From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 7D6B678003C for ; Thu, 31 Aug 2023 11:15:05 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=pAD8/JOZm3wgGBvVgO8T16ZvYw0SnWdgxQQK3ofXRXc=; c=relaxed/simple; d=groups.io; h=Message-ID:Date:MIME-Version:User-Agent:Subject:To:CC:References:From:In-Reply-To:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1693480504; v=1; b=a5YDljgWk+/ebJ+MvqAdK7JxAx+10k96zJF9PHBPavnGqK+Rp1rdzdoJAv4I8lYkOcxqBXTF KvWJMnjsdyj1bFcT9zIuLuQf+pBAg55XmchFcUx88QVIjbG1B2CQHIwyiBv7EzWIXw3Vw/bny3B Y4dKwA5fSK0w08Ya87onagPo= X-Received: by 127.0.0.2 with SMTP id BHLkYY7687511x9T6VPkUQFh; Thu, 31 Aug 2023 04:15:04 -0700 X-Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) by mx.groups.io with SMTP id smtpd.web10.14288.1693480503491708727 for ; Thu, 31 Aug 2023 04:15:03 -0700 X-Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 37VAuDh7014274; Thu, 31 Aug 2023 11:14:52 GMT X-Received: from nasanppmta05.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3st6cta6dc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 31 Aug 2023 11:14:52 +0000 X-Received: from nasanex01c.na.qualcomm.com (nasanex01c.na.qualcomm.com [10.45.79.139]) by NASANPPMTA05.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 37VBEoeZ020793 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 31 Aug 2023 11:14:51 GMT X-Received: from [10.111.143.38] (10.80.80.8) by nasanex01c.na.qualcomm.com (10.45.79.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.36; Thu, 31 Aug 2023 04:14:49 -0700 Message-ID: <0cca40e7-d050-4e2b-bbdd-ebdc800124e5@quicinc.com> Date: Thu, 31 Aug 2023 12:14:46 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [edk2-devel] [edk2/add_mbedtls PATCH 0/9] *** Add HMAC/HKDF/RSA/HASH features based on Mbedtls *** To: "Yao, Jiewen" , "devel@edk2.groups.io" , "spbrogan@outlook.com" , "Hou, Wenxing" CC: "afish@apple.com" , "Kinney, Michael D" References: <20230830075220.2070-1-wenxing.hou@intel.com> From: "Leif Lindholm" In-Reply-To: X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01b.na.qualcomm.com (10.46.141.250) To nasanex01c.na.qualcomm.com (10.45.79.139) X-QCInternal: smtphost X-Proofpoint-GUID: YK8MpfY-Xtyd-WaWvk2hkTkXfLt_K5Ze X-Proofpoint-ORIG-GUID: YK8MpfY-Xtyd-WaWvk2hkTkXfLt_K5Ze X-MIME-Autoconverted: from 8bit to quoted-printable by mx0a-0031df01.pphosted.com id 37VAuDh7014274 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,quic_llindhol@quicinc.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: wnrfAAVBFT32cg3h7VBMgxqFx7686176AA= Content-Language: en-GB Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=a5YDljgW; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=quicinc.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io Like Sean, I'm very positive to the work - and I'm excited about the=20 opportunity to formalise the abstractions. But Sean is also asking to import the mbedTLS code outright instead of=20 using submodules, which adds an additional dimension to the matrix below. I'm not too concerned over the infrastructure change as such, but I=20 would prefer to not move the dial even further in the direction of=20 "upstream is a swarm of repositories". This adds complexity for new=20 developers. And submodules are way easier for upstream to track external=20 projects through. At the cost of complicating the maintenance process=20 for released products. Which isn't great. Am I kicking the can too far down the road if I suggest we do some=20 brainstorming around ways to achieve this with the least amount of=20 friction for everyone at the plugfest in October? Regards, Leif On 2023-08-31 03:34, Yao, Jiewen wrote: > Hi Sean/Andrew/Leif/Mike > Now, I think we actually have multiple options to handle this: >=20 > 1) CryptoPkg in edk2 repo (add MbedTls to existing CryptoPkg) >=20 > 2) CryptoPkg in edk2 repo + a new MbedTlsCryptoPkg in edk2 repo >=20 > 3) CryptoPkg in edk2 repo + MbedTlsCryptoPkg in a new repo >=20 > 4) Move CryptoPkg from edk2 repo to OpensslCryptoPkg in a new repo + Mbed= TlsCryptoPkg in another new repo >=20 >=20 >=20 > Current patch is for option 1). > Sean's proposal is for option 4). >=20 > I feel 4) is very aggressive. My worry is that it will involve many infra= structure change such as CI, and all edk2 platforms. >=20 > What about 2) or 3) ? >=20 > Thank you > Yao, Jiewen >=20 >=20 >> -----Original Message----- >> From: Yao, Jiewen >> Sent: Thursday, August 31, 2023 8:10 AM >> To: devel@edk2.groups.io; spbrogan@outlook.com; Hou, Wenxing >> >> Cc: afish@apple.com; quic_llindhol@quicinc.com; Kinney, Michael D >> >> Subject: RE: [edk2-devel] [edk2/add_mbedtls PATCH 0/9] *** Add >> HMAC/HKDF/RSA/HASH features based on Mbedtls *** >> >> Hi Sean >> Thanks for the feedback. Personally, I don't have strong opinion on this= . >> >> Since this is a big change, I would like to have Steward member's opinio= n. >> >> Hi Andrew/Leif/Mike >> What do you think? >> >> Thank you >> Yao, Jiewen >> >> >>> -----Original Message----- >>> From: devel@edk2.groups.io On Behalf Of Sean >>> Sent: Thursday, August 31, 2023 2:57 AM >>> To: devel@edk2.groups.io; Hou, Wenxing >>> Subject: Re: [edk2-devel] [edk2/add_mbedtls PATCH 0/9] *** Add >>> HMAC/HKDF/RSA/HASH features based on Mbedtls *** >>> >>> I appreciate and really like this work to enable mbedtls but I don't >>> like the idea of adding another submodule to edk2. >>> >>> For a long time there has been discussion about formalizing the >>> abstraction of the edk2 crypto api so that it would be practical to >>> implement edk2's crypto using various libraries.=C2=A0=C2=A0 I propose = we remove >>> openssl from the edk2 CryptoPkg and into the OpenSslCryptoPkg in anothe= r >>> new tianocore repository dedicated to OpenSsl.=C2=A0 MbedTls could then= be >>> checked into the MbedTlsCryptoPkg and added to another new repository. >>> This would also have the benefit of breaking the tight coupling of edk2 >>> stable tags from the crypto used in the code base (crypto has more >>> widely tracked vulnerabilities). >>> >>> Happy to discuss more if others have different ideas. >>> >>> Thanks >>> >>> Sean >>> >>> >>> >>> On 8/30/2023 12:52 AM, Wenxing Hou wrote: >>>> *** Add BaseCryptLibMbedTls for CryptoPkg, which can be an alternative= to >>> OpenSSL in some scenarios. There are four features in the patch: >>> HMAC/HKDF/RSA/HASH.*** >>>> >>>> Wenxing Hou (9): >>>> CryptoPkg: Add mbedtls submodule for EDKII >>>> CryptoPkg: Add mbedtls_config and MbedTlsLib.inf >>>> CryptoPkg: Add HMAC functions based on Mbedtls >>>> CryptoPkg: Add HKDF functions based on Mbedtls >>>> CryptoPkg: Add RSA functions based on Mbedtls >>>> CryptoPkg: Add all .inf files for BaseCryptLibMbedTls >>>> CryptoPkg: Add Null functions for building pass >>>> CryptoPkg: Add MD5/SHA1/SHA2 functions based on Mbedtls >>>> CryptoPkg: Add Mbedtls submodule in CI >>>> >>>> .gitmodules | 3 + >>>> .pytool/CISettings.py | 2 + >>>> CryptoPkg/CryptoPkg.ci.yaml | 66 +- >>>> CryptoPkg/CryptoPkg.dec | 4 + >>>> CryptoPkg/CryptoPkgMbedTls.dsc | 280 ++ >>>> .../BaseCryptLibMbedTls/BaseCryptLib.inf | 81 + >>>> .../BaseCryptLibMbedTls/Bn/CryptBnNull.c | 520 +++ >>>> .../Cipher/CryptAeadAesGcmNull.c | 100 + >>>> .../BaseCryptLibMbedTls/Cipher/CryptAesNull.c | 159 + >>>> .../BaseCryptLibMbedTls/Hash/CryptMd5.c | 234 + >>>> .../BaseCryptLibMbedTls/Hash/CryptMd5Null.c | 163 + >>>> .../Hash/CryptParallelHashNull.c | 40 + >>>> .../BaseCryptLibMbedTls/Hash/CryptSha1.c | 234 + >>>> .../BaseCryptLibMbedTls/Hash/CryptSha1Null.c | 166 + >>>> .../BaseCryptLibMbedTls/Hash/CryptSha256.c | 227 + >>>> .../Hash/CryptSha256Null.c | 162 + >>>> .../BaseCryptLibMbedTls/Hash/CryptSha512.c | 447 ++ >>>> .../Hash/CryptSha512Null.c | 275 ++ >>>> .../BaseCryptLibMbedTls/Hash/CryptSm3Null.c | 164 + >>>> .../BaseCryptLibMbedTls/Hmac/CryptHmac.c | 620 +++ >>>> .../BaseCryptLibMbedTls/Hmac/CryptHmacNull.c | 359 ++ >>>> .../BaseCryptLibMbedTls/InternalCryptLib.h | 44 + >>>> .../BaseCryptLibMbedTls/Kdf/CryptHkdf.c | 372 ++ >>>> .../BaseCryptLibMbedTls/Kdf/CryptHkdfNull.c | 192 + >>>> .../BaseCryptLibMbedTls/PeiCryptLib.inf | 101 + >>>> .../BaseCryptLibMbedTls/PeiCryptLib.uni | 25 + >>>> .../BaseCryptLibMbedTls/Pem/CryptPemNull.c | 69 + >>>> .../Pk/CryptAuthenticodeNull.c | 45 + >>>> .../BaseCryptLibMbedTls/Pk/CryptDhNull.c | 150 + >>>> .../BaseCryptLibMbedTls/Pk/CryptEcNull.c | 578 +++ >>>> .../Pk/CryptPkcs1OaepNull.c | 51 + >>>> .../Pk/CryptPkcs5Pbkdf2Null.c | 48 + >>>> .../Pk/CryptPkcs7Internal.h | 83 + >>>> .../Pk/CryptPkcs7SignNull.c | 53 + >>>> .../Pk/CryptPkcs7VerifyEkuNull.c | 152 + >>>> .../Pk/CryptPkcs7VerifyEkuRuntime.c | 56 + >>>> .../Pk/CryptPkcs7VerifyNull.c | 163 + >>>> .../Pk/CryptPkcs7VerifyRuntime.c | 38 + >>>> .../BaseCryptLibMbedTls/Pk/CryptRsaBasic.c | 268 ++ >>>> .../Pk/CryptRsaBasicNull.c | 121 + >>>> .../BaseCryptLibMbedTls/Pk/CryptRsaExt.c | 337 ++ >>>> .../BaseCryptLibMbedTls/Pk/CryptRsaExtNull.c | 117 + >>>> .../BaseCryptLibMbedTls/Pk/CryptRsaPss.c | 164 + >>>> .../BaseCryptLibMbedTls/Pk/CryptRsaPssNull.c | 46 + >>>> .../BaseCryptLibMbedTls/Pk/CryptRsaPssSign.c | 231 + >>>> .../Pk/CryptRsaPssSignNull.c | 60 + >>>> .../BaseCryptLibMbedTls/Pk/CryptTsNull.c | 42 + >>>> .../BaseCryptLibMbedTls/Pk/CryptX509Null.c | 753 ++++ >>>> .../BaseCryptLibMbedTls/Rand/CryptRandNull.c | 56 + >>>> .../BaseCryptLibMbedTls/RuntimeCryptLib.inf | 92 + >>>> .../BaseCryptLibMbedTls/RuntimeCryptLib.uni | 22 + >>>> .../BaseCryptLibMbedTls/SecCryptLib.inf | 84 + >>>> .../BaseCryptLibMbedTls/SecCryptLib.uni | 17 + >>>> .../BaseCryptLibMbedTls/SmmCryptLib.inf | 92 + >>>> .../BaseCryptLibMbedTls/SmmCryptLib.uni | 22 + >>>> .../SysCall/ConstantTimeClock.c | 75 + >>>> .../BaseCryptLibMbedTls/SysCall/CrtWrapper.c | 58 + >>>> .../SysCall/RuntimeMemAllocation.c | 462 ++ >>>> .../SysCall/TimerWrapper.c | 198 + >>>> .../BaseCryptLibMbedTls/TestBaseCryptLib.inf | 78 + >>>> CryptoPkg/Library/MbedTlsLib/CrtWrapper.c | 96 + >>>> CryptoPkg/Library/MbedTlsLib/EcSm2Null.c | 495 +++ >>>> .../Include/mbedtls/mbedtls_config.h | 3823 ++++++++++++++= +++ >>>> CryptoPkg/Library/MbedTlsLib/MbedTlsLib.inf | 173 + >>>> .../Library/MbedTlsLib/MbedTlsLibFull.inf | 177 + >>>> CryptoPkg/Library/MbedTlsLib/mbedtls | 1 + >>>> 66 files changed, 14683 insertions(+), 3 deletions(-) >>>> create mode 100644 CryptoPkg/CryptoPkgMbedTls.dsc >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/BaseCryptLib.inf >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Bn/CryptBnNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAeadAesGcmNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Cipher/CryptAesNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptParallelHashNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSm3Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmac.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Hmac/CryptHmacNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/InternalCryptLib.h >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdf.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Kdf/CryptHkdfNull.c >>>> create mode 100644 >> CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.inf >>>> create mode 100644 >> CryptoPkg/Library/BaseCryptLibMbedTls/PeiCryptLib.uni >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pem/CryptPemNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptAuthenticodeNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptDhNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptEcNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs1OaepNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs5Pbkdf2Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7Internal.h >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7SignNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyEkuRuntime.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptPkcs7VerifyRuntime.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasic.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaBasicNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaExt.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaExtNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssSign.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPssSignNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptTsNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptX509Null.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/Rand/CryptRandNull.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.inf >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/RuntimeCryptLib.uni >>>> create mode 100644 >> CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.inf >>>> create mode 100644 >> CryptoPkg/Library/BaseCryptLibMbedTls/SecCryptLib.uni >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.inf >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/SmmCryptLib.uni >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/ConstantTimeClock.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/CrtWrapper.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/RuntimeMemAllocation.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/SysCall/TimerWrapper.c >>>> create mode 100644 >>> CryptoPkg/Library/BaseCryptLibMbedTls/TestBaseCryptLib.inf >>>> create mode 100644 CryptoPkg/Library/MbedTlsLib/CrtWrapper.c >>>> create mode 100644 CryptoPkg/Library/MbedTlsLib/EcSm2Null.c >>>> create mode 100644 >>> CryptoPkg/Library/MbedTlsLib/Include/mbedtls/mbedtls_config.h >>>> create mode 100644 CryptoPkg/Library/MbedTlsLib/MbedTlsLib.inf >>>> create mode 100644 CryptoPkg/Library/MbedTlsLib/MbedTlsLibFull.inf >>>> create mode 160000 CryptoPkg/Library/MbedTlsLib/mbedtls >>>> >>> >>> >>>=20 >>> >=20 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#108187): https://edk2.groups.io/g/devel/message/108187 Mute This Topic: https://groups.io/mt/101048094/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/leave/12367111/7686176/19134562= 12/xyzzy [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-