[PATCH v2 0/2] CryptoPkg bug fixes

[PATCH v2 0/2] CryptoPkg bug fixes

[Judah Vang]

https://bugzilla.tianocore.org/show_bug.cgi?id=3991
https://bugzilla.tianocore.org/show_bug.cgi?id=3992

There is a #define to deprecate Sha1 functions but not
all the Sha1 function are wrapped around this #define causing
a build error. The fix is to wrap all Sha1 functions with
the #define.

Need crypto AES to be supported for PEI phase and need
crypto KDF to be supported for SMM phase. Update Readme
to show AES and HKDF defaults.

Judah Vang (2):
  CryptoPkg: Sha1 functions causing build errors
  CryptoPkg: Need to enable crypto functions

 CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf    |  2 +-
 CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf    |  2 +-
 CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c | 14 ++++++++++-
 CryptoPkg/Readme.md                               | 26 +++++++++++---------
 4 files changed, 29 insertions(+), 15 deletions(-)

-- 
2.35.1.windows.2

[PATCH v2 1/2] CryptoPkg: Sha1 functions causing build errors

[Judah Vang]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3991

Fix build issue when DiSABLE_SHA1_DEPRECATED_INTERFACES
is defined. Percolate the #ifndef DiSABLE_SHA1_DEPRECATED_INTERFACES
to all the Sha1 functions.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Nishant C Mistry <nishant.c.mistry@intel.com>
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Nishant C Mistry <nishant.c.mistry@intel.com>
Signed-off-by: Judah Vang <judah.vang@intel.com>
---
 CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c b/CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c
index f9796b215865..ede9fa8c09ec 100644
--- a/CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c
+++ b/CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c
@@ -6,7 +6,7 @@
   This API, when called, will calculate the Hash using the
   hashing algorithm specified by PcdHashApiLibPolicy.
 
-  Copyright (c) 2020, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2020-2022, Intel Corporation. All rights reserved.<BR>
   SPDX-License-Identifier: BSD-2-Clause-Patent
 
 **/
@@ -33,9 +33,11 @@ HashApiGetContextSize (
   )
 {
   switch (PcdGet32 (PcdHashApiLibPolicy)) {
+ #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
     case HASH_ALG_SHA1:
       return Sha1GetContextSize ();
       break;
+ #endif
 
     case HASH_ALG_SHA256:
       return Sha256GetContextSize ();
@@ -75,9 +77,11 @@ HashApiInit (
   )
 {
   switch (PcdGet32 (PcdHashApiLibPolicy)) {
+ #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
     case HASH_ALG_SHA1:
       return Sha1Init (HashContext);
       break;
+ #endif
 
     case HASH_ALG_SHA256:
       return Sha256Init (HashContext);
@@ -119,9 +123,11 @@ HashApiDuplicate (
   )
 {
   switch (PcdGet32 (PcdHashApiLibPolicy)) {
+ #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
     case HASH_ALG_SHA1:
       return Sha1Duplicate (HashContext, NewHashContext);
       break;
+ #endif
 
     case HASH_ALG_SHA256:
       return Sha256Duplicate (HashContext, NewHashContext);
@@ -165,9 +171,11 @@ HashApiUpdate (
   )
 {
   switch (PcdGet32 (PcdHashApiLibPolicy)) {
+ #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
     case HASH_ALG_SHA1:
       return Sha1Update (HashContext, DataToHash, DataToHashLen);
       break;
+ #endif
 
     case HASH_ALG_SHA256:
       return Sha256Update (HashContext, DataToHash, DataToHashLen);
@@ -209,9 +217,11 @@ HashApiFinal (
   )
 {
   switch (PcdGet32 (PcdHashApiLibPolicy)) {
+ #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
     case HASH_ALG_SHA1:
       return Sha1Final (HashContext, Digest);
       break;
+ #endif
 
     case HASH_ALG_SHA256:
       return Sha256Final (HashContext, Digest);
@@ -255,9 +265,11 @@ HashApiHashAll (
   )
 {
   switch (PcdGet32 (PcdHashApiLibPolicy)) {
+ #ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
     case HASH_ALG_SHA1:
       return Sha1HashAll (DataToHash, DataToHashLen, Digest);
       break;
+ #endif
 
     case HASH_ALG_SHA256:
       return Sha256HashAll (DataToHash, DataToHashLen, Digest);
-- 
2.35.1.windows.2

[PATCH v2 2/2] CryptoPkg: Need to enable crypto functions

[Judah Vang]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3992

V2: Update Readme.md

V1: Enable CryptAes for PEI phase. Enable CryptHkdf for SMM phase.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Cc: Nishant C Mistry <nishant.c.mistry@intel.com>
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Nishant C Mistry <nishant.c.mistry@intel.com>
Signed-off-by: Judah Vang <judah.vang@intel.com>
---
 CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf |  2 +-
 CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf |  2 +-
 CryptoPkg/Readme.md                            | 26 +++++++++++---------
 3 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
index b1629647f9c6..ee5f3cd5d4b6 100644
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
@@ -43,7 +43,7 @@ [Sources]
   Hash/CryptParallelHashNull.c
   Hmac/CryptHmac.c
   Kdf/CryptHkdf.c
-  Cipher/CryptAesNull.c
+  Cipher/CryptAes.c
   Cipher/CryptAeadAesGcmNull.c
   Pk/CryptRsaBasic.c
   Pk/CryptRsaExtNull.c
diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
index 0af7a3f96e8f..cc5a53ca92cd 100644
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
@@ -43,7 +43,7 @@ [Sources]
   Hash/CryptCShake256.c
   Hash/CryptParallelHash.c
   Hmac/CryptHmac.c
-  Kdf/CryptHkdfNull.c
+  Kdf/CryptHkdf.c
   Cipher/CryptAes.c
   Cipher/CryptAeadAesGcmNull.c
   Pk/CryptRsaBasic.c
diff --git a/CryptoPkg/Readme.md b/CryptoPkg/Readme.md
index 067465b8eb7d..fe8fc5e03684 100644
--- a/CryptoPkg/Readme.md
+++ b/CryptoPkg/Readme.md
@@ -447,18 +447,20 @@ and CryptoSmm modules.
 #### Common PEI PcdCryptoServiceFamilyEnable Settings
 
 ```
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha384.Family               | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family                     | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family                   | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family                   | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family                   | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family                      | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Pkcs1Verify        | TRUE
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.New                | TRUE
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Free               | TRUE
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.SetKey             | TRUE
-  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs5HashPassword | TRUE
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha256.Family                    | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.HmacSha384.Family                    | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha1.Family                          | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha256.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha384.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sha512.Family                        | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Sm3.Family                           | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Family                           | PCD_CRYPTO_SERVICE_ENABLE_FAMILY
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Pkcs1Verify             | TRUE
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.New                     | TRUE
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.Free                    | TRUE
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Rsa.Services.SetKey                  | TRUE
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Pkcs.Services.Pkcs5HashPassword      | TRUE
+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Hkdf.Services.Sha256ExtractAndExpand | TRUE
 ```
 
 #### Common DXE and SMM PcdCryptoServiceFamilyEnable Settings
-- 
2.35.1.windows.2

Re: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes

[Yao, Jiewen]

Hey
Would you please split this patch set to two different one? They are two different HSDs.

Please aware that we are in software freeze phase now.

I suggest we include 3991 in this release, because it is an important bug fix.

I suggest we defer 3992 to next release, because it is feature enhancement.

Comment is welcome!

Thank you
Yao, Jiewen


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Judah
> Vang
> Sent: Tuesday, November 8, 2022 2:37 AM
> To: devel@edk2.groups.io
> Subject: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> 
> https://bugzilla.tianocore.org/show_bug.cgi?id=3991
> https://bugzilla.tianocore.org/show_bug.cgi?id=3992
> 
> There is a #define to deprecate Sha1 functions but not
> all the Sha1 function are wrapped around this #define causing
> a build error. The fix is to wrap all Sha1 functions with
> the #define.
> 
> Need crypto AES to be supported for PEI phase and need
> crypto KDF to be supported for SMM phase. Update Readme
> to show AES and HKDF defaults.
> 
> Judah Vang (2):
>   CryptoPkg: Sha1 functions causing build errors
>   CryptoPkg: Need to enable crypto functions
> 
>  CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf    |  2 +-
>  CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf    |  2 +-
>  CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c | 14 ++++++++++-
>  CryptoPkg/Readme.md                               | 26 +++++++++++---------
>  4 files changed, 29 insertions(+), 15 deletions(-)
> 
> --
> 2.35.1.windows.2
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes

[Judah Vang]

Sure, I can do that.  I will resubmit as separate patches.

-----Original Message-----
From: Yao, Jiewen <jiewen.yao@intel.com> 
Sent: Monday, November 7, 2022 10:42 AM
To: devel@edk2.groups.io; Vang, Judah <judah.vang@intel.com>
Subject: RE: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes

Hey
Would you please split this patch set to two different one? They are two different HSDs.

Please aware that we are in software freeze phase now.

I suggest we include 3991 in this release, because it is an important bug fix.

I suggest we defer 3992 to next release, because it is feature enhancement.

Comment is welcome!

Thank you
Yao, Jiewen


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Judah 
> Vang
> Sent: Tuesday, November 8, 2022 2:37 AM
> To: devel@edk2.groups.io
> Subject: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> 
> https://bugzilla.tianocore.org/show_bug.cgi?id=3991
> https://bugzilla.tianocore.org/show_bug.cgi?id=3992
> 
> There is a #define to deprecate Sha1 functions but not all the Sha1 
> function are wrapped around this #define causing a build error. The 
> fix is to wrap all Sha1 functions with the #define.
> 
> Need crypto AES to be supported for PEI phase and need crypto KDF to 
> be supported for SMM phase. Update Readme to show AES and HKDF 
> defaults.
> 
> Judah Vang (2):
>   CryptoPkg: Sha1 functions causing build errors
>   CryptoPkg: Need to enable crypto functions
> 
>  CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf    |  2 +-
>  CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf    |  2 +-
>  CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c | 14 ++++++++++-
>  CryptoPkg/Readme.md                               | 26 +++++++++++---------
>  4 files changed, 29 insertions(+), 15 deletions(-)
> 
> --
> 2.35.1.windows.2
> 
> 
> 
> 
> 

Re: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes

[Yao, Jiewen]

Also, please ensure your patch can pass tiano CI.

I cannot find the PR to CI for those features. Would you please point to me?

Thank you
Yao Jiewen


> -----Original Message-----
> From: Vang, Judah <judah.vang@intel.com>
> Sent: Tuesday, November 8, 2022 2:45 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Subject: RE: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> 
> Sure, I can do that.  I will resubmit as separate patches.
> 
> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Monday, November 7, 2022 10:42 AM
> To: devel@edk2.groups.io; Vang, Judah <judah.vang@intel.com>
> Subject: RE: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> 
> Hey
> Would you please split this patch set to two different one? They are two
> different HSDs.
> 
> Please aware that we are in software freeze phase now.
> 
> I suggest we include 3991 in this release, because it is an important bug fix.
> 
> I suggest we defer 3992 to next release, because it is feature enhancement.
> 
> Comment is welcome!
> 
> Thank you
> Yao, Jiewen
> 
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Judah
> > Vang
> > Sent: Tuesday, November 8, 2022 2:37 AM
> > To: devel@edk2.groups.io
> > Subject: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> >
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3991
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3992
> >
> > There is a #define to deprecate Sha1 functions but not all the Sha1
> > function are wrapped around this #define causing a build error. The
> > fix is to wrap all Sha1 functions with the #define.
> >
> > Need crypto AES to be supported for PEI phase and need crypto KDF to
> > be supported for SMM phase. Update Readme to show AES and HKDF
> > defaults.
> >
> > Judah Vang (2):
> >   CryptoPkg: Sha1 functions causing build errors
> >   CryptoPkg: Need to enable crypto functions
> >
> >  CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf    |  2 +-
> >  CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf    |  2 +-
> >  CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c | 14 ++++++++++-
> >  CryptoPkg/Readme.md                               | 26 +++++++++++---------
> >  4 files changed, 29 insertions(+), 15 deletions(-)
> >
> > --
> > 2.35.1.windows.2
> >
> >
> >
> > 
> >

Re: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes

[Judah Vang]

Jiewen,

Thanks.  Running the CI now.
https://github.com/tianocore/edk2/pull/3609

Judah

-----Original Message-----
From: Yao, Jiewen <jiewen.yao@intel.com> 
Sent: Monday, November 7, 2022 10:48 AM
To: Vang, Judah <judah.vang@intel.com>; devel@edk2.groups.io
Subject: RE: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes

Also, please ensure your patch can pass tiano CI.

I cannot find the PR to CI for those features. Would you please point to me?

Thank you
Yao Jiewen


> -----Original Message-----
> From: Vang, Judah <judah.vang@intel.com>
> Sent: Tuesday, November 8, 2022 2:45 AM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Subject: RE: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> 
> Sure, I can do that.  I will resubmit as separate patches.
> 
> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Monday, November 7, 2022 10:42 AM
> To: devel@edk2.groups.io; Vang, Judah <judah.vang@intel.com>
> Subject: RE: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> 
> Hey
> Would you please split this patch set to two different one? They are 
> two different HSDs.
> 
> Please aware that we are in software freeze phase now.
> 
> I suggest we include 3991 in this release, because it is an important bug fix.
> 
> I suggest we defer 3992 to next release, because it is feature enhancement.
> 
> Comment is welcome!
> 
> Thank you
> Yao, Jiewen
> 
> 
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Judah 
> > Vang
> > Sent: Tuesday, November 8, 2022 2:37 AM
> > To: devel@edk2.groups.io
> > Subject: [edk2-devel] [PATCH v2 0/2] CryptoPkg bug fixes
> >
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3991
> > https://bugzilla.tianocore.org/show_bug.cgi?id=3992
> >
> > There is a #define to deprecate Sha1 functions but not all the Sha1 
> > function are wrapped around this #define causing a build error. The 
> > fix is to wrap all Sha1 functions with the #define.
> >
> > Need crypto AES to be supported for PEI phase and need crypto KDF to 
> > be supported for SMM phase. Update Readme to show AES and HKDF 
> > defaults.
> >
> > Judah Vang (2):
> >   CryptoPkg: Sha1 functions causing build errors
> >   CryptoPkg: Need to enable crypto functions
> >
> >  CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf    |  2 +-
> >  CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf    |  2 +-
> >  CryptoPkg/Library/BaseHashApiLib/BaseHashApiLib.c | 14 ++++++++++-
> >  CryptoPkg/Readme.md                               | 26 +++++++++++---------
> >  4 files changed, 29 insertions(+), 15 deletions(-)
> >
> > --
> > 2.35.1.windows.2
> >
> >
> >
> > 
> >