CryptoPkg: Document and disable deprecated crypto services

Also note services that are recommended to be disabled and
update CryptoPkg.dsc PcdCryptoServiceFamilyEnable settings
to disable all deprecated services.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Christopher Zurcher <christopher.zurcher@microsoft.com>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index 8c6906acf00607eaae1206019e3aea32e1ee52c2..032b9e6377379758e96d59cf82697e956d5809d3 100644 (file)
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -151,7 +151,6 @@
 !if $(CRYPTO_SERVICES) IN "PACKAGE ALL"\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha384.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Md5.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Dh.Family                                | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Random.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
@@ -161,8 +160,10 @@
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.X509.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tdes.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.GetContextSize              | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init                        | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt                  | TRUE\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt                  | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Arc4.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Family                              | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
@@ -173,7 +174,7 @@
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.ParallelHash.Family                      | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Bn.Family                                | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Ec.Family                                | 0\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Ec.Family                                | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
 !endif\r
 \r
 !if $(CRYPTO_SERVICES) == MIN_PEI\r
@@ -217,6 +218,7 @@
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Tls.Family                               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsSet.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.TlsGet.Family                            | PCD_CRYPTO_SERVICE_ENABLE_FAMILY\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.GetContextSize              | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init                        | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt                  | TRUE\r
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt                  | TRUE\r

diff --git a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
index f1f5084e70f4bc850591d7d6f7e242e68a06a1cd..74eaf44cca3e81062cd52fa8146ca9e0755d0502 100644 (file)
--- a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
+++ b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
@@ -1,6 +1,26 @@
 /** @file\r
   Defines the PCD_CRYPTO_SERVICE_FAMILY_ENABLE structure associated with\r
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.\r
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable that is used\r
+  to enable/disable crypto services at either the family scope or the\r
+  individual service scope.  Platforms can minimize the number of enabled\r
+  services to reduce size.\r
+\r
+  The following services have been deprecated and must never be enabled.\r
+  The associated fields in this data structure are never removed or replaced\r
+  to preseve the binary layout of the data structure.  New services are\r
+  always added to the end of the data structure.\r
+  * HmacMd5 family\r
+  * HmacSha1 family\r
+  * Md4 family\r
+  * Md5 family\r
+  * Tdes family\r
+  * Arc4 family\r
+  * Aes.Services.EcbEncrypt service\r
+  * Aes.Services.EcbDecrypt service\r
+\r
+  Is is recommended that the following services always be disabled and may\r
+  be deprecated in the future.\r
+  * Sha1 family\r
 \r
   Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.<BR>\r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
@@ -25,25 +45,25 @@
 typedef struct {\r
   union {\r
     struct {\r
-      UINT8    New       : 1;\r
-      UINT8    Free      : 1;\r
-      UINT8    SetKey    : 1;\r
-      UINT8    Duplicate : 1;\r
-      UINT8    Update    : 1;\r
-      UINT8    Final     : 1;\r
+      UINT8    New       : 1;  // Deprecated\r
+      UINT8    Free      : 1;  // Deprecated\r
+      UINT8    SetKey    : 1;  // Deprecated\r
+      UINT8    Duplicate : 1;  // Deprecated\r
+      UINT8    Update    : 1;  // Deprecated\r
+      UINT8    Final     : 1;  // Deprecated\r
     } Services;\r
-    UINT32    Family;\r
+    UINT32    Family;          // Deprecated\r
   } HmacMd5;\r
   union {\r
     struct {\r
-      UINT8    New       : 1;\r
-      UINT8    Free      : 1;\r
-      UINT8    SetKey    : 1;\r
-      UINT8    Duplicate : 1;\r
-      UINT8    Update    : 1;\r
-      UINT8    Final     : 1;\r
+      UINT8    New       : 1;  // Deprecated\r
+      UINT8    Free      : 1;  // Deprecated\r
+      UINT8    SetKey    : 1;  // Deprecated\r
+      UINT8    Duplicate : 1;  // Deprecated\r
+      UINT8    Update    : 1;  // Deprecated\r
+      UINT8    Final     : 1;  // Deprecated\r
     } Services;\r
-    UINT32    Family;\r
+    UINT32    Family;          // Deprecated\r
   } HmacSha1;\r
   union {\r
     struct {\r
@@ -71,26 +91,26 @@ typedef struct {
   } HmacSha384;\r
   union {\r
     struct {\r
-      UINT8    GetContextSize : 1;\r
-      UINT8    Init           : 1;\r
-      UINT8    Duplicate      : 1;\r
-      UINT8    Update         : 1;\r
-      UINT8    Final          : 1;\r
-      UINT8    HashAll        : 1;\r
+      UINT8    GetContextSize : 1;  // Deprecated\r
+      UINT8    Init           : 1;  // Deprecated\r
+      UINT8    Duplicate      : 1;  // Deprecated\r
+      UINT8    Update         : 1;  // Deprecated\r
+      UINT8    Final          : 1;  // Deprecated\r
+      UINT8    HashAll        : 1;  // Deprecated\r
     } Services;\r
-    UINT32    Family;\r
+    UINT32    Family;               // Deprecated\r
   } Md4;\r
   union {\r
     struct {\r
-      UINT8    GetContextSize : 1;\r
-      UINT8    Init           : 1;\r
-      UINT8    Duplicate      : 1;\r
-      UINT8    Update         : 1;\r
-      UINT8    Final          : 1;\r
-      UINT8    HashAll        : 1;\r
+      UINT8    GetContextSize : 1;  // Deprecated\r
+      UINT8    Init           : 1;  // Deprecated\r
+      UINT8    Duplicate      : 1;  // Deprecated\r
+      UINT8    Update         : 1;  // Deprecated\r
+      UINT8    Final          : 1;  // Deprecated\r
+      UINT8    HashAll        : 1;  // Deprecated\r
     } Services;\r
     UINT32    Family;\r
-  } Md5;\r
+  } Md5;                            // Deprecated\r
   union {\r
     struct {\r
       UINT8    Pkcs1v2Encrypt             : 1;\r
@@ -143,14 +163,14 @@ typedef struct {
   } Rsa;\r
   union {\r
     struct {\r
-      UINT8    GetContextSize : 1;\r
-      UINT8    Init           : 1;\r
-      UINT8    Duplicate      : 1;\r
-      UINT8    Update         : 1;\r
-      UINT8    Final          : 1;\r
-      UINT8    HashAll        : 1;\r
+      UINT8    GetContextSize : 1;  // Recommend disable\r
+      UINT8    Init           : 1;  // Recommend disable\r
+      UINT8    Duplicate      : 1;  // Recommend disable\r
+      UINT8    Update         : 1;  // Recommend disable\r
+      UINT8    Final          : 1;  // Recommend disable\r
+      UINT8    HashAll        : 1;  // Recommend disable\r
     } Services;\r
-    UINT32    Family;\r
+    UINT32    Family;               // Recommend disable\r
   } Sha1;\r
   union {\r
     struct {\r
@@ -216,21 +236,21 @@ typedef struct {
   } X509;\r
   union {\r
     struct {\r
-      UINT8    GetContextSize : 1;\r
-      UINT8    Init           : 1;\r
-      UINT8    EcbEncrypt     : 1;\r
-      UINT8    EcbDecrypt     : 1;\r
-      UINT8    CbcEncrypt     : 1;\r
-      UINT8    CbcDecrypt     : 1;\r
+      UINT8    GetContextSize : 1;  // Deprecated\r
+      UINT8    Init           : 1;  // Deprecated\r
+      UINT8    EcbEncrypt     : 1;  // Deprecated\r
+      UINT8    EcbDecrypt     : 1;  // Deprecated\r
+      UINT8    CbcEncrypt     : 1;  // Deprecated\r
+      UINT8    CbcDecrypt     : 1;  // Deprecated\r
     } Services;\r
-    UINT32    Family;\r
+    UINT32    Family;               // Deprecated\r
   } Tdes;\r
   union {\r
     struct {\r
       UINT8    GetContextSize : 1;\r
       UINT8    Init           : 1;\r
-      UINT8    EcbEncrypt     : 1;\r
-      UINT8    EcbDecrypt     : 1;\r
+      UINT8    EcbEncrypt     : 1;  // Deprecated\r
+      UINT8    EcbDecrypt     : 1;  // Deprecated\r
       UINT8    CbcEncrypt     : 1;\r
       UINT8    CbcDecrypt     : 1;\r
     } Services;\r
@@ -238,13 +258,13 @@ typedef struct {
   } Aes;\r
   union {\r
     struct {\r
-      UINT8    GetContextSize : 1;\r
-      UINT8    Init           : 1;\r
-      UINT8    Encrypt        : 1;\r
-      UINT8    Decrypt        : 1;\r
-      UINT8    Reset          : 1;\r
+      UINT8    GetContextSize : 1;  // Deprecated\r
+      UINT8    Init           : 1;  // Deprecated\r
+      UINT8    Encrypt        : 1;  // Deprecated\r
+      UINT8    Decrypt        : 1;  // Deprecated\r
+      UINT8    Reset          : 1;  // Deprecated\r
     } Services;\r
-    UINT32    Family;\r
+    UINT32    Family;               // Deprecated\r
   } Arc4;\r
   union {\r
     struct {\r