[patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

[patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

[Dandan Bi]

Patch 1-3: Update the dsc file of related package which 
ues the DriverSampleDxe, becasue DriverSampleDxe will 
consume BaseCryptLib/OpensslLib/IntrinsicLib.
Patch 4: Use SHA256 algorithm for password encoding

Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Andrew Fish <afish@apple.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>

Dandan Bi (4):
  MdeModulePkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  Nt32Pkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  EmulatorPkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  MdeModulePkg/DriverSample: Use SHA256 algorithm for password encoding

 EmulatorPkg/EmulatorPkg.dsc                        |   5 +-
 MdeModulePkg/MdeModulePkg.dsc                      |   4 +
 .../Universal/DriverSampleDxe/DriverSample.c       | 171 ++++++++++++---------
 .../Universal/DriverSampleDxe/DriverSample.h       |   3 +-
 .../Universal/DriverSampleDxe/DriverSampleDxe.inf  |   4 +-
 .../Universal/DriverSampleDxe/NVDataStruc.h        |   7 +-
 MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr     |   8 -
 Nt32Pkg/Nt32Pkg.dsc                                |   7 +-
 8 files changed, 123 insertions(+), 86 deletions(-)

-- 
1.9.5.msysgit.1

[patch 1/4] MdeModulePkg: Add BaseCryptLib/OpensslLib/IntrinsicLib

[Dandan Bi]

The DriverSample will consume BaseCryptLib/OpensslLib/IntrinsicLib,
so add these libraries into the dsc files.

Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
---
 MdeModulePkg/MdeModulePkg.dsc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/MdeModulePkg/MdeModulePkg.dsc b/MdeModulePkg/MdeModulePkg.dsc
index ea75c85..d476a3b 100644
--- a/MdeModulePkg/MdeModulePkg.dsc
+++ b/MdeModulePkg/MdeModulePkg.dsc
@@ -104,10 +104,13 @@ [LibraryClasses]
   FileExplorerLib|MdeModulePkg/Library/FileExplorerLib/FileExplorerLib.inf
 
   FmpAuthenticationLib|MdeModulePkg/Library/FmpAuthenticationLibNull/FmpAuthenticationLibNull.inf
   CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
 
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+
 [LibraryClasses.EBC.PEIM]
   IoLib|MdePkg/Library/PeiIoLibCpuIo/PeiIoLibCpuIo.inf
 
 [LibraryClasses.common.PEI_CORE]
   HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf
@@ -128,10 +131,11 @@ [LibraryClasses.common.DXE_DRIVER]
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf
   LockBoxLib|MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.inf
   MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
   ExtractGuidedSectionLib|MdePkg/Library/DxeExtractGuidedSectionLib/DxeExtractGuidedSectionLib.inf
   CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.inf
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
 
 [LibraryClasses.common.DXE_RUNTIME_DRIVER]
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf
   MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
   DebugLib|MdePkg/Library/UefiDebugLibConOut/UefiDebugLibConOut.inf
-- 
1.9.5.msysgit.1

[patch 2/4] Nt32Pkg: Add BaseCryptLib/OpensslLib/IntrinsicLib

[Dandan Bi]

DriverSampleDxe will consume BaseCryptLib/OpensslLib/IntrinsicLib,
so remove the SECURE_BOOT_ENABLE check before these libraries now.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
---
 Nt32Pkg/Nt32Pkg.dsc | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/Nt32Pkg/Nt32Pkg.dsc b/Nt32Pkg/Nt32Pkg.dsc
index 4458c02..319d86a 100644
--- a/Nt32Pkg/Nt32Pkg.dsc
+++ b/Nt32Pkg/Nt32Pkg.dsc
@@ -131,15 +131,16 @@ [LibraryClasses]
   DebugPrintErrorLevelLib|MdeModulePkg/Library/DxeDebugPrintErrorLevelLib/DxeDebugPrintErrorLevelLib.inf
   PerformanceLib|MdePkg/Library/BasePerformanceLibNull/BasePerformanceLibNull.inf
   DebugAgentLib|MdeModulePkg/Library/DebugAgentLibNull/DebugAgentLibNull.inf
   CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/CpuExceptionHandlerLibNull.inf
   LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
+
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
   
 !if $(SECURE_BOOT_ENABLE) == TRUE
   PlatformSecureLib|Nt32Pkg/Library/PlatformSecureLib/PlatformSecureLib.inf
-  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
-  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
   TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
   AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
 !else
   TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
   AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
@@ -190,13 +191,11 @@ [LibraryClasses.common]
   ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
   OemHookStatusCodeLib|Nt32Pkg/Library/DxeNt32OemHookStatusCodeLib/DxeNt32OemHookStatusCodeLib.inf
   PeCoffExtraActionLib|Nt32Pkg/Library/DxeNt32PeCoffExtraActionLib/DxeNt32PeCoffExtraActionLib.inf
   ExtractGuidedSectionLib|MdePkg/Library/DxeExtractGuidedSectionLib/DxeExtractGuidedSectionLib.inf
   WinNtLib|Nt32Pkg/Library/DxeWinNtLib/DxeWinNtLib.inf
-!if $(SECURE_BOOT_ENABLE) == TRUE
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
-!endif
 
 [LibraryClasses.common.DXE_CORE]
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf
   MemoryAllocationLib|MdeModulePkg/Library/DxeCoreMemoryAllocationLib/DxeCoreMemoryAllocationLib.inf
   PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
-- 
1.9.5.msysgit.1

Re: [patch 2/4] Nt32Pkg: Add BaseCryptLib/OpensslLib/IntrinsicLib

[Ni, Ruiyu]

Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>

Thanks/Ray

> -----Original Message-----
> From: Bi, Dandan
> Sent: Thursday, November 17, 2016 10:26 AM
> To: edk2-devel@lists.01.org
> Cc: Ni, Ruiyu <ruiyu.ni@intel.com>
> Subject: [patch 2/4] Nt32Pkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
> 
> DriverSampleDxe will consume BaseCryptLib/OpensslLib/IntrinsicLib,
> so remove the SECURE_BOOT_ENABLE check before these libraries now.
> 
> Cc: Ruiyu Ni <ruiyu.ni@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Dandan Bi <dandan.bi@intel.com>
> ---
>  Nt32Pkg/Nt32Pkg.dsc | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/Nt32Pkg/Nt32Pkg.dsc b/Nt32Pkg/Nt32Pkg.dsc index
> 4458c02..319d86a 100644
> --- a/Nt32Pkg/Nt32Pkg.dsc
> +++ b/Nt32Pkg/Nt32Pkg.dsc
> @@ -131,15 +131,16 @@ [LibraryClasses]
> 
> DebugPrintErrorLevelLib|MdeModulePkg/Library/DxeDebugPrintErrorLevelL
> ib/DxeDebugPrintErrorLevelLib.inf
> 
> PerformanceLib|MdePkg/Library/BasePerformanceLibNull/BasePerformanc
> eLibNull.inf
> 
> DebugAgentLib|MdeModulePkg/Library/DebugAgentLibNull/DebugAgentLi
> bNull.inf
> 
> CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibN
> ull/CpuExceptionHandlerLibNull.inf
>    LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
> +
> +  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> +  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
> 
>  !if $(SECURE_BOOT_ENABLE) == TRUE
> 
> PlatformSecureLib|Nt32Pkg/Library/PlatformSecureLib/PlatformSecureLib.in
> f
> -  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> -  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
> 
> TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTp
> mMeasurementLib.inf
>    AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
>  !else
> 
> TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/Tp
> mMeasurementLibNull.inf
> 
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableL
> ibNull.inf
> @@ -190,13 +191,11 @@ [LibraryClasses.common]
> 
> ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/Dx
> eReportStatusCodeLib.inf
> 
> OemHookStatusCodeLib|Nt32Pkg/Library/DxeNt32OemHookStatusCodeLib/
> DxeNt32OemHookStatusCodeLib.inf
> 
> PeCoffExtraActionLib|Nt32Pkg/Library/DxeNt32PeCoffExtraActionLib/DxeNt
> 32PeCoffExtraActionLib.inf
> 
> ExtractGuidedSectionLib|MdePkg/Library/DxeExtractGuidedSectionLib/DxeE
> xtractGuidedSectionLib.inf
>    WinNtLib|Nt32Pkg/Library/DxeWinNtLib/DxeWinNtLib.inf
> -!if $(SECURE_BOOT_ENABLE) == TRUE
>    BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
> -!endif
> 
>  [LibraryClasses.common.DXE_CORE]
>    HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf
> 
> MemoryAllocationLib|MdeModulePkg/Library/DxeCoreMemoryAllocationLi
> b/DxeCoreMemoryAllocationLib.inf
>    PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
> --
> 1.9.5.msysgit.1

[patch 3/4] EmulatorPkg: Add BaseCryptLib/OpensslLib/IntrinsicLib

[Dandan Bi]

DriverSampleDxe will consume BaseCryptLib/OpensslLib/IntrinsicLib,
so add these libraries to the dsc file.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Andrew Fish <afish@apple.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
---
 EmulatorPkg/EmulatorPkg.dsc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
index f516adf..6bb916d 100644
--- a/EmulatorPkg/EmulatorPkg.dsc
+++ b/EmulatorPkg/EmulatorPkg.dsc
@@ -2,11 +2,11 @@
 # UEFI/PI Emulation Platform with UEFI HII interface supported.
 #
 # The Emulation Platform can be used to debug individual modules, prior to creating
 # a real platform. This also provides an example for how an DSC is created.
 #
-# Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
 # Portions copyright (c) 2010 - 2011, Apple Inc. All rights reserved.<BR>
 #
 # This program and the accompanying materials
 # are licensed and made available under the terms and conditions of the BSD License
 # which accompanies this distribution. The full text of the license may be found at
@@ -105,10 +105,13 @@ [LibraryClasses]
   LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
   CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/CpuExceptionHandlerLibNull.inf
   TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
   AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
   VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
 
 [LibraryClasses.common.SEC]
   PeiServicesLib|EmulatorPkg/Library/SecPeiServicesLib/SecPeiServicesLib.inf
   PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
   PeCoffGetEntryPointLib|EmulatorPkg/Library/PeiEmuPeCoffGetEntryPointLib/PeiEmuPeCoffGetEntryPointLib.inf
-- 
1.9.5.msysgit.1

[patch 4/4] MdeModulePkg/DriverSample: Use SHA256 algorithm for password encoding

[Dandan Bi]

Use the SHA256 algorithm to hash the password
instead of using XOR operation to encode the password.
And remove the string opcode that echo the password.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
---
 .../Universal/DriverSampleDxe/DriverSample.c       | 171 ++++++++++++---------
 .../Universal/DriverSampleDxe/DriverSample.h       |   3 +-
 .../Universal/DriverSampleDxe/DriverSampleDxe.inf  |   4 +-
 .../Universal/DriverSampleDxe/NVDataStruc.h        |   7 +-
 MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr     |   8 -
 5 files changed, 112 insertions(+), 81 deletions(-)

diff --git a/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.c b/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.c
index 3c494e3..380226d 100644
--- a/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.c
+++ b/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.c
@@ -259,43 +259,88 @@ InternalStopMonitor(
     }
   }
   return EFI_SUCCESS;
 }
 
-
 /**
-  Encode the password using a simple algorithm.
+  Generate Salt value.
 
-  @param Password The string to be encoded.
-  @param MaxSize  The size of the string.
+  @param[in, out]   SaltValue           Points to the salt buffer, 32 bytes
 
 **/
 VOID
-EncodePassword (
-  IN  CHAR16                      *Password,
-  IN  UINTN                       MaxSize
+GenSalt (
+  IN OUT UINT8  *SaltValue
   )
 {
-  UINTN   Index;
-  UINTN   Loop;
-  CHAR16  *Buffer;
-  CHAR16  *Key;
-
-  Key     = L"MAR10648567";
-  Buffer  = AllocateZeroPool (MaxSize);
-  ASSERT (Buffer != NULL);
-
-  for (Index = 0; Key[Index] != 0; Index++) {
-    for (Loop = 0; Loop < (UINT8) (MaxSize / 2); Loop++) {
-      Buffer[Loop] = (CHAR16) (Password[Loop] ^ Key[Index]);
-    }
+  RandomSeed (NULL, 0);
+  RandomBytes (SaltValue, PASSWORD_SALT_SIZE);
+}
+
+/**
+  Hash the data.
+
+  @param[in]   Buffer         Points to the data buffer, 32 bytes
+  @param[in]   SaltValue      Points to the salt buffer, 32 bytes
+  @param[out]  EncodedDate    Points to the hashed result
+
+  @retval      TRUE           Hash the data successfully.
+  @retval      FALSE          Failed to hash the data.
+
+**/
+BOOLEAN
+HashPassword(
+  IN      UINT8               *Buffer,
+  IN      UINT8               *SaltValue,
+  OUT     UINT8               *EncodedDate
+  )
+{
+  BOOLEAN                     Status;
+  UINTN                       HashSize;
+  VOID                        *Hash;
+  VOID                        *HashData;
+
+  Hash      = NULL;
+  HashData  = NULL;
+  Status    = FALSE;
+
+  HashSize = Sha256GetContextSize ();
+  Hash     = AllocateZeroPool (HashSize);
+  ASSERT (Hash != NULL);
+  if (Hash == NULL) {
+    goto Done;
+  }
+
+  Status = Sha256Init (Hash);
+  if (!Status) {
+    goto Done;
+  }
+
+  HashData = AllocateZeroPool (PASSWORD_SALT_SIZE + 32);
+  ASSERT (HashData != NULL);
+  if (HashData == NULL) {
+    goto Done;
+  }
+
+  CopyMem (HashData, SaltValue, PASSWORD_SALT_SIZE);
+  CopyMem ((CHAR8*)HashData + PASSWORD_SALT_SIZE, Buffer, 32);
+
+  Status = Sha256Update (Hash, HashData, PASSWORD_SALT_SIZE + 32);
+  if (!Status) {
+    goto Done;
   }
 
-  CopyMem (Password, Buffer, MaxSize);
+  Status = Sha256Final (Hash, EncodedDate);
 
-  FreePool (Buffer);
-  return ;
+Done:
+  if (Hash != NULL) {
+    FreePool (Hash);
+  }
+  if (HashData != NULL) {
+    FreePool (HashData);
+  }
+  return Status;
 }
 
 /**
   Validate the user's password.
 
@@ -314,12 +359,14 @@ ValidatePassword (
   EFI_STATUS                      Status;
   UINTN                           Index;
   UINTN                           BufferSize;
   UINTN                           PasswordMaxSize;
   CHAR16                          *Password;
-  CHAR16                          *EncodedPassword;
   BOOLEAN                         OldPassword;
+  CHAR8                           AsciiPassword[32 + 1];
+  UINT8                           HashedPassword[PASSWORD_SHA256_SIZE];
+  BOOLEAN                         EncodedOk;
 
   //
   // Get encoded password first
   //
   BufferSize = sizeof (DRIVER_SAMPLE_CONFIGURATION);
@@ -340,11 +387,11 @@ ValidatePassword (
   OldPassword = FALSE;
   PasswordMaxSize = sizeof (PrivateData->Configuration.WhatIsThePassword2);
   //
   // Check whether we have any old password set
   //
-  for (Index = 0; Index < PasswordMaxSize / sizeof (UINT16); Index++) {
+  for (Index = 0; Index < PasswordMaxSize / sizeof (UINT8); Index++) {
     if (PrivateData->Configuration.WhatIsThePassword2[Index] != 0) {
       OldPassword = TRUE;
       break;
     }
   }
@@ -360,33 +407,34 @@ ValidatePassword (
   //
   Password = HiiGetString (PrivateData->HiiHandle[0], StringId, NULL);
   if (Password == NULL) {
     return EFI_NOT_READY;
   }
-  if (StrSize (Password) > PasswordMaxSize) {
+  if ((StrLen (Password) > 32) || (Password[0] == 0)) {
     FreePool (Password);
     return EFI_NOT_READY;
   }
 
   //
-  // Validate old password
+  // Validate the input password
   //
-  EncodedPassword = AllocateZeroPool (PasswordMaxSize);
-  ASSERT (EncodedPassword != NULL);
-  StrnCpyS (EncodedPassword, PasswordMaxSize / sizeof (CHAR16), Password, StrLen (Password));
-  EncodePassword (EncodedPassword, StrLen (EncodedPassword) * sizeof (CHAR16));
-  if (CompareMem (EncodedPassword, PrivateData->Configuration.WhatIsThePassword2, PasswordMaxSize) != 0) {
+  ZeroMem (AsciiPassword, sizeof (AsciiPassword));
+  UnicodeStrToAsciiStrS (Password, AsciiPassword, sizeof (AsciiPassword));
+  ZeroMem (HashedPassword, sizeof (HashedPassword));
+
+  EncodedOk = HashPassword ((UINT8 *)AsciiPassword, PrivateData->Configuration.PasswordSalt, HashedPassword);
+  ASSERT (EncodedOk);
+  if (CompareMem (HashedPassword, PrivateData->Configuration.WhatIsThePassword2, PASSWORD_SHA256_SIZE) != 0) {
     //
     // Old password mismatch, return EFI_NOT_READY to prompt for error message
     //
     Status = EFI_NOT_READY;
   } else {
     Status = EFI_SUCCESS;
   }
-
+  ZeroMem (Password, StrSize (Password));
   FreePool (Password);
-  FreePool (EncodedPassword);
 
   return Status;
 }
 
 /**
@@ -404,15 +452,16 @@ SetPassword (
   IN DRIVER_SAMPLE_PRIVATE_DATA      *PrivateData,
   IN EFI_STRING_ID                   StringId
   )
 {
   EFI_STATUS                      Status;
-  CHAR16                          *Password;
+  UINT8                           *HashedPassword;
   CHAR16                          *TempPassword;
-  UINTN                           PasswordSize;
-  DRIVER_SAMPLE_CONFIGURATION     *Configuration;
   UINTN                           BufferSize;
+  UINT8                           *PasswordSalt;
+  CHAR8                           AsciiPassword[32 + 1];
+  BOOLEAN                         EncodedOk;
 
   //
   // Get Buffer Storage data from EFI variable
   //
   BufferSize = sizeof (DRIVER_SAMPLE_CONFIGURATION);
@@ -425,61 +474,45 @@ SetPassword (
                   );
   if (EFI_ERROR (Status)) {
     return Status;
   }
 
+  HashedPassword = PrivateData->Configuration.WhatIsThePassword2;
+  ZeroMem (HashedPassword, sizeof (HashedPassword));
+  PasswordSalt = PrivateData->Configuration.PasswordSalt;
+  ZeroMem (PasswordSalt, sizeof (PasswordSalt));
+
   //
   // Get user input password
   //
-  Password = PrivateData->Configuration.WhatIsThePassword2;
-  PasswordSize = sizeof (PrivateData->Configuration.WhatIsThePassword2);
-  ZeroMem (Password, PasswordSize);
-
   TempPassword = HiiGetString (PrivateData->HiiHandle[0], StringId, NULL);
   if (TempPassword == NULL) {
     return EFI_NOT_READY;
   }
-  if (StrSize (TempPassword) > PasswordSize) {
+  if (StrLen(TempPassword) > 32) {
     FreePool (TempPassword);
     return EFI_NOT_READY;
   }
-  StrnCpyS (Password, PasswordSize / sizeof (CHAR16), TempPassword, StrLen (TempPassword));
-  FreePool (TempPassword);
 
   //
-  // Retrieve uncommitted data from Browser
+  // Generate Salt value.
   //
-  Configuration = AllocateZeroPool (sizeof (DRIVER_SAMPLE_CONFIGURATION));
-  ASSERT (Configuration != NULL);
-  if (HiiGetBrowserData (&gDriverSampleFormSetGuid, VariableName, sizeof (DRIVER_SAMPLE_CONFIGURATION), (UINT8 *) Configuration)) {
-    //
-    // Update password's clear text in the screen
-    //
-    CopyMem (Configuration->PasswordClearText, Password, StrSize (Password));
-
-    //
-    // Update uncommitted data of Browser
-    //
-    HiiSetBrowserData (
-       &gDriverSampleFormSetGuid,
-       VariableName,
-       sizeof (DRIVER_SAMPLE_CONFIGURATION),
-       (UINT8 *) Configuration,
-       NULL
-       );
-  }
+  GenSalt (PasswordSalt);
 
   //
-  // Free Configuration Buffer
+  // Hash password.
   //
-  FreePool (Configuration);
-
+  ZeroMem (AsciiPassword, sizeof (AsciiPassword));
+  UnicodeStrToAsciiStrS (TempPassword, AsciiPassword, sizeof (AsciiPassword));
+  EncodedOk = HashPassword ((UINT8 *) AsciiPassword, PasswordSalt, HashedPassword);
+  ASSERT (EncodedOk);
+  ZeroMem (TempPassword, StrSize (TempPassword));
+  FreePool (TempPassword);
 
   //
-  // Set password
+  // Set the password.
   //
-  EncodePassword (Password, StrLen (Password) * 2);
   Status = gRT->SetVariable(
                   VariableName,
                   &gDriverSampleFormSetGuid,
                   EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
                   sizeof (DRIVER_SAMPLE_CONFIGURATION),
diff --git a/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.h b/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.h
index 97dee9c..32e61eb 100644
--- a/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.h
+++ b/MdeModulePkg/Universal/DriverSampleDxe/DriverSample.h
@@ -1,8 +1,8 @@
 /** @file
 
-Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
 http://opensource.org/licenses/bsd-license.php
 
@@ -44,10 +44,11 @@ Revision History
 #include <Library/MemoryAllocationLib.h>
 #include <Library/HiiLib.h>
 #include <Library/DevicePathLib.h>
 #include <Library/PrintLib.h>
 #include <Library/UefiLib.h>
+#include <Library/BaseCryptLib.h>
 
 #include "NVDataStruc.h"
 
 //
 // This is the generated IFR binary data for each formset defined in VFR.
diff --git a/MdeModulePkg/Universal/DriverSampleDxe/DriverSampleDxe.inf b/MdeModulePkg/Universal/DriverSampleDxe/DriverSampleDxe.inf
index 4233e63..144ac17 100644
--- a/MdeModulePkg/Universal/DriverSampleDxe/DriverSampleDxe.inf
+++ b/MdeModulePkg/Universal/DriverSampleDxe/DriverSampleDxe.inf
@@ -2,11 +2,11 @@
 # This is a sample HII driver. 
 #
 # This driver shows how HII protocol, VFR and UNI files are used to create a HII 
 # driver which can be dipslayed and configured by a UEFI HII Form Browser.
 #
-# Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.<BR>
 #
 #  This program and the accompanying materials
 #  are licensed and made available under the terms and conditions of the BSD License
 #  which accompanies this distribution. The full text of the license may be found at
 #  http://opensource.org/licenses/bsd-license.php
@@ -43,14 +43,16 @@ [Sources]
   Vfr.vfr
 
 [Packages]
   MdePkg/MdePkg.dec
   MdeModulePkg/MdeModulePkg.dec
+  CryptoPkg/CryptoPkg.dec
 
 
 [LibraryClasses]
   BaseLib
+  BaseCryptLib
   MemoryAllocationLib
   UefiBootServicesTableLib
   UefiDriverEntryPoint
   UefiRuntimeServicesTableLib
   BaseMemoryLib
diff --git a/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h b/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h
index 17b4d99..32d5491 100644
--- a/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h
+++ b/MdeModulePkg/Universal/DriverSampleDxe/NVDataStruc.h
@@ -29,17 +29,20 @@ Revision History:
 #include <Guid/HiiFormMapMethodGuid.h>
 #include <Guid/DriverSampleHii.h>
 #include <Guid/ZeroGuid.h>
 
 #define CONFIGURATION_VARSTORE_ID    0x1234
+#define PASSWORD_SALT_SIZE 32
+#define PASSWORD_SHA256_SIZE 32
+
 
 #pragma pack(1)
 typedef struct {
   UINT16  WhatIsThePassword[20];
-  UINT16  WhatIsThePassword2[20];
+  UINT8   WhatIsThePassword2[32];
+  UINT8   PasswordSalt[PASSWORD_SALT_SIZE];
   UINT16  MyStringData[40];
-  UINT16  PasswordClearText[20];
   UINT16  SomethingHiddenForHtml;
   UINT8   HowOldAreYouInYearsManual;
   UINT16  HowTallAreYouManual;
   UINT8   HowOldAreYouInYears;
   UINT16  HowTallAreYou;
diff --git a/MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr b/MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr
index 6e7b96b..922f2f9 100644
--- a/MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr
+++ b/MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr
@@ -466,18 +466,10 @@ formset
               help     = STRING_TOKEN(STR_PASSWORD_HELP),
               minsize  = 6,
               maxsize  = 20,
     endpassword;
 
-    string    varid    = MyIfrNVData.PasswordClearText,
-              prompt   = STRING_TOKEN(STR_MY_STRING_PROMPT),
-              help     = STRING_TOKEN(STR_MY_STRING_HELP),
-              minsize  = 6,
-              maxsize  = 0x14,
-              default  = STRING_TOKEN(STR_MY_STRING_DEFAULT),
-    endstring;
-
     //
     // Interactive password, validate via ConfigAccess.Callback()
     //
     password  varid    = MyIfrNVData.WhatIsThePassword2,
               prompt   = STRING_TOKEN(STR_PASSWORD_CALLBACK_PROMPT),
-- 
1.9.5.msysgit.1

Re: [patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

[Gao, Liming]

Dandan:

I don't think MdeModulePkg can depend on CryptoPkg. Could you drop password sample in DriverSample driver? You may consider add such sample in some SecurityPkg driver. 

Thanks
Liming
-----Original Message-----
From: Bi, Dandan 
Sent: Thursday, November 17, 2016 10:26 AM
To: edk2-devel@lists.01.org
Cc: Gao, Liming <liming.gao@intel.com>; Dong, Eric <eric.dong@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tian, Feng <feng.tian@intel.com>; Zeng, Star <star.zeng@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Andrew Fish <afish@apple.com>
Subject: [patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

Patch 1-3: Update the dsc file of related package which 
ues the DriverSampleDxe, becasue DriverSampleDxe will 
consume BaseCryptLib/OpensslLib/IntrinsicLib.
Patch 4: Use SHA256 algorithm for password encoding

Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Andrew Fish <afish@apple.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>

Dandan Bi (4):
  MdeModulePkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  Nt32Pkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  EmulatorPkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  MdeModulePkg/DriverSample: Use SHA256 algorithm for password encoding

 EmulatorPkg/EmulatorPkg.dsc                        |   5 +-
 MdeModulePkg/MdeModulePkg.dsc                      |   4 +
 .../Universal/DriverSampleDxe/DriverSample.c       | 171 ++++++++++++---------
 .../Universal/DriverSampleDxe/DriverSample.h       |   3 +-
 .../Universal/DriverSampleDxe/DriverSampleDxe.inf  |   4 +-
 .../Universal/DriverSampleDxe/NVDataStruc.h        |   7 +-
 MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr     |   8 -
 Nt32Pkg/Nt32Pkg.dsc                                |   7 +-
 8 files changed, 123 insertions(+), 86 deletions(-)

-- 
1.9.5.msysgit.1

Re: [patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

[Bi, Dandan]

Hi Liming,

Got it ! Thanks for your comments. I will remove the password sample in the DriverSampleDxe.

Hi all,

Please ignore these patch series! Sorry for any inconvenience.

Thanks,
Dandan

-----Original Message-----
From: Gao, Liming 
Sent: Thursday, November 17, 2016 11:28 AM
To: Bi, Dandan <dandan.bi@intel.com>; edk2-devel@lists.01.org
Cc: Dong, Eric <eric.dong@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tian, Feng <feng.tian@intel.com>; Zeng, Star <star.zeng@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Andrew Fish <afish@apple.com>
Subject: RE: [patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

Dandan:

I don't think MdeModulePkg can depend on CryptoPkg. Could you drop password sample in DriverSample driver? You may consider add such sample in some SecurityPkg driver. 

Thanks
Liming
-----Original Message-----
From: Bi, Dandan
Sent: Thursday, November 17, 2016 10:26 AM
To: edk2-devel@lists.01.org
Cc: Gao, Liming <liming.gao@intel.com>; Dong, Eric <eric.dong@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tian, Feng <feng.tian@intel.com>; Zeng, Star <star.zeng@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Andrew Fish <afish@apple.com>
Subject: [patch 0/4] MdeModulePkg: Use SHA256 algorithm for password encoding

Patch 1-3: Update the dsc file of related package which ues the DriverSampleDxe, becasue DriverSampleDxe will consume BaseCryptLib/OpensslLib/IntrinsicLib.
Patch 4: Use SHA256 algorithm for password encoding

Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Andrew Fish <afish@apple.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>

Dandan Bi (4):
  MdeModulePkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  Nt32Pkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  EmulatorPkg: Add BaseCryptLib/OpensslLib/IntrinsicLib
  MdeModulePkg/DriverSample: Use SHA256 algorithm for password encoding

 EmulatorPkg/EmulatorPkg.dsc                        |   5 +-
 MdeModulePkg/MdeModulePkg.dsc                      |   4 +
 .../Universal/DriverSampleDxe/DriverSample.c       | 171 ++++++++++++---------
 .../Universal/DriverSampleDxe/DriverSample.h       |   3 +-
 .../Universal/DriverSampleDxe/DriverSampleDxe.inf  |   4 +-
 .../Universal/DriverSampleDxe/NVDataStruc.h        |   7 +-
 MdeModulePkg/Universal/DriverSampleDxe/Vfr.vfr     |   8 -
 Nt32Pkg/Nt32Pkg.dsc                                |   7 +-
 8 files changed, 123 insertions(+), 86 deletions(-)

--
1.9.5.msysgit.1