* [edk2-devel] [PATCH 2/3] CryptoPkg: Update Md5/Sha1/Sha2 by using new mbedtls api
2024-03-29 2:32 [edk2-devel] [PATCH 0/3] CryptoPkg: Optimize APIs in BaseCryptLibMbedTls Wenxing Hou
2024-03-29 2:32 ` [edk2-devel] [PATCH 1/3] CryptoPkg: Update OPTIONAL location for BaseCryptLibMbedTls Wenxing Hou
@ 2024-03-29 2:32 ` Wenxing Hou
2024-03-29 2:32 ` [edk2-devel] [PATCH 3/3] CryptoPkg: Remove interdependence for RsaPssVerify Wenxing Hou
2024-03-29 3:32 ` [edk2-devel] [PATCH 0/3] CryptoPkg: Optimize APIs in BaseCryptLibMbedTls Li, Yi
3 siblings, 0 replies; 5+ messages in thread
From: Wenxing Hou @ 2024-03-29 2:32 UTC (permalink / raw)
To: devel; +Cc: Jiewen Yao, Yi Li
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4741
Update Md5/Sha1/Sha2 by using mbedtls 3.0 api in BaseCryptLibMbedTls,
because the old API may be deprecated when open some MACRO.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
---
.../Library/BaseCryptLibMbedTls/Hash/CryptMd5.c | 9 ++++-----
.../BaseCryptLibMbedTls/Hash/CryptSha1.c | 9 ++++-----
.../BaseCryptLibMbedTls/Hash/CryptSha256.c | 9 ++++-----
.../BaseCryptLibMbedTls/Hash/CryptSha512.c | 17 ++++++++---------
4 files changed, 20 insertions(+), 24 deletions(-)
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c
index 35978291ca..f9590f59a0 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptMd5.c
@@ -8,7 +8,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "InternalCryptLib.h"
#include <mbedtls/md5.h>
-#include <mbedtls/compat-2.x.h>
#ifdef ENABLE_MD5_DEPRECATED_INTERFACES
@@ -56,7 +55,7 @@ Md5Init (
mbedtls_md5_init (Md5Context);
- Ret = mbedtls_md5_starts_ret (Md5Context);
+ Ret = mbedtls_md5_starts (Md5Context);
if (Ret != 0) {
return FALSE;
}
@@ -129,7 +128,7 @@ Md5Update (
return FALSE;
}
- Ret = mbedtls_md5_update_ret (Md5Context, Data, DataSize);
+ Ret = mbedtls_md5_update (Md5Context, Data, DataSize);
if (Ret != 0) {
return FALSE;
}
@@ -170,7 +169,7 @@ Md5Final (
return FALSE;
}
- Ret = mbedtls_md5_finish_ret (Md5Context, HashValue);
+ Ret = mbedtls_md5_finish (Md5Context, HashValue);
mbedtls_md5_free (Md5Context);
if (Ret != 0) {
return FALSE;
@@ -215,7 +214,7 @@ Md5HashAll (
return FALSE;
}
- Ret = mbedtls_md5_ret (Data, DataSize, HashValue);
+ Ret = mbedtls_md5 (Data, DataSize, HashValue);
if (Ret != 0) {
return FALSE;
}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c
index 68b107bd7b..718608faec 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha1.c
@@ -8,7 +8,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "InternalCryptLib.h"
#include <mbedtls/sha1.h>
-#include <mbedtls/compat-2.x.h>
#ifndef DISABLE_SHA1_DEPRECATED_INTERFACES
@@ -56,7 +55,7 @@ Sha1Init (
mbedtls_sha1_init (Sha1Context);
- Ret = mbedtls_sha1_starts_ret (Sha1Context);
+ Ret = mbedtls_sha1_starts (Sha1Context);
if (Ret != 0) {
return FALSE;
}
@@ -129,7 +128,7 @@ Sha1Update (
return FALSE;
}
- Ret = mbedtls_sha1_update_ret (Sha1Context, Data, DataSize);
+ Ret = mbedtls_sha1_update (Sha1Context, Data, DataSize);
if (Ret != 0) {
return FALSE;
}
@@ -170,7 +169,7 @@ Sha1Final (
return FALSE;
}
- Ret = mbedtls_sha1_finish_ret (Sha1Context, HashValue);
+ Ret = mbedtls_sha1_finish (Sha1Context, HashValue);
mbedtls_sha1_free (Sha1Context);
if (Ret != 0) {
return FALSE;
@@ -215,7 +214,7 @@ Sha1HashAll (
return FALSE;
}
- Ret = mbedtls_sha1_ret (Data, DataSize, HashValue);
+ Ret = mbedtls_sha1 (Data, DataSize, HashValue);
if (Ret != 0) {
return FALSE;
}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c
index 007f5c12aa..b0356732cf 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha256.c
@@ -8,7 +8,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "InternalCryptLib.h"
#include <mbedtls/sha256.h>
-#include <mbedtls/compat-2.x.h>
/**
Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
@@ -51,7 +50,7 @@ Sha256Init (
mbedtls_sha256_init (Sha256Context);
- Ret = mbedtls_sha256_starts_ret (Sha256Context, FALSE);
+ Ret = mbedtls_sha256_starts (Sha256Context, FALSE);
if (Ret != 0) {
return FALSE;
}
@@ -124,7 +123,7 @@ Sha256Update (
return FALSE;
}
- Ret = mbedtls_sha256_update_ret (Sha256Context, Data, DataSize);
+ Ret = mbedtls_sha256_update (Sha256Context, Data, DataSize);
if (Ret != 0) {
return FALSE;
}
@@ -165,7 +164,7 @@ Sha256Final (
return FALSE;
}
- Ret = mbedtls_sha256_finish_ret (Sha256Context, HashValue);
+ Ret = mbedtls_sha256_finish (Sha256Context, HashValue);
mbedtls_sha256_free (Sha256Context);
if (Ret != 0) {
return FALSE;
@@ -210,7 +209,7 @@ Sha256HashAll (
return FALSE;
}
- Ret = mbedtls_sha256_ret (Data, DataSize, HashValue, FALSE);
+ Ret = mbedtls_sha256 (Data, DataSize, HashValue, FALSE);
if (Ret != 0) {
return FALSE;
}
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c
index 3c6fc951d3..3342a1f8fe 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Hash/CryptSha512.c
@@ -8,7 +8,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "InternalCryptLib.h"
#include <mbedtls/sha512.h>
-#include <mbedtls/compat-2.x.h>
/**
Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
@@ -51,7 +50,7 @@ Sha384Init (
mbedtls_sha512_init (Sha384Context);
- Ret = mbedtls_sha512_starts_ret (Sha384Context, TRUE);
+ Ret = mbedtls_sha512_starts (Sha384Context, TRUE);
if (Ret != 0) {
return FALSE;
}
@@ -126,7 +125,7 @@ Sha384Update (
return FALSE;
}
- Ret = mbedtls_sha512_update_ret (Sha384Context, Data, DataSize);
+ Ret = mbedtls_sha512_update (Sha384Context, Data, DataSize);
if (Ret != 0) {
return FALSE;
}
@@ -167,7 +166,7 @@ Sha384Final (
return FALSE;
}
- Ret = mbedtls_sha512_finish_ret (Sha384Context, HashValue);
+ Ret = mbedtls_sha512_finish (Sha384Context, HashValue);
mbedtls_sha512_free (Sha384Context);
if (Ret != 0) {
return FALSE;
@@ -212,7 +211,7 @@ Sha384HashAll (
return FALSE;
}
- Ret = mbedtls_sha512_ret (Data, DataSize, HashValue, TRUE);
+ Ret = mbedtls_sha512 (Data, DataSize, HashValue, TRUE);
if (Ret != 0) {
return FALSE;
}
@@ -261,7 +260,7 @@ Sha512Init (
mbedtls_sha512_init (Sha512Context);
- Ret = mbedtls_sha512_starts_ret (Sha512Context, FALSE);
+ Ret = mbedtls_sha512_starts (Sha512Context, FALSE);
if (Ret != 0) {
return FALSE;
}
@@ -336,7 +335,7 @@ Sha512Update (
return FALSE;
}
- Ret = mbedtls_sha512_update_ret (Sha512Context, Data, DataSize);
+ Ret = mbedtls_sha512_update (Sha512Context, Data, DataSize);
if (Ret != 0) {
return FALSE;
}
@@ -377,7 +376,7 @@ Sha512Final (
return FALSE;
}
- Ret = mbedtls_sha512_finish_ret (Sha512Context, HashValue);
+ Ret = mbedtls_sha512_finish (Sha512Context, HashValue);
mbedtls_sha512_free (Sha512Context);
if (Ret != 0) {
return FALSE;
@@ -422,7 +421,7 @@ Sha512HashAll (
return FALSE;
}
- Ret = mbedtls_sha512_ret (Data, DataSize, HashValue, FALSE);
+ Ret = mbedtls_sha512 (Data, DataSize, HashValue, FALSE);
if (Ret != 0) {
return FALSE;
}
--
2.26.2.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#117222): https://edk2.groups.io/g/devel/message/117222
Mute This Topic: https://groups.io/mt/105210161/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply related [flat|nested] 5+ messages in thread* [edk2-devel] [PATCH 3/3] CryptoPkg: Remove interdependence for RsaPssVerify
2024-03-29 2:32 [edk2-devel] [PATCH 0/3] CryptoPkg: Optimize APIs in BaseCryptLibMbedTls Wenxing Hou
2024-03-29 2:32 ` [edk2-devel] [PATCH 1/3] CryptoPkg: Update OPTIONAL location for BaseCryptLibMbedTls Wenxing Hou
2024-03-29 2:32 ` [edk2-devel] [PATCH 2/3] CryptoPkg: Update Md5/Sha1/Sha2 by using new mbedtls api Wenxing Hou
@ 2024-03-29 2:32 ` Wenxing Hou
2024-03-29 3:32 ` [edk2-devel] [PATCH 0/3] CryptoPkg: Optimize APIs in BaseCryptLibMbedTls Li, Yi
3 siblings, 0 replies; 5+ messages in thread
From: Wenxing Hou @ 2024-03-29 2:32 UTC (permalink / raw)
To: devel; +Cc: Jiewen Yao, Yi Li
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4742
Remove interdependence for RsaPssVerify, only use original
mbedtls API.
Because APIs such as Sha512Init may be closed by the platform PCD.
And this patch optimize the hash flow.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
---
.../BaseCryptLibMbedTls/Pk/CryptRsaPss.c | 74 +++----------------
1 file changed, 11 insertions(+), 63 deletions(-)
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
index 7927c34ae9..ecd1bd1a41 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
@@ -11,6 +11,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "InternalCryptLib.h"
#include <mbedtls/rsa.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
/**
Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
@@ -43,11 +45,8 @@ RsaPssVerify (
)
{
INT32 Ret;
- mbedtls_md_type_t md_alg;
+ mbedtls_md_type_t MdAlg;
UINT8 HashValue[SHA512_DIGEST_SIZE];
- BOOLEAN Status;
- UINTN ShaCtxSize;
- VOID *ShaCtx;
mbedtls_rsa_context *RsaKey;
if (RsaContext == NULL) {
@@ -75,78 +74,27 @@ RsaPssVerify (
switch (DigestLen) {
case SHA256_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA256;
- ShaCtxSize = Sha256GetContextSize ();
- ShaCtx = AllocateZeroPool (ShaCtxSize);
-
- Status = Sha256Init (ShaCtx);
- if (!Status) {
- return FALSE;
- }
-
- Status = Sha256Update (ShaCtx, Message, MsgSize);
- if (!Status) {
- FreePool (ShaCtx);
+ MdAlg = MBEDTLS_MD_SHA256;
+ if (mbedtls_sha256 (Message, MsgSize, HashValue, FALSE) != 0) {
return FALSE;
}
- Status = Sha256Final (ShaCtx, HashValue);
- if (!Status) {
- FreePool (ShaCtx);
- return FALSE;
- }
-
- FreePool (ShaCtx);
break;
case SHA384_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA384;
- ShaCtxSize = Sha384GetContextSize ();
- ShaCtx = AllocateZeroPool (ShaCtxSize);
-
- Status = Sha384Init (ShaCtx);
- if (!Status) {
- return FALSE;
- }
-
- Status = Sha384Update (ShaCtx, Message, MsgSize);
- if (!Status) {
- FreePool (ShaCtx);
+ MdAlg = MBEDTLS_MD_SHA384;
+ if (mbedtls_sha512 (Message, MsgSize, HashValue, TRUE) != 0) {
return FALSE;
}
- Status = Sha384Final (ShaCtx, HashValue);
- if (!Status) {
- FreePool (ShaCtx);
- return FALSE;
- }
-
- FreePool (ShaCtx);
break;
case SHA512_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA512;
- ShaCtxSize = Sha512GetContextSize ();
- ShaCtx = AllocateZeroPool (ShaCtxSize);
-
- Status = Sha512Init (ShaCtx);
- if (!Status) {
- return FALSE;
- }
-
- Status = Sha512Update (ShaCtx, Message, MsgSize);
- if (!Status) {
- FreePool (ShaCtx);
- return FALSE;
- }
-
- Status = Sha512Final (ShaCtx, HashValue);
- if (!Status) {
- FreePool (ShaCtx);
+ MdAlg = MBEDTLS_MD_SHA512;
+ if (mbedtls_sha512 (Message, MsgSize, HashValue, FALSE) != 0) {
return FALSE;
}
- FreePool (ShaCtx);
break;
default:
@@ -157,11 +105,11 @@ RsaPssVerify (
return FALSE;
}
- mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, md_alg);
+ mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, MdAlg);
Ret = mbedtls_rsa_rsassa_pss_verify (
RsaContext,
- md_alg,
+ MdAlg,
(UINT32)DigestLen,
HashValue,
Signature
--
2.26.2.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#117223): https://edk2.groups.io/g/devel/message/117223
Mute This Topic: https://groups.io/mt/105210162/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply related [flat|nested] 5+ messages in thread