CryptoPkg/BaseCryptLib: Retire Aes Ecb mode algorithm

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898

Aes Ecb mode is not secure any longer.
Remove the Aes Ecb mode support from edk2.
Change the Aes Ecb mode field name in EDKII_CRYPTO_PROTOCOL to indicate the
function is unsupported any longer.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Philippe Mathieu-Daude <philmd@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index 6ed7046563904711b95e082232aa9028a4f6e8d7..1f68cc633b9ab463ba2bf8ef611434706f122900 100644 (file)
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -137,27 +137,30 @@
   gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x06\r
 \r
 !if $(CRYPTO_SERVICES) IN "PACKAGE ALL"\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacMd5.Family    | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family   | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md5.Family        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family       | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Dh.Family         | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Random.Family     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Family        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family       | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Family       | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tdes.Family       | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Family        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Arc4.Family       | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family       | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tls.Family        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsSet.Family     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsGet.Family     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacMd5.Family                           | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family                          | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md5.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Dh.Family                                | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Random.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tdes.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.GetContextSize              | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init                        | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt                  | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt                  | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Arc4.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tls.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsSet.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsGet.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
 !endif\r
 \r
 !if $(CRYPTO_SERVICES) == MIN_PEI\r

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index 642d0267d95fec73fef78f8cb69a6956e4bb7ea0..1337fea42ad687cfb445dad3357260b316bd9d57 100644 (file)
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -1801,79 +1801,51 @@ CryptoServiceAesInit (
 }\r
 \r
 /**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  AES ECB Mode is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]   AesContext  Pointer to the AES context.\r
   @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
   @param[in]   InputSize   Size of the Input buffer in bytes.\r
   @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
 \r
-  @retval TRUE   AES encryption succeeded.\r
-  @retval FALSE  AES encryption failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceAesEcbEncrypt (\r
+DeprecatedCryptoServiceAesEcbEncrypt (\r
   IN   VOID         *AesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Aes.Services.EcbEncrypt, AesEcbEncrypt, (AesContext, Input, InputSize, Output), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("AesEcbEncrypt"), FALSE;\r
 }\r
 \r
 /**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  AES ECB Mode is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]   AesContext  Pointer to the AES context.\r
   @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
   @param[in]   InputSize   Size of the Input buffer in bytes.\r
   @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
 \r
-  @retval TRUE   AES decryption succeeded.\r
-  @retval FALSE  AES decryption failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceAesEcbDecrypt (\r
+DeprecatedCryptoServiceAesEcbDecrypt (\r
   IN   VOID         *AesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Aes.Services.EcbDecrypt, AesEcbDecrypt, (AesContext, Input, InputSize, Output), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("AesEcbDecrypt"), FALSE;\r
 }\r
 \r
 /**\r
@@ -4376,11 +4348,11 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
   DeprecatedCryptoServiceTdesEcbDecrypt,\r
   DeprecatedCryptoServiceTdesCbcEncrypt,\r
   DeprecatedCryptoServiceTdesCbcDecrypt,\r
-  /// AES\r
+  /// AES - ECB mode is deprecated and unsupported\r
   CryptoServiceAesGetContextSize,\r
   CryptoServiceAesInit,\r
-  CryptoServiceAesEcbEncrypt,\r
-  CryptoServiceAesEcbDecrypt,\r
+  DeprecatedCryptoServiceAesEcbEncrypt,\r
+  DeprecatedCryptoServiceAesEcbDecrypt,\r
   CryptoServiceAesCbcEncrypt,\r
   CryptoServiceAesCbcDecrypt,\r
   /// Arc4 - deprecated and unsupported\r

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 621bcfd1c4c656c6c1be6ff0d607f7db3869390e..86175c7a8a99841afc5775a5a729d5ebf04d13d0 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -1323,76 +1323,6 @@ AesInit (
   IN   UINTN        KeyLength\r
   );\r
 \r
-/**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
-\r
-  @retval TRUE   AES encryption succeeded.\r
-  @retval FALSE  AES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbEncrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  );\r
-\r
-/**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
-\r
-  @retval TRUE   AES decryption succeeded.\r
-  @retval FALSE  AES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbDecrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  );\r
-\r
 /**\r
   Performs AES encryption on a data buffer of the specified size in CBC mode.\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
index 2515b34bb8c4bc7b5d7476fb7aff5fbf83b3a255..914cffb2111511a03c749d0ae1556915f7cffab8 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
+++ b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
@@ -78,120 +78,6 @@ AesInit (
   return TRUE;\r
 }\r
 \r
-/**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
-\r
-  @retval TRUE   AES encryption succeeded.\r
-  @retval FALSE  AES encryption failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbEncrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  AES_KEY  *AesKey;\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (AesContext == NULL || Input == NULL || (InputSize % AES_BLOCK_SIZE) != 0 || Output == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  AesKey = (AES_KEY *) AesContext;\r
-\r
-  //\r
-  // Perform AES data encryption with ECB mode (block-by-block)\r
-  //\r
-  while (InputSize > 0) {\r
-    AES_ecb_encrypt (Input, Output, AesKey, AES_ENCRYPT);\r
-    Input     += AES_BLOCK_SIZE;\r
-    Output    += AES_BLOCK_SIZE;\r
-    InputSize -= AES_BLOCK_SIZE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
-\r
-  @retval TRUE   AES decryption succeeded.\r
-  @retval FALSE  AES decryption failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbDecrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  AES_KEY  *AesKey;\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (AesContext == NULL || Input == NULL || (InputSize % AES_BLOCK_SIZE) != 0 || Output == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  AesKey = (AES_KEY *) AesContext;\r
-\r
-  //\r
-  // Perform AES data decryption with ECB mode (block-by-block)\r
-  //\r
-  while (InputSize > 0) {\r
-    AES_ecb_encrypt (Input, Output, AesKey + 1, AES_DECRYPT);\r
-    Input     += AES_BLOCK_SIZE;\r
-    Output    += AES_BLOCK_SIZE;\r
-    InputSize -= AES_BLOCK_SIZE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
 /**\r
   Performs AES encryption on a data buffer of the specified size in CBC mode.\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c
index a82adacf4fe97ab5a622b0c31c362fa3c19d381e..d235422e7abad65da2bcfc43c06dea4c2d78ebd1 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c
+++ b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAesNull.c
@@ -50,58 +50,6 @@ AesInit (
   return FALSE;\r
 }\r
 \r
-/**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbEncrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbDecrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
 /**\r
   Performs AES encryption on a data buffer of the specified size in CBC mode.\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
index a82adacf4fe97ab5a622b0c31c362fa3c19d381e..d235422e7abad65da2bcfc43c06dea4c2d78ebd1 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
+++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
@@ -50,58 +50,6 @@ AesInit (
   return FALSE;\r
 }\r
 \r
-/**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbEncrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbDecrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
 /**\r
   Performs AES encryption on a data buffer of the specified size in CBC mode.\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index 43ee4e08418d81d6fedd6fd19e1c8aab62415bfd..c937f8540d921501c64ec55d160555c411482cd7 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -1518,82 +1518,6 @@ AesInit (
   CALL_CRYPTO_SERVICE (AesInit, (AesContext, Key, KeyLength), FALSE);\r
 }\r
 \r
-/**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
-\r
-  @retval TRUE   AES encryption succeeded.\r
-  @retval FALSE  AES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbEncrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (AesEcbEncrypt, (AesContext, Input, InputSize, Output), FALSE);\r
-}\r
-\r
-/**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
-\r
-  @retval TRUE   AES decryption succeeded.\r
-  @retval FALSE  AES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-AesEcbDecrypt (\r
-  IN   VOID         *AesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (AesEcbDecrypt, (AesContext, Input, InputSize, Output), FALSE);\r
-}\r
-\r
 /**\r
   Performs AES encryption on a data buffer of the specified size in CBC mode.\r
 \r

diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Private/Protocol/Crypto.h
index a30660c1920ab4d5fedff1f1a6578d7221994f17..e76ff623a51d4775c7ad7c4c62d3900598daca65 100644 (file)
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Private/Protocol/Crypto.h
@@ -2498,69 +2498,22 @@ BOOLEAN
   );\r
 \r
 /**\r
-  Performs AES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.\r
-\r
-  @retval TRUE   AES encryption succeeded.\r
-  @retval FALSE  AES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
+  AES ECB Mode is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
 **/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_AES_ECB_ENCRYPT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_AES_ECB_ENCRYPT) (\r
   IN   VOID         *AesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   );\r
 \r
-/**\r
-  Performs AES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs AES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (16 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  AesContext should be already correctly initialized by AesInit(). Behavior with\r
-  invalid AES context is undefined.\r
-\r
-  If AesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (16 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   AesContext  Pointer to the AES context.\r
-  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize   Size of the Input buffer in bytes.\r
-  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.\r
-\r
-  @retval TRUE   AES decryption succeeded.\r
-  @retval FALSE  AES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_AES_ECB_DECRYPT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_AES_ECB_DECRYPT) (\r
   IN   VOID         *AesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
@@ -3779,11 +3732,11 @@ struct _EDKII_CRYPTO_PROTOCOL {
   DEPRECATED_EDKII_CRYPTO_TDES_ECB_DECRYPT        DeprecatedTdesEcbDecrypt;\r
   DEPRECATED_EDKII_CRYPTO_TDES_CBC_ENCRYPT        DeprecatedTdesCbcEncrypt;\r
   DEPRECATED_EDKII_CRYPTO_TDES_CBC_DECRYPT        DeprecatedTdesCbcDecrypt;\r
-  /// AES\r
+  /// AES - ECB Mode is deprecated and unsupported\r
   EDKII_CRYPTO_AES_GET_CONTEXT_SIZE               AesGetContextSize;\r
   EDKII_CRYPTO_AES_INIT                           AesInit;\r
-  EDKII_CRYPTO_AES_ECB_ENCRYPT                    AesEcbEncrypt;\r
-  EDKII_CRYPTO_AES_ECB_DECRYPT                    AesEcbDecrypt;\r
+  DEPRECATED_EDKII_CRYPTO_AES_ECB_ENCRYPT         DeprecatedAesEcbEncrypt;\r
+  DEPRECATED_EDKII_CRYPTO_AES_ECB_DECRYPT         DeprecatedAesEcbDecrypt;\r
   EDKII_CRYPTO_AES_CBC_ENCRYPT                    AesCbcEncrypt;\r
   EDKII_CRYPTO_AES_CBC_DECRYPT                    AesCbcDecrypt;\r
   /// Arc4 - deprecated and unsupported\r