CryptoPkg/BaseCryptLib: Retire the TDES algorithm

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898

TDES is not secure any longer.
Remove the Tdes support from edk2.
Change the Tdes field name in EDKII_CRYPTO_PROTOCOL to indicate the
function is unsupported any longer.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Philippe Mathieu-Daude <philmd@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index af6148291949d0d1b6094cd2e402a4190a7e1bf0..642d0267d95fec73fef78f8cb69a6956e4bb7ea0 100644 (file)
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -1612,152 +1612,94 @@ CryptoServiceHmacSha256Final (
 //=====================================================================================\r
 \r
 /**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  If this interface is not supported, then return zero.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
-  @return  The size, in bytes, of the context buffer required for TDES operations.\r
   @retval  0   This interface is not supported.\r
 \r
 **/\r
 UINTN\r
 EFIAPI\r
-CryptoServiceTdesGetContextSize (\r
+DeprecatedCryptoServiceTdesGetContextSize (\r
   VOID\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Tdes.Services.GetContextSize, TdesGetContextSize, (), 0);\r
+  return BaseCryptLibServiceDeprecated ("TdesGetContextSize"), 0;\r
 }\r
 \r
 /**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  This function initializes user-supplied memory pointed by TdesContext as TDES context.\r
-  In addition, it sets up all TDES key materials for subsequent encryption and decryption\r
-  operations.\r
-  There are 3 key options as follows:\r
-  KeyLength = 64,  Keying option 1: K1 == K2 == K3 (Backward compatibility with DES)\r
-  KeyLength = 128, Keying option 2: K1 != K2 and K3 = K1 (Less Security)\r
-  KeyLength = 192  Keying option 3: K1 != K2 != K3 (Strongest)\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Key is NULL, then return FALSE.\r
-  If KeyLength is not valid, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[out]  TdesContext  Pointer to TDES context being initialized.\r
   @param[in]   Key          Pointer to the user-supplied TDES key.\r
   @param[in]   KeyLength    Length of TDES key in bits.\r
 \r
-  @retval TRUE   TDES context initialization succeeded.\r
-  @retval FALSE  TDES context initialization failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceTdesInit (\r
+DeprecatedCryptoServiceTdesInit (\r
   OUT  VOID         *TdesContext,\r
   IN   CONST UINT8  *Key,\r
   IN   UINTN        KeyLength\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Tdes.Services.Init, TdesInit, (TdesContext, Key, KeyLength), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("TdesInit"), FALSE;\r
 }\r
 \r
 /**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]   TdesContext  Pointer to the TDES context.\r
   @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
   @param[in]   InputSize    Size of the Input buffer in bytes.\r
   @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
 \r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceTdesEcbEncrypt (\r
+DeprecatedCryptoServiceTdesEcbEncrypt (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Tdes.Services.EcbEncrypt, TdesEcbEncrypt, (TdesContext, Input, InputSize, Output), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("TdesEcbEncrypt"), FALSE;\r
 }\r
 \r
 /**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]   TdesContext  Pointer to the TDES context.\r
   @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
   @param[in]   InputSize    Size of the Input buffer in bytes.\r
   @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
 \r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceTdesEcbDecrypt (\r
+DeprecatedCryptoServiceTdesEcbDecrypt (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Tdes.Services.EcbDecrypt, TdesEcbDecrypt, (TdesContext, Input, InputSize, Output), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("TdesEcbDecrypt"), FALSE;\r
 }\r
 \r
 /**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]   TdesContext  Pointer to the TDES context.\r
   @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
@@ -1765,14 +1707,12 @@ CryptoServiceTdesEcbDecrypt (
   @param[in]   Ivec         Pointer to initialization vector.\r
   @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
 \r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceTdesCbcEncrypt (\r
+DeprecatedCryptoServiceTdesCbcEncrypt (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
@@ -1780,26 +1720,12 @@ CryptoServiceTdesCbcEncrypt (
   OUT  UINT8        *Output\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Tdes.Services.CbcEncrypt, TdesCbcEncrypt, (TdesContext, Input, InputSize, Ivec, Output), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("TdesCbcEncrypt"), FALSE;\r
 }\r
 \r
 /**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]   TdesContext  Pointer to the TDES context.\r
   @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
@@ -1807,14 +1733,12 @@ CryptoServiceTdesCbcEncrypt (
   @param[in]   Ivec         Pointer to initialization vector.\r
   @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
 \r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceTdesCbcDecrypt (\r
+DeprecatedCryptoServiceTdesCbcDecrypt (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
@@ -1822,7 +1746,7 @@ CryptoServiceTdesCbcDecrypt (
   OUT  UINT8        *Output\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (Tdes.Services.CbcDecrypt, TdesCbcDecrypt, (TdesContext, Input, InputSize, Ivec, Output), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("TdesCbcDecrypt"), FALSE;\r
 }\r
 \r
 /**\r
@@ -4445,13 +4369,13 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
   CryptoServiceX509Free,\r
   CryptoServiceX509StackFree,\r
   CryptoServiceX509GetTBSCert,\r
-  /// TDES\r
-  CryptoServiceTdesGetContextSize,\r
-  CryptoServiceTdesInit,\r
-  CryptoServiceTdesEcbEncrypt,\r
-  CryptoServiceTdesEcbDecrypt,\r
-  CryptoServiceTdesCbcEncrypt,\r
-  CryptoServiceTdesCbcDecrypt,\r
+  /// TDES - deprecated and unsupported\r
+  DeprecatedCryptoServiceTdesGetContextSize,\r
+  DeprecatedCryptoServiceTdesInit,\r
+  DeprecatedCryptoServiceTdesEcbEncrypt,\r
+  DeprecatedCryptoServiceTdesEcbDecrypt,\r
+  DeprecatedCryptoServiceTdesCbcEncrypt,\r
+  DeprecatedCryptoServiceTdesCbcDecrypt,\r
   /// AES\r
   CryptoServiceAesGetContextSize,\r
   CryptoServiceAesInit,\r

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 25e236c4a30f63c990b8de006279190991d12f54..621bcfd1c4c656c6c1be6ff0d607f7db3869390e 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -1278,202 +1278,6 @@ HmacSha256Final (
 //    Symmetric Cryptography Primitive\r
 //=====================================================================================\r
 \r
-/**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  If this interface is not supported, then return zero.\r
-\r
-  @return  The size, in bytes, of the context buffer required for TDES operations.\r
-  @retval  0   This interface is not supported.\r
-\r
-**/\r
-UINTN\r
-EFIAPI\r
-TdesGetContextSize (\r
-  VOID\r
-  );\r
-\r
-/**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  This function initializes user-supplied memory pointed by TdesContext as TDES context.\r
-  In addition, it sets up all TDES key materials for subsequent encryption and decryption\r
-  operations.\r
-  There are 3 key options as follows:\r
-  KeyLength = 64,  Keying option 1: K1 == K2 == K3 (Backward compatibility with DES)\r
-  KeyLength = 128, Keying option 2: K1 != K2 and K3 = K1 (Less Security)\r
-  KeyLength = 192  Keying option 3: K1 != K2 != K3 (Strongest)\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Key is NULL, then return FALSE.\r
-  If KeyLength is not valid, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[out]  TdesContext  Pointer to TDES context being initialized.\r
-  @param[in]   Key          Pointer to the user-supplied TDES key.\r
-  @param[in]   KeyLength    Length of TDES key in bits.\r
-\r
-  @retval TRUE   TDES context initialization succeeded.\r
-  @retval FALSE  TDES context initialization failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesInit (\r
-  OUT  VOID         *TdesContext,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeyLength\r
-  );\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  );\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  );\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  );\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  );\r
-\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for AES operations.\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
index da38ea552ff63498356156c8ba27641a200ab308..2de8e9c34678df753d622147bbf654d0cd1cb2f8 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
@@ -39,7 +39,6 @@
   Hmac/CryptHmacSha256.c\r
   Kdf/CryptHkdf.c\r
   Cipher/CryptAes.c\r
-  Cipher/CryptTdes.c\r
   Pk/CryptRsaBasic.c\r
   Pk/CryptRsaExt.c\r
   Pk/CryptPkcs1Oaep.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c
deleted file mode 100644 (file)
index fd799f3..0000000
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c
+++ /dev/null
@@ -1,364 +0,0 @@
-/** @file\r
-  TDES Wrapper Implementation over OpenSSL.\r
-\r
-Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>\r
-SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "InternalCryptLib.h"\r
-#include <openssl/des.h>\r
-\r
-/**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  @return  The size, in bytes, of the context buffer required for TDES operations.\r
-\r
-**/\r
-UINTN\r
-EFIAPI\r
-TdesGetContextSize (\r
-  VOID\r
-  )\r
-{\r
-  //\r
-  // Memory for 3 copies of DES_key_schedule is allocated, for K1, K2 and K3 each.\r
-  //\r
-  return (UINTN) (3 * sizeof (DES_key_schedule));\r
-}\r
-\r
-/**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  This function initializes user-supplied memory pointed by TdesContext as TDES context.\r
-  In addition, it sets up all TDES key materials for subsequent encryption and decryption\r
-  operations.\r
-  There are 3 key options as follows:\r
-  KeyLength = 64,  Keying option 1: K1 == K2 == K3 (Backward compatibility with DES)\r
-  KeyLength = 128, Keying option 2: K1 != K2 and K3 = K1 (Less Security)\r
-  KeyLength = 192  Keying option 3: K1 != K2 != K3 (Strongest)\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Key is NULL, then return FALSE.\r
-  If KeyLength is not valid, then return FALSE.\r
-\r
-  @param[out]  TdesContext  Pointer to TDES context being initialized.\r
-  @param[in]   Key          Pointer to the user-supplied TDES key.\r
-  @param[in]   KeyLength    Length of TDES key in bits.\r
-\r
-  @retval TRUE   TDES context initialization succeeded.\r
-  @retval FALSE  TDES context initialization failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesInit (\r
-  OUT  VOID         *TdesContext,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeyLength\r
-  )\r
-{\r
-  DES_key_schedule  *KeySchedule;\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (TdesContext == NULL || Key == NULL || (KeyLength != 64 && KeyLength != 128 && KeyLength != 192)) {\r
-    return FALSE;\r
-  }\r
-\r
-  KeySchedule = (DES_key_schedule *) TdesContext;\r
-\r
-  //\r
-  // If input Key is a weak key, return error.\r
-  //\r
-  if (DES_is_weak_key ((const_DES_cblock *) Key) == 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  DES_set_key_unchecked ((const_DES_cblock *) Key, KeySchedule);\r
-\r
-  if (KeyLength == 64) {\r
-    CopyMem (KeySchedule + 1, KeySchedule, sizeof (DES_key_schedule));\r
-    CopyMem (KeySchedule + 2, KeySchedule, sizeof (DES_key_schedule));\r
-    return TRUE;\r
-  }\r
-\r
-  if (DES_is_weak_key ((const_DES_cblock *) (Key + 8)) == 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  DES_set_key_unchecked ((const_DES_cblock *) (Key + 8), KeySchedule + 1);\r
-\r
-  if (KeyLength == 128) {\r
-    CopyMem (KeySchedule + 2, KeySchedule, sizeof (DES_key_schedule));\r
-    return TRUE;\r
-  }\r
-\r
-  if (DES_is_weak_key ((const_DES_cblock *) (Key + 16)) == 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  DES_set_key_unchecked ((const_DES_cblock *) (Key + 16), KeySchedule + 2);\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  DES_key_schedule  *KeySchedule;\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0 || Output == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  KeySchedule = (DES_key_schedule *) TdesContext;\r
-\r
-  while (InputSize > 0) {\r
-    DES_ecb3_encrypt (\r
-      (const_DES_cblock *) Input,\r
-      (DES_cblock *) Output,\r
-      KeySchedule,\r
-      KeySchedule + 1,\r
-      KeySchedule + 2,\r
-      DES_ENCRYPT\r
-      );\r
-    Input     += TDES_BLOCK_SIZE;\r
-    Output    += TDES_BLOCK_SIZE;\r
-    InputSize -= TDES_BLOCK_SIZE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  DES_key_schedule  *KeySchedule;\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0 || Output == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  KeySchedule = (DES_key_schedule *) TdesContext;\r
-\r
-  while (InputSize > 0) {\r
-    DES_ecb3_encrypt (\r
-      (const_DES_cblock *) Input,\r
-      (DES_cblock *) Output,\r
-      KeySchedule,\r
-      KeySchedule + 1,\r
-      KeySchedule + 2,\r
-      DES_DECRYPT\r
-      );\r
-    Input     += TDES_BLOCK_SIZE;\r
-    Output    += TDES_BLOCK_SIZE;\r
-    InputSize -= TDES_BLOCK_SIZE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  DES_key_schedule  *KeySchedule;\r
-  UINT8             IvecBuffer[TDES_BLOCK_SIZE];\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0) {\r
-    return FALSE;\r
-  }\r
-\r
-  if (Ivec == NULL || Output == NULL || InputSize > INT_MAX) {\r
-    return FALSE;\r
-  }\r
-\r
-  KeySchedule = (DES_key_schedule *) TdesContext;\r
-  CopyMem (IvecBuffer, Ivec, TDES_BLOCK_SIZE);\r
-\r
-  DES_ede3_cbc_encrypt (\r
-    Input,\r
-    Output,\r
-    (UINT32) InputSize,\r
-    KeySchedule,\r
-    KeySchedule + 1,\r
-    KeySchedule + 2,\r
-    (DES_cblock *) IvecBuffer,\r
-    DES_ENCRYPT\r
-    );\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  DES_key_schedule  *KeySchedule;\r
-  UINT8             IvecBuffer[TDES_BLOCK_SIZE];\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0) {\r
-    return FALSE;\r
-  }\r
-\r
-  if (Ivec == NULL || Output == NULL || InputSize > INT_MAX) {\r
-    return FALSE;\r
-  }\r
-\r
-  KeySchedule = (DES_key_schedule *) TdesContext;\r
-  CopyMem (IvecBuffer, Ivec, TDES_BLOCK_SIZE);\r
-\r
-  DES_ede3_cbc_encrypt (\r
-    Input,\r
-    Output,\r
-    (UINT32) InputSize,\r
-    KeySchedule,\r
-    KeySchedule + 1,\r
-    KeySchedule + 2,\r
-    (DES_cblock *) IvecBuffer,\r
-    DES_DECRYPT\r
-    );\r
-\r
-  return TRUE;\r
-}\r
-\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdesNull.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdesNull.c
deleted file mode 100644 (file)
index efa2716..0000000
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdesNull.c
+++ /dev/null
@@ -1,160 +0,0 @@
-/** @file\r
-  TDES Wrapper Implementation which does not provide real capabilities.\r
-\r
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>\r
-SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "InternalCryptLib.h"\r
-\r
-/**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  Return zero to indicate this interface is not supported.\r
-\r
-  @retval  0   This interface is not supported.\r
-\r
-**/\r
-UINTN\r
-EFIAPI\r
-TdesGetContextSize (\r
-  VOID\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return 0;\r
-}\r
-\r
-/**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[out]  TdesContext  Pointer to TDES context being initialized.\r
-  @param[in]   Key          Pointer to the user-supplied TDES key.\r
-  @param[in]   KeyLength    Length of TDES key in bits.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesInit (\r
-  OUT  VOID         *TdesContext,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeyLength\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
index f43953b78c1d97f215e30e7bb70fd250e14a5eca..f631f8d879758e2d4f2961f42e4b54f24b6175c2 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
@@ -7,7 +7,7 @@
 #  buffer overflow or integer overflow.\r
 #\r
 #  Note:\r
-#  HMAC-MD5 functions, HMAC-SHA1/SHA256 functions, AES/TDES functions, RSA external\r
+#  HMAC-MD5 functions, HMAC-SHA1/SHA256 functions, AES functions, RSA external\r
 #  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509\r
 #  certificate handler functions, authenticode signature verification functions,\r
 #  PEM handler functions, and pseudorandom number generator functions are not\r
@@ -45,7 +45,6 @@
   Hmac/CryptHmacSha256Null.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r
-  Cipher/CryptTdesNull.c\r
   Pk/CryptRsaBasic.c\r
   Pk/CryptRsaExtNull.c\r
   Pk/CryptPkcs1OaepNull.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
index 5abd8e8dfb48d2d03c652c1b675e4ebd6fc74a22..c906935d3dd8a484f68a99bd7d6aab6c563266ba 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
@@ -6,8 +6,8 @@
 // This external input must be validated carefully to avoid security issues such as\r
 // buffer overflow or integer overflow.\r
 //\r
-// Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES/\r
-// TDES functions, RSA external functions, PKCS#7 SignedData sign functions,\r
+// Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES\r
+// functions, RSA external functions, PKCS#7 SignedData sign functions,\r
 // Diffie-Hellman functions, X.509 certificate handler functions, authenticode\r
 // signature verification functions, PEM handler functions, and pseudorandom number\r
 // generator functions are not supported in this instance.\r
@@ -21,5 +21,5 @@
 \r
 #string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Instance for PEIM"\r
 \r
-#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES/ TDES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c b/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
index 75a133bd0ca057afaa848fa9543aad310c6d8c0a..6f7e1971f8e196ab3e99d387dfced2454cad3842 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
@@ -1,7 +1,7 @@
 /** @file\r
   PEM (Privacy Enhanced Mail) Format Handler Wrapper Implementation over OpenSSL.\r
 \r
-Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>\r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
@@ -82,11 +82,8 @@ RsaGetPrivateKeyFromPem (
 \r
   //\r
   // Add possible block-cipher descriptor for PEM data decryption.\r
-  // NOTE: Only support most popular ciphers (3DES, AES) for the encrypted PEM.\r
+  // NOTE: Only support most popular ciphers AES for the encrypted PEM.\r
   //\r
-  if (EVP_add_cipher (EVP_des_ede3_cbc ()) == 0) {\r
-    return FALSE;\r
-  }\r
   if (EVP_add_cipher (EVP_aes_128_cbc ()) == 0) {\r
     return FALSE;\r
   }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
index f1eb099b6721f72f07b9a340233a2d706e326700..672e19299c6fed9e23aa37e353fe845d8d1d6e84 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
@@ -7,7 +7,7 @@
 #  buffer overflow or integer overflow.\r
 #\r
 #  Note: SHA-384 Digest functions, SHA-512 Digest functions,\r
-#  HMAC-MD5 functions, HMAC-SHA1/SHA256 functions, AES/TDES functions, RSA external\r
+#  HMAC-MD5 functions, HMAC-SHA1/SHA256 functions, AES functions, RSA external\r
 #  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and\r
 #  authenticode signature verification functions are not supported in this instance.\r
 #\r
@@ -45,7 +45,6 @@
   Hmac/CryptHmacSha256Null.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r
-  Cipher/CryptTdesNull.c\r
   Pk/CryptRsaBasic.c\r
   Pk/CryptRsaExtNull.c\r
   Pk/CryptPkcs1OaepNull.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
index 5a48d2a308f630be9331ad9a07c8b1a19cb4d016..0a3bb1c04f35d86f8707b7e75a8e304998396da8 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
@@ -6,8 +6,8 @@
 // This external input must be validated carefully to avoid security issues such as\r
 // buffer overflow or integer overflow.\r
 //\r
-// Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES/\r
-// TDES functions, RSA external functions, PKCS#7 SignedData sign functions,\r
+// Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES\r
+// functions, RSA external functions, PKCS#7 SignedData sign functions,\r
 // Diffie-Hellman functions, and authenticode signature verification functions are\r
 // not supported in this instance.\r
 //\r
@@ -20,5 +20,5 @@
 \r
 #string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Instance for DXE_RUNTIME_DRIVER"\r
 \r
-#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES/ TDES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
index 3a9465577592ba3cec677c8cd73dab986b37392c..cc3556ae3f89dea82a324c74bdcf2cc587c57919 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
@@ -7,7 +7,7 @@
 #  buffer overflow or integer overflow.\r
 #\r
 #  Note: SHA-384 Digest functions, SHA-512 Digest functions,\r
-#  HMAC-MD5 functions, HMAC-SHA1 functions, TDES functions, RSA external\r
+#  HMAC-MD5 functions, HMAC-SHA1 functions, RSA external\r
 #  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and\r
 #  authenticode signature verification functions are not supported in this instance.\r
 #\r
@@ -44,7 +44,6 @@
   Hmac/CryptHmacSha256.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAes.c\r
-  Cipher/CryptTdesNull.c\r
   Pk/CryptRsaBasic.c\r
   Pk/CryptRsaExtNull.c\r
   Pk/CryptPkcs1Oaep.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
index 0561f107e88cda08ab0318972b65bcb3352b16b3..2e362c635ff2545f2b771e773a740bd70e6d82ff 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
@@ -6,8 +6,8 @@
 // This external input must be validated carefully to avoid security issues such as\r
 // buffer overflow or integer overflow.\r
 //\r
-// Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES/\r
-// TDES functions, RSA external functions, PKCS#7 SignedData sign functions,\r
+// Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES\r
+// functions, RSA external functions, PKCS#7 SignedData sign functions,\r
 // Diffie-Hellman functions, and authenticode signature verification functions are\r
 // not supported in this instance.\r
 //\r
@@ -20,5 +20,5 @@
 \r
 #string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Instance for SMM driver"\r
 \r
-#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES/ TDES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-MD5 functions, HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
index a205c9005d85207d1027cb217a0684f1f513a98a..04b552f8b7177fd19ae9f9c1ee79ce03bb7eeb8d 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
+++ b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
@@ -39,7 +39,6 @@
   Hmac/CryptHmacSha256Null.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r
-  Cipher/CryptTdesNull.c\r
   Pk/CryptRsaBasicNull.c\r
   Pk/CryptRsaExtNull.c\r
   Pk/CryptPkcs1OaepNull.c\r

diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
deleted file mode 100644 (file)
index efa2716..0000000
--- a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
+++ /dev/null
@@ -1,160 +0,0 @@
-/** @file\r
-  TDES Wrapper Implementation which does not provide real capabilities.\r
-\r
-Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>\r
-SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "InternalCryptLib.h"\r
-\r
-/**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  Return zero to indicate this interface is not supported.\r
-\r
-  @retval  0   This interface is not supported.\r
-\r
-**/\r
-UINTN\r
-EFIAPI\r
-TdesGetContextSize (\r
-  VOID\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return 0;\r
-}\r
-\r
-/**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[out]  TdesContext  Pointer to TDES context being initialized.\r
-  @param[in]   Key          Pointer to the user-supplied TDES key.\r
-  @param[in]   KeyLength    Length of TDES key in bits.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesInit (\r
-  OUT  VOID         *TdesContext,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeyLength\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r

diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index 77915bdb864833e1e6c2ed4e486773ec782dccf1..43ee4e08418d81d6fedd6fd19e1c8aab62415bfd 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -1467,220 +1467,6 @@ HmacSha256Final (
 //    Symmetric Cryptography Primitive\r
 //=====================================================================================\r
 \r
-/**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  If this interface is not supported, then return zero.\r
-\r
-  @return  The size, in bytes, of the context buffer required for TDES operations.\r
-  @retval  0   This interface is not supported.\r
-\r
-**/\r
-UINTN\r
-EFIAPI\r
-TdesGetContextSize (\r
-  VOID\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (TdesGetContextSize, (), 0);\r
-}\r
-\r
-/**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  This function initializes user-supplied memory pointed by TdesContext as TDES context.\r
-  In addition, it sets up all TDES key materials for subsequent encryption and decryption\r
-  operations.\r
-  There are 3 key options as follows:\r
-  KeyLength = 64,  Keying option 1: K1 == K2 == K3 (Backward compatibility with DES)\r
-  KeyLength = 128, Keying option 2: K1 != K2 and K3 = K1 (Less Security)\r
-  KeyLength = 192  Keying option 3: K1 != K2 != K3 (Strongest)\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Key is NULL, then return FALSE.\r
-  If KeyLength is not valid, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[out]  TdesContext  Pointer to TDES context being initialized.\r
-  @param[in]   Key          Pointer to the user-supplied TDES key.\r
-  @param[in]   KeyLength    Length of TDES key in bits.\r
-\r
-  @retval TRUE   TDES context initialization succeeded.\r
-  @retval FALSE  TDES context initialization failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesInit (\r
-  OUT  VOID         *TdesContext,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeyLength\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (TdesInit, (TdesContext, Key, KeyLength), FALSE);\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (TdesEcbEncrypt, (TdesContext, Input, InputSize, Output), FALSE);\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesEcbDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (TdesEcbDecrypt, (TdesContext, Input, InputSize, Output), FALSE);\r
-}\r
-\r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcEncrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (TdesCbcEncrypt, (TdesContext, Input, InputSize, Ivec, Output), FALSE);\r
-}\r
-\r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-TdesCbcDecrypt (\r
-  IN   VOID         *TdesContext,\r
-  IN   CONST UINT8  *Input,\r
-  IN   UINTN        InputSize,\r
-  IN   CONST UINT8  *Ivec,\r
-  OUT  UINT8        *Output\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (TdesCbcDecrypt, (TdesContext, Input, InputSize, Ivec, Output), FALSE);\r
-}\r
-\r
 /**\r
   Retrieves the size, in bytes, of the context buffer required for AES operations.\r
 \r

diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Private/Protocol/Crypto.h
index f36c5c1aff4dbe8a1ba84c312e03bd23bcdd82bb..a30660c1920ab4d5fedff1f1a6578d7221994f17 100644 (file)
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Private/Protocol/Crypto.h
@@ -2396,155 +2396,45 @@ BOOLEAN
 //=====================================================================================\r
 \r
 /**\r
-  Retrieves the size, in bytes, of the context buffer required for TDES operations.\r
-\r
-  If this interface is not supported, then return zero.\r
-\r
-  @return  The size, in bytes, of the context buffer required for TDES operations.\r
-  @retval  0   This interface is not supported.\r
+  TDES is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
 **/\r
 typedef\r
 UINTN\r
-(EFIAPI *EDKII_CRYPTO_TDES_GET_CONTEXT_SIZE) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_GET_CONTEXT_SIZE) (\r
   VOID\r
   );\r
 \r
-/**\r
-  Initializes user-supplied memory as TDES context for subsequent use.\r
-\r
-  This function initializes user-supplied memory pointed by TdesContext as TDES context.\r
-  In addition, it sets up all TDES key materials for subsequent encryption and decryption\r
-  operations.\r
-  There are 3 key options as follows:\r
-  KeyLength = 64,  Keying option 1: K1 == K2 == K3 (Backward compatibility with DES)\r
-  KeyLength = 128, Keying option 2: K1 != K2 and K3 = K1 (Less Security)\r
-  KeyLength = 192  Keying option 3: K1 != K2 != K3 (Strongest)\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Key is NULL, then return FALSE.\r
-  If KeyLength is not valid, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[out]  TdesContext  Pointer to TDES context being initialized.\r
-  @param[in]   Key          Pointer to the user-supplied TDES key.\r
-  @param[in]   KeyLength    Length of TDES key in bits.\r
-\r
-  @retval TRUE   TDES context initialization succeeded.\r
-  @retval FALSE  TDES context initialization failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_TDES_INIT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_INIT) (\r
   OUT  VOID         *TdesContext,\r
   IN   CONST UINT8  *Key,\r
   IN   UINTN        KeyLength\r
   );\r
 \r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_TDES_ECB_ENCRYPT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_ECB_ENCRYPT) (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   );\r
 \r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in ECB mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in ECB mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_TDES_ECB_DECRYPT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_ECB_DECRYPT) (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
   OUT  UINT8        *Output\r
   );\r
 \r
-/**\r
-  Performs TDES encryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES encryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES encryption succeeded.\r
-  @retval FALSE  TDES encryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_TDES_CBC_ENCRYPT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_CBC_ENCRYPT) (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
@@ -2552,38 +2442,9 @@ BOOLEAN
   OUT  UINT8        *Output\r
   );\r
 \r
-/**\r
-  Performs TDES decryption on a data buffer of the specified size in CBC mode.\r
-\r
-  This function performs TDES decryption on data buffer pointed by Input, of specified\r
-  size of InputSize, in CBC mode.\r
-  InputSize must be multiple of block size (8 bytes). This function does not perform\r
-  padding. Caller must perform padding, if necessary, to ensure valid input data size.\r
-  Initialization vector should be one block size (8 bytes).\r
-  TdesContext should be already correctly initialized by TdesInit(). Behavior with\r
-  invalid TDES context is undefined.\r
-\r
-  If TdesContext is NULL, then return FALSE.\r
-  If Input is NULL, then return FALSE.\r
-  If InputSize is not multiple of block size (8 bytes), then return FALSE.\r
-  If Ivec is NULL, then return FALSE.\r
-  If Output is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]   TdesContext  Pointer to the TDES context.\r
-  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.\r
-  @param[in]   InputSize    Size of the Input buffer in bytes.\r
-  @param[in]   Ivec         Pointer to initialization vector.\r
-  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.\r
-\r
-  @retval TRUE   TDES decryption succeeded.\r
-  @retval FALSE  TDES decryption failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_TDES_CBC_DECRYPT) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_TDES_CBC_DECRYPT) (\r
   IN   VOID         *TdesContext,\r
   IN   CONST UINT8  *Input,\r
   IN   UINTN        InputSize,\r
@@ -3911,13 +3772,13 @@ struct _EDKII_CRYPTO_PROTOCOL {
   EDKII_CRYPTO_X509_FREE                          X509Free;\r
   EDKII_CRYPTO_X509_STACK_FREE                    X509StackFree;\r
   EDKII_CRYPTO_X509_GET_TBS_CERT                  X509GetTBSCert;\r
-  /// TDES\r
-  EDKII_CRYPTO_TDES_GET_CONTEXT_SIZE              TdesGetContextSize;\r
-  EDKII_CRYPTO_TDES_INIT                          TdesInit;\r
-  EDKII_CRYPTO_TDES_ECB_ENCRYPT                   TdesEcbEncrypt;\r
-  EDKII_CRYPTO_TDES_ECB_DECRYPT                   TdesEcbDecrypt;\r
-  EDKII_CRYPTO_TDES_CBC_ENCRYPT                   TdesCbcEncrypt;\r
-  EDKII_CRYPTO_TDES_CBC_DECRYPT                   TdesCbcDecrypt;\r
+  /// TDES - deprecated and unsupported\r
+  DEPRECATED_EDKII_CRYPTO_TDES_GET_CONTEXT_SIZE   DeprecatedTdesGetContextSize;\r
+  DEPRECATED_EDKII_CRYPTO_TDES_INIT               DeprecatedTdesInit;\r
+  DEPRECATED_EDKII_CRYPTO_TDES_ECB_ENCRYPT        DeprecatedTdesEcbEncrypt;\r
+  DEPRECATED_EDKII_CRYPTO_TDES_ECB_DECRYPT        DeprecatedTdesEcbDecrypt;\r
+  DEPRECATED_EDKII_CRYPTO_TDES_CBC_ENCRYPT        DeprecatedTdesCbcEncrypt;\r
+  DEPRECATED_EDKII_CRYPTO_TDES_CBC_DECRYPT        DeprecatedTdesCbcDecrypt;\r
   /// AES\r
   EDKII_CRYPTO_AES_GET_CONTEXT_SIZE               AesGetContextSize;\r
   EDKII_CRYPTO_AES_INIT                           AesInit;\r