CryptoPkg/BaseCryptLib: Retire HMAC SHA1 algorithm

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1898

HMAC SHA1 is not secure any longer.
Remove the HMAC SHA1 support from edk2.
Change the HMAC SHA1 field name in EDKII_CRYPTO_PROTOCOL to indicate the
function is unsupported any longer.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Philippe Mathieu-Daude <philmd@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index 9ddf73f9fac9d4afd85dcefe65c81c6471bdf99e..1af78468a19c912102859c081f6d46547b8b13f0 100644 (file)
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -137,7 +137,6 @@
   gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x06\r
 \r
 !if $(CRYPTO_SERVICES) IN "PACKAGE ALL"\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family                          | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md5.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
@@ -163,7 +162,6 @@
 !endif\r
 \r
 !if $(CRYPTO_SERVICES) == MIN_PEI\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family                 | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family                     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family                   | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
@@ -178,7 +176,6 @@
 !endif\r
 \r
 !if $(CRYPTO_SERVICES) == MIN_DXE_MIN_SMM\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha1.Family                          | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs1v2Encrypt             | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs5HashPassword          | TRUE\r

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index 1cd5923ce228d1cda3a87ee9c5a5f27b3aff8532..73ae56675548add2e26245c9ebfed08a3c78c07a 100644 (file)
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -1277,154 +1277,120 @@ DeprecatedCryptoServiceHmacMd5Final (
 }\r
 \r
 /**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  If this interface is not supported, then return NULL.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
-  @return  Pointer to the HMAC_CTX context that has been initialized.\r
-           If the allocations fails, HmacSha1New() returns NULL.\r
   @return  NULL   This interface is not supported.\r
 \r
 **/\r
 VOID *\r
 EFIAPI\r
-CryptoServiceHmacSha1New (\r
+DeprecatedCryptoServiceHmacSha1New (\r
   VOID\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (HmacSha1.Services.New, HmacSha1New, (), NULL);\r
+  return BaseCryptLibServiceDeprecated ("HmacSha1New"), NULL;\r
 }\r
 \r
 /**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  If this interface is not supported, then do nothing.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
 \r
 **/\r
 VOID\r
 EFIAPI\r
-CryptoServiceHmacSha1Free (\r
+DeprecatedCryptoServiceHmacSha1Free (\r
   IN  VOID  *HmacSha1Ctx\r
   )\r
 {\r
-  CALL_VOID_BASECRYPTLIB (HmacSha1.Services.Free, HmacSha1Free, (HmacSha1Ctx));\r
+  BaseCryptLibServiceDeprecated ("HmacSha1Free");\r
 }\r
 \r
 /**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
   @param[in]   Key              Pointer to the user-supplied key.\r
   @param[in]   KeySize          Key size in bytes.\r
 \r
-  @retval TRUE   The Key is set successfully.\r
-  @retval FALSE  The Key is set unsuccessfully.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceHmacSha1SetKey (\r
+DeprecatedCryptoServiceHmacSha1SetKey (\r
   OUT  VOID         *HmacSha1Context,\r
   IN   CONST UINT8  *Key,\r
   IN   UINTN        KeySize\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (HmacSha1.Services.SetKey, HmacSha1SetKey, (HmacSha1Context, Key, KeySize), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("HmacSha1SetKey"), FALSE;\r
 }\r
 \r
 /**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If NewHmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
   @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
 \r
-  @retval TRUE   HMAC-SHA1 context copy succeeded.\r
-  @retval FALSE  HMAC-SHA1 context copy failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceHmacSha1Duplicate (\r
+DeprecatedCryptoServiceHmacSha1Duplicate (\r
   IN   CONST VOID  *HmacSha1Context,\r
   OUT  VOID        *NewHmacSha1Context\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (HmacSha1.Services.Duplicate, HmacSha1Duplicate, (HmacSha1Context, NewHmacSha1Context), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("HmacSha1Duplicate"), FALSE;\r
 }\r
 \r
 /**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  This function performs HMAC-SHA1 digest on a data buffer of the specified size.\r
-  It can be called multiple times to compute the digest of long or discontinuous data streams.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by\r
-  HmacSha1Final(). Behavior with invalid context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
   @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
   @param[in]       DataSize        Size of Data buffer in bytes.\r
 \r
-  @retval TRUE   HMAC-SHA1 data digest succeeded.\r
-  @retval FALSE  HMAC-SHA1 data digest failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceHmacSha1Update (\r
+DeprecatedCryptoServiceHmacSha1Update (\r
   IN OUT  VOID        *HmacSha1Context,\r
   IN      CONST VOID  *Data,\r
   IN      UINTN       DataSize\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (HmacSha1.Services.Update, HmacSha1Update, (HmacSha1Context, Data, DataSize), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("HmacSha1Update"), FALSE;\r
 }\r
 \r
 /**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  This function completes HMAC-SHA1 hash computation and retrieves the digest value into\r
-  the specified memory. After this function has been called, the HMAC-SHA1 context cannot\r
-  be used again.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized\r
-  by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If HmacValue is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
   @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
   @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
                                     value (20 bytes).\r
 \r
-  @retval TRUE   HMAC-SHA1 digest computation succeeded.\r
-  @retval FALSE  HMAC-SHA1 digest computation failed.\r
   @retval FALSE  This interface is not supported.\r
 \r
 **/\r
 BOOLEAN\r
 EFIAPI\r
-CryptoServiceHmacSha1Final (\r
+DeprecatedCryptoServiceHmacSha1Final (\r
   IN OUT  VOID   *HmacSha1Context,\r
   OUT     UINT8  *HmacValue\r
   )\r
 {\r
-  return CALL_BASECRYPTLIB (HmacSha1.Services.Final, HmacSha1Final, (HmacSha1Context, HmacValue), FALSE);\r
+  return BaseCryptLibServiceDeprecated ("HmacSha1Final"), FALSE;\r
 }\r
 \r
 /**\r
@@ -4207,13 +4173,13 @@ const EDKII_CRYPTO_PROTOCOL mEdkiiCrypto = {
   DeprecatedCryptoServiceHmacMd5Duplicate,\r
   DeprecatedCryptoServiceHmacMd5Update,\r
   DeprecatedCryptoServiceHmacMd5Final,\r
-  /// HMAC SHA1\r
-  CryptoServiceHmacSha1New,\r
-  CryptoServiceHmacSha1Free,\r
-  CryptoServiceHmacSha1SetKey,\r
-  CryptoServiceHmacSha1Duplicate,\r
-  CryptoServiceHmacSha1Update,\r
-  CryptoServiceHmacSha1Final,\r
+  /// HMAC SHA1 - deprecated and unsupported\r
+  DeprecatedCryptoServiceHmacSha1New,\r
+  DeprecatedCryptoServiceHmacSha1Free,\r
+  DeprecatedCryptoServiceHmacSha1SetKey,\r
+  DeprecatedCryptoServiceHmacSha1Duplicate,\r
+  DeprecatedCryptoServiceHmacSha1Update,\r
+  DeprecatedCryptoServiceHmacSha1Final,\r
   /// HMAC SHA256\r
   CryptoServiceHmacSha256New,\r
   CryptoServiceHmacSha256Free,\r

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index b99401661cb98a2a89b278a32ff96e44ccaf9912..1b1ffa75ef5e1b8605d2e7c3699465f9eaedb07f 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -880,139 +880,6 @@ Sm3HashAll (
 //    MAC (Message Authentication Code) Primitive\r
 //=====================================================================================\r
 \r
-/**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  If this interface is not supported, then return NULL.\r
-\r
-  @return  Pointer to the HMAC_CTX context that has been initialized.\r
-           If the allocations fails, HmacSha1New() returns NULL.\r
-  @return  NULL   This interface is not supported.\r
-\r
-**/\r
-VOID *\r
-EFIAPI\r
-HmacSha1New (\r
-  VOID\r
-  );\r
-\r
-/**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  If this interface is not supported, then do nothing.\r
-\r
-  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-HmacSha1Free (\r
-  IN  VOID  *HmacSha1Ctx\r
-  );\r
-\r
-/**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
-  @param[in]   Key              Pointer to the user-supplied key.\r
-  @param[in]   KeySize          Key size in bytes.\r
-\r
-  @retval TRUE   The Key is set successfully.\r
-  @retval FALSE  The Key is set unsuccessfully.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1SetKey (\r
-  OUT  VOID         *HmacSha1Context,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeySize\r
-  );\r
-\r
-/**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If NewHmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
-  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
-\r
-  @retval TRUE   HMAC-SHA1 context copy succeeded.\r
-  @retval FALSE  HMAC-SHA1 context copy failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Duplicate (\r
-  IN   CONST VOID  *HmacSha1Context,\r
-  OUT  VOID        *NewHmacSha1Context\r
-  );\r
-\r
-/**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  This function performs HMAC-SHA1 digest on a data buffer of the specified size.\r
-  It can be called multiple times to compute the digest of long or discontinuous data streams.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by\r
-  HmacSha1Final(). Behavior with invalid context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
-  @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
-  @param[in]       DataSize        Size of Data buffer in bytes.\r
-\r
-  @retval TRUE   HMAC-SHA1 data digest succeeded.\r
-  @retval FALSE  HMAC-SHA1 data digest failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Update (\r
-  IN OUT  VOID        *HmacSha1Context,\r
-  IN      CONST VOID  *Data,\r
-  IN      UINTN       DataSize\r
-  );\r
-\r
-/**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  This function completes HMAC-SHA1 hash computation and retrieves the digest value into\r
-  the specified memory. After this function has been called, the HMAC-SHA1 context cannot\r
-  be used again.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized\r
-  by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If HmacValue is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
-  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
-                                    value (20 bytes).\r
-\r
-  @retval TRUE   HMAC-SHA1 digest computation succeeded.\r
-  @retval FALSE  HMAC-SHA1 digest computation failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Final (\r
-  IN OUT  VOID   *HmacSha1Context,\r
-  OUT     UINT8  *HmacValue\r
-  );\r
-\r
 /**\r
   Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
index 33d7c13bfff32f3f3ca485329924a77dbb52af65..4aae2aba95d69a6f130c62908349d367cf035f21 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
@@ -34,7 +34,6 @@
   Hash/CryptSha256.c\r
   Hash/CryptSha512.c\r
   Hash/CryptSm3.c\r
-  Hmac/CryptHmacSha1.c\r
   Hmac/CryptHmacSha256.c\r
   Kdf/CryptHkdf.c\r
   Cipher/CryptAes.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
deleted file mode 100644 (file)
index 7593ca5..0000000
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
+++ /dev/null
@@ -1,216 +0,0 @@
-/** @file\r
-  HMAC-SHA1 Wrapper Implementation over OpenSSL.\r
-\r
-Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>\r
-SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "InternalCryptLib.h"\r
-#include <openssl/hmac.h>\r
-\r
-/**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  @return  Pointer to the HMAC_CTX context that has been initialized.\r
-           If the allocations fails, HmacSha1New() returns NULL.\r
-\r
-**/\r
-VOID *\r
-EFIAPI\r
-HmacSha1New (\r
-  VOID\r
-  )\r
-{\r
-  //\r
-  // Allocates & Initializes HMAC_CTX Context by OpenSSL HMAC_CTX_new()\r
-  //\r
-  return (VOID *) HMAC_CTX_new ();\r
-}\r
-\r
-/**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-HmacSha1Free (\r
-  IN  VOID  *HmacSha1Ctx\r
-  )\r
-{\r
-  //\r
-  // Free OpenSSL HMAC_CTX Context\r
-  //\r
-  HMAC_CTX_free ((HMAC_CTX *)HmacSha1Ctx);\r
-}\r
-\r
-/**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-\r
-  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
-  @param[in]   Key              Pointer to the user-supplied key.\r
-  @param[in]   KeySize          Key size in bytes.\r
-\r
-  @retval TRUE   The Key is set successfully.\r
-  @retval FALSE  The Key is set unsuccessfully.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1SetKey (\r
-  OUT  VOID         *HmacSha1Context,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeySize\r
-  )\r
-{\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (HmacSha1Context == NULL || KeySize > INT_MAX) {\r
-    return FALSE;\r
-  }\r
-\r
-  if (HMAC_Init_ex ((HMAC_CTX *)HmacSha1Context, Key, (UINT32) KeySize, EVP_sha1(), NULL) != 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If NewHmacSha1Context is NULL, then return FALSE.\r
-\r
-  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
-  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
-\r
-  @retval TRUE   HMAC-SHA1 context copy succeeded.\r
-  @retval FALSE  HMAC-SHA1 context copy failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Duplicate (\r
-  IN   CONST VOID  *HmacSha1Context,\r
-  OUT  VOID        *NewHmacSha1Context\r
-  )\r
-{\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (HmacSha1Context == NULL || NewHmacSha1Context == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  if (HMAC_CTX_copy ((HMAC_CTX *)NewHmacSha1Context, (HMAC_CTX *)HmacSha1Context) != 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  This function performs HMAC-SHA1 digest on a data buffer of the specified size.\r
-  It can be called multiple times to compute the digest of long or discontinuous data streams.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by\r
-  HmacSha1Final(). Behavior with invalid context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
-  @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
-  @param[in]       DataSize        Size of Data buffer in bytes.\r
-\r
-  @retval TRUE   HMAC-SHA1 data digest succeeded.\r
-  @retval FALSE  HMAC-SHA1 data digest failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Update (\r
-  IN OUT  VOID        *HmacSha1Context,\r
-  IN      CONST VOID  *Data,\r
-  IN      UINTN       DataSize\r
-  )\r
-{\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (HmacSha1Context == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  //\r
-  // Check invalid parameters, in case that only DataLength was checked in OpenSSL\r
-  //\r
-  if (Data == NULL && DataSize != 0) {\r
-    return FALSE;\r
-  }\r
-\r
-  //\r
-  // OpenSSL HMAC-SHA1 digest update\r
-  //\r
-  if (HMAC_Update ((HMAC_CTX *)HmacSha1Context, Data, DataSize) != 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r
-\r
-/**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  This function completes HMAC-SHA1 digest computation and retrieves the digest value into\r
-  the specified memory. After this function has been called, the HMAC-SHA1 context cannot\r
-  be used again.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by\r
-  HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If HmacValue is NULL, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
-  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
-                                    value (20 bytes).\r
-\r
-  @retval TRUE   HMAC-SHA1 digest computation succeeded.\r
-  @retval FALSE  HMAC-SHA1 digest computation failed.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Final (\r
-  IN OUT  VOID   *HmacSha1Context,\r
-  OUT     UINT8  *HmacValue\r
-  )\r
-{\r
-  UINT32  Length;\r
-\r
-  //\r
-  // Check input parameters.\r
-  //\r
-  if (HmacSha1Context == NULL || HmacValue == NULL) {\r
-    return FALSE;\r
-  }\r
-\r
-  //\r
-  // OpenSSL HMAC-SHA1 digest finalization\r
-  //\r
-  if (HMAC_Final ((HMAC_CTX *)HmacSha1Context, HmacValue, &Length) != 1) {\r
-    return FALSE;\r
-  }\r
-  if (HMAC_CTX_reset ((HMAC_CTX *)HmacSha1Context) != 1) {\r
-    return FALSE;\r
-  }\r
-\r
-  return TRUE;\r
-}\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c
deleted file mode 100644 (file)
index e8c0f34..0000000
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1Null.c
+++ /dev/null
@@ -1,139 +0,0 @@
-/** @file\r
-  HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.\r
-\r
-Copyright (c) 2012 - 2020, Intel Corporation. All rights reserved.<BR>\r
-SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "InternalCryptLib.h"\r
-\r
-/**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  Return NULL to indicate this interface is not supported.\r
-\r
-  @return  NULL  This interface is not supported..\r
-\r
-**/\r
-VOID *\r
-EFIAPI\r
-HmacSha1New (\r
-  VOID\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return NULL;\r
-}\r
-\r
-/**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  This function will do nothing.\r
-\r
-  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-HmacSha1Free (\r
-  IN  VOID  *HmacSha1Ctx\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return;\r
-}\r
-\r
-/**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
-  @param[in]   Key              Pointer to the user-supplied key.\r
-  @param[in]   KeySize          Key size in bytes.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1SetKey (\r
-  OUT  VOID         *HmacSha1Context,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeySize\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
-  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Duplicate (\r
-  IN   CONST VOID  *HmacSha1Context,\r
-  OUT  VOID        *NewHmacSha1Context\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
-  @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
-  @param[in]       DataSize        Size of Data buffer in bytes.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Update (\r
-  IN OUT  VOID        *HmacSha1Context,\r
-  IN      CONST VOID  *Data,\r
-  IN      UINTN       DataSize\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
-  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
-                                    value (20 bytes).\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Final (\r
-  IN OUT  VOID   *HmacSha1Context,\r
-  OUT     UINT8  *HmacValue\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
index 2a630ef29031a7c6816a8f9a9f80c4f10afb751e..dc28e3a11d486a05cd49fc0475a1353b8895edb9 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
@@ -7,7 +7,7 @@
 #  buffer overflow or integer overflow.\r
 #\r
 #  Note:\r
-#  HMAC-SHA1/SHA256 functions, AES functions, RSA external\r
+#  HMAC-SHA256 functions, AES functions, RSA external\r
 #  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509\r
 #  certificate handler functions, authenticode signature verification functions,\r
 #  PEM handler functions, and pseudorandom number generator functions are not\r
@@ -40,7 +40,6 @@
   Hash/CryptSha256.c\r
   Hash/CryptSm3.c\r
   Hash/CryptSha512.c\r
-  Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256Null.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
index 95c71a8ae27d37f4d8a7239e5bb1f2ca25bd68e3..20ae64e8bf1a93abd543049c8eb11948813aa385 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.uni
@@ -6,7 +6,7 @@
 // This external input must be validated carefully to avoid security issues such as\r
 // buffer overflow or integer overflow.\r
 //\r
-// Note: HMAC-SHA1 functions, AES\r
+// Note: AES\r
 // functions, RSA external functions, PKCS#7 SignedData sign functions,\r
 // Diffie-Hellman functions, X.509 certificate handler functions, authenticode\r
 // signature verification functions, PEM handler functions, and pseudorandom number\r
@@ -21,5 +21,5 @@
 \r
 #string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Instance for PEIM"\r
 \r
-#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, X.509 certificate handler functions, authenticode signature verification functions, PEM handler functions, and pseudorandom number generator functions are not supported in this instance."\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
index 1642521087f27a407aa785635d7dd160a0a9dcdb..5005beed028ca21f5ead06b0c95736e6e99febe3 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
@@ -7,7 +7,7 @@
 #  buffer overflow or integer overflow.\r
 #\r
 #  Note: SHA-384 Digest functions, SHA-512 Digest functions,\r
-#  HMAC-SHA1/SHA256 functions, AES functions, RSA external\r
+#  HMAC-SHA256 functions, AES functions, RSA external\r
 #  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and\r
 #  authenticode signature verification functions are not supported in this instance.\r
 #\r
@@ -40,7 +40,6 @@
   Hash/CryptSha256.c\r
   Hash/CryptSm3.c\r
   Hash/CryptSha512Null.c\r
-  Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256Null.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
index f7e1acb3a72e832668577a700ecea53802d3d1ff..0cf378c5ab84484f653a6c320ac34e754ca71fb9 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.uni
@@ -6,7 +6,7 @@
 // This external input must be validated carefully to avoid security issues such as\r
 // buffer overflow or integer overflow.\r
 //\r
-// Note: HMAC-SHA1 functions, AES\r
+// Note: AES\r
 // functions, RSA external functions, PKCS#7 SignedData sign functions,\r
 // Diffie-Hellman functions, and authenticode signature verification functions are\r
 // not supported in this instance.\r
@@ -20,5 +20,5 @@
 \r
 #string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Instance for DXE_RUNTIME_DRIVER"\r
 \r
-#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
index ec9c8e7c055341e9f11235dde7cc194ec578b465..91ec3e03bf5e7700810c90929c85f295c2a56568 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
@@ -7,8 +7,7 @@
 #  buffer overflow or integer overflow.\r
 #\r
 #  Note: SHA-384 Digest functions, SHA-512 Digest functions,\r
-#  HMAC-SHA1 functions, RSA external\r
-#  functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and\r
+#  RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and\r
 #  authenticode signature verification functions are not supported in this instance.\r
 #\r
 #  Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>\r
@@ -39,7 +38,6 @@
   Hash/CryptSha256.c\r
   Hash/CryptSm3.c\r
   Hash/CryptSha512Null.c\r
-  Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAes.c\r

diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
index 8eb3acac9339395b1b7ae603867bb1cf233582fb..f0c33abbcf221fd99757dddbf34f0d48ebb4c48a 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.uni
@@ -6,7 +6,7 @@
 // This external input must be validated carefully to avoid security issues such as\r
 // buffer overflow or integer overflow.\r
 //\r
-// Note: HMAC-SHA1 functions, AES\r
+// Note: AES\r
 // functions, RSA external functions, PKCS#7 SignedData sign functions,\r
 // Diffie-Hellman functions, and authenticode signature verification functions are\r
 // not supported in this instance.\r
@@ -20,5 +20,5 @@
 \r
 #string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Instance for SMM driver"\r
 \r
-#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: HMAC-SHA1 functions, AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This module requires additional review when modified. This library will have external input - signature. This external input must be validated carefully to avoid security issues such as buffer overflow or integer overflow. Note: AES functions, RSA external functions, PKCS#7 SignedData sign functions, Diffie-Hellman functions, and authenticode signature verification functions are not supported in this instance."\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
index 558ccfc002f03a1b77b7839fd2ded226e08e05cb..689af4fedd68e1e4acd87f6dd7fee8fa06684315 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
+++ b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
@@ -34,7 +34,6 @@
   Hash/CryptSha256Null.c\r
   Hash/CryptSha512Null.c\r
   Hash/CryptSm3Null.c\r
-  Hmac/CryptHmacSha1Null.c\r
   Hmac/CryptHmacSha256Null.c\r
   Kdf/CryptHkdfNull.c\r
   Cipher/CryptAesNull.c\r

diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
deleted file mode 100644 (file)
index e8c0f34..0000000
--- a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
+++ /dev/null
@@ -1,139 +0,0 @@
-/** @file\r
-  HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.\r
-\r
-Copyright (c) 2012 - 2020, Intel Corporation. All rights reserved.<BR>\r
-SPDX-License-Identifier: BSD-2-Clause-Patent\r
-\r
-**/\r
-\r
-#include "InternalCryptLib.h"\r
-\r
-/**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  Return NULL to indicate this interface is not supported.\r
-\r
-  @return  NULL  This interface is not supported..\r
-\r
-**/\r
-VOID *\r
-EFIAPI\r
-HmacSha1New (\r
-  VOID\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return NULL;\r
-}\r
-\r
-/**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  This function will do nothing.\r
-\r
-  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-HmacSha1Free (\r
-  IN  VOID  *HmacSha1Ctx\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return;\r
-}\r
-\r
-/**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
-  @param[in]   Key              Pointer to the user-supplied key.\r
-  @param[in]   KeySize          Key size in bytes.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1SetKey (\r
-  OUT  VOID         *HmacSha1Context,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeySize\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
-  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Duplicate (\r
-  IN   CONST VOID  *HmacSha1Context,\r
-  OUT  VOID        *NewHmacSha1Context\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
-  @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
-  @param[in]       DataSize        Size of Data buffer in bytes.\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Update (\r
-  IN OUT  VOID        *HmacSha1Context,\r
-  IN      CONST VOID  *Data,\r
-  IN      UINTN       DataSize\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r
-\r
-/**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  Return FALSE to indicate this interface is not supported.\r
-\r
-  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
-  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
-                                    value (20 bytes).\r
-\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Final (\r
-  IN OUT  VOID   *HmacSha1Context,\r
-  OUT     UINT8  *HmacValue\r
-  )\r
-{\r
-  ASSERT (FALSE);\r
-  return FALSE;\r
-}\r

diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index dfe7fb7e91d34feb88c199cbc01baba81539a42b..a614b61ed48e2a2efe35efb3761c7f69c9e1bfef 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -1015,157 +1015,6 @@ Sm3HashAll (
 //    MAC (Message Authentication Code) Primitive\r
 //=====================================================================================\r
 \r
-/**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  If this interface is not supported, then return NULL.\r
-\r
-  @return  Pointer to the HMAC_CTX context that has been initialized.\r
-           If the allocations fails, HmacSha1New() returns NULL.\r
-  @return  NULL   This interface is not supported.\r
-\r
-**/\r
-VOID *\r
-EFIAPI\r
-HmacSha1New (\r
-  VOID\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (HmacSha1New, (), NULL);\r
-}\r
-\r
-/**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  If this interface is not supported, then do nothing.\r
-\r
-  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-HmacSha1Free (\r
-  IN  VOID  *HmacSha1Ctx\r
-  )\r
-{\r
-  CALL_VOID_CRYPTO_SERVICE (HmacSha1Free, (HmacSha1Ctx));\r
-}\r
-\r
-/**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
-  @param[in]   Key              Pointer to the user-supplied key.\r
-  @param[in]   KeySize          Key size in bytes.\r
-\r
-  @retval TRUE   The Key is set successfully.\r
-  @retval FALSE  The Key is set unsuccessfully.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1SetKey (\r
-  OUT  VOID         *HmacSha1Context,\r
-  IN   CONST UINT8  *Key,\r
-  IN   UINTN        KeySize\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (HmacSha1SetKey, (HmacSha1Context, Key, KeySize), FALSE);\r
-}\r
-\r
-/**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If NewHmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
-  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
-\r
-  @retval TRUE   HMAC-SHA1 context copy succeeded.\r
-  @retval FALSE  HMAC-SHA1 context copy failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Duplicate (\r
-  IN   CONST VOID  *HmacSha1Context,\r
-  OUT  VOID        *NewHmacSha1Context\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (HmacSha1Duplicate, (HmacSha1Context, NewHmacSha1Context), FALSE);\r
-}\r
-\r
-/**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  This function performs HMAC-SHA1 digest on a data buffer of the specified size.\r
-  It can be called multiple times to compute the digest of long or discontinuous data streams.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by\r
-  HmacSha1Final(). Behavior with invalid context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
-  @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
-  @param[in]       DataSize        Size of Data buffer in bytes.\r
-\r
-  @retval TRUE   HMAC-SHA1 data digest succeeded.\r
-  @retval FALSE  HMAC-SHA1 data digest failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Update (\r
-  IN OUT  VOID        *HmacSha1Context,\r
-  IN      CONST VOID  *Data,\r
-  IN      UINTN       DataSize\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (HmacSha1Update, (HmacSha1Context, Data, DataSize), FALSE);\r
-}\r
-\r
-/**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  This function completes HMAC-SHA1 hash computation and retrieves the digest value into\r
-  the specified memory. After this function has been called, the HMAC-SHA1 context cannot\r
-  be used again.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized\r
-  by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If HmacValue is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
-  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
-                                    value (20 bytes).\r
-\r
-  @retval TRUE   HMAC-SHA1 digest computation succeeded.\r
-  @retval FALSE  HMAC-SHA1 digest computation failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-HmacSha1Final (\r
-  IN OUT  VOID   *HmacSha1Context,\r
-  OUT     UINT8  *HmacValue\r
-  )\r
-{\r
-  CALL_CRYPTO_SERVICE (HmacSha1Final, (HmacSha1Context, HmacValue), FALSE);\r
-}\r
-\r
 /**\r
   Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.\r
 \r

diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Private/Protocol/Crypto.h
index bd4cd7f383f052c8fdeebb35cf0fff96cab11c80..d16739077438f02bc9da9c156ab1dc3da3cdf31b 100644 (file)
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Private/Protocol/Crypto.h
@@ -89,140 +89,49 @@ BOOLEAN
   OUT     UINT8  *HmacValue\r
   );\r
 \r
-\r
 /**\r
-  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.\r
-\r
-  If this interface is not supported, then return NULL.\r
-\r
-  @return  Pointer to the HMAC_CTX context that has been initialized.\r
-           If the allocations fails, HmacSha1New() returns NULL.\r
-  @return  NULL   This interface is not supported.\r
+  HMAC SHA1 is deprecated and unsupported any longer.\r
+  Keep the function field for binary compability.\r
 \r
 **/\r
 typedef\r
 VOID*\r
-(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_NEW) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_NEW) (\r
   VOID\r
   );\r
 \r
-/**\r
-  Release the specified HMAC_CTX context.\r
-\r
-  If this interface is not supported, then do nothing.\r
-\r
-  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.\r
-\r
-**/\r
 typedef\r
 VOID\r
-(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_FREE) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FREE) (\r
   IN  VOID  *HmacSha1Ctx\r
   );\r
 \r
-\r
-/**\r
-  Set user-supplied key for subsequent use. It must be done before any\r
-  calling to HmacSha1Update().\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context.\r
-  @param[in]   Key              Pointer to the user-supplied key.\r
-  @param[in]   KeySize          Key size in bytes.\r
-\r
-  @retval TRUE   The Key is set successfully.\r
-  @retval FALSE  The Key is set unsuccessfully.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_SET_KEY) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_SET_KEY) (\r
   OUT  VOID         *HmacSha1Context,\r
   IN   CONST UINT8  *Key,\r
   IN   UINTN        KeySize\r
   );\r
 \r
-\r
-/**\r
-  Makes a copy of an existing HMAC-SHA1 context.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If NewHmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.\r
-  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.\r
-\r
-  @retval TRUE   HMAC-SHA1 context copy succeeded.\r
-  @retval FALSE  HMAC-SHA1 context copy failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_DUPLICATE) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_DUPLICATE) (\r
   IN   CONST VOID  *HmacSha1Context,\r
   OUT  VOID        *NewHmacSha1Context\r
   );\r
 \r
-\r
-/**\r
-  Digests the input data and updates HMAC-SHA1 context.\r
-\r
-  This function performs HMAC-SHA1 digest on a data buffer of the specified size.\r
-  It can be called multiple times to compute the digest of long or discontinuous data streams.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized by\r
-  HmacSha1Final(). Behavior with invalid context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.\r
-  @param[in]       Data            Pointer to the buffer containing the data to be digested.\r
-  @param[in]       DataSize        Size of Data buffer in bytes.\r
-\r
-  @retval TRUE   HMAC-SHA1 data digest succeeded.\r
-  @retval FALSE  HMAC-SHA1 data digest failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_UPDATE) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_UPDATE) (\r
   IN OUT  VOID        *HmacSha1Context,\r
   IN      CONST VOID  *Data,\r
   IN      UINTN       DataSize\r
   );\r
 \r
-\r
-/**\r
-  Completes computation of the HMAC-SHA1 digest value.\r
-\r
-  This function completes HMAC-SHA1 hash computation and retrieves the digest value into\r
-  the specified memory. After this function has been called, the HMAC-SHA1 context cannot\r
-  be used again.\r
-  HMAC-SHA1 context should be initialized by HmacSha1New(), and should not be finalized\r
-  by HmacSha1Final(). Behavior with invalid HMAC-SHA1 context is undefined.\r
-\r
-  If HmacSha1Context is NULL, then return FALSE.\r
-  If HmacValue is NULL, then return FALSE.\r
-  If this interface is not supported, then return FALSE.\r
-\r
-  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.\r
-  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest\r
-                                    value (20 bytes).\r
-\r
-  @retval TRUE   HMAC-SHA1 digest computation succeeded.\r
-  @retval FALSE  HMAC-SHA1 digest computation failed.\r
-  @retval FALSE  This interface is not supported.\r
-\r
-**/\r
 typedef\r
 BOOLEAN\r
-(EFIAPI *EDKII_CRYPTO_HMAC_SHA1_FINAL) (\r
+(EFIAPI *DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FINAL) (\r
   IN OUT  VOID   *HmacSha1Context,\r
   OUT     UINT8  *HmacValue\r
   );\r
@@ -3538,13 +3447,13 @@ struct _EDKII_CRYPTO_PROTOCOL {
   DEPRECATED_EDKII_CRYPTO_HMAC_MD5_DUPLICATE      DeprecatedHmacMd5Duplicate;\r
   DEPRECATED_EDKII_CRYPTO_HMAC_MD5_UPDATE         DeprecatedHmacMd5Update;\r
   DEPRECATED_EDKII_CRYPTO_HMAC_MD5_FINAL          DeprecatedHmacMd5Final;\r
-  /// HMAC SHA1\r
-  EDKII_CRYPTO_HMAC_SHA1_NEW                      HmacSha1New;\r
-  EDKII_CRYPTO_HMAC_SHA1_FREE                     HmacSha1Free;\r
-  EDKII_CRYPTO_HMAC_SHA1_SET_KEY                  HmacSha1SetKey;\r
-  EDKII_CRYPTO_HMAC_SHA1_DUPLICATE                HmacSha1Duplicate;\r
-  EDKII_CRYPTO_HMAC_SHA1_UPDATE                   HmacSha1Update;\r
-  EDKII_CRYPTO_HMAC_SHA1_FINAL                    HmacSha1Final;\r
+  /// HMAC SHA1 - deprecated and unsupported\r
+  DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_NEW           DeprecatedHmacSha1New;\r
+  DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FREE          DeprecatedHmacSha1Free;\r
+  DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_SET_KEY       DeprecatedHmacSha1SetKey;\r
+  DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_DUPLICATE     DeprecatedHmacSha1Duplicate;\r
+  DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_UPDATE        DeprecatedHmacSha1Update;\r
+  DEPRECATED_EDKII_CRYPTO_HMAC_SHA1_FINAL         DeprecatedHmacSha1Final;\r
   /// HMAC SHA256\r
   EDKII_CRYPTO_HMAC_SHA256_NEW                    HmacSha256New;\r
   EDKII_CRYPTO_HMAC_SHA256_FREE                   HmacSha256Free;\r