From: "Wenxing Hou" <wenxing.hou@intel.com>
To: devel@edk2.groups.io
Cc: Jiewen Yao <jiewen.yao@intel.com>, Yi Li <yi1.li@intel.com>
Subject: [edk2-devel] [PATCH 3/3] CryptoPkg: Remove interdependence for RsaPssVerify
Date: Fri, 29 Mar 2024 10:32:42 +0800 [thread overview]
Message-ID: <20240329023242.2443-4-wenxing.hou@intel.com> (raw)
In-Reply-To: <20240329023242.2443-1-wenxing.hou@intel.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4742
Remove interdependence for RsaPssVerify, only use original
mbedtls API.
Because APIs such as Sha512Init may be closed by the platform PCD.
And this patch optimize the hash flow.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
---
.../BaseCryptLibMbedTls/Pk/CryptRsaPss.c | 74 +++----------------
1 file changed, 11 insertions(+), 63 deletions(-)
diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
index 7927c34ae9..ecd1bd1a41 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
@@ -11,6 +11,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include "InternalCryptLib.h"
#include <mbedtls/rsa.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
/**
Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
@@ -43,11 +45,8 @@ RsaPssVerify (
)
{
INT32 Ret;
- mbedtls_md_type_t md_alg;
+ mbedtls_md_type_t MdAlg;
UINT8 HashValue[SHA512_DIGEST_SIZE];
- BOOLEAN Status;
- UINTN ShaCtxSize;
- VOID *ShaCtx;
mbedtls_rsa_context *RsaKey;
if (RsaContext == NULL) {
@@ -75,78 +74,27 @@ RsaPssVerify (
switch (DigestLen) {
case SHA256_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA256;
- ShaCtxSize = Sha256GetContextSize ();
- ShaCtx = AllocateZeroPool (ShaCtxSize);
-
- Status = Sha256Init (ShaCtx);
- if (!Status) {
- return FALSE;
- }
-
- Status = Sha256Update (ShaCtx, Message, MsgSize);
- if (!Status) {
- FreePool (ShaCtx);
+ MdAlg = MBEDTLS_MD_SHA256;
+ if (mbedtls_sha256 (Message, MsgSize, HashValue, FALSE) != 0) {
return FALSE;
}
- Status = Sha256Final (ShaCtx, HashValue);
- if (!Status) {
- FreePool (ShaCtx);
- return FALSE;
- }
-
- FreePool (ShaCtx);
break;
case SHA384_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA384;
- ShaCtxSize = Sha384GetContextSize ();
- ShaCtx = AllocateZeroPool (ShaCtxSize);
-
- Status = Sha384Init (ShaCtx);
- if (!Status) {
- return FALSE;
- }
-
- Status = Sha384Update (ShaCtx, Message, MsgSize);
- if (!Status) {
- FreePool (ShaCtx);
+ MdAlg = MBEDTLS_MD_SHA384;
+ if (mbedtls_sha512 (Message, MsgSize, HashValue, TRUE) != 0) {
return FALSE;
}
- Status = Sha384Final (ShaCtx, HashValue);
- if (!Status) {
- FreePool (ShaCtx);
- return FALSE;
- }
-
- FreePool (ShaCtx);
break;
case SHA512_DIGEST_SIZE:
- md_alg = MBEDTLS_MD_SHA512;
- ShaCtxSize = Sha512GetContextSize ();
- ShaCtx = AllocateZeroPool (ShaCtxSize);
-
- Status = Sha512Init (ShaCtx);
- if (!Status) {
- return FALSE;
- }
-
- Status = Sha512Update (ShaCtx, Message, MsgSize);
- if (!Status) {
- FreePool (ShaCtx);
- return FALSE;
- }
-
- Status = Sha512Final (ShaCtx, HashValue);
- if (!Status) {
- FreePool (ShaCtx);
+ MdAlg = MBEDTLS_MD_SHA512;
+ if (mbedtls_sha512 (Message, MsgSize, HashValue, FALSE) != 0) {
return FALSE;
}
- FreePool (ShaCtx);
break;
default:
@@ -157,11 +105,11 @@ RsaPssVerify (
return FALSE;
}
- mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, md_alg);
+ mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, MdAlg);
Ret = mbedtls_rsa_rsassa_pss_verify (
RsaContext,
- md_alg,
+ MdAlg,
(UINT32)DigestLen,
HashValue,
Signature
--
2.26.2.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#117223): https://edk2.groups.io/g/devel/message/117223
Mute This Topic: https://groups.io/mt/105210162/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
next prev parent reply other threads:[~2024-03-29 2:32 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-29 2:32 [edk2-devel] [PATCH 0/3] CryptoPkg: Optimize APIs in BaseCryptLibMbedTls Wenxing Hou
2024-03-29 2:32 ` [edk2-devel] [PATCH 1/3] CryptoPkg: Update OPTIONAL location for BaseCryptLibMbedTls Wenxing Hou
2024-03-29 2:32 ` [edk2-devel] [PATCH 2/3] CryptoPkg: Update Md5/Sha1/Sha2 by using new mbedtls api Wenxing Hou
2024-03-29 2:32 ` Wenxing Hou [this message]
2024-03-29 3:32 ` [edk2-devel] [PATCH 0/3] CryptoPkg: Optimize APIs in BaseCryptLibMbedTls Li, Yi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240329023242.2443-4-wenxing.hou@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox