CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF algorithm

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1928

1. Implement OpenSSL HKDF wrapped function in CryptHkdf.c file.
2. Implement stub implementation function in CryptHkdfNull.c file.
3. Add wrapped HKDF function declaration to BaseCryptLib.h file.
4. Add CryptHkdf.c to module information BaseCryptLib.inf file.
5. Add CryptHkdfNull.c to module information PeiCryptLib.inf,
   RuntimeCryptLib.inf and SmmCryptLib.inf

Signed-off-by: Gary West <Gary.West@intel.com>
Cc: Jian Wang <jian.j.wang@intel.com>
Cc: Ting Ye <ting.ye@intel.com>
Reviewed-by: Jian Wang <jian.j.wang@intel.com>

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 19d1afe3c8c0b81330fb19fe3369c8e185c4d5bf..da32bb2444fd6e2cc49680da87092576edf00088 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -3122,4 +3122,37 @@ RandomBytes (
   IN   UINTN  Size\r
   );\r
 \r
+//=====================================================================================\r
+//    Key Derivation Function Primitive\r
+//=====================================================================================\r
+\r
+/**\r
+  Derive key data using HMAC-SHA256 based KDF.\r
+\r
+  @param[in]   Key              Pointer to the user-supplied key.\r
+  @param[in]   KeySize          Key size in bytes.\r
+  @param[in]   Salt             Pointer to the salt(non-secret) value.\r
+  @param[in]   SaltSize         Salt size in bytes.\r
+  @param[in]   Info             Pointer to the application specific info.\r
+  @param[in]   InfoSize         Info size in bytes.\r
+  @param[Out]  Out              Pointer to buffer to receive hkdf value.\r
+  @param[in]   OutSize          Size of hkdf bytes to generate.\r
+\r
+  @retval TRUE   Hkdf generated successfully.\r
+  @retval FALSE  Hkdf generation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+HkdfSha256ExtractAndExpand (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Salt,\r
+  IN   UINTN        SaltSize,\r
+  IN   CONST UINT8  *Info,\r
+  IN   UINTN        InfoSize,\r
+  OUT  UINT8        *Out,\r
+  IN   UINTN        OutSize\r
+  );\r
+\r
 #endif // __BASE_CRYPT_LIB_H__\r

diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
index 020df3c19b3c143fd5f2f480ed7d02719ecef58c..8d4988e8c6b4d8532b0d58ed95b4b08716907401 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
@@ -37,6 +37,7 @@
   Hmac/CryptHmacMd5.c\r
   Hmac/CryptHmacSha1.c\r
   Hmac/CryptHmacSha256.c\r
+  Kdf/CryptHkdf.c\r
   Cipher/CryptAes.c\r
   Cipher/CryptTdes.c\r
   Cipher/CryptArc4.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c
new file mode 100644 (file)
index 0000000..f0fcef2
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c
@@ -0,0 +1,75 @@
+/** @file\r
+  HMAC-SHA256 KDF Wrapper Implementation over OpenSSL.\r
+\r
+Copyright (c) 2018 - 2019, Intel Corporation. All rights reserved.<BR>\r
+SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#include <Library/BaseCryptLib.h>\r
+#include <openssl/evp.h>\r
+#include <openssl/kdf.h>\r
+\r
+/**\r
+  Derive HMAC-based Extract-and-Expand Key Derivation Function (HKDF).\r
+\r
+  @param[in]   Key              Pointer to the user-supplied key.\r
+  @param[in]   KeySize          Key size in bytes.\r
+  @param[in]   Salt             Pointer to the salt(non-secret) value.\r
+  @param[in]   SaltSize         Salt size in bytes.\r
+  @param[in]   Info             Pointer to the application specific info.\r
+  @param[in]   InfoSize         Info size in bytes.\r
+  @param[Out]  Out              Pointer to buffer to receive hkdf value.\r
+  @param[in]   OutSize          Size of hkdf bytes to generate.\r
+\r
+  @retval TRUE   Hkdf generated successfully.\r
+  @retval FALSE  Hkdf generation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+HkdfSha256ExtractAndExpand (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Salt,\r
+  IN   UINTN        SaltSize,\r
+  IN   CONST UINT8  *Info,\r
+  IN   UINTN        InfoSize,\r
+  OUT  UINT8        *Out,\r
+  IN   UINTN        OutSize\r
+  )\r
+{\r
+  EVP_PKEY_CTX *pHkdfCtx;\r
+  BOOLEAN Result;\r
+\r
+  if (Key == NULL || Salt == NULL || Info == NULL || Out == NULL ||\r
+    KeySize > INT_MAX || SaltSize > INT_MAX || InfoSize > INT_MAX || OutSize > INT_MAX ) {\r
+    return FALSE;\r
+  }\r
+\r
+  pHkdfCtx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);\r
+  if (pHkdfCtx == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
+  Result = EVP_PKEY_derive_init(pHkdfCtx) > 0;\r
+  if (Result) {\r
+    Result = EVP_PKEY_CTX_set_hkdf_md(pHkdfCtx, EVP_sha256()) > 0;\r
+  }\r
+  if (Result) {\r
+    Result = EVP_PKEY_CTX_set1_hkdf_salt(pHkdfCtx, Salt, (UINT32)SaltSize) > 0;\r
+  }\r
+  if (Result) {\r
+    Result = EVP_PKEY_CTX_set1_hkdf_key(pHkdfCtx, Key, (UINT32)KeySize) > 0;\r
+  }\r
+  if (Result) {\r
+    Result = EVP_PKEY_CTX_add1_hkdf_info(pHkdfCtx, Info, (UINT32)InfoSize) > 0;\r
+  }\r
+  if (Result) {\r
+    Result = EVP_PKEY_derive(pHkdfCtx, Out, &OutSize) > 0;\r
+  }\r
+\r
+  EVP_PKEY_CTX_free(pHkdfCtx);\r
+  pHkdfCtx = NULL;\r
+  return Result;\r
+}\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c
new file mode 100644 (file)
index 0000000..73deb5b
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c
@@ -0,0 +1,43 @@
+/** @file\r
+  HMAC-SHA256 KDF Wrapper Implementation which does not provide real capabilities.\r
+\r
+Copyright (c) 2018 - 2019, Intel Corporation. All rights reserved.<BR>\r
+SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+**/\r
+\r
+#include <Library/BaseCryptLib.h>\r
+#include <Library/DebugLib.h>\r
+\r
+/**\r
+  Derive key data using HMAC-SHA256 based KDF.\r
+\r
+  @param[in]   Key              Pointer to the user-supplied key.\r
+  @param[in]   KeySize          Key size in bytes.\r
+  @param[in]   Salt             Pointer to the salt(non-secret) value.\r
+  @param[in]   SaltSize         Salt size in bytes.\r
+  @param[in]   Info             Pointer to the application specific info.\r
+  @param[in]   InfoSize         Info size in bytes.\r
+  @param[Out]  Out              Pointer to buffer to receive hkdf value.\r
+  @param[in]   OutSize          Size of hkdf bytes to generate.\r
+\r
+  @retval TRUE   Hkdf generated successfully.\r
+  @retval FALSE  Hkdf generation failed.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+HkdfSha256ExtractAndExpand (\r
+  IN   CONST UINT8  *Key,\r
+  IN   UINTN        KeySize,\r
+  IN   CONST UINT8  *Salt,\r
+  IN   UINTN        SaltSize,\r
+  IN   CONST UINT8  *Info,\r
+  IN   UINTN        InfoSize,\r
+  OUT  UINT8        *Out,\r
+  IN   UINTN        OutSize\r
+  )\r
+{\r
+  ASSERT (FALSE);\r
+  return FALSE;\r
+}\r

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
index 99dbad23ed5d982beb4c4a40f9c159a98b0005eb..3da8bd848017d296f0a5a4bd0ccb5f029181aa05 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
@@ -44,10 +44,10 @@
   Hmac/CryptHmacMd5Null.c\r
   Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256Null.c\r
+  Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r
   Cipher/CryptTdesNull.c\r
   Cipher/CryptArc4Null.c\r
-\r
   Pk/CryptRsaBasic.c\r
   Pk/CryptRsaExtNull.c\r
   Pk/CryptPkcs1OaepNull.c\r
@@ -56,13 +56,11 @@
   Pk/CryptPkcs7VerifyCommon.c\r
   Pk/CryptPkcs7VerifyBase.c\r
   Pk/CryptPkcs7VerifyEku.c\r
-\r
   Pk/CryptDhNull.c\r
   Pk/CryptX509Null.c\r
   Pk/CryptAuthenticodeNull.c\r
   Pk/CryptTsNull.c\r
   Pem/CryptPemNull.c\r
-\r
   Rand/CryptRandNull.c\r
 \r
   SysCall/CrtWrapper.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
index 0e58d2b5b0eaf958888f444869e72aa681a91018..21a481eb776784d876c78f778bffd0c03af39ca0 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
@@ -43,6 +43,7 @@
   Hmac/CryptHmacMd5Null.c\r
   Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256Null.c\r
+  Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r
   Cipher/CryptTdesNull.c\r
   Cipher/CryptArc4Null.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
index c79f2bf4c6c0fd04711586f632dec0c4ff56dbdd..7c187e21b3b9a9cb69f8b1acf92013ad43a72d1c 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
@@ -43,6 +43,7 @@
   Hmac/CryptHmacMd5Null.c\r
   Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256.c\r
+  Kdf/CryptHkdfNull.c\r
   Cipher/CryptAes.c\r
   Cipher/CryptTdesNull.c\r
   Cipher/CryptArc4Null.c\r