UINTN        ADataSize,\r
+  IN   CONST UINT8  *DataIn,\r
+  IN   UINTN        DataInSize,\r
+  IN   CONST UINT8  *Tag,\r
+  IN   UINTN        TagSize,\r
+  OUT  UINT8        *DataOut,\r
+  OUT  UINTN        *DataOutSize\r
+  );\r
+\r
 ///\r
 /// EDK II Crypto Protocol\r
 ///\r
@@ -4010,6 +4093,9 @@ struct _EDKII_CRYPTO_PROTOCOL {
   EDKII_CRYPTO_HKDF_SHA_384_EXTRACT_AND_EXPAND       HkdfSha384ExtractAndExpand;\r
   EDKII_CRYPTO_HKDF_SHA_384_EXTRACT                  HkdfSha384Extract;\r
   EDKII_CRYPTO_HKDF_SHA_384_EXPAND                   HkdfSha384Expand;\r
+  /// AEAD AES-GCM\r
+  EDKII_AEAD_AES_GCM_ENCRYPT                         AeadAesGcmEncrypt;\r
+  EDKII_AEAD_AES_GCM_DECRYPT                         AeadAesGcmDecrypt;\r
 };\r
 \r
 extern GUID  gEdkiiCryptoProtocolGuid;\r