回复: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5 and SHA1 support

["gaoliming" <gaoliming@byosoft.com.cn>]

Zhichao:
  I see the latest V4 version have been sent. Few days may be required for
code review. 

Hi, NetworkPkg, CryptoPkg, OvmfPkg, ArmVirtPkg package maintainer and
reviewer:
  Because stable tag 202011 is coming soon, can you finish the code review
for this patch set (V4 version) before Nov 17 (Next Tuesday)? 

Thanks
Liming
> -----邮件原件-----
> 发件人: bounce+27952+67411+4905953+8761045@groups.io
> <bounce+27952+67411+4905953+8761045@groups.io> 代表 Gao, Zhichao
> 发送时间: 2020年11月13日 9:08
> 收件人: devel@edk2.groups.io; Gao, Zhichao <zhichao.gao@intel.com>
> 抄送: Justen, Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek
> <lersek@redhat.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Sami
> Mujawar <sami.mujawar@arm.com>; Leif Lindholm <leif@nuviainc.com>;
> Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
> Lu, XiaoyuX <xiaoyux.lu@intel.com>; Jiang, Guomin
> <guomin.jiang@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> Steele, Kelly <kelly.steele@intel.com>; Sun, Zailiang <zailiang.sun@intel.
com>;
> Qian, Yi <yi.qian@intel.com>; Liming Gao <gaoliming@byosoft.com.cn>;
> Maciej Rabeda <maciej.rabeda@linux.intel.com>; Wu, Jiaxin
> <jiaxin.wu@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>; Feng, Roger
> <roger.feng@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> 主题: Re: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5 and
> SHA1 support
> 
> I plan to catch the 202011 stable tag for this patch set. Please help to
review
> this patch. I would like to request to extend time for review after
feature
> freeze.
> Make the default setting for security and let the user of edk2 aware of it
if
> they are using unsecure functions make sense.
> If you have any doubt or comment, please feel free to let me know.
> 
> Thanks,
> Zhichao
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Gao,
> Zhichao
> > Sent: Wednesday, November 11, 2020 1:37 AM
> > To: devel@edk2.groups.io
> > Cc: Justen, Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek
> > <lersek@redhat.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Sami
> > Mujawar <sami.mujawar@arm.com>; Leif Lindholm <leif@nuviainc.com>;
> Yao,
> > Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Lu,
> > XiaoyuX <xiaoyux.lu@intel.com>; Jiang, Guomin <guomin.jiang@intel.com>;
> > Kinney, Michael D <michael.d.kinney@intel.com>; Steele, Kelly
> > <kelly.steele@intel.com>; Sun, Zailiang <zailiang.sun@intel.com>; Qian,
Yi
> > <yi.qian@intel.com>; Liming Gao <gaoliming@byosoft.com.cn>; Maciej
> Rabeda
> > <maciej.rabeda@linux.intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; Fu,
> Siyuan
> > <siyuan.fu@intel.com>; Feng, Roger <roger.feng@intel.com>; Liu, Zhiguang
> > <zhiguang.liu@intel.com>
> > Subject: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5 and
> SHA1
> > support
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3021
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3027
> >
> > MD5 is deprecated, make it disable as default for security.
> > It required to set MD5 enable explicitly if the module is still using
MD5. List
> the
> > modules that are still using it:
> > iSCSI, Hash2DxeCrypto, CryptoDxe(Pei, Smm) (with PACKAGE or ALL config).
> >
> > This patch set would affact the platforms that are using iSCSI function.
> >
> > V2:
> > Remove MD5 and SHA1 support of Hash2DxeCrypto.
> > Remove the MD5 GUID defination in MdePkg.dec. SHA1 related GUIDs are
> still
> > using in TPM2, so keep them.
> > No requirement to add MD5 enable MACRO in SecurityPkg.
> >
> > V3:
> > Explicitly enable iSCSI for ArmVirtQemu, ArmVirtQemuKernel, OvmfPkgIa32,
> > OvmfPkgIa32X64, OvmfPkgX64 and BhyveX64.
> > And set the MD5 enable base on the new MD5 MACRO.
> > Rejust the patch order.
> >
> > Cc: Jordan Justen <jordan.l.justen@intel.com>
> > Cc: Laszlo Ersek <lersek@redhat.com>
> > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> > Cc: Sami Mujawar <sami.mujawar@arm.com>
> > Cc: Leif Lindholm <leif@nuviainc.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Jian J Wang <jian.j.wang@intel.com>
> > Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
> > Cc: Guomin Jiang <guomin.jiang@intel.com>
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Kelly Steele <kelly.steele@intel.com>
> > Cc: Zailiang Sun <zailiang.sun@intel.com>
> > Cc: Yi Qian <yi.qian@intel.com>
> > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
> > Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> > Cc: Siyuan Fu <siyuan.fu@intel.com>
> > Cc: Roger Feng <roger.feng@intel.com>
> > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
> >
> > Zhichao Gao (12):
> >   SecurityPkg/Hash2DxeCrypto: Remove MD5 support
> >   SecurityPkg/Hash2DxeCrypto: Remove SHA1 support
> >   CryptoPkg/dsc: Enable MD5 when CRYPTO_SERVICES enable MD5
> >   NetworkPkg: Enable MD5 while enable iSCSI
> >   ArmVirtPkg/ArmVirtQemu.dsc: Enable MD5 while enable iSCSI
> >   ArmVirtPkg/ArmVirtQemuKernel.dsc: Enable MD5 while enable iSCSI
> >   OvmfPkg/OvmfPkgIa32.dsc: Enable MD5 while enable iSCSI
> >   OvmfPkg/OvmfPkgIa32X64.dsc: Enable MD5 while enable iSCSI
> >   OvmfPkg/OvmfPkgX64.dsc: Enable MD5 while enable iSCSI
> >   OvmfPkg/BhyveX64.dsc: Enable MD5 while enable iSCSI
> >   NetworkPkg/Defines: Make iSCSI disable as default
> >   CryptoPkg: Make the MD5 disable as default for security
> >
> >  ArmVirtPkg/ArmVirtQemu.dsc                             | 8
> +++++++-
> >  ArmVirtPkg/ArmVirtQemuKernel.dsc                       | 8
> +++++++-
> >  CryptoPkg/CryptoPkg.dsc                                | 3 +++
> >  CryptoPkg/Driver/Crypto.c                              | 4 ++--
> >  CryptoPkg/Include/Library/BaseCryptLib.h               | 2 +-
> >  CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c         | 2 +-
> >  CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c | 2 +-
> >  NetworkPkg/Network.dsc.inc                             | 5
> +++++
> >  NetworkPkg/NetworkDefines.dsc.inc                      | 4 ++--
> >  OvmfPkg/Bhyve/BhyveX64.dsc                             | 7
> ++++++-
> >  OvmfPkg/OvmfPkgIa32.dsc                                | 5
> +++++
> >  OvmfPkg/OvmfPkgIa32X64.dsc                             | 5
> +++++
> >  OvmfPkg/OvmfPkgX64.dsc                                 | 5
> +++++
> >  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.c            | 2 --
> >  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf          | 4 +---
> >  15 files changed, 51 insertions(+), 15 deletions(-)
> >
> > --
> > 2.21.0.windows.1
> >
> >
> >
> >
> >
> 
> 
> 
> 
>