public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Laszlo Ersek <lersek@redhat.com>
To: "Fu, Siyuan" <siyuan.fu@intel.com>, "Wu, Jiaxin" <jiaxin.wu@intel.com>
Cc: edk2-devel-01 <edk2-devel@lists.01.org>,
	"Daniel P. Berrange" <berrange@redhat.com>
Subject: Re: internal structure of EFI_TLS_CA_CERTIFICATE_VARIABLE
Date: Wed, 21 Mar 2018 14:39:18 +0100	[thread overview]
Message-ID: <74abb2db-a6d0-d88d-7153-0347f5cb64bb@redhat.com> (raw)
In-Reply-To: <B1FF2E9001CE9041BD10B825821D5BC58B468F73@SHSMSX103.ccr.corp.intel.com>

On 03/21/18 02:30, Fu, Siyuan wrote:
> The data structure of EFI_TLS_CA_CERTIFICATE_VARIABLE is
> EFI_SIGNATURE_LIST and we have documented this in HTTPs Boot wiki
> page:
> https://github.com/tianocore/tianocore.github.io/wiki/HTTPS-Boot
> 
> You can refer section 31.4.1 "Signature Database" in UEFI 2.7 A for a
> detail description of EFI_SIGNATURE_LIST structure.

Thanks! I have two more questions.

The nested loops that parse the signature list in TlsConfigCertificate()
currently ignore the contents of the following fields:
- EFI_SIGNATURE_LIST.SignatureType,
- EFI_SIGNATURE_DATA.SignatureOwner.

I'd like the generator / extractor tool to populate these fields
correctly right from the start, so that it remain compatible with future
features added to edk2.


So, I suggest that the tool set "EFI_SIGNATURE_LIST.SignatureType" to
EFI_CERT_X509_GUID ("This identifies a signature based on a DER-encoded
X.509 certificate"). Because, this is what the current edk2 code assumes
anyway -- in TlsSetCaCertificate(), we have a comment saying

  //
  // DER-encoded binary X.509 certificate or PEM-encoded X.509
  // certificate. Determine whether certificate is from DER encoding, if
  // so, translate it to X509 structure.
  //

(1) Do you agree EFI_CERT_X509_GUID is the right setting for
"EFI_SIGNATURE_LIST.SignatureType" (even though the edk2 code currently
ignores it)?

This would also imply that we set
"EFI_SIGNATURE_LIST.SignatureHeaderSize" to zero, according to the UEFI
spec.


Furthermore, what would you suggest for
"EFI_SIGNATURE_DATA.SignatureOwner"? According to the spec, it is "An
identifier which identifies the agent which added the signature to the
list", so in theory we could just generate any GUID for the tool with
"uuidgen". However, based on past experience, this may not be good
enough; for example, the Secure Boot Logo Test in the Microsoft HCK
expect the SignatureOwner field (on the Microsoft certificates) to be
constant 77FA9ABD-0359-4D32-BD60-28F4E78F784B. In other words, Microsoft
want the SignatureOwner field to stand for the organization that issued
the certificates (i.e., themselves), not for the agent that enrolled the
certificates.

(2) Do you foresee any such restrictions for the
"EFI_SIGNATURE_DATA.SignatureOwner" field in
EFI_TLS_CA_CERTIFICATE_VARIABLE? Or is it safe if we generate a GUID for
the tool with "uuidgen"?

Thanks!
Laszlo


  reply	other threads:[~2018-03-21 13:32 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-20 14:55 internal structure of EFI_TLS_CA_CERTIFICATE_VARIABLE Laszlo Ersek
2018-03-21  1:30 ` Fu, Siyuan
2018-03-21 13:39   ` Laszlo Ersek [this message]
2018-03-22  2:02     ` Wu, Jiaxin
2018-03-22  9:20       ` Laszlo Ersek
2018-03-28  2:31   ` Laszlo Ersek
2018-03-28  3:28     ` Zeng, Star
2018-03-28 10:06       ` Laszlo Ersek
2018-03-28 11:10         ` Zeng, Star
2018-03-28 12:01           ` Laszlo Ersek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=74abb2db-a6d0-d88d-7153-0347f5cb64bb@redhat.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox